Privacy Policy

Article 1 (Purpose and Scope)

1. SEARED BONITO (hereinafter the "Studio") handles personal information in accordance with the Act on the Protection of Personal Information of Japan (Act No. 57 of 2003, as amended; hereinafter the "APPI") and other applicable laws and regulations, and pursuant to this Privacy Policy (hereinafter this "Policy").
2. This Policy applies to the handling of personal information in connection with the website operated by the Studio at searedbonito.com and the mobile and web applications published by the Studio — currently including Golf Rhythm Coach for iPhone and iPad — and any application published by the Studio hereafter (collectively, the "Services").
3. Where the General Data Protection Regulation (Regulation (EU) 2016/679; hereinafter the "GDPR") or the United Kingdom General Data Protection Regulation (hereinafter the "UK GDPR") applies, the provisions of Article 17 shall apply in addition to this Policy. Where the California Consumer Privacy Act (Cal. Civ. Code §1798.100 et seq., as amended; hereinafter the "CCPA") applies, the provisions of Article 18 shall apply in addition to this Policy.

Article 2 (Definitions)

For the purposes of this Policy, the following terms shall have the meanings set out below:

1. "Personal Information" means personal information as defined in Article 2, paragraph 1 of the APPI, and, where the GDPR or UK GDPR applies, personal data as defined in Article 4(1) thereof.
2. "Retained Personal Data" means retained personal data as defined in Article 16, paragraph 4 of the APPI.
3. "User" means any person who uses the Services.
4. "App Store Operator" means Apple Inc., Google LLC, or any other operator of a platform through which the Services are distributed.
5. "Processing" means any operation performed on Personal Information, including collection, use, storage, transfer, disclosure, and erasure.

Article 3 (Identity of the Controller)

1. The entity responsible for the handling of Personal Information under this Policy is as follows:
   1. Trade name: SEARED BONITO
   2. Representative: Toshiyuki Maeda
   3. Location: 503, 5-8-4 Daizawa, Setagaya-ku, Tokyo 155-0032, Japan
   4. Contact for privacy matters: privacy@searedbonito.com
2. Where the GDPR or UK GDPR applies, the Studio acts as the controller within the meaning of Article 4(7) thereof.

Article 4 (Categories of Personal Information Collected and Means of Collection)

1. The Studio collects Personal Information by the following means:
   1. directly from the User, including upon registration of an account or upon the User contacting the Studio;
   2. automatically from the User's device in the course of use of the Services, including crash and error reports; and
   3. from the App Store Operator, being confirmation of a transaction and of the status of a purchase or subscription.
2. The categories of Personal Information collected, the purposes of use, and the legal bases for Processing are set out in the Schedule to this Policy.
3. The Studio shall not collect Personal Information beyond the scope necessary for the functioning of the Services. Functions that do not require an account may be used without the collection of account information.

Article 5 (Purposes of Use)

1. The Studio shall handle Personal Information within the scope of the purposes of use set out in the Schedule.
2. Where the Studio changes a purpose of use, such change shall be limited to a scope reasonably deemed to be duly related to the purpose of use before the change, and the Studio shall notify the User of, or publicly announce, the purpose of use after the change, in accordance with Article 21 of the APPI.
3. The Studio shall not:
   1. sell or lease Personal Information, or provide Personal Information to data brokers;
   2. track Users across the services of other undertakings for advertising purposes, or incorporate third-party advertising networks into the Services;
   3. use Personal Information or User content for the training of artificial intelligence models, or provide the same to third-party artificial intelligence services, without clear disclosure and the prior consent of the User; or
   4. collect precise location data, contacts, health data, or special-category or sensitive Personal Information, save where a specific application expressly requests the same and the User grants permission.

Article 6 (Payments and In-App Purchases)

Purchases made through the Services are processed by the App Store Operator and not by the Studio. Payment credentials, including card numbers, are entered outside the Services, and the Studio neither receives nor stores the same. The Studio receives only confirmation of the transaction and its status, which it uses for the purpose of providing the features purchased by the User.

Article 7 (Provision to Third Parties)

1. The Studio shall not provide Personal Information to any third party without the prior consent of the User, save in any of the following cases:
   1. where required by laws and regulations;
   2. where necessary for the protection of the life, body, or property of an individual and it is difficult to obtain the consent of the User;
   3. where it is necessary to cooperate with a national or local government body, or a party entrusted thereby, in the performance of duties prescribed by laws and regulations, and obtaining consent is likely to impede the performance of such duties; or
   4. where Personal Information is provided in connection with the succession of business by reason of merger or otherwise, in which case the Studio shall notify Users in advance if the privacy policy applicable after such succession differs from this Policy.
2. The Studio may disclose Personal Information where necessary to establish, exercise, or defend legal claims.

Article 8 (Entrustment of Handling)

1. The Studio may entrust the handling of Personal Information, in whole or in part, within the scope necessary to achieve the purposes of use.
2. The entrustees referred to in the preceding paragraph are as follows:
   1. Cloudflare, Inc. — hosting, content delivery, security, privacy-preserving analytics, and email forwarding;
   2. Apple Inc. and Google LLC — distribution of the Services and processing of purchases and subscriptions; and
   3. the diagnostic services incorporated into the operating system of the User's device, where the User has enabled sharing.
3. The Studio shall contractually require each entrustee to protect Personal Information to a standard at least equivalent to that set out in this Policy, to handle the same solely in accordance with the Studio's instructions, and to refrain from using the same for its own purposes, and shall exercise necessary and appropriate supervision over each entrustee.

