Privacy Policy

Article 1 (Scope of this policy)

1. Astran, Inc. (the “Company”) handles the user information it collects on motitown.com, the website it operates (the “Site”), in accordance with this Privacy Policy (the “Policy”).
2. The Site includes pages such as the MotiTan Dictionary (/vocabulary/), login and My Page (/account/), contact (/contact/), news (/news/), the app introduction pages (/motitan/ and /motispi/), and careers (/recruit/).
3. How information is handled inside the MotiTan and MotiSpi apps, and the registration and deletion of app accounts, are governed by each app's privacy policy.
   • MotiTan: https://motitown.com/notification/en/document/legal-privacy/motitan/
   • MotiSpi: https://motitown.com/notification/en/document/legal-privacy/motispi/
4. How information is handled when you purchase a paid plan on the web (payments are processed by Stripe) is explained on the purchase screen and in the Paid Plan Terms of Use and the Notation Based on the Specified Commercial Transactions Act (both in Japanese).
5. In this Policy, the terms “personal information”, “personal data”, “retained personal data” and “personally referable information” have the same meanings as in the Act on the Protection of Personal Information of Japan (the “APPI”).

Article 2 (Information collected when you view the site)

We collect the following information even from people who only browse the Site. It does not include information that by itself identifies an individual, such as a name or email address. However, if you type your name or similar information into a search box, those words will also be recorded and sent. Please do not enter words that could identify an individual.

(1) Server records

(2) Web analytics (Google Analytics)

Many pages of the Site use “Google Analytics” by Google LLC (United States). When you open or interact with a page, your browser sends the following information to Google.

• An identifier stored in a cookie (a number assigned to each browser)
• The URL (including words you looked up) and title of the pages you view, the page you came from, and the date and time
• Device, browser and OS type, screen size, and language setting
• IP address and the approximate region estimated from it
• Words entered in search boxes and filter boxes (this may include words partway through being typed)
• Actions on the page: starting, clearing and quitting a game, together with the name of the wordbook, accuracy rate, time taken and number of stars; starting a vocabulary test (diagnosis), its result (number of correct answers and level) and sharing it; quiz scores; “learned” marks and display changes in word lists; pressing read-aloud buttons; and pressing menu items, article links, login buttons, app buttons and the like

The Company does not send your name, email address, or the identifier of the account you use to log in to Google Analytics.

Uses: To learn which pages are viewed often and which words are looked up, and to use this in adding or correcting entries and improving pages. We also use it to measure the effectiveness of our app promotions.

For how Google uses this information, please see Google's page “How Google uses information from sites or apps that use our services”. How to stop the transmission is explained in Article 4.

(3) App buttons (Adjust)

When you press a button to download an app, you are taken to the app store via the servers of Adjust GmbH (Germany). At that time, the following information is sent to Adjust.

• The location of the button pressed (which button on which type of page)
• IP address, device and browser type, and date and time
• If you came to the Site from an AI-powered search or answer service, which service you came from

Some buttons on the app introduction pages go through the URL shortening service “Short.io” before reaching Adjust.

Uses: To measure which pages led to the app being installed, and to improve our promotions. For people who install an app, we link this with the records of their use of the app and aggregate them (for handling within the apps, please see each app's privacy policy).

(4) Communication with outside servers for display and login

Your browser communicates with outside servers for fonts (Google Fonts by Google LLC), audio and illustrations (Microsoft Azure by Microsoft Corporation), page components (jsDelivr, cdnjs, code.jquery.com), login (Firebase by Google LLC, and Apple), and bot detection (Cloudflare). At that time, your IP address, browser type and similar information are passed to the other party. These communications are for display, login and security, and the Company does not use them to collect user information (the information received at login is as described in Article 3, and recording by Cloudflare is as described in (1)).

A list of the information sent and its recipients is provided on the page “External Transmission of User Information”.

Article 3 (Login and game records)

1. Logging in is optional. You can log in with an account that has been linked to Google or Apple in the MotiTan or MotiSpi app. The login itself takes place on Google's or Apple's screen, and the Company does not receive your password.
2. Login uses “Firebase Authentication” by Google LLC (United States). When you log in, the Company receives the following information.

