Privacy Policy | メイシα

Version: 2026-08-11

This policy explains how メイシα (“the Service”) handles personal data related to business cards and contacts. It is the version linked from the guest exchange-back consent checkbox.

1. Data we collect

Name, company, title, email, and optional phone that you enter
Contacts and exchange history created by sharing, scanning, or joining a room
Account data (verified email, display name, organization memberships)
Technical data needed to run the Service (sessions, device push tokens, access logs)

2. How we use it

To store, share, and display cards and contacts within your organizations
To authenticate you, secure the Service, and prevent abuse
To operate the product, handle incidents, and meet legal duties
With consent, for aggregated product analytics. Third-party names are never placed in push notification bodies

3. Other people’s data

When you store someone else’s card or contact details, you confirm you obtained them lawfully and may store them in the Service. Guest exchange will not store your details if the consent box is left unticked.

4. Processing outside Japan (OCR)

Scan images may be sent through OpenRouter to Google Vertex (google-vertex/global) for optical character recognition. That is processing outside the Tokyo region and is a residency exception we disclose here. Primary databases and object storage remain in Tokyo (Turso Tokyo, GCS asia-northeast1, Cloud Run asia-northeast1).

5. Retention and deletion

We keep personal data only as long as needed for the purposes above. On account deletion or an APPI deletion request, identifiable personal data is removed from both the database and object storage. Anonymized exchange ledger rows may remain for counts and referential integrity.

6. Contact

For privacy questions or deletion requests, contact Service support. Deletion requests are handled within 14 days.