Privacy Policy

art-0-1 株式会社和心Washin Co., Ltd.(hereinafter the "Company") establishes this Privacy Policy (the "Policy") in respect of the handling of personal information in the AI-facing information disclosure platform "IDAEO" (the "Service") provided by the Company. The Service is a platform by which a user structures, publishes and maintains factual information concerning its own business in a form that AI systems can accurately read and cite. This single document serves both as the matters to be published under the Act on the Protection of Personal Information of Japan (the "Japan APPI") and as the matters to be notified under 第8條 of the Personal Data Protection Act of Taiwan (the "Taiwan PDPA").

art-1-1 This Policy applies to all personal information handled by the Company in connection with the provision of the Service. Although users of the Service are limited to business entities, this Policy applies to every data subject, including the officers, employees and other individuals of a user, and the representatives and other individuals of establishments whose information the Company obtains under Article 2(3).

art-1-2 The business operator handling personal information is as follows. Trade name: Washin Co., Ltd. (株式会社和心) / Corporate number: 8011401020677 / Address: 〒107-0061 東京都港区北青山一丁目3番1号 アールキューブ青山3階 / Name of representative: 竹の内 馨, Representative Director / Contact point for enquiries and complaints concerning personal information: idaeo@idaeo.ai. This paragraph corresponds to 第8條第1項第1款 of the Taiwan PDPA (name of the non-government agency).

art-1-3 The Company has not been able to identify any express official position as to whether the Japan APPI applies where the Company, a Japanese corporation, handles the personal information of data subjects located solely outside Japan. Regardless of whether it applies, the Company handles personal information as set out in this Policy.

art-1-4 The provisions of this Policy corresponding to 第8條第1項各款 of the Taiwan PDPA are set out in 附表 1.

art-2-1 Information obtained directly from a user: company or establishment name, contact person's name, department and title, e-mail address, telephone number, billing address, login identifiers and authentication credentials, and the contents of enquiries and customer reports. As this information is obtained through an application screen or other document (including electronic records), the Company expressly states the purpose of use in advance (Japan APPI, 第21条第2項).

art-2-2 Third-party information provided to the Company by a user: personal information of third parties (a user's customers, patients, job applicants, employees and the like) contained in materials, drafts, images and other content that the user uploads or enters into the Service. The Company handles such information on the premise that the user has already completed the statutory notification, consent and other procedures owed to the data subject. Information that a user provides to the Service for the purpose of publication (including the names, titles, qualifications and achievements of officers and employees) is handled on the premise that it will be published as set out in Article 6(4) of the Terms of Service; the Company publishes it and permits its retrieval by search engines and generative AI. A user must not provide to the Service, without the Company's prior written approval, special care-required personal information under the Japan APPI or the personal data specified in 第6條第1項 of the Taiwan PDPA (medical records, healthcare, genetic information, sex life, health examination and criminal records).

art-2-3 Information obtained from public sources (obtained other than from the data subject): the name, address, telephone number and website of an establishment, the name of its representative or responsible person, establishment identifiers contained in government open data, and other publicly available establishment information. Under 第9條 of the Taiwan PDPA, the Company notifies the data subject, before processing or use, of the source of the personal data and of the matters listed in 第8條第1項第1款 to 第5款 of that Act; under 同條第3項, that notification may be given together with the first use directed at the data subject. Where government open data is used, the Company displays the attribution statement required by the Open Government Data License. The list of sources is set out at https://idaeo.ai/legal/sources.

art-2-4 Information collected automatically: identifiers transmitted by cookies and similar technologies, IP addresses, browser and device type, referring URL, pages viewed, dates and times of operations, and access logs. Their handling is set out in Article 9.

