ThinkSpace sets forth this Privacy Policy (this “Policy”) with regard to the treatment of users’ personal information, during the performance of services provided by Naoya Enokida (the “Services”), as follows;

1. Collection of Personal Information

Texts, images, and various data (collectively "contents") created by users with this service are saved not only on the terminal but also on the cloud when using the paid version or sharing the canvas. In addition, this service collects the following types of information.
(1) Data which can specify a user (Example: the user name and e-mail address you use to access and use this service)
(2) Technological data related to a user's device, network, and internet connection (Example: IP address, MAC address, device ID (UUID), device model, OS type and version)
(3) Data provided by other services when a user links this service with others (Example: ID used by a user for the relevant external service)
(4) Information about your use of the Services (types and timestamps of in-app operations, etc. See “3. Usage Data (Operation Logs)” for details)

2. Purposes of Personal Information

The provider will not sell User's Information to a third party. The specific purposes of use for User's Information related to providing this service are as follows.
(1) Accepting registrations for this service, identity confirmation, calculating user fees, etc., in order to provide, maintain, protect, and improve this service
(2) Providing information and responding to inquiries about this service
(3) Handling behavior which violates the provider's rules and policies related to this service (referred to as "the Policies" below)
(4) Notifying users of changes to the Policies related to this service
(5) Calculating anonymous statistical data of this service's usage
(6) Analyzing usage of the Services and improving their features and quality
(7) Any purposes of use incidental to those listed above

3. Usage Data (Operation Logs)

To improve the Services, the Provider collects data about in-app operations (“Usage Data”).
(1) What we collect: the type of operation (creating, editing, and connecting cards, use of AI features, screen interactions, etc.), the time of the operation, internal identifiers of the objects operated on, and the app version, language setting, and device type.
(2) What we do not collect: the text of your cards and memos, titles, search keywords, and the content of your input to and responses from AI features are never included in Usage Data.
(3) Identifiers: Usage Data is managed under an identifier generated for each device, and is associated with your user account while you are signed in.
(4) Retention: per-operation records are deleted within 30 days of collection. Statistical information that does not directly identify individuals may be retained thereafter.
(5) Purpose: Usage Data is used solely to understand how the Services are used and to improve their features and quality, and is not used for advertising or third-party tracking.
(6) Opt-out: if you wish to stop the transmission of Usage Data, please contact us at the contact point described in Section 9. We will respond after verifying your request.

4. Provision of Personal Information to Third Parties

4-1 Unless required by the Personal Information Protection Act or other applicable laws and regulations, we shall not provide to any third party personal information contained in User's Information without the prior consent of the user, unless:
i The Provider authorizes such third party to handle the personal information in whole or in part to the extent necessary to accomplish the purpose of the use;
ii The personal information is provided through a business transfer by way of merger or other similar transactions;
iii The Provider is required to cooperate with state or local governmental organizations or their agents to perform their duties or obligations pursuant to applicable laws and regulations, and such performance is likely to be precluded if the consent of the user must be obtained; and
iv In addition to the foregoing, the Provider is entitled to disclose information pursuant to the Personal Information Protection Act or other applicable laws and regulations.
v If there is a clear consent of the user to be shared information.
vi In order to complete the payment procedure and / or operation of this service, and the service provider that processes data on behalf of the Provider, under strict data protection requirements, need to share information of a user on account of the service provider these In some cases

4-2 Providers may provide personal information to third parties in the following foreign countries. In that case, the information by country that should be used as a reference is as listed on the following page at this time. Although we have not been able to identify Third party and its country of residence at this time, we may entrust personal information to foreign third party other than those listed on the following page. In this case, we may outsource to a new third party without obtaining the customer's consent. Third party services
4-3 In the AI features of the Services, the content you enter is sent to OpenAI, LLC (United States), a service provider entrusted by the Provider, to the extent necessary to generate responses (outputs). Such content is not used to train AI models.

5. Linked websites and third party services

This service may provide links to other third party websites and services, which are outside the control of the service provider and beyond the scope of this policy. We encourage you to review the privacy policies posted on these (and all) sites.

6. Disclosure of Personal Information

Upon request from the user to disclose its personal information under the Personal Information Protection Act, the Provider shall, without delay, disclose to the user such information after confirming its identity (or notify it of the non-existence of such personal information), to the extent required to do so pursuant to the Personal Information Protection Act and other applicable laws and regulations.

