Privacy Policy

This policy explains what personal data JINSEI.STUDIO collects, why we collect it, and the choices you have. It applies to founders, builders, program operators, instructors, and investors who use the JINSEI.STUDIO console.

By using the service you agree to the collection and use of information as described here. If you do not agree, please do not use the service.

Account and authentication data: your name, email address, role, and sign-in metadata (passkey or session token metadata, a hashed IP address used for security). You can sign in with a password, a passkey, a one-time sign-in link, or through Google or GitHub.

Program and workspace content: the material you submit as part of a program, including decisions, evidence artifacts, interview notes, and questionnaire responses.

Optional financial connection data: if you choose to connect a bank account, we receive read-only account and transaction data through our financial data provider, Plaid. You control when this connection is made and can disconnect it at any time.

Billing information: subscription and payment processing is handled by Stripe. We store your subscription status and Stripe customer identifiers; we do not store your full card number.

Support communications: messages you send us for help, which may include free-text content you choose to share.

Usage and device data, and cookies: standard technical information (browser type, pages visited, timestamps) and the cookies described below.

To operate the program console: run your workspace, track progress, and generate the operator and investor views your program enables.

To evaluate submitted work, which may include AI-assisted evaluation performed by a third-party AI service provider on the content you submit.

To connect founders and investors, but only where your program's sharing settings and your own consent allow it.

To process payments, provide support, secure the platform, and comply with applicable law.

We use a single session cookie to keep you signed in. It is HttpOnly, Secure, and SameSite=Lax, meaning it cannot be read by page scripts and is not sent to third-party sites. We do not use third-party advertising or cross-site tracking cookies.

Your language preference is stored in your browser's local storage so the console remembers whether you prefer English or Japanese.

Service providers who process data on our behalf: Google Cloud Platform (hosting), Stripe (billing), Plaid (financial connections, only if you opt in), an AI service provider (evaluation), Resend (transactional email), and Slack (support ticket handling). Each is bound to use data only to provide their service to us.

Investors and program operators, but only to the extent your program's sharing model and your own permissions allow.

Legal and safety disclosures where required by law, or in connection with a merger, acquisition, or sale of assets, with notice to affected users where required.

We do not sell your personal data.

Your data is primarily hosted on Google Cloud Platform. Some processing, notably AI-assisted evaluation, takes place in the United States. Where required, we rely on appropriate safeguards for cross-border transfer, including the mechanisms recognized under the GDPR and, for transfers of personal information originating in Japan, the cross-border transfer requirements of Article 28 of the Act on the Protection of Personal Information (APPI): we transfer only to recipients in a country the Personal Information Protection Commission recognizes as providing an equivalent level of protection, or under a data processing agreement that imposes APPI-equivalent safeguards, or with your consent.

Program and workspace data is retained for the duration of your program, plus a retention window configured at the end of your cohort. Security audit logs are retained for seven years for accountability. AI-generated evaluation outputs are retained for a limited window, then deleted. Aggregated benchmarking metrics are anonymized and may be retained indefinitely.

Wherever you are located, you can ask us to give you a copy of your personal data, correct it, or delete it. Where applicable law grants additional rights, we honor those rights, including the specific regimes below. To exercise any of these rights, use the contact details at the end of this policy.

We encrypt data in transit and at rest, apply field-level encryption to particularly sensitive fields, and isolate each tenant's data at the database level. Audit records are tamper-evident. No system is perfectly secure, and we cannot guarantee absolute security.

JINSEI.STUDIO is not directed to children under 16, and we do not knowingly collect personal data from them.

If we make material changes to this policy, we will update the date above and, where appropriate, notify you directly.

Questions about this policy or your data can be sent to privacy@jinsei.studio.