Forple Privacy Policy

Last Updated: September 6, 2026 Effective Date: September 6, 2026

Important Notice Regarding Language: The original and legally binding version of this Privacy Policy is written in Japanese. This English translation is provided for reference purposes only. In the event of any inconsistency or discrepancy between the Japanese version and this English translation, the Japanese version shall prevail.

Forple, Inc. (hereinafter referred to as "the Company") hereby establishes this Privacy Policy (hereinafter referred to as "this Policy") regarding the handling of personal information in the community platform "Forple" (hereinafter referred to as "the Service").

The Company complies with the Act on the Protection of Personal Information of Japan (hereinafter referred to as "APPI") and other related laws and regulations, and handles Users' personal information appropriately.

Article 1 (Information We Collect)

1.1 Information Provided Directly by Users

Account Information: Email address, display name, date of birth (for age verification)
Profile Information: Profile photo, biography, headline, gender, location (country and city)
Professional Information: Current occupation, company name, work history, education, skills, qualifications and licenses
Language Information: Languages used and proficiency levels
Work Authorization Information: Type of work visa, expiration date, presence of work restrictions, need for sponsorship
User Content: Discussion posts, learning recipes, comments, questions, answers, reactions
Media: Profile photos, images and videos attached to posts

1.1b Visa Check Responses (collected before registration)

Through the "visa check" on our website, the Company collects the following information whether or not you have an account.

Your answers: what you want to find out (which status you could get, renewing, an expiring card, or permanent residency), nationality, age range, current residence status and period, Japanese ability, education, occupation and field, income band, where you live (prefecture), and family situation
The result: the verdict, the reasons and cautions shown, and the next actions listed
Survey responses: the optional survey after the check, including free text
Technical information: a random string identifying the check session (stored in your browser) and a hashed IP address (to prevent abuse; the raw IP address is not stored)

The check can be used without giving your name or email address. If you only use the check, the Company cannot connect your answers to you as an individual.

However, if you create an account after the check, or post a question to "Ask" from the result, the Company links that check session to your account. From then on, those answers are treated as personal information belonging to that account.

1.2 Sensitive Personal Information

The Company may collect the following information. These may constitute "Special Care-Required Personal Information" under the APPI and are collected and used only with the User's explicit consent.

Nationality: As part of profile information and visa check responses
Residency Status (Visa) Information: As part of work authorization information and visa check responses

The Company will not obtain sensitive personal information such as race, creed, medical history, or criminal record without the User's explicit consent, except as provided by law.

1.3 Information Collected Automatically

Device Information: Device model, OS name and version, app version, unique device identifiers
Push Notification Tokens: Device identifiers necessary for notification delivery (Expo Push Token)
Usage Data: View counts, voting data, notification read status, feature usage frequency
Error and Crash Logs: Log data for the purpose of improving app stability (via Sentry)
Access Logs: IP address, access date and time, request content (when using the web version)

1.4 Cookies and Tracking Technologies

The Company may use the following cookies and similar technologies on the website (https://www.for-ple.com and related subdomains):

Essential Cookies: Cookies that are indispensable for the provision of the Service, such as maintaining login status and security measures. These cannot be disabled.
Analytics Cookies: Cookies used to analyze service usage and contribute to improvements. The Company uses Google Analytics (provided by Google LLC) as its access analysis tool. Google Analytics uses cookies to collect website usage information (pages viewed, time spent, approximate region, etc.) in a form that does not identify individuals. Collected information is managed under Google's Privacy Policy (https://policies.google.com/privacy). Users can disable data collection with the Google Analytics Opt-out Add-on (https://tools.google.com/dlpage/gaoptout).
Functional Cookies: Cookies used to remember User settings (such as language selection).
Advertising Cookies: The Company may display advertisements served by third-party vendors (Google) on the website. Third-party vendors, including Google, use cookies to serve ads based on a user's prior visits to this website or other websites.

Additional notes on advertising cookies:

Users may opt out of personalized advertising by visiting Google's Ads Settings (https://adssettings.google.com/). Users may also opt out of third-party vendors' use of cookies by visiting www.aboutads.info.
For details on how Google uses data, please see "How Google uses information from sites or apps that use our services" (https://policies.google.com/technologies/partner-sites).
Users in the European Economic Area (EEA), the United Kingdom, and Switzerland will be shown a consent message via a consent management tool before advertisements are displayed.

Users can disable cookies other than Essential Cookies through their browser settings. However, some features may not function properly.

1.5 Information Obtained from Third Parties

Information related to the inviting User obtained through Invitation Codes (inviter's User ID, invitation date and time).

