Privacy Policy (International)

Issued: 14 October 2026

KATO TECH LLC (カトーテック合同会社, representative: Yoshiharu Kato, "we") handles personal information in AIITO as set out below. This policy applies to customers located in Taiwan, Singapore, Australia, New Zealand, the United States and Canada, and to the people whose information they give us.

We are a business established in Japan, and we handle personal information in accordance with the Act on the Protection of Personal Information of Japan ("APPI"). Where the privacy law of the place where you live also applies to us, we comply with it as well; section 12 summarises the additional points for each place.

1. What we collect

1. Account and contact information: name, business name (if any), email address, telephone number, the country and, in the United States and Canada, the state or province you declare, and whether you subscribe as a business or an individual.
2. Billing information: your plan, subscription status, amounts, and the billing address and card-issuing country reported to us by the payment provider. Card numbers are collected and processed by Stripe and its affiliate acting as reseller (section 5). We do not hold your card number.
3. Login and security information: login credentials (passwords are stored only as a hash), two-factor authentication settings, and IP addresses processed in short-lived records used to limit login attempts and prevent misuse.
4. Usage information: records of the operations you request in the Service (see section 8).
5. Service content: content you store or send through the Service — including email messages and their senders and recipients, website content, files, enquiries to support, and what you enter into the AI features and the responses.
6. Operational logs: mail and server logs on the hosting servers, which may include IP addresses and email addresses.

We do not intentionally collect information from children under 18.

2. Why we use it

1. To provide the Service, including hosting your website and email and providing the AI features.
2. To verify your identity and your declared location and customer type, and to apply the correct terms, prices, taxes and server region.
3. To bill you and to keep records required for tax and accounting.
4. To provide support.
5. To prevent and investigate misuse, fraud and security incidents, and to respond to abuse reports.
6. To monitor and improve the reliability, security and performance of the Service using usage data and, where practicable, aggregated data.
7. To send you important notices about the Service, your subscription, and changes to our terms.
8. To comply with law and respond to lawful requests from authorities.

When investigating a fault you have reported, our staff may need to look at the affected email or website content. We do this only so far as necessary to resolve the fault, and access is limited to staff who need it.

The information needed to register an account, verify your identity and take payment is necessary in order to use the Service. If you do not provide it, we may be unable to open an account or provide the Service. If you do not use the AI features, nothing needs to be provided to them.

We do not sell personal information, we do not share it for cross-context behavioural advertising, and we do not use it for direct marketing without your consent. Service notices (billing, faults, changes to terms) are not marketing.

3. Where your website and email are hosted

Your website and email are hosted on servers in the region associated with the country you declared:

These servers are leased from Vultr (The Constant Company, LLC, United States) by our affiliate KATO INFORMATION TECHNOLOGY CO., LIMITED (Hong Kong), which makes them available to us for providing the Service.

Your account information is held on the AIITO platform (aiito.co / api.aiito.co). The AIITO core platform and its database run on servers of KAGOYA JAPAN Inc. in Japan. Backups of hosted content are stored in the same country as the server that hosts it.

4. AI processing

1. To provide the AI features, the instructions you enter, the content of the page or email concerned, and related data are sent to an AI provider for processing. At the date of this policy, the provider is Anthropic, PBC (United States), through its commercial API.
2. To diagnose faults, the AI features may also send information that you did not type yourself — such as error records for your website, the list of your email addresses, and the status of your domain, SSL certificate and billing.
3. Training. Under Anthropic's commercial terms, inputs and outputs are not used to train its models. We do not opt in to training or send feedback that could be used for training.
4. Retention. Not used for training is not the same as not retained. Anthropic states that, under its standard commercial terms, it automatically deletes inputs and outputs from its systems within about 30 days, subject to exceptions such as legal obligations and misuse monitoring. We use Anthropic's prompt caching, which keeps part of a request for a short time. We have not arranged zero data retention with Anthropic.
5. We also keep your conversations with the AI assistant in our own database so that you can see your history (section 8).
6. The AI features are offered only where the provider supports your country. If the provider stops serving your country, or while we change provider, the AI features may be unavailable and nothing you enter is sent to any AI provider. If we change provider, we will update this policy before any data is sent to the new provider.

5. Payments (Stripe Managed Payments)

Your subscription is sold and charged by a Stripe affiliate acting as reseller and merchant of record, Sold through Link, LLC (United States), through Link ("Sold through Link"; statement descriptor `LINK.COM* AIITO`). At checkout you provide your payment details, billing address and email address directly to Stripe and the Reseller, which handle them under their own privacy policies as well as on our behalf where applicable. Stripe and the Reseller tell us your subscription status, the amounts paid, tax collected, your billing country and card-issuing country, and similar information needed to provide the Service and to keep records.

