Privacy Policy

This Privacy Policy describes how ARMERIA LLC ("we", "us") handles users' information in connection with INARY, including the web app, the desktop app, the mobile apps, and the website inary.ai (the "Service").

1. Who we are

• Name: ARMERIA LLC (ARMERIA合同会社)
• Address: Tenjin First Bldg. 7F, 4-6-28 Tenjin, Chuo-ku, Fukuoka 810-0001, Japan
• Representative: Kunihiro Nakano, Representative Member
• Contact: support@inary.ai

2. Information we collect and how we collect it

1. Account information: your name, email address, organization, profile image, and similar information. This includes what you enter, what we receive from Google or Apple when you sign in with them (such as your name and email address), and email addresses an organization administrator enters to invite you.
2. Content you enter or send: messages, attachments, instructions to the AI, notes, events, and other content you create.
3. Information from services you connect: information we obtain from the email addresses and external services you connect to the Service (such as Google, GitHub, Zoom, and Shopify), within the scope of the connection and according to your actions, your instructions, or features you turn on (including the senders, recipients, subjects, bodies, and attachments of email, which contain information about third parties). Passwords and authentication tokens used to connect are stored encrypted. Email bodies are retrieved from your mail server each time they are needed and are not stored on our servers. However, content posted or shared into a conversation (including AI responses) and shared drafts are stored as content (item 2), and results of features (such as detection results) are stored as described in Section 11.
4. Payment information: the billing email address and subscription status for paid plans. Card numbers are collected directly by our payment processor (Stripe); we do not hold them.
5. Device and usage information: IP address, browser and device type, access times, activity records, error records, device identifiers for push notifications, and similar information.
6. Cookies and similar technologies: as described in Section 8.

3. How we use information

We use the information we collect for the following purposes:

1. To provide the Service (creating accounts and verifying identity; displaying, sending, and receiving messages, files, email, and events; delivering notifications).
2. To provide AI features (generating responses to your instructions, such as research, search, summaries, translation, and writing; creating memories from conversation content and using them in later responses; automated determinations made by the Service, such as deciding whether a response is needed and detecting spam and phishing).
3. To bill and process payments.
4. To prevent abuse, keep the Service secure, and investigate failures.
5. To send notices about the Service and respond to inquiries.
6. To improve the Service (aggregating and analyzing usage). We do not use your content to train AI models.
7. To analyze traffic to our website and measure the effectiveness of our ads (Section 8).
8. To comply with the law.

4. Processing by third-party AI providers

1. For the purposes in Section 3, item 2, we send your content (Section 2, item 2) and, as needed for responses and determinations, information obtained from services you connect (Section 2, item 3) to the third-party AI providers we engage, which process it: Google (Vertex AI), Anthropic, OpenAI, and SpaceXAI (Grok). All are US companies.
2. We use these providers under terms that do not allow them to use what they receive to train their AI models. Under those terms, providers may retain data for a limited period for purposes such as abuse monitoring.
3. When you call the AI, its response is posted in the conversation where you called it, and the participants there can read it. A response may include summaries or quotes of information the AI read (such as the contents of email).

5. Disclosure to third parties

We do not provide personal information to third parties except:

1. with your consent;
2. where permitted by law, such as when required by law or necessary to protect a person's life, body, or property; or
3. in connection with a merger or other transfer of business.

Disclosure for ad measurement: If you complete sign-up for the Service after clicking one of our Google ads, we provide the ad's click ID and the time sign-up was completed to Google LLC (United States). We do not provide your name, email address, or user ID. This disclosure is based on your consent, which you give by agreeing to this Policy when you sign up. For information on the United States' personal information protection system, see the survey by Japan's Personal Information Protection Commission (https://www.ppc.go.jp/personalinfo/legal/kaiseihogohou/#gaikoku). For how Google LLC handles data, see its Privacy Policy (https://policies.google.com/privacy).

6. Service providers and third parties in foreign countries

1. We engage the following companies to perform work needed to operate the Service and have them handle personal information to that extent.

   Service provider	Work	Country
   Google LLC (Google Cloud)	Servers, database, and file storage	United States (data is stored in US data centers)
   Google LLC, Anthropic, PBC, OpenAI, SpaceXAI LLC	AI processing (Section 4)	United States
   Stripe, Inc.	Payments	United States
   XServer Inc. (エックスサーバー株式会社)	Sending emails such as verification codes	Japan
   Google LLC (Firebase Cloud Messaging), Apple Inc. (Apple Push Notification service)	Delivering notifications to mobile devices	United States

2. Engaging US companies constitutes providing personal information to a "third party in a foreign country" under Article 28 of Japan's Act on the Protection of Personal Information. Through our contracts with each company, we ensure measures consistent with that Act (handling within the scope of the purpose of use, not using data to train AI models, security safeguards, and so on). On request, we will provide the information set out in paragraph 3 of that Article (an overview of the measures, how we check them, the name of the destination country, that country's system, and so on).

