Privacy Policy

Article 1 — Company and Contact

Company: tetos Inc.

Address: 6F, 2-2-1 Shibadaimon, Minato-ku, Tokyo 105-0012, Japan

Representative: Hozumi Hattori, Representative Director

Privacy inquiries: privacy@tetos.co.jp

Article 2 — Scope

This Policy applies to personal information handled in connection with individual and corporate customers’ use of the Service, our websites, inquiries, recruitment applications, and transactions with corporate customers. It also covers information about conversation participants who have not registered for the Service.

We handle personal information entrusted to us by corporate customers, including conversation data, only to provide the Service (including maintenance and defect correction necessary for its provision), in accordance with those customers’ instructions and contracts. We do not use it for our own independent purposes. Specific handling conditions are set out in our contracts with those customers.

Separately, we handle corporate customers’ contact details and contract and billing information for purposes such as entering into and performing contracts, billing, and responding to inquiries; this Policy applies to that handling. In all cases, we comply with applicable law.

We handle employees’ and other personnel’s personal information for personnel administration and other purposes necessary for company operations. Details are provided in internal rules and other documents.

Article 3 — Information We Collect and Purposes of Use

1. Account and authentication information: We handle email addresses, names, display names, information required for authentication, and similar information for registration, login, identity verification, and account management. We obtain names and similar information through external account login (such as Google login), screen input, or other means, and also use it for display within the Service, understanding the conversation, and addressing participants.

2. Conversation information: We handle users’ and participants’ audio, transcripts, and summaries and contextual information temporarily generated during conversations for real-time speech recognition, conversation understanding, response generation, and the detection and correction of defects described in the following article.

3. AI speech information: We handle AI response text and generated audio to provide responses, synthesize speech, record generation processes, improve processing efficiency, and reduce response times. AI speech may also contain personal information. Its handling is described in the following article.

4. Contract and payment information: We handle subscription plans, billing details, payment status, transaction identifiers, and similar information for contract administration, billing, refunds, and accounting. We use external payment services and do not store complete credit card numbers or security codes in our systems.

5. Device, usage, and technical information: We handle IP addresses, operating system and browser information, usage dates, times and duration, operations and feature usage, response times, error information, and similar information for stable operation, incident response, security, prevention of misuse, usage analysis, and feature improvement.

6. Inquiry information: We handle names, contact details, inquiry content, response histories, and similar information to respond to inquiries, verify identity, and resolve problems.

7. Recruitment information: We handle names, contact details, employment histories, application documents, and similar information for recruitment selection and communication with applicants.

8. Corporate transaction information: We handle company names, contact persons’ names and details, business discussions and contract details, and similar information for business discussions, entering into contracts, service provision, and transaction management.

We may also handle the above information to the extent necessary for important communications, compliance with legal obligations, responses to the exercise of rights, and resolution of specific disputes. However, we do not rely on this provision to retain, as a general precaution against disputes, information that the following article states we do not store.

Article 4 — Processing and Retention of Audio and Conversation Content

1. Users’ and participants’ audio and conversation processing data

We transcribe audio using speech recognition models deployed in environments we manage. We do not send audio to external providers’ speech recognition APIs for transcription.

We temporarily hold users’ and participants’ audio, transcripts, conversation summaries, and other contextual information in memory or similar storage only as needed to process the ongoing conversation, and release it when no longer needed. We do not store this information in the Service’s conversation history, databases, operational logs, or backups. We do not retain memory for use after the conversation ends or individual profiles derived from conversation content. Account information, such as names obtained through login or screen input, is managed separately from conversation processing data and retained and deleted under Article 8.

2. Processing by external AI services

We send transcripts, necessary conversation context, and similar information to external AI services for conversation understanding, response generation, and the detection and correction of defects described in this article. We also send account information such as names to the extent necessary to understand the conversation or address participants. Recipients may retain inputs and outputs for processing caches, abuse monitoring, or similar purposes. This handling is separate from our not storing conversation history in the Service.