6. Who we share personal information with, and transfers outside Japan

1. We share personal information only with the recipients listed in the table below, to the extent needed for the purposes in section 2, and otherwise only where required or permitted by law or with your consent.
2. A purchaser, successor or proposed purchaser of all or part of our business may receive personal information where reasonably necessary for the transaction and subject to confidentiality and data protection safeguards.
3. Most recipients are located outside Japan. The table is the information we provide under Article 28 of the APPI (provision to a third party in a foreign country) and Article 17 of the Enforcement Rules, and also serves the overseas-disclosure notices required by the laws in section 12.

Overseas recipients

For each country, the Personal Information Protection Commission of Japan (PPC) publishes information about that country's personal information protection system: https://www.ppc.go.jp/personalinfo/legal/kaiseihogohou/#gaikoku. The summaries below are short; please refer to the PPC's information for details.

Your data stored on the Tokyo servers (for customers in Taiwan) is located in Japan but is stored on servers of a foreign company (row 2).

1. Your choice. You may ask us for information about the measures taken by the recipients, as described in section 10.

7. Security

We take the following measures to protect personal information against unauthorised access, loss or damage:

1. Encryption in transit. Connections to the AIITO dashboard and API (aiito.co / api.aiito.co) are encrypted (TLS). HTTPS for your website uses certificates issued automatically on the hosting server.
2. Passwords are not stored in a readable form. They are stored as a cryptographic hash; we cannot know your login password.
3. Certain stored credentials are encrypted, including mailbox and hosting-panel passwords that we need to show you again. The decryption key is not stored in the database.
4. We do not hold card numbers. These are handled by Stripe and the Reseller.
5. Limits on login attempts and other operations.
6. Access control. Only staff who need it for their work can handle personal information.
7. Records of administrative operations on hosting settings and billing.
8. Supervision of the parties we engage listed in section 6.
9. Understanding the external environment. Personal information is handled in the countries listed in sections 3 and 6. We have checked the personal information protection systems of those countries using the PPC's published information and take the measures described above.

Stored service content — email, website files and database records — is not encrypted at rest. It is protected by the access controls and operational measures described above.

Data breaches. If a data breach occurs that is likely to harm you, we will notify the PPC and you as required by the APPI, and will notify the regulators and people concerned as required by the law of the place where you live (for example, the PDPC in Singapore within 3 days of assessing a notifiable breach, the OAIC in Australia, the Office of the Privacy Commissioner in New Zealand and Canada, and under US state breach-notification laws).

8. How long we keep it

1. Hosted service content (email, websites, files) is deleted 30 days after your access ends, as described in the Refund and Cancellation Policy. Backups expire after about 30 days.
2. Application records. For each request it handles, our application records the time, the operation requested, the result, the processing time and the account identifier. These records do not contain your IP address, what you typed or the content of your communications, although fault-investigation details (such as an error message and the domain concerned) may appear. We keep these conversations while your account is active and delete them within 90 days after your account is closed.
3. Conversations with the AI assistant are stored in our database, linked to your account, so that we can show you your history. Where a conversation is handed over to our staff, we keep the text you wrote (up to the first 2,000 characters) as a support record. We keep these conversations while your account is active and delete them within 90 days after your account is closed.
4. Mail and server logs on the hosting servers exist only as long as the server software keeps them, and are then overwritten. We do not archive them separately.
5. Account, billing and transaction records, and records of administrative operations, may be kept longer where required by law (for example, Japanese tax and accounting law, which generally requires 7 years) or reasonably necessary for legal, accounting or fraud-prevention purposes. Support enquiries remain in our support records after you delete them from your screen.

9. Cookies

We place one cookie, which remembers the language you chose. It contains no personal information and expires after one year. We do not use cookies for analytics or advertising, and we do not use any third-party analytics service. Signing in uses your browser's local storage rather than a cookie.

Checkout pages are operated by Stripe and Link on their own sites, and any cookies there are theirs.

Do Not Track and Global Privacy Control. Because we do not track you across other websites or sell or share personal information, we do not change our practices in response to these signals.

10. Your rights and how to make a request

Depending on where you live, you may ask us to:

• tell you whether we hold personal information about you and what we use it for;
• give you access to, or a copy of, your personal information (including, under the APPI, records of provision to third parties);
• correct, add to or delete it;
• stop using it, or stop providing it to third parties;
• give you information about the measures taken by overseas recipients (section 6);
• withdraw any consent you have given (this does not affect processing before withdrawal); and
• exercise any other right given by the law of the place where you live (section 12).

How to ask. Email info@aiito.co with the subject "Privacy request". Please send it from your registered email address; we may ask for further information to verify your identity. You may act through an authorised representative, in which case we will ask for proof of authority.