art-3-1 The Company uses the personal information it obtains for the following purposes: (i) providing the Service, creating and administering accounts and verifying contact persons; (ii) invoicing, payment and receipt of fees and management of arrears; (iii) intermediation to the extent necessary for payment on behalf (代理支払) and user administration by a Partner; (iv) responding to enquiries, customer reports and requests to exercise data subject rights; (v) calculating visibility indicators and providing reports and visualisation outputs to users; (vi) creating generated content and publishing it on the user's instructions; (vii) structuring, publishing and maintaining factual information on the user's instructions (Article 11) and, limited to the information referred to in Article 2(3), displaying public establishment information pages and aggregations of already-published information (Article 12); (viii) improving the quality of the Service, investigating defects and statistical analysis (carried out after processing the data into a form from which individuals cannot be identified); (ix) providing notices and information about the Service by e-mail; and (x) performing statutory obligations, handling disputes and preventing improper use. This paragraph corresponds to 第8條第1項第2款 of the Taiwan PDPA (purpose of collection).

art-3-2 The specific purposes under the Taiwan PDPA are the following codes designated in the "Specific Purposes and Classification of Personal Data under the Personal Data Protection Act": 040 marketing; 063 collection, processing and use of personal data by a non-government agency pursuant to a statutory obligation; 069 contractual, quasi-contractual or other legal relationship matters; 090 consumer and customer management and service; 091 consumer protection; 104 account management and receivables transactions; 136 information and communications and database management; 148 online shopping and other electronic commerce services; 152 advertising or commercial conduct management; 157 survey, statistics and research analysis; and 182 other advisory and consultancy services.

art-3-3 The classifications of personal data handled are the following codes in the same schedule: C001 identifiers of an individual; C002 financial identifiers; C003 identifiers in government records; C011 personal description; and C038 occupation. This paragraph corresponds to 第8條第1項第3款 of the Taiwan PDPA (classification of personal data).

art-3-4 The period, territory, recipients and means of use of personal data are as follows. Period: the retention periods set out in Article 8. Territory: the countries or regions listed in the schedule in Article 6(1). Recipients: the recipients and entrusted parties listed in Articles 4 and 5. Means: electronic processing, storage, access, transmission, publication and display (the scope of and destinations for publication are set out in Article 11). This paragraph corresponds to 第8條第1項第4款 of the Taiwan PDPA.

art-3-5 Where the data subject may choose whether to provide personal data, the effect of not providing it is as follows. If the information referred to in Article 2(1) is not provided, the Company cannot open an account, invoice fees or provide the Service. As regards the information referred to in Article 2(4) that is not strictly necessary for the provision of the Service, the basic functions of the Service remain available if it is not provided, although certain functions may become unavailable. This paragraph corresponds to 第8條第1項第6款 of the Taiwan PDPA.

art-3-6 Where the Company changes a purpose of use, it does not do so beyond the scope that can reasonably be regarded as having relevance to the purpose of use before the change (Japan APPI, 第17条第2項). A change beyond that scope is made only with the prior consent of the data subject. Under 第20條第1項 of the Taiwan PDPA, the Company uses personal data within the scope necessary for the specific purpose of collection.

art-3-7 As regards the notices referred to in Article 3(1)(ix), if a data subject expresses refusal to receive them, the Company immediately ceases using that data subject's personal data for marketing. The Company provides a means of refusal at the time of the first marketing communication and bears the costs required for it (Taiwan PDPA, 第20條第2項及第3項).

art-4-1 The Company does not provide personal data to a third party without the prior consent of the data subject, except where: (i) required by law; (ii) it is necessary for the protection of a person's life, body or property and it is difficult to obtain the consent of the data subject; (iii) the provision accompanies an entrustment under Article 5; or (iv) the provision accompanies a succession of business by merger or other cause.

art-4-2 Provision to Partners. For the purposes of a user's application, payment on behalf and user administration, the Company provides a Partner with the user's company name, contact person's name, e-mail address, telephone number, contract details and billing status. To the extent that the Partner handles such information at its own discretion, that provision constitutes provision to a third party under 第27条 of the Japan APPI. The Company obtains the prior consent of the data subject for this provision at the time of application. Where the Partner is located outside Japan, Article 6 also applies.

