Privacy Policy

• Your daily reports are stored in a spreadsheet inside your own Google Drive (Google LLC).
• Raw data on our server can be viewed for at most 24 hours after submission (anything older becomes inaccessible and is erased by the daily scheduled deletion at the latest the next day). It is erased immediately when a manager approves.
• AI output is a draft; the final decision is yours. The developer is not liable for AI errors or temporary issues from external API changes.
• When you use AI assist or the alignment report, and when weekly reviews are created, the report text you enter is sent to and processed by our generative-AI provider (Anthropic). By default, weekly reviews are created automatically every Friday (a manager can turn off the automatic creation on the “Coaching policy” page). If you prefer not to send it, you can fill in everything manually without the AI features, and a manager can turn off the automatic creation of weekly reviews. (If you use the business plan and goals feature, a summary of goal names and goal/actual figures is also sent, in addition to the report text, when creating the weekly review and 1-on-1 materials. When you use Evaluation Pro “AI drafts”, the business plan text, your department policy and the numerical assumptions you entered are also sent, only when a draft is generated. We do not store them.)
• Subprocessors: Google LLC (Sheets storage), Anthropic, PBC (AI processing), Vercel Inc. (hosting), Upstash, Inc. (KV; temporary retention for report data (inaccessible after 24h, erased at the latest the next day); business plan and goals data is kept while the Service is used). Governing law: Japan.
• If you use Google sign-in, login email addresses (managers/members) and the display names registered in the settings screen are retained as login settings (a separate category from the automatic erasure of report content). Members' email addresses and display names are automatically erased 90 days after the termination of the contract is confirmed. The manager's (purchaser's) email address is retained after termination for billing and contract records and for sign-in upon re-subscription. Google (OAuth) is used for authentication.
• Personal data controller: 株式会社狼煙 (Norolu). Requests to disclose, correct, suspend the use of, or delete your retained personal data, as well as inquiries and complaints, are handled at our Personal Data Inquiry Desk (kakehashi@norolu.jp).
• Purpose of use: We use personal data to manage daily-report PDCA, for manager approval, weekly reviews and 1-on-1 support, and to authenticate users and determine department/role for Google sign-in, and for the purchaser's billing and contract records and sign-in upon re-subscription.
• Security measures: We apply encryption in transit, privilege separation via a service account, and automatic erasure of server-side source data (inaccessible after 24 hours and erased by the daily scheduled deletion at the latest the next day; immediately on approval).
• Provision to third parties overseas: For AI processing, report text is sent to Anthropic, PBC (United States); for storage we use Google LLC (United States and others). The temporary-retention providers Vercel Inc. and Upstash, Inc. (U.S. entities) hold data in the Tokyo region (within Japan). Please consent to these provisions to overseas third parties before use. (If you use the business plan and goals feature, a summary of goal names and goal/actual figures is also sent to Anthropic, PBC (United States) for AI processing, in addition to the report text. When you use Evaluation Pro “AI drafts”, the business plan text, your department policy and the numerical assumptions are also provided, only when a draft is generated. We do not store them.)
• Provision of analytics data to a third party overseas: when Google Analytics is used, analytics data is sent to Google LLC (United States).
• Sales & payment: Sales of this service use Polar (Merchant of Record). When payment is enabled, payment information is processed by Polar, and we do not retain payment information.
• Analytics: this Service may use Vercel's cookieless, aggregate analytics (Vercel Web Analytics / Speed Insights). It does not identify individuals and is used only for statistics such as page views and load speed.
• Business plan and goals: If you use the business plan and goals feature, the business plan you enter (each section’s text and the monthly numerical plan), your goals and your daily actual figures are kept in our data store (KV) while you use the Service (a separate category from the automatic erasure of report text). Figures created by us are not included. They are erased on request, or by an administrator using “Erase plan, goals and actuals” under “Data management” on the Settings screen. For a team whose contract has ended (cancellation) more than 90 days ago, they are erased automatically. The roster (members’ email addresses) and policy settings, as well as the business plan, goals and actual figures, are erased automatically 90 days after cancellation. The administrator’s email address is kept as contract information and is erased on request.
• Analytics: when configured, this site uses Google Analytics to understand site usage (cookies may be used). The data collected is used only for statistics and is not linked to the content of daily reports or other inputs.
• How Google handles data: how Google uses the data is described on the following page. https://policies.google.com/technologies/partner-sites
• How to stop analytics: you can stop measurement with the Google Analytics Opt-out Browser Add-on or through your browser's cookie settings. https://tools.google.com/dlpage/gaoptout

The Japanese version of this policy prevails; in case of any discrepancy with a translation, the Japanese version governs.