7. Correction and Suspension of Use of Personal Information

7.1 If the Provider is required by the user to (1) correct the content of personal information under the provisions of the Personal Information Protection Act because such information is false, or (2) suspend use of personal information because such information is being handled beyond the scope of the purpose of the use previously made public, or has been collected in a fraudulent or otherwise illicit manner, then the Provider shall, without delay, conduct an appropriate investigation after confirming the requesting party’s identity, and based upon the results, correct the content or suspend the use of such personal information, and notify the party to that effect. The user shall also be notified of any determination, if applicable, not to correct or suspend the use of such information, together with the justification for such determination.
7.2 In the event that the Provider is required by the user to delete its personal information and has determined that it is necessary to accept such request, the Provider shall delete such personal information confirming the requesting party’s identity and shall notify the party to that effect.
7.3 Should the Provider not be obligated to correct, or suspend use of, information pursuant to the Personal Information Protection Act and other applicable laws and regulations, the preceding paragraphs shall not apply.

8. Children’s Information

The Services are not directed to children under 13 (or other age as required by local law), and we do not knowingly collect personal information from children. If you learn that your child has provided us with personal information without your consent, you may contact us as set forth below. If we learn that we have collected a child’s personal information in violation of applicable law, we will promptly take steps to delete such information and terminate the child’s account.

9. Business Operator and Inquiries

The Services “ThinkSpace” are provided by the business operator below. Any suggestions, questions, complaints, or other inquiries on the handling of the User's Information must be submitted to:
Business operator: Naoya Enokida (individual)
E-mail: razer006@gmail.com
The address and other particulars will be provided without delay upon request from the person concerned.

10. Procedure to Amend this Privacy Policy

The Provider will review its handling of personal information from time to time, strive for continuous improvement, and may amend this Policy as necessary. When making material changes, the Provider will notify users in a clear manner, such as an in-app notice. The amended Policy takes effect when posted on this page. Please review this Policy periodically. By continuing to use the Services after an amendment, you are deemed to have agreed to the amended Policy. If you do not agree with the changes, please consider discontinuing use of the Services and deleting your account. If you have any questions, please contact us via “9. Business Operator and Inquiries”.

This Policy shall be executed in the Japanese language. Japanese shall be the governing language and any translation of this Policy into any other language is for convenience of reference only and shall not bind the parties hereto.

APPENDIX A : ADDITIONAL PROVISIONS APPLICABLE TO PROCESSING OF PERSONAL INFORMATION OF EEA RESIDENTS

For individuals residing in the EEA, this Appendix outlines certain additional information that the provider is obligated to provide to you, as well as certain rights you have with respect to the processing of your personal information, pursuant to applicable local laws. This Appendix will control to the extent it conflicts with any provision in the main body of this Statement.
Controller: The service provider handles your personal information.
Data Protection Officer: Data Protection Officer may be contacted by email at razer006@gmail.com
Purposes and Legal Basis for Processing: The provider processes your personal information for the purposes set forth in Sections 2 (Purposes of User's Information) of the main body of this Statement.

Retention: We retain personal information about you for the time necessary to accomplish the purpose for which such information was collected, usually for the duration of any contractual relationship and for any period thereafter as legally required or permitted by applicable law. Our retention policies reflect applicable statute of limitation periods and legal requirements.

Data Subject Rights: Residents of the EEA have the following rights:
Access, Correction and Erasure Requests: You have the right to:
・ask us to confirm whether we are processing your personal information
・receive information on how your data is processed
・obtain a copy of your personal information
・request that we update or correct your personal information
・request that we delete personal information in certain circumstances

Right to Object to Processing: You have the right to request the provider cease processing of your personal information:
・for marketing activities, including profiling for statistical purposes
・where such processing is based on our legitimate business interests, unless we are able to demonstrate a compelling legitimate basis for such processing or we need to process your personal information for the establishment, exercise or defense of a legal claim

Right to Restrict Processing: You have the right to request the provider limit the processing of your personal information:
・while the provider is evaluating or in the process of responding to a request by you to update or correct your personal information where such processing is unlawful and you do not want the provider to delete your data
・where the provider no longer requires such data, but you want us to retain the data for the establishment, exercise or defense of a legal claim
・where you have submitted an objection to processing based on our legitimate business interests, pending our response to such request
・Where we limit the processing of your personal information pursuant to your request, we will inform you prior to re-engaging in such processing.

Data Portability Requests: You have the right to request that we provide you or a third party that you designate with certain of your personal information in a commonly used, machine readable format. Please note, however, that data portability rights apply only to personal information that we have obtained directly from you and only where our processing is based on consent or the performance of a contract.
Submitting Requests: your requests may be submitted in writing to razer006@gmail.com. we will not respond to any request unless we are able to appropriately verify the requester's identity.
Right to Withdraw Consent: You have the right to withdraw your consent to any processing that we conduct solely based on your consent. you may contact razer006@gmail.com to withdraw such consent.
International Data Transfers: We may transfer the personal information we collect about you pursuant to the purposes described in this Statement to countries that have not been found by the European Commission to provide adequate protection. In particular, we transfer your personal information to the United States.

[Revised on January/21/2023]
[Revised on August/1/2026]