art-4-3 The Company does not provide personal data to third parties on an opt-out basis under 第27条第2項 of the Japan APPI.

art-4-4 Displaying information obtained under Article 2(3) on public establishment information pages and as aggregations of already-published information constitutes use under 第20條第1項 of the Taiwan PDPA in respect of those parts of the information that constitute personal data. Such display is an aggregation of information that has already been published and is not an evaluation by the Company of the user or the establishment. The procedure for objection, correction and deletion in respect of such display is set out in Article 12.

art-5-1 The Company may entrust the handling of personal data to external parties within the scope necessary to achieve the purposes of use. The categories of entrusted parties are: (i) cloud infrastructure providers; (ii) payment processing providers; (iii) providers of e-mail delivery and customer support tools; (iv) providers of generative AI and other external APIs; and (v) Partners (where they carry out user administration and payment-on-behalf matters within the scope of the Company's instructions). The names and countries of entrusted parties are as set out in 附表 2 (cloud infrastructure: Cloudflare, Inc. (United States) and Amazon Web Services, Inc. (United States; data is stored in the Japan region) / payment processing: Stripe, Inc. (United States) / e-mail: Google LLC (United States) / generative AI and external APIs: OpenAI, L.L.C. (United States), Google LLC (United States) and Anthropic, PBC (United States) / Partners: the Company's agents and resellers located in Taiwan).

art-5-2 The Company concludes with each entrusted party a contract containing the following matters and exercises appropriate supervision (台灣個資法施行細則第8條第2項): (i) the scope, classification, specific purpose and period of the personal data to be collected, processed or used; (ii) the measures taken by the entrusted party under 同細則第12條第2項; (iii) where there is sub-entrustment, the agreed sub-entrusted party; (iv) the matters to be notified to the entrusting party and the remedial measures to be taken where the entrusted party or its employees breach the Personal Data Protection Act, other personal data protection laws or their subordinate regulations; (v) where the entrusting party reserves instructions to the entrusted party, the matters so reserved; and (vi) upon termination or rescission of the entrustment relationship, the return of the media carrying the personal data and the deletion of personal data held by the entrusted party by way of storage in performing the entrustment contract.

art-5-3 In respect of the supervision under the preceding paragraph, the Company periodically confirms the entrusted party's performance and records the results of such confirmation (台灣個資法施行細則第8條第3項).

art-5-4 Where the Company is entrusted by another business operator with the handling of personal data, the Company collects, processes or uses that personal data only within the scope instructed by the entrusting party. If the Company considers that such an instruction breaches the Personal Data Protection Act, other personal data protection laws or their subordinate regulations, it immediately notifies the entrusting party (台灣個資法施行細則第8條第4項).

art-5-5 Whether the Company constitutes the "entrusting party" or the "entrusted party" under 台灣個資法施行細則第8條 (in the latter case a Partner would be a sub-entrusted party) may differ according to the type of contract. The Company takes the measures set out in the preceding paragraphs under either characterisation.

art-5-6 Under 第25条 of the Japan APPI, the Company exercises necessary and appropriate supervision over entrusted parties to ensure the security control of personal data. Where an entrusted party is located in a foreign country, Article 6 also applies.

art-6-1 The third parties in foreign countries to which the Company provides personal data, and the countries in which they are located, are set out in "附表 2: List of Transferees" following this Article. That schedule also serves as the disclosure of the "territory" and "recipients" required by 第8條第1項第4款 of the Taiwan PDPA.

art-6-2 Taiwan is not included among the foreign countries designated by rules of the Personal Information Protection Commission under 第28条第1項 of the Japan APPI as having a personal information protection system recognised to be at a level equivalent to that of Japan (only the European Economic Area and the United Kingdom are so designated). Accordingly, for provision of personal data to a Partner located in Taiwan, the Company takes one of the following measures: (i) obtaining in advance the data subject's consent to provision to a third party in a foreign country; or (ii) establishing a system with that third party. The route adopted is the system-establishment route under item (ii). The Company concludes with each Partner located in Taiwan a contract containing the matters set out in Article 5(2) and confirms its implementation status at least 1 time per year. This does not preclude the Company from also obtaining the consent under item (i) at the time of application.

