Privacy Policy

Last Updated: November 1, 2026 Effective Date: November 1, 2026

---

Forple Inc. (hereinafter referred to as "the Company") hereby establishes this Privacy Policy (hereinafter referred to as "this Policy") regarding the handling of personal information in the community platform "Forple" (hereinafter referred to as "the Service").

The Company complies with the Act on the Protection of Personal Information of Japan (hereinafter referred to as "APPI") and other related laws and regulations, and handles Users' personal information appropriately.

The official text of this Policy is in Japanese. If this Policy is translated into other languages, the Japanese version shall prevail in the event of any inconsistency or discrepancy between the Japanese version and the translation.

---

Article 1 (Information We Collect)

1.1 Information Provided Directly by Users

1. Account Information: Email address, display name, date of birth (for the roster of a partner school, when you register through a school)
2. Profile Information: Profile photo, biography, headline, gender, location (country and city)
3. Professional Information: Current occupation, company name, work history, education, skills, qualifications and licenses
4. Language Information: Languages used and proficiency levels
5. Work Authorization Information: Type of work visa, expiration date, presence of work restrictions, need for sponsorship
6. User Content: Discussion posts, learning recipes, comments, questions, answers, reactions
7. Media: Profile photos, images and videos attached to posts
8. Learning Data: Written-composition answers, speech recordings (audio files) and their transcriptions (text), weekly reflections (self-assessment, what did not go well, what you worked hard on, plans for improvement next week, and questions for your teacher or coach), test answers and scores, and learning progress (number of days studied, number of words studied and compositions written, etc.)
9. Purchase Information: Subscription status (whether you are currently on a paid plan), the type of product purchased (Paid Plan for 1, 3 or 6 months, or Full Coaching), start, renewal and end dates, and the store where you purchased (App Store or Google Play). Neither the Company nor RevenueCat, which the Company uses, receives credit card numbers or other payment information (payments are processed by Apple Inc. or Google LLC).
10. Full Coaching Session Records: Recordings (video and audio) of Full Coaching sessions and AI-generated transcriptions. Limited to sessions in which the User agreed to recording at the start (Article 3-2).

1.1b Visa Check Responses (collected before registration)

Through the "visa check" on our website, the Company collects the following information whether or not you have an account.

1. Your answers: what you want to find out (which status you could get, renewing, an expiring card, or permanent residency), nationality, age range, current residence status and period, Japanese ability, education, occupation and field, income band, where you live (prefecture), and family situation
2. The result: the verdict, the reasons and cautions shown, and the next actions listed
3. Survey responses: the optional survey after the check, including free text
4. Technical information: a random string identifying the check session (stored in your browser) and a hashed IP address (to prevent heavy use by the same person; the raw IP address is not stored)

The check can be used without giving your name or email address. If you only use the check, the Company cannot connect your answers to you as an individual.

However, if you create an account after the check, or post a question to "Ask" from the result, the Company links that check session to your account. From then on, those answers are treated as personal information belonging to that account.

1.1c Early-Access Sign-Up (collected before registration)

Through the early-access sign-up on our website (https://www.for-ple.com/join), the Company collects the following information.

1. Contact details and name: email address and name
2. Your answers: preferred language, nationality, how you heard about the Service, and why you are learning Japanese
3. Record of consent: the date and time you agreed to this Policy, and the version of the wording you agreed to
4. Technical information: a hashed IP address (to prevent many sign-ups from the same connection; it is erased after one day, and the raw IP address is not stored)

The Company sends an invitation code issued by the Company to the email address you signed up with. The invitation code can be used to register for the Service only with that email address.

1.1d Contact Forms

Through the contact forms on our website (the pages for schools and companies, and the contact page), the Company collects the following information.

1. Contact details and name: email address and name (on the form for schools and companies, the name of the contact person)
2. Answers on the form for schools and companies: name of the school, company or organisation, country, and the approximate number of students or staff
3. Your message: the text you write in the form, and the page and language from which you sent it
4. Record of consent: the version of the wording of this Policy you agreed to
5. Technical information: a hashed IP address (to prevent many messages from the same connection; it is erased after one day, and the raw IP address is not stored)

The Company uses this information only to answer your message and to tell you about introducing the Service.

