Personal Information Protection
We treat the protection of your personal information as a corporate responsibility and comply with Japan's Act on the Protection of Personal Information (APPI) and related laws.
KOMORI Co., Ltd. (the "Company") recognizes the importance of the personal information entrusted to it through this website and its business activities, and acquires, uses and manages such information appropriately in accordance with the policy set out below.
In this policy, "personal information" means personal information as defined in Article 2, Paragraph 1 of Japan's Act on the Protection of Personal Information: information about a living individual that can identify that individual — such as name, address, telephone number and email address — including information that can be readily collated with other information and thereby identify the individual.
The Company acquires personal information by lawful and fair means. We may collect the information you yourself provide through the contact form, quotation requests, job applications and inquiries via the website chat.
The Company uses the personal information it acquires within the scope of the following purposes:
The Company does not provide personal information to third parties without the prior consent of the individual, except in the following cases:
The Company may outsource all or part of the handling of personal information to the extent necessary to achieve the purposes of use. In such cases, we carefully select the contractors, conclude the necessary agreements and exercise appropriate supervision.
The Company implements the organizational, personnel, physical and technical measures that are necessary and appropriate to prevent the leakage, loss or damage of personal information, and strives to keep such information accurate and up to date.
This website uses first-party cookies and technical storage for language, sessions, security, preferences and form continuity. IP address, browser and technical identifiers may be personal data when combined with other information. External services, sent data and purposes are described in the External Transmission Policy. You can control cookies in the browser, but blocking essential cookies may prevent login and requested functions.
Pursuant to the Act on the Protection of Personal Information, the individual or their representative may request notification of the purpose of use, disclosure, correction, addition or deletion of content, suspension of use, erasure, and suspension of provision to third parties of the retained personal data. We will respond within a reasonable period after confirming the identity of the requester.
The Company may revise this policy without prior notice in response to changes in laws or in its business. The revised privacy policy takes effect from the time it is posted on this website.
Name, email, optional phone, language, password hash, IP, acceptance and membership records are processed to create and secure the account, verify email, locate groups and notify decisions. Authorized administrators see information necessary to decide admission. Participants see your name and group messages. The Privacy Policy describes security, processing outside Japan, providers and channels for access, correction, deletion and cessation of use under APPI. Impersonation and use of other people’s data are prohibited. Account deletion is available in the app and account page; shared messages and records may remain anonymized to preserve conversations and legal obligations.
By accepting these terms you request matching of your conversations with KOMORI using your verified email and existing records. A valid invitation to the same email or a safe match permits automatic joining. Unverified phones, name-only matches and ambiguous identical names require administrator approval. Old messages may be linked to your account when identity is safely established. You may leave; group managers may approve, reject or remove membership. Actions are recorded and exits/removals are notified by email. Automatic matching does not reverse removal or leaving.
We may process identity and contact data, professional affiliation, request and support content, contract and payment data, usage records, IP address, device, browser, authentication and security data. Data is obtained from the person, customer company, authorized users, contracting partners or automatically during service use.
When a customer uses Kenten drivers and fleet, we record driver name or code, vehicle identifiers, licence and inspection expiry, and answers about driving conditions: alcohol, substances, medication that may impair driving, sleep, fatigue and health. Answers are linked to the driver and inspection history for operational safety and review by authorized organization users. Standard fields do not ask for diagnoses, medication names or clinical details; customers and users should not enter these in notes. Self-report does not replace a supervisor decision or legally required checks. The customer must inform the driver and obtain any required authorization before recording personal or health-related answers. The access, rights and retention provisions of this policy apply.
In the KŌLOGY app, a driver can start tracking an assigned delivery route. While active, the app sends precise coordinates, time, accuracy, speed and heading, linked to the driver and route, to the contracting company for delivery progress and actual distance calculations. Tracking may continue while the app is in the background; Android shows an ongoing notification and iOS shows the system location indicator. The driver can stop sharing in Routes at any time; signing out also stops it. Tracking is off by default.