   Received from	Information received
   Firebase Authentication (Google LLC, United States)	Account identifier (UID), login method (Google or Apple), and the email address and display name of the account used to log in (if you use Apple's “Hide My Email”, the forwarding address provided by Apple)
   The Company's app server	App nickname and MotiTan ID

3. The information received is used for the following.
   1. Checking whether you have an app account (identity verification)
   2. Displaying it on My Page
   3. Automatically filling in your email address and ID in the contact form (you can change them)
   4. Saving your game records so that you can continue playing on other devices
   5. Preventing fraudulent use
   6. Sending important notices about login and records
4. Your email address, display name and nickname are used only at that time, for display and automatic filling, and are not saved on the Site's server. Your login state is saved within your browser (Firebase's storage area).
5. Game records are handled as follows.

   When you are not logged in	Game records are saved only within your browser. The contents of the records are not sent to the Company's server (actions such as starting and clearing a game are sent through the web analytics described in Article 2 (2)).
   When you are logged in	Game records (quests cleared and number of stars for each wordbook, words learned, names and pages of wordbooks played, the date and time you last played, etc.) are linked to your account identifier (UID) and saved on the Company's server (Japan). When you log in, the records remaining on that device are combined with the records in your account and saved. My Wordbook is not sent.

   Retention periods and how to delete records are as described in Article 10.

Article 4 (Cookies, storage on your device, and how to stop them)

1. The Site uses the following cookies (small records stored in your browser).

   Scroll the table sideways to read it.

   Name	Set by	Purpose	Retention period
   _ga and names starting with _ga_	Google (Google Analytics)	Distinguishing browsers and counting usage	Up to 2 years
   mt_contact	The Company	Preventing fraudulent submissions of inquiries and counting the number of submissions	Until the browser is closed
   Cookies set by Cloudflare	Cloudflare	Determining whether a visitor is a bot and preventing unauthorized access	Depends on Cloudflare's settings

2. The following information is saved in your browser's storage features (such as local storage). Except as stated in the table, it is not sent to the Company's server.

   Scroll the table sideways to read it.

   What is stored	Sending to the Company's server, etc.	Name
   Game records	Only while logged in, mt_adventure_v1 is sent to the Company's server (Article 3)	mt_adventure_v1, mt_qq_v1
   My Wordbook	Not sent	mt_wordbook_v1, mt_wordbook_(language)_v1
   “Learned” marks and display settings in word lists	Not sent	mt_learned_v1, mt_wl_view
   Items read in the grammar dictionary	Not sent	mt_gd_v1
   Unfinished inquiry drafts (deleted when you close the tab)	Sent only when you press the submit button	motitown-contact:(form name)
   A marker showing whether you came from an AI-powered search or answer service (deleted when you close the tab)	Used for the marker sent to Adjust when you press an app button (Article 2 (3))	mt_ai_ref
   Login state	Sent to Google and the Company's server when your login is checked	firebaseLocalStorageDb (Firebase's storage area)

3. How to stop or delete them is as follows.
   1. Google Analytics: Installing Google's “Google Analytics Opt-out Browser Add-on” stops the transmission (for desktop browsers). If you refuse or delete cookies in your browser settings, the number that distinguishes your browser will no longer be saved.
   2. Storage in your browser: Deleting the Site's cookies and site data in your browser settings deletes it. The Company cannot restore deleted records. For game records saved while logged in, you can request deletion by the method in Article 11.
   3. If you refuse cookies, some features, such as submitting inquiries and logging in, may not be available.

Article 5 (Inquiries and job applications)

1. On the contact forms (/contact/), we ask you to fill in the following items for each form.

   Form	Items you fill in
   Contacting the MotiTan / MotiSpi developers	Email address, name, app ID, device information (optional), content of your message, images and videos (optional)
   Reporting errors in words or phrases	The course you are using, the word or phrase containing the error, type of error, details, opinions and requests (optional), images (optional)
   Reporting a message board post	The app you are using, the reporter's ID, the ID of the person being reported, the name of the message board, the post number, the reason for the report, specific reasons (optional)