1.2 Sensitive Personal Information

The Company may collect the following information. These may constitute "Special Care-Required Personal Information" under the APPI and are collected and used only with the User's explicit consent.

1. Nationality: As part of profile information, visa check responses and early-access sign-up answers
2. Residency Status (Visa) Information: As part of work authorization information and visa check responses

The Company will not obtain sensitive personal information such as race, creed, medical history, or criminal record without the User's explicit consent, except as provided by law.

In free-text entries and conversations, such as compositions, weekly reflections and Full Coaching sessions, Users may write or speak about their own health or personal circumstances. The Company cannot restrict such content in advance. Please do not write information that is not needed for your studies, such as your full name, address or telephone number. You do not have to write anything about your health or personal circumstances if you prefer not to.

1.3 Information Collected Automatically

1. Device Information: Device model, OS name and version, app version, unique device identifiers
2. Push Notification Tokens: Device identifiers necessary for notification delivery (Expo Push Token)
3. Usage Data: View counts, voting data, notification read status, feature usage frequency
4. Error and Crash Logs: Log data for the purpose of improving app stability (via Sentry; in the app, a User ID (a random string) is attached when logs are sent so that we can find out which account an error occurred on)
5. Access Logs: IP address, access date and time, request content (when using the web version)

1.4 Cookies and Tracking Technologies

The Company may use the following cookies and similar technologies on its website (https://www.for-ple.com and related subdomains).

1. Essential Cookies: Cookies indispensable for providing the Service, such as maintaining login status and security measures. They cannot be disabled.
2. Analytics Cookies: Cookies used to analyze how the Service is used and to help improve it. The Company uses Google Analytics (provided by Google LLC) as an access analytics tool. Google Analytics uses cookies to collect website usage (pages viewed, time spent, approximate region, etc.) in a form that does not identify individuals. The information collected is managed in accordance with Google's Privacy Policy (https://policies.google.com/privacy). Users can disable data collection by using the Google Analytics Opt-out Browser Add-on (https://tools.google.com/dlpage/gaoptout).
3. Functional Cookies: Cookies used to remember User settings (such as language selection).
4. Advertising Cookies: The Company may display advertisements delivered by third-party ad providers (Google) on its website. Third-party ad providers, including Google, use cookies to serve ads based on a User's past visits to this site and other websites.

Additional notes on advertising cookies:

• Users can disable personalized advertising through Google's Ads Settings (https://adssettings.google.com/). Users can also opt out of the use of cookies by third-party ad providers at www.aboutads.info.
• For how Google uses data, please see "How Google uses information from sites or apps that use our services" (https://policies.google.com/technologies/partner-sites).
• Users in the European Economic Area (EEA), the United Kingdom and Switzerland are shown a consent management tool to confirm consent before ads are displayed.

Users can disable cookies other than essential cookies through their browser settings. However, some features may no longer work properly.

1.5 Information Obtained from Third Parties

1. Information about the inviting User linked through an Invitation Code (the inviter's User ID and the date and time of the invitation).
2. From the stores (Apple Inc.'s App Store and Google LLC's Google Play), through RevenueCat, Inc., the purchase information described in item 9 of Section 1.1 and purchase receipt data.

---

Article 2 (Purposes of Use)

The Company uses the information it collects for the following purposes:

