Legal
Last updated: July 6, 2026
Provider: SAGBRAIN CORPORATION (株式会社サグブレイン) — privacy contact details at the end of this document
This is the Japan-market Privacy Policy (株式会社サグブレイン, under Japanese law / APPI). The Japanese version governs. A separate global version is in preparation.
(1) Account info (name, email, organization, hashed password), (2) Billing info via Stripe (we do not store card numbers), (3) Usage logs, cookies, analytics. We act as the controller for (1)-(3).
(4) Personal data contained in Content uploaded by the User. We process this as the User processor under the User instructions; the User determines the purpose.
For service delivery, authentication, billing (incl. qualified invoices), support, quality improvement, abuse prevention, and important notices. We do not use Customer Content to train AI models.
Via registration, use of the Service, inquiries, and connected services (e.g., Google sign-in).
We do not provide personal data to third parties without consent, except as permitted by law (e.g., to protect life or property).
We may entrust processing of personal data as necessary. Processor categories are: payments (Stripe); AI processing (Anthropic, Google/Gemini); cloud infrastructure & storage (Amazon Web Services); error monitoring (Sentry); email delivery (SMTP provider); push notification delivery (Google/FCM, Apple/APNs); analytics (Google Analytics/GA4); external integrations you enable (Google Drive/Calendar, Atlassian/Jira, chat notifications via Slack/Microsoft Teams/Google Chat); and group companies for development/support (Singapore, Bangladesh). We supervise processors appropriately, and the list is disclosed consistently across this Policy and the Data Processing Agreement (DPA).
Group-company relationships are treated as entrustment in principle. If joint use is adopted, the items, scope, purpose, and responsible party will be specified here.
Personal data may be handled abroad (AI processing, group companies in Singapore/Bangladesh, cloud infrastructure). Per APPI Art. 28, we either obtain consent or rely on an adequacy framework and provide required information about the destination. Data is primarily stored in the AWS Tokyo region.
For personal data in Customer Content (4 above), we act as a processor under the User instructions; the User is the controller. Where a separate Data Processing Agreement (DPA) applies, that will be noted.
We apply organizational, personnel, physical, and technical safeguards. TLS in transit, AES-256 at rest, group-based access control, and PostgreSQL Row Level Security. Development/operations are conducted under the ISMS (ISO/IEC 27001, cert. MSA-IS-532) held by 株式会社サグブレイン.
You may request notification of purpose, disclosure, correction, deletion, suspension, and disclosure of third-party provision records via the contact below. Requests regarding Customer Content (4) are handled through the User (controller).
We use cookies to store the authentication token and similar essential purposes. For analytics we use Google Analytics (GA4), and for error monitoring (fault detection and quality improvement) we use Sentry; these may set cookies or similar identifiers. Analytics (GA4) is loaded only after you consent. You can disable cookies in your browser, but the service cannot be used if the authentication cookie is disabled. Google Analytics measurement can also be disabled via the opt-out tools Google provides.
We retain personal data only as long as necessary and then delete it. A team whose trial ends, or that is canceled, is archived for 90 days (data retained); if not reactivated within that window it becomes eligible for deletion. Upon a deletion request we delete within 30 days (Terms Article 17).
Updates are posted on this page; significant changes are notified by email.
For privacy inquiries and rights requests, contact: 株式会社サグブレイン (SAGBRAIN CORPORATION) Email: info@sagbrain.com / Phone: +81-3-6661-3300
Nokoru's Google Drive integration complies with the Limited Use requirements of the Google API Services User Data Policy. Information obtained from Google Drive is used only to (1) provide the service to the user, (2) comply with applicable law, or (3) for security purposes. We do not use Google Drive data for advertising or transfer it to third parties.
Have questions? We are happy to help.
info@sagbrain.com