GIJITO Privacy Policy

• Name: Kaopiz Inc. (株式会社カオピーズ)
• Address: 3F, 3-8-8 Minamiikebukuro, Toshima-ku, Tokyo 171-0022, Japan
• Representative: TRINH CONG HUAN, Representative Director

1. In this Policy, a customer that has a contract for the Service is a "Customer", an officer, employee or other person whom a Customer allows to use the Service is a "User", and a User with authority to manage the members and settings of the Customer's organization is an "Organization Administrator".
2. We handle information about accounts, contracts and inquiries as a business operator handling personal information.
3. Personal information contained in the audio, transcripts, minutes, items and other information recorded or created in the Service (the "Customer Data" defined in the Terms of Use, referred to in this Policy as "Meeting Data") is handled by us as entrusted by the Customer. We handle Meeting Data only to the extent necessary to provide the Service, in accordance with our contract with the Customer.
4. The Customer is responsible for notifying meeting participants that the meeting will be recorded and for obtaining any consent required (Article 8 of the Terms of Use).

1. Account information: display name, email address, password (stored irreversibly converted, i.e. hashed), the account identifier when signing in with a Google or Microsoft account, the organization and role, and settings such as the display language
2. Contract and billing information: the Customer's name, the name, department and email address of the person in charge, the address for invoices, and similar information
3. Meeting Data: meeting names and background descriptions, meeting audio and uploaded audio or video files (processed for transcription; stored only if audio storage is enabled in the contract), transcripts (including speakers' display names), minutes, items (including any owner or due date stated), glossaries, notes in My item list, example minutes uploaded to create a template (used only for the analysis and not stored), and, when the notetaker bot is used, the URL of the meeting
4. Information about connections to external tools: the destination and credentials of external tools the Customer connects (stored encrypted)
5. Usage records: the date, time and content of operations such as signing in, creating or deleting meetings and changing members, transcription time and AI usage
6. Inquiry information: company or organization name, name, email address, phone number (if provided) and the content of the inquiry
7. Server access records: IP address, browser type, date and time of access, pages viewed and similar information

We obtain personal information in the following ways.

1. Information Users enter in or upload to the Service
2. Audio Users record in their browser, and audio and participants' display names recorded by the notetaker bot
3. Invitations sent by us or by an Organization Administrator
4. Information received through Google or Microsoft sign-in
5. Information provided when making a contract, when billed, or when sending an inquiry
6. Information recorded automatically when the Website or the Service is accessed

We use the personal information we obtain for the following purposes.

1. Providing the Service (transcription, creating minutes and items, search, sending to external tools and other features)
2. Verifying identity, signing in, and managing organizations and members
3. Counting usage, managing limits under the contract, and billing
4. Screening before a contract (including confirming that there is no relationship with antisocial forces)
5. Responding to inquiries, consultations and support requests, and sending important notices about the Service
6. Preventing unauthorized use, ensuring security, and responding to failures
7. Complying with laws and regulations

We use Meeting Data only to provide the Service, within the scope entrusted by the Customer. We do not use Meeting Data to train AI.

1. Except through a share link under paragraph 4, Meeting Data can be viewed on screen by the members of the folder in which the minutes are saved. Even an Organization Administrator cannot, by that role, open on screen the content of a folder they are not a member of.
2. The data of a whole organization can be exported only by a designated Organization Administrator, and only if we have enabled it. Exported data also includes the data of deleted meetings.
3. Our administration console handles management information such as contracts and usage. It has no screen for viewing meeting transcripts or minutes.
4. In organizations where the sharing feature is enabled, the User who created a meeting can issue a share link for that meeting. There are two kinds of sharing: sharing during a meeting (the transcript of the meeting in progress is shared) and sharing after a meeting (what is shared is chosen from the approved minutes, the transcript and the audio). The people who can view are one of the following: members of the organization, members of the folder, designated Users, anyone who knows the link and the passcode, or anyone who knows the link. Who can view, and what a share after a meeting contains and how long it is valid, are chosen by the User who shares, within what our settings and the settings of the organization allow. Sharing during a meeting ends when the meeting ends. A share link whose viewers are set to “anyone who knows the link and the passcode” or “anyone who knows the link” can also be viewed by people outside the Customer's organization and by people who do not have an account for the Service.
5. Our staff view the content of Meeting Data only when a court, an investigative authority or another public authority requires it under law.

1. Audio is transcribed and translated on our contractor's speech recognition service. Audio being recorded is sent directly from the User's browser to the systems of that service. To improve recognition, the meeting's background description and glossary are sent with it.
2. The AI features of the Service, such as drafting minutes, naming meetings automatically and creating templates, are used through Amazon Bedrock of Amazon Web Services. According to AWS's published documentation, AI model providers cannot access content sent to Amazon Bedrock (https://docs.aws.amazon.com/bedrock/latest/userguide/data-protection.html).
3. We do not use Meeting Data to train AI.