1. Providing, operating and maintaining the Service
2. Authenticating and managing User accounts
3. Displaying User profiles (based on visibility settings)
4. Displaying, searching and sorting content
5. Sending push notifications
6. Content moderation (detecting inappropriate content)
7. Improving the Service and developing new features
8. Creating statistical data (in a form that does not identify individuals)
9. Preventing unauthorized use and ensuring security
10. Responding to violations of the Terms of Service
11. Responding as required by law (including reporting to the Personal Information Protection Commission)
12. Responding to inquiries from Users
13. Delivering and displaying advertisements (including by third-party ad providers)
14. Creating and displaying visa check results and next actions
15. Creating and analyzing statistics from check responses after processing them so that individuals cannot be identified (trends in difficulties by residence status, distribution by region, etc.). These statistics are used to improve the Service, to understand the challenges foreigners face in Japan, and to explain the Company's business, and are provided to third parties only in the form of statistical information that does not identify individuals
16. Creating and sending corrections of compositions, feedback on speeches, and replies to weekly reflections (including AI processing and review by coaches; Article 3)
17. Providing the Paid Plan and Full Coaching, confirming purchase status, and switching features after cancellation, expiry of the period, or refund
18. Assigning a coach and contacting Users to arrange Full Coaching session schedules
19. Recording and transcribing Full Coaching sessions (to improve the quality of the Service and coaching; limited to Users who consented to recording; Article 3-2)
20. Retaining records as required by accounting, tax and other laws
21. Sending invitation codes and news about the Service to people who signed up for early access
22. Improving the Service and how we present it, by totalling early-access answers (such as how people heard about the Service and why they are learning Japanese). Totals are shared with third parties only as statistics that cannot identify any individual.

The Company does not handle personal information beyond the scope necessary to achieve the above purposes. If the purposes of use are changed, the Company will publish the revised purposes or notify Users.

---

Article 3 (Data Processing by AI Features)

3.1 AI Service Used and Purposes

The Company uses the API (Claude) of the AI provider Anthropic, PBC (United States) for the following purposes:

1. Correcting compositions
2. Giving feedback on speeches
3. Creating replies from the character "Umamiy-kun" to weekly reflections, and creating drafts of replies that require review

The visa check uses no AI, either for the verdict or for showing the next actions. Both are done mechanically, based on rules created by the Company. Check responses and verdicts are not sent to any external third party, including AI providers. AI processing such as translation or moderation is also not performed on posted content (discussions, questions and answers, etc.).

3.2 Data Sent

Email addresses, display names, school names, User IDs and telephone numbers are not sent. However, anything Users themselves write in a composition, transcription or reflection (such as names or personal circumstances) is sent as written (see the note in Section 1.2).

Reflections of students at partner schools are also sent to Anthropic in order to determine whether review is required.

3.3 Handling of Data by Anthropic

1. The data sent is processed on Anthropic's servers (mainly in the United States).
2. Under Anthropic's commercial terms, Anthropic does not use the data sent by the Company to train AI models.
3. Anthropic deletes the inputs sent and the outputs generated, in principle within 30 days of receipt or generation. However, data determined to be a suspected violation of Anthropic's usage policy, data required by law, and the like may be retained longer in accordance with Anthropic's rules.
4. The results of AI processing are automatically generated, and their accuracy is not guaranteed.

3.4 Human Review

For weekly reflections that contain a question for a teacher or coach, or that the Company determines require review, a coach assigned by the Company reads the content of the reflection and the learning records, reviews and corrects the draft created by the AI, and then sends it. Coaches are members of the Company or persons designated by the Company, and are bound by a duty of confidentiality to the Company.

3.5 Voice Input (Device Speech Recognition)

When you enter speeches or compositions by voice, your voice is converted into text using the speech recognition feature built into your device's OS (iOS or Android). The Company does not send your voice to any separate speech recognition provider. However, depending on your device and OS settings, your voice may be sent to and processed on the servers of the OS provider (Apple Inc. or Google LLC), in which case it is handled in accordance with each company's privacy policy.

Speech recordings (audio files) are stored in a private storage area of the Company's database provider (Supabase), and can be heard only by you, the teachers of the school you belong to, and the Company's administrators.

3.6 Opt-out

AI processing cannot be turned off on its own. If you do not wish to have your data processed by AI, please do not use the composition correction, speech, and weekly reflection features.

