enBright Inc. ("we", "us") sets out this Privacy Policy ("this Policy") for how we handle the personal
information of users ("you") of the ONMYAKU service and the related Constellation of Values and Compass
services (together, "the Service"), in compliance with Japan's Act on the Protection of Personal Information
and other applicable laws and guidelines.
Article 1 (Name and contact details of the operator)
Name: enBright Inc.
Data protection manager (responsible officer): Takayuki Hoda
Contact: enbright.inc@gmail.com
Article 2 (Personal information we collect, and how)
We collect the following by lawful means, from what you enter and register and from your use of the Service.
- Profile information — name, date of birth, email address, name in Roman letters, preferred name, company or trading name, role or title
- What you write about yourself — the things you want to do, the values you choose, what you are putting energy into, what is nagging at you, and the constellation, title and Compass results generated from them
- Account information — email address; password (stored as an irreversible hash, never in plain text); and, if you sign in with Google, the email address and name registered with Google
- Payment information — payment status and the payment session identifier. Card numbers are handled directly by our payment processor (Stripe, Inc.); they never pass through our servers and we do not hold them
- Usage counts — how often pages are viewed and music is played (anonymous totals only; we do not record IP addresses or device information)
Article 3 (Purposes of use)
We use the personal information we collect only so far as is necessary for the following purposes.
- To generate your constellation of values and Compass, and to display them on My Page
- To produce and deliver your ONMYAKU card and SOURCE CODE music
- To authenticate your account and send confirmation and password-reset emails
- To take payment and confirm its status
- To respond to enquiries and send important notices
- To maintain and improve the Service and develop new features
Where we change a purpose of use, we will do so only within a scope reasonably considered related to the
original purpose, and will publish the revised purpose on the Service or by other appropriate means.
Article 4 (Provision to third parties)
We do not provide personal information to third parties without your prior consent, except in the following cases.
- Where required by law
- Where necessary to protect a person's life, body or property and obtaining consent is difficult
- Where particularly necessary for public health or the sound development of children and obtaining consent is difficult
- Where cooperation is needed for a national or local government body, or a party it has appointed, to carry out statutory duties, and obtaining consent would impede those duties
Article 5 (Outsourcing and external services)
We may outsource all or part of the handling of personal information to external providers, so far as necessary
to achieve the purposes above. We select providers carefully and send only the information required.
The Service uses the following external providers.
- OpenAI, L.L.C. (United States) — to generate readings of your constellation and your Compass, we send your name, values, the things you want to do, and any context you have written. Content sent via the API is not used to train their models
- Stripe, Inc. — to process card payments. Your email address is sent at the point of payment
- Google LLC — to verify your identity if you sign in with Google. We receive your email address and name from Google; we do not send your data to Google
- Xserver Inc. — for data storage (servers located in Japan) and email delivery
Where a provider is located outside Japan, we confirm their personal-information protection arrangements before use,
in accordance with the Act on the Protection of Personal Information.
Article 6 (Security measures)
We take the following measures to prevent leakage, loss or damage of personal information.
- Encryption in transit (HTTPS/TLS)
- Storage in a restricted server area that cannot be reached directly from outside
- Storing passwords as irreversible hashes
- Strict management of the credentials and keys used to handle personal information
Article 7 (Retention and deletion)
- We retain personal information only for as long as is necessary to achieve the purposes of use
- If you delete your account from My Page, your account information, constellation and Compass results are deleted
- Data created by people without an account is also deleted on request to the contact in Article 10, after we verify your identity
Article 8 (Cookies and similar)
The Service uses cookies to keep you signed in, and browser local storage to hold work in progress.
Neither contains information identifying you, and we do not carry out advertising tracking.
You can disable cookies in your browser, but features requiring sign-in will then be unavailable.
Article 9 (Disclosure, correction and suspension of use)
You may ask us to disclose, correct, add to, delete, suspend the use of, erase, or stop the third-party provision of
your retained personal data. Please contact us at the address in Article 10. We will verify your identity and
respond without delay in accordance with the law. There is no charge for such requests.
Article 10 (Contact)
Please direct enquiries and requests about this Policy or the handling of personal information to:
enBright Inc., personal information enquiries (attn: Takayuki Hoda)
enbright.inc@gmail.com
Article 11 (Changes to this Policy)
We may revise this Policy in response to changes in law or in the Service. A revised Policy takes effect when
it is published on the Service. We will announce material changes on the Service.