art-6-3 Where the Company seeks the consent referred to in the preceding paragraph, item ①, it provides the data subject in advance with (a) the name of the foreign country, (b) information on the personal information protection system in that foreign country obtained by appropriate and reasonable means, and (c) information on the measures taken by the third party for the protection of personal information (Japan APPI 第28条第2項; 同法施行規則第17条第2項). Where the country cannot be identified, the Company provides that fact and the reason; where it cannot provide information on the third party's measures, it provides that fact and the reason (同規則第17条第3項及び第4項).

art-6-4 Where the Company adopts the system-establishment route under paragraph 2(ii), it establishes with that third party, by appropriate and reasonable means, a system ensuring the implementation of measures consistent with the purport of 日本個情法第4章第2節 (同法施行規則第16条第1号). In that case the Company periodically confirms the third party's implementation of equivalent measures, takes necessary and appropriate measures where an impediment arises, and suspends the provision of personal data where it becomes difficult to ensure the continued implementation of those measures (同規則第18条第1項). The Company also provides, at the data subject's request, the method of system establishment, an outline of the equivalent measures, the frequency and method of confirmation, the name of the foreign country, whether that country has a protection system and its outline, whether any impediment exists and its outline, and an outline of the measures taken by the Company (同規則第18条第3項).

art-6-5 Use of cloud services. Where a business operator in a foreign country that operates a server is, by contractual provisions, not to handle the personal data stored on that server, and the Company exercises appropriate access control, such storage does not constitute "provision to a third party in a foreign country". Even so, the Company ascertains the personal information protection system and related circumstances of that foreign country and takes necessary and appropriate measures for security control (Article 7(6)). This treatment is limited to cases where the foreign business operator does not handle the personal data, and cannot be relied on where a Partner actually views the personal data.

art-6-6 Under 第21條 of the Taiwan PDPA, the competent authority may in certain cases restrict the international transmission of personal data by a non-government agency. As at the date of this Policy, the Company has not been able to identify any currently effective public notice under that Article restricting transmission to Japan. The fact that none has been identified does not mean that no such restriction exists or that there is no risk. Separately, 勞動部 112 年 2 月 20 日 勞動發管字第 1120500319A 號公告, issued under 同條第3款, restricts manpower agencies (private employment services institutions permitted under 就業服務法第34條 and the like) from transmitting data subjects' personal data internationally to mainland China. That notice is addressed to those institutions and does not include the Company. As a result of the Company's inventory, none of the Service's data, CDN, backups or external APIs is located in mainland China (see 附表 2).

art-7-1 The Company takes necessary and appropriate measures for the security control of the personal data it handles, including the prevention of leakage, loss or damage (Japan APPI, 第23条). Under the Taiwan PDPA the Company likewise adopts appropriate security measures to prevent personal data from being stolen, altered, damaged, lost or disclosed.

art-7-2 Organisational security control measures: the Company designates the Representative Director as the person responsible for the handling of personal data, establishes handling rules, and inspects the handling status at least 1 time per year. The framework to be described comprises the appointment of a person responsible for the handling of personal data, the establishment of handling rules, and arrangements for inspection and audit of handling status.

art-7-3 Human security control measures: the Company imposes confidentiality obligations on the employees and entrusted parties who handle personal data and provides periodic training. The framework to be described comprises training of personnel and the imposition of confidentiality obligations.

art-7-4 Physical security control measures: personal data is stored on access-controlled cloud infrastructure, encryption and screen locking are mandatory on the Company's devices, and the removal of recording media is restricted. The framework to be described comprises the management of equipment and recording media and the prevention of leakage when they are carried.