---

Article 3-2 (Recording and Transcription of Full Coaching Sessions)

1. To improve the quality of the Service and coaching, the Company records sessions and creates AI transcriptions only for sessions in which the User agreed to recording at the start of the session. Recordings and transcriptions are made using Google LLC's Google Workspace (the recording and transcription features of Google Meet) and are stored in the Company's Google Drive.
2. At the start of each session, the assigned coach starts the recording and asks the User whether the session may be recorded. That recording, including the User's agreement, is the record of consent. If the User declines, the recording is stopped immediately and deleted. Declining recording does not change what Full Coaching includes, and the User may decline at any session.
3. Recordings and transcriptions may be viewed only by the assigned coach and by persons designated by the Company for improving the Service and coaching, training coaches, and handling disputes. These persons are bound by a duty of confidentiality to the Company.
4. Recordings and transcriptions are deleted one year after the User's Full Coaching ends (Article 6).

---

Article 4 (Information Sharing and Disclosure to Third Parties)

4.1 User Profile Visibility

Users can set the visibility of their profile information at three levels:

1. "Public": Viewable by everyone
2. "Community": Viewable only by logged-in Users
3. "Private": Viewable only by the User

4.1b Viewing of Learning Data by Schools and Coaches

1. The learning data of students at partner schools can be viewed by the teachers of that school. Users who register with a school code consent, at registration, to that school's teachers viewing their learning data. In its contracts with partner schools, the Company requires teachers to maintain confidentiality and not to use the data for other purposes.
2. The learning data of Users of the Company's online school (Users who study individually) can be viewed by the assigned coach designated by the Company and by the Company's administrators.

4.2 External Service Providers

The Company uses the following external services to provide the Service. User data may be sent to these services.

The Company uses each external service provider in accordance with that provider's terms of use and data handling provisions. The status of data processing agreements (DPAs) is as follows:

1. DPAs incorporated into the terms of service: Anthropic, PBC; Supabase, Inc.; RevenueCat, Inc.; Resend (Plus Five Five, Inc.); and Google Firebase (the Google Cloud Data Processing Addendum). These took effect when the Company accepted each provider's terms of service.
2. DPAs the Company separately accepted in each provider's dashboard: Sentry (Data Processing Addendum), Google Analytics (Data Processing Amendment) and Google Workspace (Cloud Data Processing Addendum).
3. DPA that applies to the Company's plan: Vercel Inc. (Vercel's DPA applies to the Pro plan that the Company uses).
4. Expo / EAS: Data handling is governed to the extent included in Expo's terms of service.
5. Not covered by a DPA: Apple Inc. and Google LLC handle data on their own responsibility, under their own terms of use and privacy policies, for payments and subscription management on the App Store and Google Play, device speech recognition, and ad delivery (Google AdSense). There is no DPA between the Company and these companies for these purposes.

4.3 Compliance with the External Transmission Rule

In accordance with Article 27-12 of the Telecommunications Business Act, the Company publishes, as set out in 4.2 above, the information that is sent from Users' devices to external servers.

4.4 Disclosure Required by Law

The Company may disclose User information in the following cases:

1. When required by law
2. When an inquiry is made in accordance with law by a court, public prosecutor's office, police, tax office, bar association, consumer center, or other administrative agency
3. When necessary to protect the life, body or property of a person and it is difficult to obtain the person's consent
4. When particularly necessary to improve public health or promote the sound upbringing of children
5. When necessary for a national agency or the like to carry out affairs prescribed by law

4.5 Business Succession

In connection with a succession of the Company's business (merger, company split, business transfer, etc.), User information may be transferred to the successor. In such a case, the successor shall handle personal information in accordance with this Policy.

---

Article 5 (International Data Transfers)

5.1 Countries of Transfer

The Service is operated from Japan; however, as described in Article 4, because external service providers are located in the United States, User information may be processed and stored on servers in the United States.

5.2 Personal Information Protection Systems in the United States

The United States has no comprehensive federal law on personal information protection. However, there are sector-specific laws and regulations (HIPAA, COPPA, CCPA/CPRA, etc.), enforcement by the Federal Trade Commission (FTC), and privacy laws of individual states. For details of the personal information protection system of the United States, please see the "Survey of Systems for the Protection of Personal Information in Foreign Countries" published by the Personal Information Protection Commission (https://www.ppc.go.jp/personalinfo/legal/kaiseihogohou/#gaikoku).