Article 2 (Purposes of Use)

The Company uses collected information for the following purposes:

Provision, operation, and maintenance of the Service
Authentication and management of User accounts
Display of User profiles (based on visibility settings)
Display, search, and sorting of Content
Delivery of push notifications
Content moderation (detection of inappropriate content)
Service improvement and development of new features
Creation of statistical data (in a non-personally identifiable format)
Prevention of fraudulent use and ensuring security
Response to violations of the Terms of Service
Compliance with applicable laws (including reporting to the Personal Information Protection Commission)
Responding to User inquiries
Delivery and display of advertisements (including those served by third-party vendors)
Producing and displaying visa check results and the next actions
Producing and analysing statistics from check responses after processing them so that individuals cannot be identified (for example, trends in difficulties by residence status, or distribution by region). Such statistics are used to improve the Service, to understand the problems foreign residents face in Japan, and to explain our business. Any disclosure to third parties is limited to statistical information from which individuals cannot be identified.

The Company will not handle personal information beyond the scope necessary to achieve the purposes of use described above. If the purposes of use are changed, the Company will publish or notify Users of the revised purposes.

Article 3 (Data Processing by AI Features)

The Service does not currently process User Content with AI.

The visa check does not use AI at all — neither for the verdict nor for the next actions. Both are produced mechanically from rules written by the Company. Your check responses and the verdict are not sent to any third party, including any AI provider.

Content you post is not put through AI translation, moderation or any other automated processing either.

If the Company introduces an AI feature in future, this Policy will state what data is sent, to whom and for what purpose, and Users will be notified in advance by the method set out in Article 10 (Changes to This Policy).

(History: until 8 September 2026 the Company used an AI provider (Anthropic PBC) for content translation and moderation, and — between 7 and 8 September 2026 only — to write the action plan from a check result. Names and email addresses were never sent. Both were retired on that date.)

Article 4 (Sharing and Third-Party Disclosure of Information)

4.1 User Profile Visibility

Users can set the visibility of their profile information at three levels:

"Public": Viewable by everyone
"Community": Viewable only by logged-in Users
"Private": Viewable only by the User themselves

4.2 External Service Providers

The Company uses the following external services for the provision of the Service. User data may be transmitted to these services.

| Service Name | Location | Purpose | Data Transmitted | |---|---|---|---| | Supabase, Inc. | United States | Database hosting, user authentication, file storage | Account information, profile information, Content, media files |

The Company has entered into data processing agreements with each external service provider and has implemented appropriate security measures.

4.3 Compliance with External Transmission Regulations

In accordance with Article 27-12 of Japan's Telecommunications Business Act, the Company discloses information about data transmitted from Users' devices to external servers as described in Section 4.2 above.

4.4 Disclosure Based on Laws and Regulations

The Company may disclose User information in the following cases:

When required by laws and regulations
When there is a request based on laws and regulations from courts, prosecutors' offices, police, tax authorities, bar associations, consumer centers, or other administrative agencies
When necessary for the protection of life, body, or property, and it is difficult to obtain the User's consent
When particularly necessary for improving public health or promoting the healthy development of children
When necessary for a national agency to carry out duties prescribed by law

4.5 Business Succession

User information may be transferred to a successor in connection with the succession of the Company's business (merger, division, business transfer, etc.). In such cases, the successor shall handle personal information in accordance with this Policy.

Article 5 (International Data Transfers)

5.1 Destination Countries

The Service is operated from within Japan; however, as described in Article 4, User information may be processed and stored on servers in the United States, as external service providers are located in the United States.

5.2 Personal Information Protection System in the United States

There is no comprehensive federal law on personal information protection in the United States. However, sector-specific regulations (HIPAA, COPPA, CCPA/CPRA, etc.), enforcement by the Federal Trade Commission (FTC), and various state privacy laws exist. For details on the personal information protection system in the United States, please refer to the "Survey on Systems Related to the Protection of Personal Information in Foreign Countries" published by Japan's Personal Information Protection Commission (https://www.ppc.go.jp/personalinfo/legal/kaiseihogohou/#gaikoku).

5.3 Security Measures

The Company has implemented the following security measures for international data transfers:

Data processing agreements have been entered into with external service providers, obligating them to handle personal data appropriately.
Data transmission security is ensured through encrypted communications (TLS/SSL).
External service providers have been verified to hold appropriate security certifications (SOC 2, etc.).

Article 6 (Data Retention and Security)

6.1 Retention Period

Users' personal information is retained during the period the account is active and during any retention obligation period required by law. After account deletion, personal information will be deleted within 30 days; however, if there is a retention obligation under law, retention will continue during the applicable obligation period.

6.2 Security Measures

The Company has implemented the following measures to prevent leakage, loss, and alteration of personal information:

Encrypted Communications: TLS/SSL encryption
Access Control: Row-level security (RLS) on databases
Authentication Management: Automatic renewal and secure storage of authentication tokens
Administrator Access Restrictions: Restricted administrator access and log management
Employee Training: Regular training and education for employees who handle personal information

6.3 Response to Data Breaches

In the event that a breach, loss, or damage to personal data occurs (or there is a risk thereof), the Company will take the following actions:

Promptly investigate the facts and take measures to prevent further damage.
Report to the Personal Information Protection Commission in accordance with the APPI (preliminary report within approximately 3-5 days of becoming aware of the incident; full report within 30 days).
Promptly notify affected Users. Notification will include an overview of the breach, the categories of personal data affected, the cause, measures to prevent secondary damage, and the Company's contact information.

