プライバシーポリシー

Symon Brain, Inc. (the "Company") places great importance on the protection of Users' personal information and privacy in connection with "Gungi," an AI development process management platform, and all associated services (collectively, the "Service").

This Privacy Policy (the "Policy") explains what information we collect, and how we use, store, and share it. By using the Service, you are deemed to have agreed to the terms described in this Policy.

In the event of any discrepancy between the Japanese and English versions, the Japanese version shall prevail.

We collect the following information in order to provide the Service:

[Account Information] Through GitHub OAuth authentication, we obtain your GitHub username, email address, profile image URL, and GitHub user ID. We do not collect or store your GitHub password.

[Repository Information] We obtain the name, owner information, and metadata related to Issues, Pull Requests, commits, etc. for GitHub repositories that Users connect to Gungi.

[Service Usage Data] We collect data automatically generated through use of the Service, including phasechain execution history, AI agent input/output logs, and task creation/update history.

[Technical Information] We collect technical access logs such as IP addresses, browser type and version, operating system, access date/time, and referral URLs.

[Cookie Information] We use cookies for session management and maintaining authentication status (see Article 9 for details).

We use the information we collect for the following purposes:

(1) Providing, maintaining, and improving the Service (phasechain execution, AI agent operation, task management, etc.);

(2) User authentication and access control management;

(3) Providing customer support;

(4) Analyzing Service usage and improving quality;

(5) Ensuring security and preventing unauthorized use;

(6) Investigating and responding to violations of the Terms of Service;

(7) Fulfilling legal obligations; and

(8) Sending important notices about the Service (changes to Terms, maintenance notifications, etc.).

For personal data of Users residing in the European Economic Area (EEA), the European Union (EU), or the United Kingdom (UK), we process data based on the following legal grounds:

[Performance of Contract (Article 6(1)(b) GDPR)] Processing necessary for the provision of the Service, including account management, phasechain execution, and GitHub integration.

[Legitimate Interests (Article 6(1)(f) GDPR)] Improving the Service, ensuring security, and preventing fraud, conducted within reasonable limits with due consideration for the impact on Users' privacy.

[Legal Obligation (Article 6(1)(c) GDPR)] Fulfilling obligations under applicable laws.

[Consent (Article 6(1)(a) GDPR)] Processing based on consent, such as sending marketing communications. Consent may be withdrawn at any time.

We do not provide Users' personal information to third parties except in the following cases:

[Sharing Necessary for Service Provision] We share data with the following third-party services to the extent necessary for operating the Service:

- GitHub (account authentication, repository integration, Issue/PR operations)

- Amazon Web Services (infrastructure, database, storage)

- AI API providers (Anthropic, OpenAI, Google, etc. — AI agent processing during phasechain execution)

[Disclosure Required by Law] When required by court orders, lawful requests from law enforcement agencies, or other legal obligations.

[Business Succession] User information may be transferred to a successor entity in connection with a merger, acquisition, or business transfer. In such cases, we will require the successor to provide protections equivalent to this Policy.

We do not sell personal information to third parties for advertising purposes.

The primary infrastructure for the Service (database, application servers) is located in Japan (AWS Tokyo Region: ap-northeast-1).

However, data may be transferred outside Japan in the following cases:

(1) AI agent processing: During phasechain execution, requests are sent to AI API provider servers (Anthropic, OpenAI, Google, etc.). These servers may be located in the United States or other countries.

(2) GitHub integration: GitHub's servers are located in the United States.

(3) CDN/edge services: Globally distributed servers may be used for performance optimization.

For Users residing in the EEA/UK, Japan has received an Adequacy Decision from the European Commission. For transfers to other countries, we implement appropriate safeguards such as Standard Contractual Clauses (SCC).

We retain Users' personal information for the period necessary to fulfill the purposes of use.

[Account Information] Retained while the account is active and for thirty (30) days after account deletion.

[Service Usage Data (execution logs, etc.)] Retained for a maximum of twelve (12) months for service improvement and technical problem resolution.

[Technical Information (access logs)] Retained for a maximum of six (6) months for security and fraud prevention.

[Retention Based on Legal Obligations] Data required to be retained under tax, accounting, or other laws is retained for the period prescribed by such laws.

After the retention period expires, data will be deleted or anonymized within a reasonable timeframe.

All Users have the following rights regarding their personal information:

[Right of Access] You may request disclosure of your personal information held by us.

[Right to Rectification] You may request correction of inaccurate or incomplete personal information.

[Right to Erasure] You may request deletion of your account and erasure of your personal information.

[Right to Data Portability] You may request to receive your personal information in a structured, commonly used, and machine-readable format.

[EU/EEA/UK Users (GDPR)] In addition to the above, you have the right to request restriction of processing, the right to object to processing, and the right to lodge a complaint with a supervisory authority in your country of residence.

[California Residents (CCPA/CPRA)] You have the right to know the categories and purposes of use of personal information we collect, the right to request deletion of your personal information, and the right not to be discriminated against for exercising your rights. We do not "sell" Users' personal information (as defined under the CCPA).

To exercise any of the above rights, please contact us through our inquiry form. We will respond within a reasonable period after verifying your identity.

We use cookies and similar technologies for the following purposes:

[Essential Cookies] Cookies indispensable for basic Service functions, such as maintaining login sessions and CSRF protection. These cannot be opted out of.

[Analytics Cookies] Used to understand Service usage patterns and improve the Service.

You may refuse to accept cookies through your browser settings; however, some features of the Service may not function properly in that case.

We implement the following technical and organizational measures to protect Users' personal information from unauthorized access, leakage, alteration, and destruction:

(1) Encryption of communications (TLS/SSL);

(2) Database encryption and access controls;

(3) Encrypted storage of GitHub tokens; and

(4) Regular security assessments.

However, we cannot guarantee complete security for communications over the Internet.

The Service is not intended for persons under sixteen (16) years of age (or under the age specified by local law in EEA/UK countries).

We do not knowingly collect personal information from anyone under sixteen (16) years of age. If we become aware that personal information has been collected from such an individual, we will promptly delete that information.

We may modify this Policy for the purpose of adapting to legislative changes, changes in the Service, or improving privacy protection.

When making material changes, we will notify Users of the changes and effective date at least fourteen (14) days prior to the effective date via the Service or email.

If you continue to use the Service after a change takes effect, you will be deemed to have agreed to the revised Policy.

For inquiries about this Policy, or to request disclosure, correction, or deletion of personal information, please contact us at:

Symon Brain, Inc.

Contact: https://symon-brain.com/contact

Location: Mitsuhashi Bldg. 3F, 1-3-3 Kita-Aoyama, Minato-ku, Tokyo, Japan

For inquiries from outside Japan, please use the contact form above. We will respond in English upon request.