Managers, companies and core accounts may choose to turn on "Share my location with dispatch" in the app Settings (off by default). When on, the app sends the current position and accuracy, linked to the account, to the company's dispatch on the KOLOGY Staff Map, only while the app is open in the foreground — nothing is sent in the background. We keep only the last position (no track history); it stops being shown after 10 minutes without an update and is deleted when the option is turned off, on sign-out or on account deletion.
In the KOREOS app, when the company turns on the location rule for attendance, the app reads the device position only on the time clock screen (when it is opened and when punching in or out) and only while the app is open, never in the background. Inside the company, attendance uses the QR time clock at the entrance; outside, the punch is recorded with precise coordinates, accuracy and distance, linked to the employee, and sent for the manager's approval. The location of punches made outside the company is part of the attendance record and is kept for the period required by labor law. The person may deny the permission and use the QR time clock instead.
In KOCHAT, location is used only when the person chooses: (1) "Share location" in a conversation, static or live for a chosen period (on Android with an ongoing notification while sharing; on iPhone with the system indicator), visible to the conversation participants; (2) "Connection location", off by default: when on, it records a point at intervals set by the company while the app is open, visible to the person and the company administrators, and deleted automatically after the configured period (30 days by default). The person can turn it off and delete their own history in Settings at any time.
To improve the site and understand where enquiries come from, we measure with our own tool the pages viewed, referring site, campaign (utm/QR), language, device type, estimated country, and clicks on phone, e-mail, LINE, app stores and contact buttons. We use no tracking cookies or external analytics services, and IP addresses are not stored (an encrypted identifier that changes monthly is used). "Do Not Track"/Global Privacy Control are honoured. Details in the External Transmission Policy.
We retain data for the period needed for the stated purpose, contract performance, security, legal defense, and tax, accounting and statutory duties. When no longer needed, data is securely deleted, anonymized or made inaccessible, subject to backups and mandatory retention periods.
We maintain internal rules and assigned responsibility, restrict access by role, supervise personnel and providers, protect communications and credentials, log material events and review safeguards according to risk. Details that could facilitate an attack are not published.
Where AI is used for support, search or organization, we limit context to what is necessary and record the interaction for security and service purposes. AI must not make legal, medical, financial, disciplinary or other high-impact decisions about a person on its own. Where automation contributes to a material decision, human review will be available as appropriate to the service and law.
The primary GeHost infrastructure and providers listed in the Security Policy may process data outside Japan, including in the United States. Entering a contract alone does not replace specific consent or another legal condition required for international transfers. Depending on the circumstances, APPI requirements for prior information, consent, equivalent safeguards and supervision of delegated processing must be addressed. Before submitting data requiring Japanese residency, contact DX Department about the country, recipient, safeguards and contractual restrictions. AI and optional service providers are identified in their respective sections; absence of third parties is not presumed.
Complaints, enquiries and requests for disclosure, correction, suspension of use or deletion of your personal data should be addressed to the KOMORI株式会社 contact channel shown on this page. We will respond within a reasonable period after confirming the identity and legitimacy of the requester. If a request is refused in whole or in part, we will state the reason.
In the event of material leakage, loss, damage or unauthorized access, we investigate, contain and remediate the incident. Where there is a risk to individuals’ rights and interests and the law requires it, we will notify the Personal Information Protection Commission and affected persons clearly and within applicable deadlines.
This policy covers the KOMORI website, KOREOS, Karta, KOCHAT, KŌLOGY, Kenten, KoMail, KMR, KoCAD and EASY, including mobile and desktop versions. Depending on features used, Karta processes cards, images and contacts; KOREOS/EASY process operations, attendance, documents and communications; KOCHAT processes messages, attachments and call metadata; KŌLOGY/KMR process routes and authorized location; Kenten processes inspections and safety information; KoMail processes email accounts, messages, attachments and credentials needed to connect to the configured server; KoCAD processes projects, drawings and files submitted to the features used. Sharing depends on permissions and the contracting organization. Free accounts also involve data processing without payment.
