CLOSM i Privacy Policy
CLOSM LLC (hereinafter referred to as the "Company") hereby establishes this Privacy Policy (hereinafter referred to as the "Policy") regarding the handling of Users' personal information in connection with the CLOSM i service (hereinafter referred to as the "Service").
Article 1 (Scope)
This Policy applies to the relationship between the Company and Users regarding the use of the Service.
Article 2 (Authentication and Personal Information)
The Service uses Auth0 (an authentication platform service provided by Okta, Inc.) for user authentication. Information obtained through Auth0 (email addresses, social login profiles, etc.) is handled in accordance with Auth0's privacy policy. The Company uses information obtained from Auth0 for the purposes of user identity verification and account management.
Article 3 (Information Collected)
The Company may collect the following information in the course of providing the Service:
- User registration information: email address, username, display name, profile image, date of birth, etc.
- Profile information: bio text, custom color settings, etc.
- Posting and usage data: posted content, usage history, favorites, follow relationships, log information
- Payment-related information: purchase history, plan subscription status, payment status (Note: Credit card information is managed directly by the payment processor; the Company does not retain sensitive information such as card numbers)
- Shipping information (for merchandise purchases): name, address, phone number, email address
- Blockchain information (for NFT usage): wallet address, transaction history
- Device information: IP address, browser type, access date and time, and other log information, app instance identifiers, and push notification tokens
- Age and parental consent information: identifiers issued by the app stores (described in detail in Article 10)
Please note that your username, display name, bio, profile image, and posted content are visible to other users. Do not enter information you do not wish to make public. Your date of birth is not visible to other users.
Article 4 (Purpose of Use)
The Company uses collected information for the following purposes:
- To provide, operate, and improve the Service
- To provide user support and respond to inquiries
- To process billing and payments for paid plans
- To ship merchandise (goods) and communicate delivery status
- To mint, manage, and display transaction histories of NFTs
- To prevent and respond to violations of the Terms of Service (including the automatic detection of inappropriate content in uploaded profile images)
- To analyze and improve the usage of the Service
- To send notices and activity notifications via push notifications
- To check age range and parental consent as required by law and to restrict use accordingly
- To confirm that users meet the minimum age (Article 10, paragraph 1: 13 until October 20, 2026; 18 from that date)
Article 5 (Cookies and External Data Transmission)
- The Service may use cookies and similar technologies to enhance user experience and improve the Service.
- In accordance with the Telecommunications Business Act, the Service transmits user information to the following external services:
| Recipient | Information Transmitted | Purpose of Use |
|---|---|---|
| Auth0 (Okta, Inc.) | Authentication tokens, session information | User authentication and login management |
| Stripe, Inc. | Information necessary for payment processing (card information, name, email address, etc.) | Payment processing and subscription management |
| Google LLC (Google Analytics / Google Analytics for Firebase) | Pages viewed, in-app interaction data, search keywords, device identifiers, user ID, approximate location derived from IP address, etc. | Analysis and improvement of service usage |
| Google LLC (Firebase Cloud Messaging), Apple Inc. (Apple Push Notification service) | Push notification tokens, device information | Delivery of push notifications |
| 650 Industries, Inc. (Expo) | Push notification tokens, device information | Delivery of push notifications |
| Reown Inc. (WalletConnect) | Wallet address, IP address, device and SDK information, etc. | Wallet connection (when using NFT features) |
| GMO Pepabo, Inc. (SUZURI) | Image data of artwork uploaded by the User | Manufacturing and sale of merchandise (Products) on the external service "SUZURI" |
- Users may refuse to accept cookies through their browser settings. However, refusing cookies may prevent some features of the Service from being available.
Article 6 (Third-Party Disclosure, Outsourcing, and Provision to Third Parties Located in Foreign Countries)
- The Company will not disclose personal information to third parties without the prior consent of the User, except in the following cases:
- When required by law
- When necessary to protect a person's life, body, or property
- When particularly necessary for the improvement of public health or the promotion of the healthy upbringing of children
- When it is necessary to cooperate with a national or local government body or a person entrusted by such body in performing duties prescribed by law
- The Company may outsource all or part of the handling of personal information to external service providers to the extent necessary for the provision of the Service. In such cases, the Company shall exercise appropriate supervision over the outsourced parties. The principal outsourced parties, countries of transfer, purposes of use, and data security measures are as follows:
| Outsourced Party | Country | Purpose of Use | Data Security Measures |
|---|---|---|---|
| Auth0 (Okta, Inc.) | United States | User authentication and account management | SOC 2 Type II certified, ISO 27001 certified |
| Stripe, Inc. | United States | Processing payments for subscription fees and merchandise | PCI DSS Level 1 compliant, SOC 2 certified |
| Printful, Inc. | United States / EU | Manufacturing and shipping of merchandise | EU GDPR compliant |
| Cloudflare, Inc. | United States, etc. | Delivery and storage of image data, and matching against known child sexual abuse material | SOC 2 Type II certified, ISO 27001 certified |
| Amazon Web Services, Inc. | United States (data stored in a region in Japan) | Operation of server and network infrastructure, sending email, automatic detection of inappropriate content in profile images (Amazon Rekognition) | ISO 27001 certified, SOC 2 reports. Profile images are processed in a region in Japan and AWS is not permitted to use them to improve its services |
| Google LLC (Firebase / Google Analytics) | United States | Analysis of service usage, delivery of push notifications | ISO 27001 certified |
| 650 Industries, Inc. (Expo) | United States | Relaying delivery of push notifications | SOC 2 Type II certified |
| Reown Inc. (WalletConnect) | United States (processed mainly in Europe) | Relaying wallet connections | Data security measures prescribed by the company |
| Alchemy Insights, Inc. | United States | Issuing NFTs (recording on the blockchain) | SOC 2 Type II certified |
| Apple Inc. / Google LLC | United States | Payment processing and purchase verification for in-app purchases | Data security measures prescribed by each company |
- The outsourced parties listed in the preceding paragraph include those located outside of Japan. By using the Service, Users consent to the transfer and processing of data to the countries listed in the preceding paragraph. Note that the United States does not have a comprehensive data protection law equivalent to Japan's Act on the Protection of Personal Information; however, each outsourced party implements the data security measures described above.