1. Audio storage is available to organizations that have enabled it in their contract. We set the storage period.
2. Only audio is recorded; the screen is not recorded.
3. The audio of a particular speaker cannot be removed on its own. If an Organization Administrator instructs us in writing (including by e-mail) to delete audio, we delete all audio of that meeting.

We do not provide personal data to third parties without the consent of the person concerned, except where required by law or otherwise permitted by the APPI. Providing data to the contractors in Article 11 is not a provision to third parties. Meeting Data that a Customer sends to an external tool (such as Backlog or Jira) using a feature of the Service is sent on the Customer's instructions.

Meeting Data and account information of the Service are not included in the joint use set out in our company's personal information protection policy. Contract and billing information is not included in that joint use either.

We entrust the handling of personal data to the extent necessary to provide the Service, and supervise our contractors appropriately. The work we entrust for the handling of Meeting Data, and where the data is processed, are as follows.

1. When we handle personal data using a service provided by a business in a foreign country, we take security control measures after understanding the personal information protection system of the country where that business is located.
2. For the personal information protection system of the United States, see the report on the United States (federal) in the Personal Information Protection Commission's "Survey on personal information protection systems in foreign countries" (https://www.ppc.go.jp/files/pdf/USA_report.pdf).

As a business granted the PrivacyMark, we operate a personal information protection management system that complies with JIS Q 15001. We have appointed a personal information protection manager and set out handling procedures (organizational measures), train our employees regularly (human measures), and restrict the areas where personal information is handled (physical measures). For the Service, we take the following technical measures.

1. Data is managed separately for each organization, so that no organization can read another organization's data.
2. As a rule, only the members of the folder in which the minutes are saved can view Meeting Data on screen (the exceptions are set out in Article 6).
3. Communication with the browser is encrypted (HTTPS).
4. Passwords are stored irreversibly converted (hashed), and the credentials used to connect external tools are stored encrypted.
5. Operations such as signing in, creating and deleting meetings and changing members are recorded, and the records cannot be changed or deleted from the application.
6. Our administration console has no screen for viewing meeting transcripts or minutes.

1. A deleted meeting can be restored by the person who created it within a set period (30 days by default). After that period the meeting can no longer be viewed or restored on screen, but its data (except audio, which is handled as set out in Article 8) is kept in our systems until it is deleted under the next paragraph after the contract ends, and it is also included in an export of the whole organization's data (Article 6(2)).
2. When the contract ends, we promptly delete the Meeting Data, the accounts of Users who belong to the Customer's organization (except the accounts of Users who also belong to another organization) and the settings information of the organization, by a method that makes them unrecoverable, once 30 days have passed since the end date. Please export the data you need, by the method we specify, by the end date. On request when the contract ends, we enable the export of the whole organization's data. The scope of the data that can be exported is as we specify; audio and some other data are not included. Notwithstanding the preceding sentences, data we hold from a trial is deleted, by a method that makes it unrecoverable, when an Organization Administrator asks us to in writing (including by e-mail).
3. Information that laws require us to keep (such as billing records) is kept for the period required by law. Data in backups is deleted after the backup retention period has passed.
4. Content the Customer has sent to external tools, and data that has been downloaded or copied, are not covered by this deletion.

1. The Website does not use cookies and does not load any analytics tools.
2. The Service uses only the cookies needed to keep you signed in, to secure the steps of signing in, accepting invitations and connecting external tools, to remember your display language, and to keep the viewing session of a share link that was opened with a passcode. It does not use cookies for advertising or analytics.
3. Audio being recorded is sent directly from the User's browser to the systems of our contractor's speech recognition service for transcription (Article 7).

1. For retained personal data that we handle as a business operator handling personal information, if you wish us to notify you of the purpose of use, to disclose it (including records of provision to third parties), to correct, add to or delete its content, to stop using or erase it, or to stop providing it to third parties, please contact the contact point in Article 17. After confirming that you are the person concerned (or, for a request through an agent, that the agent has authority), we respond without delay in accordance with the law.
2. For personal information contained in Meeting Data, please contact the Customer (contract holder) that manages that Meeting Data. If you contact us and we can identify the relevant Customer from what you tell us, we will pass your request on to that Customer and cooperate in responding according to the Customer's instructions.

For consultations, complaints and requests for disclosure regarding the handling of personal information, please contact:

• Personal Information Inquiry Desk, Kaopiz Inc.
• 3F, 3-8-8 Minamiikebukuro, Toshima-ku, Tokyo 171-0022, Japan
• Email: contact_pmark@kaopiz.com
• Phone: +81-3-5809-2633
• Personal information protection manager: 奥山 聖子

For questions about the Service, please write to info@gijito.com; if you already use the Service, please write to support@gijito.com.

1. We may change this Policy in response to changes in laws and regulations or in the Service. We also change this Policy in advance when we change the work we entrust or where data is processed.
2. We change the purposes of use only within the scope reasonably considered related to the purposes before the change, and we notify the person concerned of, or publish, the changed purposes.
3. The changed Policy takes effect on the date it is posted on the Website.

Established on October 12, 2026

Revised on October 30, 2026

Revised on November 2, 2026