art-7-5 Technical security control measures: the Company grants access rights according to role, uses multi-factor authentication, encrypts communications with TLS, encrypts stored data, records access logs and monitors for unauthorised external access. The framework to be described comprises access control, identification and authentication of persons accessing data, encryption of communications, and prevention of unauthorised external access.

art-7-6 Ascertainment of the external environment. Where the Company handles personal data in a foreign country, it ascertains the personal information protection system and related circumstances of that country and then takes necessary and appropriate measures for security control. The names of those countries are set out in 附表 2.

art-7-7 Where a leakage or similar incident involving personal data occurs, the Company notifies the data subject and, where the incident falls within a reporting scope prescribed by law, reports it to the competent authority. The Company takes immediate and effective response measures and retains records describing the relevant facts, the impact and the measures taken.

art-8-1 The Company retains personal data only for the period necessary to achieve the purposes of use and, after that period, deletes it or processes it into a form from which individuals cannot be identified. The retention period for each category of information is [TBC: 情報の種類ごとの具体的保存日数].

art-8-2 Where a user ceases to use the Service, the Company deletes from its systems the personal data that the user provided to the Service within 90 days; however, where (i) retention is required by law, or (ii) the user and the Company have separately agreed otherwise in writing, the Company retains the data beyond that period.

art-8-3 Under 第11條第3項 of the Taiwan PDPA, where the specific purpose of collection ceases to exist or the period expires, the Company, on its own initiative or at the data subject's request, deletes the personal data or ceases processing or using it, except where this is necessary for the performance of its duties or business or where the data subject has consented in writing.

art-8-4 Where a statutory retention obligation applies, the data is retained for the period prescribed by that obligation notwithstanding the preceding three paragraphs. The applicable retention obligations are the retention of books, documents and electronic transaction data under the Corporation Tax Act and the Electronic Books Preservation Act (7 years), the retention of entrusting-party information under 就業服務法第41條 (2 months), and other retention obligations under the laws applicable to the Company. 就業服務法第41條 imposes on a person who is entrusted with publishing or disseminating a job vacancy advertisement an obligation to retain the entrusting party's information for 2 months; whether the Company's generated content constitutes a job vacancy advertisement under that Article is an open issue listed in Section ③.

art-9-1 The Service uses cookies and similar technologies for the following purposes: (i) maintaining login status and other processing strictly necessary for the provision of the Service; (ii) statistical understanding of usage and quality improvement; and (iii) measuring advertising effectiveness.

art-9-2 A data subject may refuse to accept cookies through browser settings. In that case, certain functions of the Service may become unavailable.

art-9-3 Publication concerning external transmission. For those parts of the Service intended to make information available for viewing by unspecified users (public establishment information pages, ranking display pages and published articles), the Company publishes, for each information-transmission instruction communication, (i) the content of the user-related information to be transmitted, (ii) the name of the person who will handle that information using the telecommunications facilities to which it is transmitted, and (iii) the purpose of use of that information, pursuant to 電気通信事業法第27条の12. The published content is set out on the "Publication concerning External Transmission" page (/legal/external-transmission). Under 同法施行規則第22条の2の28第1項第1号, that publication is made in Japanese.

art-9-4 This Policy and the publication page referred to in the preceding paragraph cross-refer to each other, and the content of neither replaces the other.

art-10-1 Under the Japan APPI, a data subject may request notification of the purposes of use of retained personal data, disclosure (including disclosure of records of provision to third parties), correction, addition or deletion of its content, cessation of use or erasure, and cessation of provision to third parties. "Disclosure" in this Article means the disclosure of retained personal data in response to a data subject's request, and is distinct from the information disclosure (publication) by the Service set out in Article 11.

art-10-2 Under 第3條 of the Taiwan PDPA, a data subject has the following rights, which may not be waived in advance or restricted by special agreement: (i) to make enquiries or request review; (ii) to request a copy; (iii) to request supplementation or correction; (iv) to request cessation of collection, processing or use; and (v) to request deletion. This paragraph corresponds to 第8條第1項第5款 of the Taiwan PDPA.