Response. We respond without undue delay, and within any period required by the law that applies (for example, 30 days in Australia, Canada, Singapore (as soon as reasonably possible, generally 30 days) and Taiwan (15 days for access, 30 days for correction/deletion, extendable), 20 working days in New Zealand, and 45 days under California law where it applies). We reply by email unless you ask for another form. There is no charge, except that we may charge a reasonable fee where the law allows it (for example, actual postage if you ask for a paper copy).

Complaints. Please contact us first at info@aiito.co. You may also complain to the PPC in Japan, or to the privacy regulator where you live (section 12). We will not discriminate against you for exercising your rights.

11. Changes

We may revise this policy. We will publish the revised version and its effective date on this page and, where a change is materially to your disadvantage, notify you by email in advance.

12. Additional information for your country

Australia

We comply with the Australian Privacy Principles to the extent the Privacy Act 1988 applies to us. APP 8 — overseas disclosure: your personal information is likely to be disclosed to recipients in Japan, Hong Kong, the United States and Singapore, and, for hosting, held in Australia; see section 6. You may complain to the Office of the Australian Information Commissioner (www.oaic.gov.au).

New Zealand

We comply with the Privacy Act 2020 and the Information Privacy Principles. IPP 12 — disclosure outside New Zealand: your hosted content is stored in Australia, and personal information is disclosed to recipients in Japan, Hong Kong and the United States (section 6). We disclose it only where the recipient is subject to comparable safeguards, including by contract, or as otherwise permitted by IPP 12. IPP 3A: where we collect personal information about you from someone else (for example, your organisation), we take reasonable steps to tell you. You may complain to the Office of the Privacy Commissioner (www.privacy.org.nz).

Singapore

We comply with the Personal Data Protection Act 2012 ("PDPA"). Our Data Protection Officer is Yoshiharu Kato, Representative, who can be contacted at info@aiito.co. Transfers out of Singapore: your hosted content is stored in Singapore, and personal data is transferred to Japan, Hong Kong and the United States (section 6). We ensure the recipients provide a standard of protection comparable to the PDPA, including through legally enforceable obligations (Personal Data Protection Regulations 2021, Part 3). You may contact the Personal Data Protection Commission (www.pdpc.gov.sg).

Taiwan

This section is our notice under Article 8 of the Personal Data Protection Act of Taiwan:

1. Collector: KATO TECH LLC (contact details in section 14).
2. Purposes: as in section 2 (including the specific purposes "contract and quasi-contract relationship", "consumer protection", "information and database management", "information and communication services" and "marketing" only with your consent).
3. Categories: as in section 1 (e.g. C001 identification, C002 financial identification, C011 personal description, C132 unclassified information).
4. Period, area, recipients and methods of use: during the contract and the retention periods in section 8; in Japan, Hong Kong, the United States and the other countries in sections 3 and 6; by us and the recipients in section 6; by automated and manual processing.
5. Your rights (Article 3): to inquire and review, request copies, supplement or correct, request cessation of collection, processing or use, and request deletion — see section 10.
6. If you do not provide information: we may be unable to provide the Service (section 2).

Your hosted content is stored in Japan (Tokyo).

Canada

We comply with the Personal Information Protection and Electronic Documents Act ("PIPEDA"). Our Privacy Officer is Yoshiharu Kato, Representative, contactable at info@aiito.co. Your hosted content is stored in Canada (Toronto), and personal information is transferred to Japan, Hong Kong and the United States (section 6), where it may be accessible to courts, law enforcement and national security authorities of those countries. We use contractual and other means to provide a comparable level of protection. You may complain to the Office of the Privacy Commissioner of Canada (www.priv.gc.ca). We do not accept individual customers resident in Quebec.

United States

Notice for California and other states. In the preceding 12 months we have collected the categories of personal information described in section 1 (identifiers; customer records; commercial information; internet or other electronic network activity; and content of communications), for the purposes in section 2, from you, your authorised users and our service providers, and disclosed them for business purposes to the categories of recipients in section 6 (service providers for hosting, AI processing and payments). We do not sell personal information and we do not share it for cross-context behavioural advertising, and we have not done so in the preceding 12 months. We do not use or disclose sensitive personal information for purposes other than providing the Service. Retention is described in section 8. You may make requests as described in section 10, or by calling +81-6-7777-4660 (weekdays 10:00–17:00 Japan time).

13. Language

This policy is written in English, and the English version is the official version. Any translation is provided for convenience only.

14. Who we are and how to contact us

KATO TECH LLC (カトーテック合同会社)
Representative: Yoshiharu Kato
3-1-10-1204 Nishitenma, Kita-ku, Osaka 530-0047, Japan
Email: info@aiito.co
Telephone: +81-6-7777-4660 (weekdays 10:00–17:00 Japan time)

14 October 2026 / KATO TECH LLC