2. In addition, we record the following information.
   • Receipt number and date and time, and the names, types and sizes of attached files
   • Information for counting the number of submissions (a value created by converting your IP address into a form that cannot be reversed, and the cookie described in Article 4)
   • For people who are logged in, we automatically fill in the email address and ID in the form (you can change them)
   • If you open a message board report from the app, the confirmation number issued by the app is sent to the Company's app server when the report is received
3. The information you provide is used for the following.
   1. Responding to your inquiry and verifying your identity
   2. Investigating bugs
   3. Correcting errors in the dictionary and the apps
   4. Checking reported posts and taking action such as deleting posts or restricting use
   5. Preventing spam and fraudulent submissions
   6. Improving our services
   If we publish or introduce the content of an inquiry, we will obtain your approval in advance.
4. The content you send is saved in a non-public location on the Site's server (Japan), and is then managed in cloud services of US companies (Google LLC's spreadsheet and email services, Slack by Slack Technologies, LLC, etc.) for internal sharing, record-keeping and responding.
5. Please do not include passwords, credit card numbers, or personal information about people unrelated to your question. Please make sure that the images you attach do not show the faces or personal information of unrelated people.
6. Applications for account recovery are accepted through a dedicated application form (Google Forms by Google LLC) linked from the contact page. The information provided is used to verify and recover the account.
7. Information provided when applying or making inquiries by email from the careers page (/recruit/) (name, contact details, career history, etc.) is used for recruitment screening and for contacting you.

Article 6 (Purposes of use)

1. The Company uses the information it collects for the following purposes.
   1. To display the Site and operate it safely (including investigating failures and preventing unauthorized access and large-scale automated retrieval)
   2. For identity verification of people who log in, displaying My Page, and saving and carrying over game records
   3. To respond to inquiries and verify identity
   4. To correct errors in the dictionary and the apps and improve their content
   5. To check message board reports and take action such as deleting posts or restricting use
   6. To respond to acts that violate the terms and to spam
   7. To analyze usage, improve the Site and the apps, and plan new features
   8. To measure the effectiveness of app promotions
   9. To send important notices to people who log in
   10. To handle applications for account recovery
   11. For recruitment screening and contacting applicants
   12. To create statistics in a form that does not identify individuals (Article 14)
2. Except where permitted by law, we do not use personal information beyond the scope of the purposes in the preceding paragraph.
3. When we change the purposes of use, we do so within a scope reasonably recognized as related to the purposes before the change, and we publish the changed purposes on this page.

Article 7 (Provision to third parties)

1. The Company does not provide personal data to third parties without your consent, except in the following cases.
   1. Where based on laws and regulations
   2. Where it is necessary to protect a person's life, body or property and it is difficult to obtain your consent
   3. Where it is especially necessary to improve public health or promote the sound growth of children and it is difficult to obtain your consent
   4. Where it is necessary to cooperate with a national government agency, a local government or similar body in carrying out affairs prescribed by laws and regulations, and obtaining your consent is likely to impede those affairs
   5. Other cases permitted under the APPI
2. The following cases do not constitute “provision to third parties” under the preceding paragraph.
   1. Where we entrust the handling of personal data to an outside company to the extent necessary to achieve the purposes of use (Article 8)
   2. Where a business is succeeded to through a merger or similar event
3. When the Company provides personally referable information, such as cookie identifiers or browsing records, in a form in which the recipient is expected to acquire it as personal data, we do so in accordance with the law after confirming that your consent has been obtained.

Article 8 (Outside companies and handling in foreign countries)

1. The Company may entrust all or part of the handling of personal data to outside companies to the extent necessary to achieve the purposes of use. When doing so, we select companies that handle personal information appropriately and exercise the necessary supervision.
2. The main outside companies that handle personal data, and the countries where they are located, are as follows.

   Scroll the table sideways to read it.