We do not use external AI services’ storage features to provide conversation history or memory after a conversation ends. Retention for abuse monitoring by external AI services is generally no more than 30 days. However, information may be retained longer where required by law or necessary to protect the service or third parties from harm. Retention conditions for processing caches and similar functions vary by feature and model.

3. Retention of AI speech

We may store all or part of AI response text and generated audio in our systems to provide responses, synthesize speech, record generation processes, improve processing efficiency, and reduce response times. Providers entrusted with speech synthesis or similar tasks may also store AI response text and generated audio. We do not uniformly delete these items automatically immediately after generation.

We retain AI speech only as long as necessary for the above purposes and delete items when they are no longer needed. Retention of AI speech is separate from the account information deletion deadline in Article 8, and it may continue after account closure.

Providers’ retention and deletion are governed by the contractual terms and retention specifications applicable to us. Even when generation histories are deleted, copies may remain for a certain period in providers’ backups, security records, or similar records. Please contact the address in Article 1 for specific retention and deletion conditions. We review handling and retention needs and endeavor to delete personal data that is no longer needed in accordance with law.

4. No use for model training

Whether or not it is stored, we do not use user data obtained through the Service to train, further train, or fine-tune our own or third parties’ AI models. For external AI services, we apply contracts or settings that prevent the data we send from being used for model training.

5. Service improvement and human access

We use technical and usage metrics that do not contain conversation content, such as usage duration, response speed, and error counts, to improve stability and features. Usage information linked to an account or similar identifier is managed as personal information.

During conversation processing, we may automatically analyze system behavior to detect and correct defects so that conversations proceed appropriately, for example by preventing missed utterances or duplicate responses. In this process, we create and retain only general proposals for system improvements and the reasons for adopting them that are not linked to individuals or individual conversations and do not reproduce conversation content.

We do not retain users’ or participants’ audio, transcripts, conversation summaries, AI speech containing personal information, or personal characteristics inferred from conversations as records for quality evaluation or improvement. We do not include conversation content or individuals’ attributes or circumstances in improvement proposals or reasons for adopting them.

We do not use information obtained through this initiative to assess individuals’ creditworthiness or abilities, or to determine pricing, eligibility, or priority in sales activities.

Our personnel do not view or listen to conversation content as part of normal operations. However, if an individual voluntarily sends text, audio, or similar material for an inquiry, our personnel may review it as necessary to respond and handle it as inquiry information. Providers may permit access to retained information for security, legal compliance, or similar purposes under applicable contractual terms. We also respond to legal requirements only to the extent necessary.

Article 5 — Information About Conversation Participants

The Service may process audio from participants other than the user. Before processing begins, users must explain to participants that AI will participate in the conversation, that audio, transcripts, and similar information will be processed, and that information will be handled under this Policy, including transmission to external AI services and retention of AI speech, and confirm their agreement. The same applies when new participants join.

We support these explanations and confirmations through information about processing and indications that processing is underway. If a participant does not wish their information to be processed, do not start processing, or stop promptly if it has already begun. Continuing a conversation alone is not treated as obtaining all consent required by law.

We handle special care-required personal information, such as medical histories, only where legally required consent or other requirements are satisfied. Do not input another person’s special care-required personal information or confidential information without the necessary authority. Participants who have not registered may also contact us under Article 10.

Article 6 — Entrusting Processing to External Providers

To the extent necessary to achieve the purposes stated in this Policy, we may entrust cloud infrastructure, conversation understanding and response generation, speech synthesis, defect detection and correction, authentication, payments, incident monitoring, and other operations to external providers and provide them with necessary information.

We appropriately select providers based on the information and operations entrusted to them, require necessary security measures through contracts or other means, and exercise necessary and appropriate supervision. We configure incident monitoring and similar tools so that users’ and participants’ audio, transcripts, summaries, and AI response content are not transmitted to or recorded by them.

We may add or change providers within the scope of handling stated in this Policy. If doing so materially changes the information provided, purposes, retention or deletion conditions, or other handling, we will give advance notice and carry out legally required information provision, consent collection, and other procedures.

Article 7 — Third-Party Provision and Handling Outside Japan

We do not provide personal data to third parties except with the individual’s consent, where required by law, or where otherwise permitted by law. Processing entrusted to providers as necessary to achieve our purposes and handling associated with business succession are conducted in accordance with law. We do not sell personal information or engage in joint use of it.