6.4 Limitations of Security

The Company endeavors to ensure security to the fullest extent, but cannot guarantee complete security on the internet.

Article 7 (User Rights)

7.1 Right of Access and Right to Rectification

Users can view and correct their personal information through the profile editing screen of the Service.

7.2 Disclosure Requests

Users may request disclosure of personal data held by the Company.

How to Apply: Please contact us through our contact page (https://www.for-ple.com/contact), specifying the categories of personal data for which disclosure is requested.
Identity Verification: The Company will verify the User's identity when processing a disclosure request. Contact from the email address registered with the Service, or identity verification by other methods prescribed by the Company, is required.
Response Period: The Company will respond to disclosure requests within two weeks from the date of receipt, as a general rule.
Fees: No fee is charged for disclosure requests.

7.3 Right to Deletion

Users may request the deletion of their personal information by applying for account deletion. However, this does not apply to data that must be retained under law.

7.4 Right to Request Cessation of Use or Erasure

Users may request the cessation of use or erasure of personal information if it is being handled beyond the scope of the stated purposes of use, or if it was obtained through unlawful means.

7.5 Data Portability

Users may request the Company to provide their personal data in a structured, commonly used, and machine-readable format (such as JSON format). The Company will comply to the extent technically feasible.

7.6 Visibility Management

Users can set the visibility (Public, Community, or Private) for each item of their profile information.

7.7 Push Notification Controls

Users can toggle push notifications on or off through their device settings.

7.8 Inquiries

For questions or requests regarding personal information, please contact us through our contact page (https://www.for-ple.com/contact).

Article 8 (Regarding Minors)

The Service is not intended for individuals under the age of 16. Individuals under the age of 16 may not use the Service.
Individuals aged 16 or older but under 18 must obtain the consent of a legal guardian before using the Service.
The Company requires the entry of a date of birth at the time of account registration and blocks registration by Users under the age of 16.
If the Company becomes aware that it has collected information from a User under the age of 16, it will promptly delete such information.
Parents or guardians who become aware that personal information of a child under the age of 16 has been provided to the Company should contact us through our contact page (https://www.for-ple.com/contact).

Article 9 (Understanding of the External Environment for Security Management Measures)

When handling personal data in a foreign country, the Company has assessed the personal information protection system of the relevant foreign country and has implemented necessary and appropriate security management measures.

For information regarding the personal information protection system in the foreign country (the United States) where personal data is handled in connection with the Service, please refer to Article 5, Section 5.2.

Article 10 (Changes to This Policy)

The Company may revise this Policy as necessary due to changes in laws and regulations, changes to the Service, or other reasons.
In the event of significant changes, the Company will notify Users through posting on the Service, email, or in-app notification. Notification will be provided a reasonable period before the effective date of the changes.
The revised Policy shall take effect from the effective date posted on the Service.
If Users continue to use the Service after the changes take effect, they are deemed to have agreed to the revised Policy.

Article 11 (Supplementary Provisions for Users in Specific Regions)

11.1 Users Residing in the European Economic Area (EEA)

For Users residing in the EEA, the following supplementary provisions apply in accordance with the EU General Data Protection Regulation (GDPR):

Legal Basis for Processing: The Company processes personal data based on the following legal grounds:
- Performance of a Contract: Processing necessary for the provision and operation of the Service
- Consent: When the User has given consent (e.g., processing of sensitive personal information)
- Legitimate Interests: Processing necessary for service improvement, security, etc.
- Compliance with Legal Obligations: Processing necessary to fulfill obligations under law
Additional Rights: Users residing in the EEA have the following rights in addition to those set forth in Article 7:
- The right to request restriction of processing
- The right to object to the processing of personal data
- The right not to be subject to automated decision-making (including profiling)
- The right to lodge a complaint with a supervisory authority (data protection authority)
Withdrawal of Consent: Users may withdraw consent for processing based on consent at any time. The lawfulness of processing carried out prior to withdrawal shall not be affected.

11.2 Users Residing in Indonesia

For Users residing in Indonesia, the following supplementary provisions apply in accordance with Indonesia's Personal Data Protection Law (PDP Law, Law No. 27 of 2022):

Users have the right to receive information about the processing of personal data, the right to request correction, updating, or deletion of personal data, and the right to request cessation or restriction of the processing of personal data.
When transferring personal data of Indonesian Users outside of Indonesia, the Company will implement appropriate safeguards in accordance with the requirements of the PDP Law.

11.3 Other Countries and Regions

The Company will implement additional safeguards as necessary in accordance with the data protection laws of the countries and regions where Users are located. Compliance with regulations in each country will be developed on an ongoing basis.

Article 12 (Contact Information)

For inquiries or requests regarding the handling of personal information, please contact us through our contact page:

Forple, Inc. Contact: https://www.for-ple.com/contact

The Company will endeavor to respond to inquiries within a reasonable period.

End of Privacy Policy