Camera and file access support card, QR, receipt, photo and document capture when the feature is invoked. Microphone and camera support voice, meetings, calls and video doorbells. Audio, video, participants and necessary metadata pass between participants and communications infrastructure, including relays when needed; direct connections may reveal network information to the other participant. System permissions can be revoked in Settings, disabling the corresponding feature. Camera or microphone permission is not consent to recording: recording, transcription and AI processing depend on the feature used and informing participants. Reception and doorbell camera operators must inform visitors and restrict access to images. Neither end-to-end encryption nor recording of every call is presumed.
In apps supporting push, Google Firebase Cloud Messaging and Apple Push Notification service receive installation tokens, technical data and the notification content forwarded to deliver alerts, messages and calls. Notifications may appear on the lock screen according to system settings. Adjust previews and notification permissions on your device; disabling push may prevent call or doorbell alerts. Social login, maps, email and payments use the corresponding providers when selected. The External Transmission Policy explains recipients and purposes.
KOMORI operates KOIA, its own AI infrastructure. External processing also exists: the operational configuration includes Anthropic (Claude), OpenAI (Codex) and Z.ai, depending on the feature and engine used. Prompts, attachments and necessary context may be processed by that engine; do not assume all AI processing stays within KOIA. Software supporting a user-configured provider is also subject to that provider’s terms. Do not submit passwords, secrets or unnecessary personal data. Contact DX Department before use with questions about processing and the applicable provider. AI responses can be wrong and require human review, particularly for legal, financial, medical, employment or safety decisions. For 3D or texture generation, Meshy may also process prompts and files when that engine is used.
Marketing campaigns include a recipient-specific unsubscribe link. Use it to stop the covered promotional messages or contact DX Department. Necessary account, security, contract, billing and requested support messages are not promotional campaigns and may continue. Unsubscribing does not require account deletion.
Uninstalling an app does not delete the account or cancel a subscription. Use the product’s account deletion option or contact DX Department, subject to identity verification. Cancel subscriptions through the purchase channel (web portal or store subscription management where applicable). Account deletion, closing a company workspace and deleting shared messages are separate operations. Tax records, contracts, security history and records involving other people may be retained for applicable legal or contractual periods; other data is deleted or anonymized through the product’s process. Backups are not rewritten instantly and remain subject to retention cycles and restricted access. No single deletion deadline is promised for every product. Request any available export before closure.
KOMORI implements organizational, human, physical and technical security safeguards in accordance with the Act on the Protection of Personal Information and other applicable laws and guidelines, and reviews them on an ongoing basis. If a leak or other incident occurs, or is likely to have occurred, KOMORI will report it to the Personal Information Protection Commission and notify the affected individuals as required by law, promptly inform the customer, and work to prevent further damage and investigate the cause.
Where KOMORI is liable for damages, its liability is limited to ordinary and direct damages actually incurred by the customer due to causes attributable to KOMORI, and excludes lost profits, indirect damages, special damages and damages arising from loss or corruption of data. The amount of compensation is capped at the total fees paid by the customer to KOMORI under this agreement during the 12 months counted back from the month in which the cause of the damage arose. This limit does not apply in cases of KOMORI’s intentional misconduct or gross negligence.
Where KOMORI has implemented the security safeguards set out in the preceding article, KOMORI is not liable for damages caused by unauthorized access, cyberattacks, computer viruses or similar acts by third parties, except in cases of KOMORI’s intentional misconduct or gross negligence.
The customer manages, at its own responsibility, authentication credentials such as IDs and passwords, its own devices and networks, the permissions granted to its employees and the backup of its important data, and must notify KOMORI immediately upon becoming aware of any unauthorized use or risk of leakage. Damages arising from causes attributable to the customer are borne by the customer.
For inquiries about the handling of personal information, or to request disclosure, correction or suspension of use, please contact us through the desk below.
Effective and revised: Revised October 29, 2026 · JST