7. Data we hold for customer organizations

The Service is for organizations. Messages, files, and other content you send within an organization are data we hold for that organization, and we handle them only to provide the Service to that organization. Organization administrators can manage this data according to the organization's settings.

8. Cookies, analytics, and ad measurement

1. The Service and our website use cookies and similar technologies.

   Name / type	Set on	Purpose	Duration
   Authentication session	app.inary.ai	Keeping you signed in	30 days
   inary_ws, *_last, and similar	app.inary.ai	Remembering the selected organization and the last screen you opened	30 days
   lng and display settings (such as mail_images)	app.inary.ai	Remembering your language and display settings	While the setting is kept
   inary_gclid	inary.ai, app.inary.ai	Storing the Google Ads click ID (ad measurement; Section 5)	90 days
   Google Analytics (such as _ga)	inary.ai	Analyzing traffic to our website	As set by Google

2. Google Analytics: Our website uses Google Analytics from Google LLC and sends Google the pages you view, the date and time, the referrer, device and browser information, cookie identifiers, and similar information. For how Google uses this data, see https://policies.google.com/technologies/partner-sites. You can stop collection by Google Analytics with Google's opt-out browser add-on (https://tools.google.com/dlpage/gaoptout).
3. Through these cookies and identifiers, Google may collect information about you over time and across different websites and services.
4. Do Not Track: The Service and our website do not currently respond to browser Do Not Track signals.
5. You can delete or block cookies in your browser settings. If you block the authentication session cookie, you will not be able to sign in.

9. External transmission (disclosure under Article 27-12 of Japan's Telecommunications Business Act)

The Service causes your device to send information to the following companies.

10. Google user data (Google connectors)

INARY offers optional connectors that let you link your own Google account (for example Google Drive, Sheets, Docs, Slides, Calendar, Tasks, and Gmail) so the AI can act on your instructions. If you connect a Google account:

What we access. The Service accesses your Google data only when you instruct the AI to do so (for example, asking it to read a spreadsheet), and only within the scopes you granted on Google's consent screen.

How we use it. Data obtained through Google APIs is used solely to provide user-facing features of the Service: reading, summarizing, and editing the content you point the AI at, and returning the result to you — which may include posting the response into the conversation where you invoked the AI. We do not use Google user data for advertising, do not sell it, and do not use it to develop, improve, or train generalized AI or machine-learning models.

What we store. We store the authentication tokens needed to keep your connection (encrypted at rest) and the list of granted scopes. Content retrieved from Google APIs is processed to answer your request; we do not maintain a separate copy of your Google data.

Sharing. Retrieved content is transmitted to the third-party model providers described in Section 4 only as needed to generate the response you requested. We do not transfer Google user data to any other third party except as necessary to provide these features, to comply with applicable law, or as part of a merger or acquisition with notice to you.

Human access. Our staff do not read data obtained from Google APIs except with your permission, where necessary for security or abuse investigations, to comply with applicable law, or where the data has been aggregated and de-identified.

Revoking access. You can disconnect your Google account at any time from the connector settings in the Service or from your Google account's security settings. Upon disconnection we delete the stored tokens.

INARY's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

11. Data retention

12. Security measures

1. Basic policy: We have established and published this Policy.
2. Handling rules: We have documented internal procedures for each stage of handling: collection, use, storage, provision, and deletion.
3. Organizational measures: Our Representative Member is responsible for the handling of personal information.
4. Personnel measures: We train employees and workers who handle personal information and obtain confidentiality pledges from them.
5. Physical measures: Data is stored in Google Cloud data centers with physical access control.
6. Technical measures: We encrypt communications (HTTPS), store email passwords and authentication tokens for external services encrypted, manage access permissions, and prohibit writing secrets to logs.
7. Understanding the external environment: We store data in the United States and engage US companies. We have taken the measures above with an understanding of the United States' personal information protection system.

13. Requests for disclosure and other requests

1. You may request, regarding your personal data that we hold, notification of the purpose of use; disclosure (including records of provision to third parties); correction, addition, or deletion; suspension of use or erasure; and suspension of provision to third parties.
2. Please send requests to support@inary.ai from the email address registered with the Service. We will verify your identity, for example by confirming through your registered email address. For requests made by an agent, please send a letter of authorization and an identity document for the agent.
3. We do not charge a fee.
4. For data we hold for an organization (Section 7), please first contact that organization's administrator.

14. Children's information

The Service is intended for businesses and is not directed to children under 13. If we learn that we have collected personal information from a child under 13, we will delete it.

15. Changes to this Policy

We may change this Policy. We will announce material changes before they take effect, within the Service and on our website (inary.ai). We will not apply use for a new purpose that is disadvantageous to users (for example, using your content to train AI models) to information already collected without your consent.

16. Contact and complaints

For inquiries, complaints, and requests for disclosure regarding the handling of personal information, please contact:

• ARMERIA LLC, Personal Information Desk
• Email: support@inary.ai
• Mail: Tenjin First Bldg. 7F, 4-6-28 Tenjin, Chuo-ku, Fukuoka 810-0001, Japan