ヨクナルセールス Privacy Policy

This is a translation provided for convenience. If the two versions differ, the Japanese version governs.

Wello, Inc. ("we" or "the Company") sets out this Privacy Policy (this "Policy") to describe how personal information is handled in ヨクナルセールス (the "Service"), which we provide. We comply with the Act on the Protection of Personal Information of Japan (the "APPI") and other applicable laws, regulations and guidelines, and handle personal information appropriately.

1. Basic policy

We recognize the importance of personal information and regard its protection as a social responsibility. We acquire, use and manage personal information properly. We maintain internal rules on the handling of personal information, make them known to our officers and employees, and work to improve them continuously.

2. Roles of the Company and the Customer

1. The Service is used by corporations and other organizations (each, a "Customer") to record and analyze sales meetings conducted by their officers, employees and similar persons (each, a "User") and to support their sales activities. This Policy also covers the handling of information about the persons with whom a User holds a sales meeting — that is, the representatives of the Customer's business partners or prospects (each, a "Meeting Counterparty").
2. With respect to the personal information of Users and Meeting Counterparties, the Customer is, in principle, the business operator handling personal information (the party that controls it), and we act as a service provider entrusted by the Customer to handle that personal information on its behalf.
3. Personal information that we ourselves handle as a business operator handling personal information in providing the Service (such as the contact details of the Customer's administrators) is handled in accordance with this Policy. In addition, given that Users enter information directly into the Service through the application and record the audio of sales meetings, we publish the contents of that handling through this Policy in order to ensure transparency.
4. The content of sales meetings recorded in the Service belongs to the Customer. Those records remain the Customer's even if a User leaves the Customer or the User's account is deleted.
5. At a User's first sign-in, we obtain from the User, by the method we prescribe (obtaining express consent by means such as check boxes), consent to this Policy and to the Terms of Service, as well as consent to the matters concerning recording set out in Section 5.
6. Because the audio of a sales meeting contains the personal information of Meeting Counterparties and other third parties, we handle it with care.

3. Personal information we acquire, and how we acquire it

We may acquire the following personal information in connection with providing the Service.

3.1 Information we acquire

• Information about Users
  • Name, email address, and the sales office or department the User belongs to
  • Job title
  • Authentication information (the identifier used to sign in, identifiers passed from the authentication platform the Customer uses, the permission level granted within the Service, and authentication and access history)
  • Records of sales meetings (recorded audio, its transcript, and meeting minutes, analysis results, draft follow-up emails, reports and other generated output)
  • Information entered about a sales meeting (customer name, meeting date, meeting type, likelihood of winning the deal, level of interest, notes and the like)
  • Information about the evaluation of a sales meeting (evaluation scores, and comments such as what went well and what can be improved)
  • Location data (acquired only where the User has granted permission, in order to suggest nearby customers)
  • Information about the device and operating environment (device type, operating system, application version, language settings, and the identifier used as the destination for push notifications)
  • Records of how the Service is used and of operations performed, and records of communication errors and the like
  • Calendar information (acquired only where the User has permitted the connection, with read-only permission, covering the date and time, title and attendees of events)
  • Audio files, images and other files that the User uploads to the Service
  • The content of inquiries
• Information about Customers (administrators)
  • Contact details such as the name, email address and telephone number of the person in charge
  • Company name and information about sales offices and places of business
  • Information about the contract, billing and payment
• Information about Meeting Counterparties
  • The audio contained in a sales meeting recording, and the transcripts, summaries and the like generated from it
  • Company name, department, name, job title, contact details and other information entered by the User or derived from the content of the sales meeting
  • Meeting history (date of visit, summary of the meeting, recommended next actions and the like)
  • Information contained in customer lists provided by the Customer
• Information about use of the Service
  • Access logs, usage data, information acquired through cookies and similar technologies, and information about devices and browsers

3.2 How we acquire it

• Entry, registration and recording by Users or Customers in the Service (including the native application and the web application)
• Information provided by the Customer (including imports of customer lists by CSV and similar means)
• Information acquired from the User's device or from external services where the User has granted permission (such as location data and calendar information)
• Information generated from sales meeting audio through analysis by AI
• Information generated and recorded automatically in the course of using the Service (logs, cookies and the like)

4. Purposes of use

We use the personal information we acquire within the scope of the following purposes.