art-10-3 How to exercise. Please send your request to idaeo@idaeo.ai stating the content of the request, information sufficient to verify your identity, and your contact details. The Company responds after verifying that you are the data subject or the data subject's agent.

art-10-4 Response deadlines (Taiwan PDPA, 第13條). For requests under paragraph 2(i) and (ii), the Company decides whether to grant or refuse the request within 15 days and, where necessary, may extend that period by no more than a further 15 days, notifying the requester of the reason in writing. For requests under paragraph 2(iii), (iv) and (v), it decides within 30 days and, where necessary, may extend by no more than a further 30 days, notifying the reason in writing.

art-10-5 Fees. The Company may charge the necessary cost for enquiries, review or the provision of copies (Taiwan PDPA, 第14條). No fee is charged. However, for the provision of copies, the Company may charge postage and other actual expenses.

art-10-6 Where a request cannot be granted. Where a ground prescribed by law applies, the Company may refuse the request, stating its reasons. 第10條 of the Taiwan PDPA provides exceptions to enquiry, review and provision of copies where these would prejudice national security, diplomatic or military secrets, overall economic interests or other major national interests; prejudice a government agency's performance of its statutory duties; or prejudice a major interest of the collecting agency or a third party.

art-10-7 The contact point for complaints is [TBC: 苦情の申出先（第1条第2項の窓口と異なる場合）]. Whether the Company is a target business operator of an accredited personal information protection organisation is [TBC: 認定個人情報保護団体の対象事業者であるか否か].

art-11-1 The Service is a platform by which a user structures, publishes and maintains factual information concerning its own business in a form that AI systems can accurately read and cite. Accordingly, of the information a user enters into or provides to the Service, the information listed in paragraph (2) of this Article is handled on the premise that it will be published. This Article sets out, where such information contains personal information, the scope of publication, the destinations of publication, and the procedure for correction and suspension of publication ("withdrawal"). The user's obligations as to the truthfulness, accuracy and updating of the information it publishes, and the provisions on requests for correction and withdrawal, are placed in the Terms of ServiceArticles 7 and 8; this Article refers to that same procedure and does not establish a separate one.

art-11-2 The information published on the user's instructions is as follows: (i) the name, address, contact details, business hours and other factual information concerning the location of and contact with the establishment; (ii) the content of the services or goods offered, the fields handled and other factual information concerning the content of the business; (iii) qualifications, licences, registration numbers and other official indications, where the user has entered them as items for publication; (iv) the names and titles of representatives, responsible persons and other contact persons, where the user has entered them as items for publication; (v) images and other materials uploaded by the user to the Service, where the user has designated them for publication; (vi) generated content created on the basis of the information in the preceding items, where the user has approved its publication; and (vii) data structuring the information in the preceding items into a machine-readable form.

art-11-3 The following information is not published: (i) login identifiers and authentication credentials; (ii) billing addresses and other information concerning payment and fees; (iii) the content of enquiries and customer reports; (iv) the information referred to in Article 2(1) that the user has not entered as an item for publication; and (v) the information referred to in Article 2(4). The Company handles such information only within the scope of the purposes of use set out in Article 3.

art-11-4 The destinations of publication of the information referred to in paragraph (2) of this Article are as follows: (i) the public pages of the Service (establishment information pages, article pages and pages displaying rankings and the like); (ii) those websites operated by the Company on which such information is posted, a list of which is set out in [TBC: 公開先ドメインの一覧]; (iii) search engines, AI crawlers and other automated programs that retrieve the pages referred to in the preceding two items; and (iv) AI platforms and other third parties that obtain the information through the preceding item. The Company does not actively transmit such information beyond the scope set out in item (ii); the pages referred to in items (i) and (ii), however, are by their nature placed in a state in which unspecified persons and automated programs can retrieve them.

