Privacy Policy

1. Information we collect

The Company may collect the following information.

• The name, email address, and message you enter in the contact form
• Account registration details (name, email address, password, and the workspaces you belong to)
• Billing information, where you subscribe to a paid plan
• Information you register or enter in the Service (boards, cards, comments, chat messages, attachments, custom field values, and the like)
• Access logs, activity logs, login history, cookies, and information about your browsing environment

2. Information inside a workspace

Information registered in a workspace belongs to the company or individual that uses that workspace (the "Customer"). The Company handles it as a processor entrusted by the Customer with its storage and processing.

The Company handles that information only as far as needed to provide, maintain, and troubleshoot the Service, and does not use it for any other purpose without the instruction of the Customer.

Data cannot be read across workspaces. The Service is designed so that information in a workspace you do not belong to is unreachable, even if the URL is entered directly.

3. How we use information

The Company uses the information it collects for the following purposes.

• Answering enquiries, discussing adoption, and providing quotations
• Providing the Service, issuing accounts, billing, and support
• Sending notification email for invitations, mentions, assignments, and due dates
• Improving the Service, investigating defects, and preventing misuse
• Sending announcements from the Company (you can stop these at any time)

4. Cookies and analytics

The Service uses cookies to keep you signed in and to remember the language you chose. You can disable cookies in your browser, but then features that require signing in will not work.

On our marketing pages (the pages before you sign in) we use the following analytics tools to understand how the site is used. They are not used on the pages behind sign-in, except for reporting affiliate conversions described below.

• Google Analytics (Google LLC): pages viewed, where visitors came from, and the kind of browser and device. No information that identifies an individual is sent.
• Microsoft Clarity (Microsoft Corporation): how the page is used, including scrolling, clicks, and session recordings, so we can find what is hard to use. Input fields are configured not to be recorded.
• Cloudflare Web Analytics (Cloudflare, Inc.): page view counts. It uses no cookies.
• Rentracks (Rentracks Co., Ltd.): measures the results of our performance-based advertising. A cookie is set only when you arrive at our marketing pages from an ad. When the first payment for the Standard plan is complete, the billing page sends the invoice number, the amount, the billing interval, and the number of seats. No information that identifies you personally, such as your name, email address, postal address, phone number, or card details, is sent.

5. Visitors from the EEA, the UK, and Switzerland

If you visit from the European Economic Area, the United Kingdom, or Switzerland, the tools that use cookies (Google Analytics, Microsoft Clarity, and Rentracks) are not loaded at all. Only Cloudflare Web Analytics, which uses no cookies, runs.

6. Disclosure to third parties and processors

The Company does not provide personal information to third parties except where required by law or where you have consented.

To run the Service the Company entrusts part of its work to the vendors below, and lets them handle personal data only as far as that work requires. Each is bound by contract to a limited scope and to appropriate security measures.

• XSERVER Inc. (Japan): servers. The runtime and database of the Service are located in Japan.
• BunnyWay d.o.o. (Slovenia): storage, transcoding, and delivery of meeting video.
• Cloudflare, Inc. (United States): storage of attachments such as images and PDFs, content delivery, and page view counts.
• Groq, Inc. (United States): transcription of meeting video and audio. Groq does not use the inputs or outputs it receives to train its machine learning models, and does not retain them by default.
• Google LLC (United States): cleaning up transcribed text via the Gemini API. The Company uses the paid tier, so what is sent is not used to improve Google models.
• SocketLabs, Inc. (United States): sending notification email.
• Stripe, Inc. (United States): credit card payments. Card numbers are handled by Stripe and are never held by the Company.
• Google LLC (United States) and Microsoft Corporation (United States): the marketing page analytics listed in section 4.

Slovenia is recognised under Japanese law as having a level of protection equivalent to Japan. Where personal data goes to a vendor in the United States, the Company treats it as a transfer to a party that maintains the arrangements required by the rules of the Personal Information Protection Commission. In practice, each contract limits the scope of handling and requires security measures, control over sub-processing, notice of incidents, and the provision of information, and the Company checks how those are carried out on a regular basis.

If you would like details of the measures any of these vendors take, please ask using the contact details below.

Speaker identification is performed on equipment the Company operates in Japan and is not sent outside the Company.

How we handle information when you connect an AI assistant such as ChatGPT (OpenAI) or Claude (Anthropic) is set out in section 7.

7. Connecting an AI assistant (ChatGPT, Claude and others)

When you connect an AI assistant such as ChatGPT (OpenAI) or Claude (Anthropic) to the Service, the assistant acts only inside the workspace you authorized, with the same permissions as the person who authorized it. It cannot reach boards that person cannot see, and it cannot change the subscription or billing or issue API tokens.

Information handled through the connection is as follows.

• What we receive from the assistant: the name and type of boards it creates; the title, description, start date, due date and completion state of cards it creates or edits; where a card is moved; new list names; custom field values; and cards to delete
• What we return to the assistant: the list of boards, the lists and cards on a board, the contents of a card (description, dates, checklist, labels and attachment details), custom field definitions and values, and Gantt tasks with their dates
• What we store about the connection: the name of the connected assistant, the person and workspace that authorized it, when it was authorized and last used, and the key that identifies it (stored only as a hash, never in its original form)
• Purpose: we use this information only to carry out what you asked the assistant to do and to return the result. Changes made through the assistant appear in the activity log, the same as changes made on screen. We do not use it for advertising, to train AI models, or for any other purpose.
• Recipients: what we return is sent, at your direction, to the provider of the assistant (such as OpenAI or Anthropic), and its handling from then on is governed by that provider's privacy policy.
• Your controls: you can disconnect an assistant at any time under API tokens in your workspace settings. From that moment it can no longer reach the Service. A card the assistant deletes stays in the trash for 30 days and can be restored on screen.
• Retention: keys used by a connected assistant expire after one hour, and refresh keys after 90 days. The record of a disconnected assistant is kept for as long as the workspace exists.

8. Security and where data is held

The runtime and database of the Service are located in Japan. Attachments are held in storage operated by Cloudflare, Inc. (United States) and meeting video in storage operated by BunnyWay d.o.o. (Slovenia).

To prevent leakage, loss, or damage of personal information, the Company encrypts communications, manages access rights, separates data by workspace, records activity logs, takes regular backups, and applies other appropriate security measures.

9. How long we keep information

The Company deletes personal data without undue delay once it is no longer needed. The rough guide is as follows.

• Workspace data (boards, cards, attachments, video): deleted from production 30 days after cancellation. Those 30 days are there so you can export what you need.
• Backups: after deletion from production, a copy may remain in backups held in Japan for up to 180 days for disaster recovery, and then disappears as generations roll over. During that time it is not used for any purpose other than recovery.
• Access logs, activity logs, and login history: one year.
• Billing and accounting records: seven years, as required by law.

10. Disclosure, correction, deletion, and complaints

The Company responds to requests from an individual to disclose, correct, add to, delete, stop using, or stop sharing their personal information, in accordance with the law and after confirming their identity. There is no charge for this.

Complaints about how personal information is handled are received at the same contact point below.

11. Revisions

This policy may be revised in response to changes in the law or to the Service. A revised policy takes effect when it is posted on this page.

12. Contact

LIFE SCAPE, K.K. (株式会社ライフスケープ)

Hisashi Hirajo, Representative Director

1-5-1 Tsukishima, Chuo-ku, Tokyo, Japan

Please get in touch using the contact form.