4.1 Our purposes of use

• Providing, maintaining and servicing the Service, and addressing defects
• Analyzing sales meeting audio and generating meeting minutes, analysis results, draft follow-up emails and reports
• Improving the features of the Service and developing new features and services
• Use for improving the quality of the Service (including training AI models; see Section 6 for details)
• Analyzing usage and preparing statistical data (including processing it into a form that cannot identify an individual)
• Billing and payment processing for service fees
• Responding to inquiries and providing support
• Communications necessary for operating the Service, such as important notices
• Responding to legal requirements

4.2 The Customer's purposes of use (where processing takes place under the Customer's control)

• Recording and reviewing sales meetings
• Understanding, analyzing and visualizing the status of sales activities
• Managing the status of dealings with each customer and the next actions
• Coaching and developing Users in their sales activities

Where we change a purpose of use, we do so within a scope that can reasonably be considered to have relevance to the purpose before the change, and we notify or publicly announce the change as necessary.

5. Recording (responsibilities of Users and Customers)

1. Recording in the Service takes place only when a User starts it by operating the application. We do not provide any feature that joins a meeting or call automatically and records it.
2. The responsibility for explaining the recording to the Meeting Counterparty in advance and obtaining their consent rests with the User and the Customer. We obtain the User's consent on this point at their first sign-in.
3. While recording is in progress, the recording indicator prescribed by the operating system of the User's device is displayed. We do not provide any feature that hides this indicator.
4. If we receive an inquiry from a Meeting Counterparty about the handling of recorded audio or other personal information, we accept it at the contact point set out in Section 14 and respond in coordination with the Customer.

6. Analysis by AI, and use for quality improvement (including AI training)

1. We send sales meeting audio to AI services provided by the subcontractors set out in Section 7, and have it analyzed in order to distinguish speakers and to generate meeting minutes, analysis results, draft follow-up emails and reports.
2. In order to improve the accuracy and quality of the Service, we may use sales meeting audio, its transcripts and the information generated from them (collectively, "Meeting Data") to train AI models.
3. Where we use Meeting Data to train AI models, we do so after taking the following measures.
   • Removing, or replacing with other descriptions, names, company names, contact details and other information capable of identifying a specific individual or corporation
   • Excluding a Customer's Meeting Data from training where that Customer so requests
   • Ensuring that, as a result of training, the content of the original sales meeting is not output in a form that is legible to Users belonging to other Customers
4. Requests under item 2 of the preceding paragraph are accepted at the contact point set out in Section 14.
5. We do not create or store identifiers based on voiceprints or other biometric information. Speakers are distinguished in the Service by inference from the content of the conversation; no matching against previously registered audio is performed.
6. We ask Customers not to use analysis results or evaluations produced by the Service as the sole basis for personnel evaluations or other treatment disadvantageous to Users.

7. Subcontracting the handling of personal information

1. We may subcontract all or part of the handling of personal information to external providers (each, a "Subcontractor") to the extent necessary to achieve the purposes of use.
2. Our principal Subcontractors are as follows.
   • Cloud infrastructure and storage of audio files and data: Google LLC (Google Cloud Platform)
   • Analysis of audio and generation of documents by AI: Google LLC (Gemini API)
   • Analysis of app usage: Google LLC (Google Analytics for Firebase)
   • Authentication: the providers of the authentication platform used by the Customer (Microsoft Entra ID, Google Workspace and the like), and the provider of the authentication service we use
   • Delivery of push notifications: Apple Inc., Google LLC and other notification delivery providers
   • Notification integration (where configured by the Customer): Microsoft Corporation (Microsoft Teams)
3. Data sent for analysis by AI is designed to be retained temporarily in that service and then deleted automatically within 48 hours.
4. We exercise necessary and appropriate supervision over Subcontractors, including by entering into agreements with them on the security control of personal information.

8. Provision to third parties

We do not provide personal information to third parties without obtaining the prior consent of the individual, except in the following cases.

