Privacy policy
We comply with Japan's Act on the Protection of Personal Information (APPI) and handle your information with care.
This policy explains how IsauLab (イサウラボ, "we") handles personal information on our website (isaulab.com) and in our template sales, build services and newsletter (the "Services").
1. Who we are
Name: IsauLab (イサウラボ)
Address and representative's name: disclosed without delay upon request. Please contact us below.
Contact: [email protected]
2. What we collect
- Requests and inquiries: name, company or shop name, email, industry, request details, tools used, budget and other information you provide.
- Newsletter: email address and delivery data (e.g., opens and clicks).
- Payments: billing and transaction information. Card numbers are handled by our payment processor (Stripe); we never store them.
- Website visits: Cloudflare Web Analytics data (pages viewed, referrer, browser type). It is cookieless and does not identify you.
- Client data entrusted to us during builds (see section 7).
We will never ask for your passwords in forms or email.
3. Why we use it
- To answer inquiries, prepare quotes and fulfil contracts
- To deliver templates and builds, and provide support and maintenance
- To invoice and confirm payments
- To send the newsletter and, if you opt in, news about templates and services
- To improve the Services using non-identifying analytics
- To respond to violations of our Terms and to legal requirements
4. Sharing with third parties
We do not provide personal data to third parties without your consent, except where required by law.
5. Service providers
We entrust personal data to the providers below only as needed for the purposes above, and choose providers with adequate security measures.
6. Transfers outside Japan (APPI Article 28)
The following services may process personal data on servers outside Japan. Overviews of each country's data protection regime are available from the Personal Information Protection Commission.
| Provider | Purpose | Country | Regime overview |
|---|---|---|---|
| Cloudflare, Inc. | Website hosting, analytics, email forwarding | USA | No comprehensive federal privacy law; state laws (e.g., the CCPA) and sector-specific laws apply. |
| Tally BV | Request form | Belgium (EU) | The GDPR applies. Japan's PPC recognizes the EU as having an equivalent level of protection. |
| Substack Inc. | Newsletter delivery | USA | As above (USA) |
| Stripe, Inc. / Stripe Japan KK | Card payments, invoicing | USA, Japan | As above (USA) |
| Lemon Squeezy (Stripe group) | International template sales | USA | As above (USA) |
| OpenAI, L.L.C. (OpenAI) | Organizing requests, drafting text and AI processing in deliverables (may process data you submit for a build; personal data only under the conditions in section 7) | USA | As above (USA) |
| Anthropic, PBC (Anthropic) | Organizing requests, drafting text and AI processing in deliverables (may process data you submit for a build; personal data only under the conditions in section 7) | USA | As above (USA) |
| Google LLC (Google) | Organizing requests, drafting text and AI processing in deliverables (may process data you submit for a build; personal data only under the conditions in section 7) | USA | As above (USA) |
| X.AI Corp. (xAI) | Organizing requests, drafting text and AI processing in deliverables (may process data you submit for a build; personal data only under the conditions in section 7) | USA | As above (USA) |
Transfers to providers outside the EU rely on each provider maintaining a system that meets the standards set under the APPI (security measures under data processing agreements and similar). We periodically check that these measures are properly carried out and take necessary action if problems arise. On request, we will provide information about these measures without delay.
For sales in Japan we plan to use BOOTH (pixiv Inc.); purchases there are covered by pixiv's privacy policy.
7. Client data in build projects
When we handle your customers' personal data on your behalf, we act as your contractor and:
- Build and test with sample data, and handle real customer data only as far as necessary.
- Never take your login passwords. You connect via OAuth or revocable API keys.
- Send personal data to cloud AI services only with your written consent, and only to providers that don't train on API data. Otherwise we use a local AI model under our control or your own API key.
- Delete your data and environment within 30 days after the contract ends, and confirm by email.
8. Security measures
- Organizational and personnel: internal rules for handling personal data; access limited to those who need it.
- Physical: disk encryption on devices that handle personal data.
- Technical: multi-factor authentication, least-privilege access, per-client isolation, encrypted connections, scheduled deletion of execution data, encrypted backups.
- Foreign environments: where data is handled abroad, we take the local regime into account (section 6).
If a data breach occurs that the law requires us to report, we will notify the PPC and the affected individuals.
9. Your rights
You may ask us to notify you of the purposes of use, or to disclose, correct, add to, delete, stop using, or stop sharing your retained personal data, or to disclose records of third-party provision. After verifying your identity, we will respond without delay as required by law. Email us below. There is no fee.
10. Cookies
We don't use advertising or tracking cookies. Our analytics are cookieless. Embedded forms (Tally) and newsletter signup forms may set cookies needed for them to work.
11. Changes
We may update this policy as laws or our Services change, and will announce significant changes on this site.
12. Contact
IsauLab (イサウラボ) privacy contact: [email protected]