5.3 Security Control Measures

For international data transfers, the Company takes the following security control measures:

1. The Company uses external service providers after reviewing their terms of use and data handling provisions.
2. The Company has data processing agreements (DPAs) with the providers listed in items 1 to 3 of Section 4.2. Under these agreements, each provider handles data within the scope of the Company's instructions and takes measures to keep it secure.
3. Data in transit is protected by encrypting communications (TLS/SSL).

---

Article 6 (Data Retention and Security)

6.1 Retention Period

1. Users' personal information is retained while the account is active and during the retention period required by law. After an account is deleted, personal information is deleted within 30 days. However, where there is a legal retention obligation, it continues to be retained for the duration of that obligation.
2. Learning data: Retained while the account is active. Even after a Paid Plan ends, past corrections, feedback, comments and test scores are not deleted.
3. Speech recordings (audio files): Like learning data, retained while the account is active and deleted within 30 days after the account is deleted.
4. Recordings and transcriptions of Full Coaching sessions: Deleted one year after the User's Full Coaching ends. If you delete your account, they are deleted within 30 days of the deletion.
5. Billing records (history of purchases, renewals and cancellations): Retained for the period prescribed by law for accounting and tax purposes (in principle 7 years; 10 years for records relating to a business year in which a loss was incurred).
6. Purchase information held by RevenueCat: Retained as part of the billing records for the same period as in the preceding item (in principle 7 years); after that period has passed, the Company requests RevenueCat to delete it.
7. Data sent to Anthropic: As described in Section 3.3.
8. Early-access sign-up information: If you register for the Service with an invitation code, it is deleted within 30 days after your account is deleted. If you do not register within one year of signing up, it is deleted promptly after that year has passed. The hashed IP address is erased after one day.
9. Contact form information: Deleted promptly after one year has passed since it was received. The hashed IP address is erased after one day.

6.2 Security Measures

To prevent leakage, loss and tampering of personal information, the Company takes the following measures:

1. Encrypted communications: Communications encrypted with TLS/SSL
2. Access control: Row-level security (RLS) on the database
3. Authentication management: Automatic renewal and secure storage of authentication tokens
4. Restrictions on administrator access: Restricted administrator access and log management
5. Employee training: Regular education and training for employees who handle personal information

6.3 Response to Data Breaches

If a leakage, loss, damage or similar incident involving personal data occurs (or is likely to occur), the Company will respond as follows:

1. Promptly investigate the facts and take measures to prevent further harm.
2. Promptly report to the Personal Information Protection Commission as required by the APPI (a preliminary report within roughly 3 to 5 days of becoming aware of the incident, and a final report within 30 days).
3. Promptly notify affected Users. The notice will include an outline of the leakage, the categories of personal data leaked, the cause, measures to prevent secondary harm, and the Company's contact information.
4. For the personal data of Users residing in Indonesia, notify the individual and the Indonesian supervisory authority in writing within 3 x 24 hours of becoming aware of the incident.

6.4 Limits of Security

The Company makes every effort to ensure security, but cannot guarantee complete security on the Internet.

---

Article 7 (User Rights)

7.1 Right of Access and Correction

Users can view and correct their personal information from the profile editing screen of the Service.

7.2 Disclosure Requests

Users may request disclosure of the personal data held by the Company.

1. How to request: Please contact the Company at the contact details in Article 12 (by email or via the contact page), specifying the items of personal data for which you request disclosure.
2. Identity verification: When a disclosure request is made, the Company verifies the User's identity. This requires contact from the email address registered with the Service, or identity verification by another method determined by the Company.
3. Response period: In principle, the Company responds within 2 weeks of receiving a disclosure request.
4. Fee: There is no fee for disclosure requests.

7.3 Right to Deletion

Users may request deletion of their personal information by applying to delete their account, except where there is a legal retention obligation. Deleting your account does not cancel your store subscription. Please cancel in the store settings before deleting your account.