• Where required by laws or regulations
• Where necessary to protect the life, body or property of a person and it is difficult to obtain the individual's consent
• Where specially necessary to improve public health or promote the sound growth of children and it is difficult to obtain the individual's consent
• Where cooperation with a national government body or similar is necessary and obtaining the individual's consent is likely to impede the performance of that function
• Where personal information is provided in connection with a succession of business due to a merger or other cause

Provision to the Subcontractors set out in Section 7 does not constitute provision to a third party under the APPI. Likewise, viewing of sales meeting records belonging to a Customer by that Customer's administrators and by Users holding the permissions the Customer defines is use within the Customer and does not constitute provision to a third party.

9. Security control measures

We take the following measures to prevent the leakage, loss or damage of personal information and otherwise to control its security.

• Organizational measures: appointing a person responsible for the handling of personal information, maintaining handling rules, and inspecting the state of handling
• Human measures: training officers and employees, and enforcing confidentiality obligations
• Physical measures: managing the areas and equipment where personal information is handled, and restricting access
• Technical measures: managing access permissions, separating data by Customer, encrypting data at rest, encrypting communications (TLS and the like), and countermeasures against unauthorized access
• Response to leakage and the like: where an incident subject to the reporting requirement for leakage of personal data occurs, we report to the Personal Information Protection Commission and notify the individuals concerned, in accordance with applicable laws and regulations.

10. Requests for disclosure and other actions regarding retained personal data

1. Individuals (including Users and Meeting Counterparties) may request notification of the purpose of use, disclosure, correction, addition or deletion of the content, suspension of use or erasure, and suspension of provision to third parties, in respect of their own personal information that we hold (collectively, a "Request for Disclosure").
2. Requests for Disclosure are accepted at the contact point set out in Section 14. We verify the identity of the requester and respond within a reasonable period in accordance with applicable laws and regulations.
3. Where the Customer is the party that controls the personal information of Users and Meeting Counterparties, we may respond in coordination with the Customer.

11. Cookies and access analysis

1. The Service uses cookies or similar technologies (such as local storage) in order to keep users signed in and otherwise to improve convenience and to provide the Service.
2. For the purpose of analyzing how the Service is used and improving the Service, we use the analysis tool "Google Analytics for Firebase" provided by Google LLC. Through this tool, usage data such as the history of screens displayed in the app, app launch and session events, and device identifiers (not including the advertising identifier) is collected and sent to servers of Google LLC located in the United States. We may associate such data with the user ID we assign. The information collected does not include the audio, transcripts or report text of sales meetings. For the handling of the information collected, please refer to Google's privacy policy (https://policies.google.com/privacy ) and "How Google uses information from sites or apps that use our services" (https://policies.google.com/technologies/partner-sites ).
3. Users may restrict the use of cookies through their browser settings, in which case some features of the Service may become unavailable.

12. Handling of personal information outside Japan

1. In providing the Service we use services provided by companies located in the United States and other countries for the following purposes, and personal data may therefore be handled outside Japan.
   • Analysis of audio and generation of documents by AI: Google LLC
   • Analysis of app usage: Google LLC
   • Authentication: Microsoft Corporation, Google LLC and the like
   • Delivery of push notifications: Apple Inc., Google LLC and the like
2. Where personal data is handled in a foreign country, we take the necessary measures in accordance with the APPI and other applicable laws and regulations, including providing information about that country's system for the protection of personal information. The United States has no federal law that comprehensively regulates the handling of personal information by businesses; we therefore take the measures necessary for the security control of personal data through our agreements with Subcontractors.

13. Retention period

We retain personal information for the period necessary to achieve the purposes of use. The retention period may be set out in the individual terms agreed with the Customer. Where the service agreement ends, or where an individual or a Customer requests deletion, we delete the personal information concerned or process it into a state in which an individual cannot be identified, within a reasonable period, except where a statutory retention obligation applies.

14. Contact point

Inquiries about this Policy, Requests for Disclosure, and complaints and consultations are accepted at the contact point below. This applies not only to Users of the Service but also to anyone whose voice is included in a sales meeting recording.

15. Changes to this Policy

We may revise this Policy in response to changes in laws and regulations or changes to the Service. The revised Policy takes effect when we make it known by posting it on our website or by other appropriate means.