Article 9 (Cross-Border Transfers)

1. The Studio is located in Japan. Entrustees may process Personal Information in other countries, including the United States.
2. Where Personal Information is provided to a third party in a foreign country, the Studio shall provide the information required under Article 28 of the APPI and shall confirm that the recipient maintains a standard of protection equivalent to that required of a business operator handling personal information in Japan.
3. Where Personal Information originating in the European Economic Area or the United Kingdom is transferred, the Studio shall rely on appropriate safeguards, including the Standard Contractual Clauses adopted by the European Commission and the United Kingdom International Data Transfer Addendum. Japan has been recognised by the European Commission as ensuring an adequate level of protection of personal data.

Article 10 (Retention Periods and Erasure)

1. The Studio shall retain Personal Information for the following periods:
   1. account and purchase data — for so long as the account remains active, and thereafter only to the extent records must be retained to satisfy obligations under laws and regulations relating to taxation and accounting, being ordinarily a period not exceeding seven years in respect of transaction records;
   2. User content — until deleted by the User or until deletion of the account;
   3. diagnostic data and crash reports — a period not exceeding twenty-four months;
   4. website analytics — aggregate statistics only, retained in accordance with the retention schedule of the service provider referred to in Article 14; and
   5. support correspondence — a period not exceeding twenty-four months following resolution of the request.
2. Upon expiry of the applicable retention period, the Studio shall erase the Personal Information or render the same irreversibly anonymous.

Article 11 (Security Control Measures)

The Studio takes necessary and appropriate measures for the security control of Personal Information in accordance with Article 23 of the APPI, including encryption of data in transit by means of HTTPS/TLS, access controls limiting access to production systems, and the minimisation of collection provided for in Article 4, paragraph 3. Where a data breach occurs, the Studio shall report the same to the Personal Information Protection Commission and notify affected Users in accordance with Article 26 of the APPI and, where applicable, Articles 33 and 34 of the GDPR.

Article 12 (Rights of Users and Procedure for Requests)

1. A User may request the disclosure, correction, addition, deletion, cessation of use, erasure, or cessation of provision to third parties of Retained Personal Data, in accordance with Articles 33 to 35 of the APPI.
2. Requests under the preceding paragraph shall be made to the contact address specified in Article 19. The Studio shall respond within thirty (30) days of receipt. The Studio may verify the identity of the requesting party before acting upon a request.
3. No fee shall be charged in respect of a request, and no User shall be subjected to any disadvantage by reason of having exercised a right under this Article.
4. Where an application offers accounts, a User may request deletion of the account from within the settings of the application, or by written request to the contact address specified in Article 19 sent from the address associated with the account. The Studio shall delete the account and the associated Personal Information within thirty (30) days, save for records required to be retained under laws and regulations. Deletion of an account shall not of itself cancel a subscription; subscriptions are managed in the settings of the User's account with the App Store Operator.

Article 13 (Cookies and Similar Technologies)

The website does not use advertising or tracking cookies. The applications may use local storage on the User's device to retain settings, including the selected display language; such data remains on the device and is not transmitted to the Studio. Where an application introduces cookies or similar technologies requiring consent, the Studio shall obtain such consent in advance.

Article 14 (Website Analytics)

The website uses Cloudflare Web Analytics, a service that does not use cookies, does not employ device fingerprinting, and does not construct profiles of individuals. The service reports aggregate statistics, including page views, referrers, and country-level location. The Studio uses the same solely for the purpose of ascertaining the performance of the website, on the basis of its legitimate interest in maintaining and improving it.

Article 15 (Personal Information of Children)

The Services are not directed at children under the age of thirteen (13), or such higher minimum age as may be prescribed in the User's country of residence, and the Studio does not knowingly collect Personal Information from such children. Any person who becomes aware that a child has provided Personal Information to the Studio may notify the contact address specified in Article 19, whereupon the Studio shall erase the same without delay.

Article 16 (Special Provisions for Residents of Japan)

In addition to the rights under Article 12, a User resident in Japan may lodge a complaint with the Personal Information Protection Commission (ppc.go.jp).

Article 17 (Special Provisions for Residents of the EEA and the United Kingdom)

1. Where the GDPR or UK GDPR applies, a User has the rights of access, rectification, erasure, restriction of Processing, objection to Processing, and data portability, under Articles 15 to 21 thereof.
2. Where Processing is based on consent, the User may withdraw such consent at any time, without affecting the lawfulness of Processing carried out before the withdrawal.
3. The legal bases for Processing are set out in the Schedule.
4. A User has the right to lodge a complaint with the supervisory authority of the User's habitual residence, place of work, or place of the alleged infringement, including the Commission nationale de l'informatique et des libertés in France (cnil.fr) and the Information Commissioner's Office in the United Kingdom (ico.org.uk).

Article 18 (Special Provisions for Residents of California)

Where the CCPA applies, a User has the right to know the categories of personal information collected and the purposes for which the same are used and disclosed, the right to request deletion or correction, and the right not to be subjected to discriminatory treatment for the exercise of such rights. The Studio does not sell or share personal information within the meaning of the CCPA, and has not done so in the preceding twelve (12) months.

Article 19 (Contact)

Enquiries, requests, and complaints concerning the handling of Personal Information shall be addressed to:

Article 20 (Amendment of this Policy)

The Studio may amend this Policy. Where an amendment is made, the Studio shall update the date of last amendment stated above and, where the amendment materially affects the handling of Personal Information, shall give notice within the Services or by electronic mail prior to the amendment taking effect.

Schedule — Categories of Personal Information, Purposes of Use, and Legal Bases (Article 4, paragraph 2)

Established 16 August 2026