art-11-5 Published information may be copied by the third parties referred to in items (3) and (4) of the preceding paragraph into their caches, indexes, datasets, training data and other records. The Company has no relationship of direction or control over such third parties and, even after the Company has suspended publication, cannot guarantee that it can obtain the deletion of copies remaining with third parties or cause an AI platform to cease citing the information in its answers. Users and data subjects shall give instructions for publication only on the understanding of this point.

art-11-6 A user may at any time correct or withdraw the information referred to in paragraph (2) of this Article through the administration screen of the Service. Where this cannot be done through the administration screen, users and data subjects may request correction or withdrawal atidaeo@idaeo.ai. The procedure for objection, correction and deletion in respect of information concerning establishments that have no contractual relationship with the Company is set out in Article 12.

art-11-7 The Company acknowledges receipt within [TBC: 訂正・取下げ請求の受領確認までの期限（営業日数）] of receiving a request under the preceding paragraph and processes it within [TBC: 訂正・取下げの完了期限]. The measures the Company takes on a withdrawal are: (i) deletion of the information from the Company's public pages; (ii) removal from the sitemap and from structured data; and (iii) [TBC: 検索エンジン及び AI クローラーに対する再取得要請の可否及び方法]. For requests to which the time limits under 第13條 of the Taiwan PDPA apply, those time limits prevail. The data subject rights set out in Article 10 may be exercised without going through the procedure in this Article.

art-11-8 The Company does not itself verify the truthfulness, accuracy or currency of the information a user instructs it to publish. Nor does the Company verify that the user satisfies the qualifications, licences or other requirements indicated in such information. Where published information ceases to be true or becomes inaccurate, the user is obliged to correct it or take it down without delay (Terms of ServiceArticles 7 and 8). Where a third party submits a request for correction, the treatment set out in Article 12(4) and (7) applies mutatis mutandis.

art-11-9 Where the contract terminates, the Company deletes the user's personal data in accordance with Article 8(2). Content already published is treated as follows: (i) business information (factual information concerning the legal entity — the name, address, business items and service content of the establishment, and the body text of articles already published) may continue to be posted after termination under the Terms of Service; (ii) information that constitutes personal data (the names of natural persons and personal contact details) does not fall within the scope of the authorisation to continue posting under the preceding item, and is deleted, or processed into a form from which individuals cannot be identified, in accordance with this Policy; (iii) the processing under the preceding item is carried out by deletion, partial masking, replacement or another appropriate method, and the Company selects the method according to the circumstances of the individual case; and (iv) where retention is required by law, that law applies. Where the continued posting under item (i) and the processing under item (ii) cannot both be satisfied, item (ii) prevails; in that case, business information that could otherwise have continued to be posted under item (i) may also be deleted in the course of the processing under item (ii). A user may request withdrawal upon termination of the contract.

art-12-1 The Company may, in the Service, obtain from public sources and display information concerning establishments with which it has no contractual relationship.

art-12-2 The Company does not verify whether such establishments hold any qualification, licence or registration. The visibility indicators displayed are estimates calculated by the Company using its own methods, and the Company does not warrant their accuracy.

art-12-3 A data subject (an establishment's representative or other individual) may request the Company to cease display, or to correct or delete the information. Requests are accepted by e-mail to idaeo@idaeo.ai.

art-12-4 第19條第1項第7款 of the Taiwan PDPA permits the collection or processing of personal data obtained from publicly available sources, subject to the proviso "unless the data subject has an overriding interest, manifestly more deserving of protection, in prohibiting the processing or use of such data". Under 同條第2項, where the Company becomes aware, or is notified by the data subject, of such a prohibition, it deletes the personal data or ceases processing or using it, on its own initiative or at the data subject's request.

art-12-5 Processing deadlines and notification of outcome. The Company acknowledges receipt of a request within 5 business days of receiving it and notifies the requester of the outcome within 30 days. For requests to which the deadlines in 第13條 of the Taiwan PDPA apply, those deadlines prevail.

art-12-6 The Company records the date of receipt, the content of the request, the course of handling and the outcome, and retains those records for 3 years.