- Users may inquire with the Company for detailed information regarding the provision of data to third parties located in foreign countries.
Article 7 (Characteristics of Blockchain Information)
Users acknowledge in advance that information recorded on the blockchain in connection with the use of NFT features (wallet addresses, transaction histories, etc.) is, due to its technical characteristics, permanently recorded and difficult to delete or modify, and is of a nature that is publicly accessible.
Article 8 (Information Management)
- The Company shall take the following measures for the security management of Users' personal information, including the prevention of leakage, loss, or damage: (1) Encryption of communications: Communications with the Service are encrypted using SSL/TLS (2) Access control: Access to personal information is limited to personnel who require it for business purposes (3) Security of external services: Payment information is managed by a PCI DSS-compliant payment processor, and authentication information is managed by an authentication platform that has obtained international security certifications (4) Periodic review: The implementation status of security management measures is periodically reviewed and improved as necessary
Article 9 (Retention Period of Personal Information)
- The Company shall retain personal information for a reasonable period within the scope necessary to achieve the purposes of use.
- Upon a User's withdrawal, the Company shall delete account information within a reasonable period. Posted Content shall be transferred to the Company's management and continue to be published under the Company's name, as provided in Article 13, Paragraph 2 of the Terms of Service. However, information required to be retained by law (order history, transaction records, etc.) shall be retained for the period prescribed by law. The types of information retained after withdrawal and their retention periods are described on the "Account Deletion" page.
- Information recorded on the blockchain cannot be technically deleted as provided in Article 7.
Article 10 (Minors)
- The Service is intended for users aged 18 and older. Individuals under 18 years of age may not use the Service (from October 20, 2026; until that date, the Service is intended for users aged 13 and older, and individuals under 13 years of age may not use the Service).
- Where required by local law, we may receive your age range and parental consent status from the App Store or Google Play. We use this information only on your device to determine whether the Service can be used; we do not send it to or store it on our servers, and we do not use it for analytics, advertising, or any other purpose.
- To check whether a parent or guardian has withdrawn consent, we may send an identifier issued by the store (the App Store app transaction ID or the Google Play install ID) to our servers, separately from your age range. We do not store the identifier sent for this check after responding and do not record it in logs.
- If a parent or guardian withdraws consent, we store the above identifier, as notified by the store, to restrict use of the Service. This record does not include your account information or name. We may keep the identifier after consent is granted again, to avoid restricting use by mistake.
- When you create an account, we ask you to enter your date of birth. We use it only to confirm that you meet the minimum age in paragraph 1 (13 until October 20, 2026; 18 from that date), and it cannot be changed after registration. If you enter a date that shows you do not meet that minimum age, we do not create the account (and we also take steps to delete the user record created at our authentication provider), and we leave a marker on your device (a cookie on the web, or storage on the device in the app) to prevent re-registration. This marker does not contain your date of birth and is not stored on our servers. We will ask existing users who have not yet registered a date of birth to enter it the next time they use the Service.
Article 11 (User Requests for Access or Deletion)
Users may request the Company to disclose, correct, add, delete, suspend the use of, or erase their personal information.
If you wish to make such a request, please contact us at the address provided below. Note that this does not apply to information that is technically impossible to delete, such as information recorded on the blockchain. Your date of birth cannot be changed after registration, but if you entered it by mistake, please contact us at the address below. We will review it individually and respond.
Article 12 (Revisions to This Policy)
- The Company may revise this Policy as necessary, to the extent permitted by law.
- For any revision that materially affects users' rights or interests, the Company will give notice of the revision, the revised content, and its effective date by posting it on the Service or by other appropriate means a reasonable period before the effective date. Any other revision shall take effect when the revised Policy is posted on the Service.
- Notwithstanding the preceding paragraphs, where the law requires users' consent to a revision, the Company will obtain such consent in the manner prescribed by the Company.
Article 13 (Contact Information)
For inquiries regarding this Policy, please contact the following:
CLOSM LLC Email: contact+Inquiry-i@closm.llc Contact Form: https://forms.gle/wm2nWxD9setSTH2s7
Enacted on February 16, 2026
Revised on October 2, 2026
Revised on October 8, 2026
Revised on October 20, 2026