   Country	Company	What they handle
   Japan	GMO Pepabo, Inc.	The Site's server (including storage of inquiries and game records)
   United States	Google LLC	Login (Firebase Authentication), web analytics (Google Analytics), records of inquiries and internal communication (spreadsheets and email), applications for account recovery (Google Forms)
   United States	Cloudflare, Inc.	Relaying traffic and protecting against unauthorized access
   United States	Slack Technologies, LLC	Internal sharing of inquiries
   Germany	Adjust GmbH	Measuring when app buttons are pressed

   In addition, we may use cloud services of US companies to manage inquiries.
3. For US companies, we use their services after confirming, through terms of use, contracts and the like, that they have established a system that meets the standards prescribed by the APPI. If you request it, we will provide information about the measures taken to maintain that system, in accordance with the law (see Article 11 for how to make a request).
4. The EU, including Germany, has been designated by the Personal Information Protection Commission as a country or region with a personal information protection system at a level equivalent to that of Japan.
5. The personal information protection systems of each country can be checked in the Personal Information Protection Commission's “Survey on Personal Information Protection Systems in Foreign Countries” (in Japanese).

Article 9 (Security control measures)

The Company takes the following measures to prevent personal data from being leaked, lost or damaged.

1. Basic policy: We have established and published this Policy.
2. Handling rules: For each stage — acquisition, use, storage, provision and deletion — we have set out how data is handled and who is responsible and in charge.
3. Organizational measures: We have appointed a person responsible, and have determined who handles personal data and the scope of information they may handle. We have a system in place for reporting to the person responsible and responding when a leak or similar incident occurs or may have occurred.
4. Human measures: We train employees on the handling of personal data and have them commit to confidentiality.
5. Physical measures: We prevent theft and loss of devices that handle personal data, and when such devices are taken out, we use passwords or similar means so that their contents cannot be viewed.
6. Technical measures:
   • Communication with the Site is encrypted (HTTPS).
   • The contents and attachments of inquiries and game records are stored in locations that cannot be read from outside. The screen for viewing inquiries internally can only be used by people who have logged in with a Company account.
   • IP addresses used to count the number of submissions are converted into a form that cannot be reversed (hash values) before being stored.
   • Information used to verify login (tokens) is not stored as is. To save the effort of re-verification, we store a value converted into a form that cannot be reversed until its expiry, and delete expired values in turn. The Company does not receive your password.
7. Understanding foreign systems: Personal data is handled using services of companies in the United States and Germany (Article 8). We take security control measures after understanding the personal information protection systems of these countries.

Article 10 (Retention periods)

We retain personal data only for as long as it is needed for the purposes of use, and endeavor to delete it without delay once it is no longer needed. The retention periods for the main types of information are as follows.

Article 11 (Requests for disclosure and other actions)

1. You (or your agent) may request the following with respect to your retained personal data held by the Company.
   1. Notification of the purposes of use
   2. Disclosure (including disclosure of records of provision to third parties)
   3. Correction, addition or deletion where the content is not true
   4. Suspension of use, or erasure
   5. Suspension of provision to third parties
2. Please submit your request through the contact form, stating that it is a “request concerning personal information” and what you are requesting.
3. To confirm that you are the person concerned, we may ask for information such as the email address of the account you use to log in or your MotiTan ID. For requests from an agent, we may ask for documents showing the authority of representation.
4. We will respond to requests without delay. Disclosure is, in principle, made by electronic means such as email. If you would like another method, please let us know when making your request.
5. We do not charge a fee.
6. In cases prescribed by law, such as where there is a risk of harming the rights of you or a third party, we may be unable to comply with a request. In that case, we will inform you of the reason.

Article 12 (Contact and business information)

Questions about this Policy, and opinions and complaints about the handling of personal information, are accepted through the contact form.

Article 13 (Minors)

If you are under 18, please read this Policy together with your parent or guardian and obtain their consent before using login or the contact forms.

Article 14 (Statistical information)

The Company may create statistical information by aggregating usage of the Site and learning records in the apps in a form that does not identify individuals, and may publish it on the Site (such as the “learning data” in the dictionary and the figures on the news pages). We ensure that individuals cannot be identified from the statistical information.

Article 15 (Changes to this policy)

1. We may change this Policy in line with changes to laws and regulations or to our services.
2. When we make a change, we will announce the changed content and the date it takes effect on this page. Changes that significantly affect users will also be announced on the Site in advance.
3. When we make a change that requires your consent under the law, we will obtain your consent.
4. This page states the revision date, and previous versions will also be made available.