art-12-7 Notifications of infringement of copyright, trade marks or other rights are handled in accordance with the preceding paragraphs, mutatis mutandis. The contact point is idaeo@idaeo.ai. The Company may forward the content of a notification to the person who provided the information concerned.

art-13-1 The Company may amend this Policy. Where a material change is made, the Company posts the content of the change and its effective date on the Service at least 30 days before that effective date.

art-13-2 For users with a paid contract, the amended Policy applies from their next contract renewal date.

art-13-3 Formal changes made to reflect amendments to laws and changes that do not disadvantage users may take effect from the time of posting, without regard to the preceding two paragraphs.

art-13-4 Version synchronisation. The Japanese version of this Policy is the original text. An amendment becomes a version only after three stages: (i) amendment of the Japanese version; (ii) synchronised translation of the traditional Chinese, simplified Chinese and English versions; and (iii) clause-by-clause reconciliation across the four languages. A language version whose synchronisation is not complete is marked "updating". Article and paragraph numbers and anchors follow the Japanese version, and translations do not add to, remove from or merge them.

art-14-1 This Policy is governed by the laws of Japan.

art-14-2 The Tokyo District Court has exclusive agreed jurisdiction over disputes concerning this Policy.

art-14-3 Where there is any discrepancy between the language versions of this Policy, the original-language version of this Policy applies in priority. Language versions other than the Japanese version are reference translations.

art-14-4 Matters not provided for in this Policy are governed by the Terms of Service and the Subscription Terms. Matters concerning fees are set out in the Subscription Terms; matters concerning the content of the Service, limitation of liability and termination are set out in the Terms of Service.

art-15-1 附表 1: Correspondence between the notice items under Article 8, paragraph 1 of the Taiwan PDPA and the provisions of this Policy. The notice items required by each subparagraph of Article 8, paragraph 1 of the Taiwan PDPA are set out in the following provisions of this Policy: (1) Subparagraph 1 (name of the non-government agency): Article 1, paragraph 2. (2) Subparagraph 2 (purpose of collection): Article 3, paragraphs 1 and 2. (3) Subparagraph 3 (categories of personal data): Article 2, paragraphs 1 to 4, and Article 3, paragraph 3. (4) Subparagraph 4 (period, area, recipients and manner of use): period in Article 8; area and recipients in Article 6, paragraph 1 and 附表 2; manner in Article 3, paragraph 4; scope and recipients of publication in Article 11, paragraphs 2 to 5. (5) Subparagraph 5 (rights exercisable under Article 3 and the manner of exercise): Article 10, paragraphs 2 to 6. (6) Subparagraph 6 (effect on the data subject's rights of not providing data where provision is optional): Article 3, paragraph 5. (7) Article 9, paragraph 1 of the same Act (notice of the source of personal data collected indirectly): Article 2, paragraph 3.

art-15-2 附表 2: List of Transferees (referred to in Article 6, paragraph 1 and Article 7, paragraph 6). The third parties located in foreign countries to which the Company provides personal data or entrusts its handling, their countries, the information provided and the legal basis are as follows: (1) Cloud infrastructure: Cloudflare, Inc. (United States) and Amazon Web Services, Inc. (United States; data is stored in the Japan region). Information: all personal data handled in the Service. Basis: entrustment (Article 6, paragraph 5). (2) Payment processing: Stripe, Inc. (United States). Information: contact person's name, e-mail address, billing information and payment-related information. Basis: entrustment. (3) E-mail delivery and customer support: Google LLC (United States). Information: contact details and inquiry contents. Basis: entrustment. (4) Generative AI and external APIs: OpenAI, L.L.C. (United States), Google LLC (United States) and Anthropic, PBC (United States). Information: input information used to create Generated Content. Basis: entrustment. (5) Partners (agents and resellers): the Company's agents and resellers located in Taiwan. Information: the User information listed in Article 4, paragraph 2. Basis: third-party provision and/or entrustment (Article 4, paragraph 2 and Article 6, paragraph 2).