Use of external services may result in personal information being handled in the United States or other countries. We assess relevant foreign legal systems and other circumstances and provide personal data only after satisfying a legally permitted basis, such as providing information to the individual and obtaining consent or ensuring the recipient maintains a system meeting the required standards.

Where we rely on a recipient’s system of protection, we periodically confirm the implementation of equivalent protective measures and take necessary action, including suspending provision, if continued implementation becomes difficult. We provide legally required information about relevant countries, protective measures, and other matters in accordance with law upon request to the contact in Article 1. Where advance information provision is required, we provide it before provision begins.

Article 8 — Retention and Deletion

1. Users’ and participants’ audio, transcripts, summaries and contextual information, and AI speech: As set out in Article 4.

2. Account information (including names and display names): Retained while the account is in use and deleted within 30 days of account closure, including copies in backups.

3. Device, usage, and technical information: Retained only as long as necessary for stable operation, incident response, security, usage analysis, and similar purposes. Information no longer needed is deleted or aggregated into statistics that do not identify individuals, or otherwise appropriately processed.

4. Inquiry and recruitment information: Deleted after a reasonable period necessary for communicating results or related confirmations following completion of the response or selection process. If we continue using it for another purpose, we provide necessary explanations and obtain consent or take other required steps.

5. Contract, payment and accounting information, corporate transaction information, and records of responses to the exercise of rights: Retained only as long as necessary to meet legal retention obligations, administer transactions, or address specific disputes or similar matters. These are managed separately from account information.

6. Backups we manage: Retained for no more than 30 days and deleted according to the retention cycle. For account information, we do not add a further 30 days after deletion from regular storage; deletion is completed within a total of 30 days from account closure.

Where information must be retained to comply with legal retention obligations or other specific legal requirements, we restrict the information concerned and access to it to the minimum necessary. This does not authorize collection or retention of information that we normally do not store or general continued retention of account information after account closure. Information retained by external AI services is subject to retention periods under those services’ contractual terms and similar conditions.

Article 9 — Cookies, Similar Technologies, and Security

We may use cookies and similar technologies or collect access and technical information to maintain login sessions, authenticate users, ensure security and stable service operation, and analyze and improve the usage and display performance of our websites and the Service. These activities may use delivery infrastructure, analytics, and incident monitoring services provided by external providers. Where notification, publication, or similar measures concerning transmission of information from users’ devices are legally required, we provide appropriate information separately.

We implement necessary and appropriate organizational, personnel, physical, and technical security measures to prevent unauthorized access, leaks, loss, or damage, including access management, encryption of communications, protection of stored information, personnel training, and provider management. We explain specific measures in accordance with law upon inquiry to the contact in Article 1.

If a leak or similar incident occurs for which reporting or notification is required by law, we report to Japan’s Personal Information Protection Commission and notify affected individuals or take other required action.

For external tools, transmitted information, and purposes of use, see External Tools and Data Transmission.

Article 10 — Individual Rights

Individuals or their lawful representatives may, in accordance with law, request notification of purposes of use; disclosure, correction, addition, deletion, suspension of use, or erasure of retained personal data; suspension of third-party provision; and disclosure of records of third-party provision. Please contact the address in Article 1. After identity verification and other necessary steps, we respond without delay in accordance with law. We do not charge for handling requests.

If we cannot fulfill a request or the relevant data does not exist, we explain this and provide necessary information. We cannot restore or recreate conversation data we do not retain for the purpose of responding to requests. For information entrusted to us by corporate customers, we coordinate with the relevant customer as necessary. This does not prevent individuals from contacting us directly.

Article 11 — Changes to This Policy

We may change this Policy in response to changes in laws, the Service, or other circumstances. We publish the revised content and its effective date on our website and give notice of material changes through appropriate means, such as in-service notifications or email, before they take effect.

Where a change requires consent or other procedures by law, we do not begin the revised handling until those procedures have been completed. A revision of this Policy or continued use alone is not treated as obtaining necessary consent.