If you only signed up for early access (and have no account), please contact us at the address in Article 12 from the email address you signed up with, asking us to delete your early-access information or to stop sending news. The Company will confirm that the request comes from you and respond promptly.

7.4 Requests to Cease Use or Erase

If personal information is being handled beyond the scope of the purposes of use, or was obtained by wrongful means, Users may request that the use of that personal information be ceased or that it be erased.

7.5 Data Portability

Users may request that the Company provide their personal data in a structured, commonly used, machine-readable format (such as JSON). The Company will respond to the extent technically feasible.

7.6 Visibility Management

Users can set the visibility (Public, Community, Private) of each item of their profile information.

7.7 Push Notification Control

Users can turn push notifications on and off from their device's settings screen.

7.8 Declining Session Recording

Full Coaching Users can decline recording at any session, when the coach asks at the start (Article 3-2).

7.9 Inquiries

Please send questions and requests about personal information to the contact in Article 12.

---

Article 8 (Minors)

1. The Service is intended for people aged 18 or older. People under 18 cannot register for the Service or purchase a Paid Plan or other plans.
2. By agreeing to the Terms of Service, Users represent that they are 18 or older.
3. If the Company learns that it has collected information from a User under 18, it will promptly delete that information.
4. Parents or guardians who become aware that personal information of a child under 18 has been provided to the Company should contact the Company at the contact in Article 12.

---

Article 9 (Understanding the External Environment for Security Control Measures)

When the Company handles personal data in a foreign country, it takes necessary and appropriate security control measures after understanding the personal information protection system of that country.

The personal information protection system of the foreign country (the United States) where personal data is handled in the Service is as described in Section 5.2 of Article 5.

---

Article 10 (Changes to this Policy)

1. The Company may revise this Policy as necessary due to changes in laws, changes to the Service, or other reasons.
2. For material changes, the Company will notify Users by notice on the Service, email or in-app notification. Notice will be given a reasonable period before the changes take effect.
3. The revised Policy takes effect on the effective date posted on the Service.
4. If a User continues to use the Service after a change, the User is deemed to have agreed to the revised Policy.

---

Article 11 (Supplementary Provisions for Users in Specific Regions)

11.1 Regions Where We Sell and Distribute

The Company does not distribute the Service's app in the European Economic Area (EEA) or the United Kingdom. The Paid Plan and Full Coaching are sold only in the Indonesian and Japanese stores.

11.2 Users Residing in Indonesia

The following supplementary provisions apply to Users residing in Indonesia under the Indonesian Personal Data Protection Law (PDP Law, Law No. 27 of 2022):

1. Users have the right to be informed about the processing of their personal data, the right to request correction, updating and deletion of their personal data, and the right to cease or restrict the processing of their personal data.
2. The Company transfers the personal data of Indonesian Users outside Indonesia. The destinations are Japan (the Company, and where Supabase stores data), the United States (Anthropic, RevenueCat and others; the companies listed in Section 4.2), and the processing locations of Google and Apple. Users consent to this transfer at registration. The data transferred includes learning data (the content of compositions, transcriptions and reflections), data sent to Anthropic for AI processing, purchase information, and recordings and transcriptions of Full Coaching sessions. The measures that protect the transferred data are described in Section 5.3.
3. Recording of Full Coaching sessions is based on the agreement the User gives at the start of each session, and that agreement is kept as part of the recording (consent in recorded form, as the Indonesian Personal Data Protection Law allows). Users can decline recording at any session (Article 3-2).

11.3 Other Countries and Regions

The Company will take additional protective measures as necessary in accordance with the data protection laws of the country or region where the User is located. Our response to the regulations of each country will be developed in stages.

---

Article 12 (Contact)

Please direct inquiries about the handling of personal information and various requests to the following:

Forple Inc. Address: Fuji Soft Building 12F, 3-banchi Kanda Neribeicho, Chiyoda-ku, Tokyo, Japan Representative: Daichi Umamichi, Representative Director Email: support@for-ple.com Contact page: https://www.for-ple.com/contact

The Company will endeavor to respond to inquiries within a reasonable period.

---

End