1. Introduction

Nue Inc. ("we," "us," or "the Company") establishes this Privacy Policy regarding the handling of users' personal information in connection with the mobile application "TabiReco" ("the App") and the website "tabire.co" ("the Site") provided by the Company.

Descriptions of accounts and receipts in the App apply to the App. Sections 3.4 and 8.2 explain how information is handled when you browse the Site, use its currency calculator, or contact us.

We comply with the Act on the Protection of Personal Information ("APPI") and other applicable laws, and handle users' personal information appropriately.

2. Definition of Personal Information

In this Privacy Policy, "personal information" refers to personal information as defined in Article 2 of the APPI — information relating to a living individual that can identify a specific individual by name, email address, or other descriptions, or that contains an individual identification code.

3. Information We Collect

3.1 Information Provided Directly by Users

3.2 Information Automatically Generated or Collected

3.3 Information We Do Not Collect

We do not collect the following information in the App:

• Device GPS location data (receipt location is estimated from store names and addresses printed on receipts — we do not use device location)
• Contacts (address book)
• Call history
• Health data
• Financial account or credit card information

3.4 Information Handled on the Site and Its Purposes

We handle viewed pages, browser and device information, article completion, clicks on internal and app store links, and currency calculator usage to analyze usage and improve the Site. Calculator usage events include the currency and, for Korean won, an amount range rather than the exact input amount.

Names, email addresses, and messages submitted through the contact form are used for receipt notifications, replies, and handling inquiries. We use Resend for email delivery to our staff and for receipt emails. If internal notifications are enabled, these details are also shared through Slack. Please do not include receipt images, credit card numbers, or other information that is unnecessary for handling your inquiry.

4. Purpose of Use

We use the collected personal information for the following purposes:

5. Provision to Third Parties

Transfers to external services from the App are described below. See Sections 3.4 and 8.2 for information sent to Google from the Site and for email delivery and internal notifications related to inquiries.

We do not provide users' personal information to third parties except in the following cases:

5.1 External Services Required for App Delivery

We transmit data to the following external services for the purpose of providing our service:

The App sends requests directly to exchange rate providers. These rate requests do not include photos, recognized text, amounts being converted, conversion history, or account information. Providers receive connection information such as IP addresses.

Important: When regular receipt management uses external processing, receipt images and analyzed text are transmitted solely for OCR analysis, translation, and AI processing. We do not use user receipt data for training AI models. We have also confirmed in our current contracts with the OCR, translation, and AI providers receiving these images and texts that the transmitted receipt data will not be used for AI model training.

5.2 Provision Based on Law

We may provide personal information to third parties in the following cases:

1. When required by law (court orders, inquiries from investigative authorities, etc.)
2. When necessary to protect the life, body, or property of a person and it is difficult to obtain the consent of the individual
3. When particularly necessary for improving public health or promoting the sound development of children and it is difficult to obtain the consent of the individual
4. When cooperating with a national or local government entity or a person entrusted thereby in executing affairs prescribed by law, and obtaining consent may impede such execution

5.3 Business Succession

In the event of a merger, company split, business transfer, or other succession involving the business that includes users' personal information, we may provide personal information to the successor. In such cases, we will require the successor to comply with this Policy.

6. Data Storage and Management

The following descriptions of cloud and device storage, retention, and account deletion apply to data in the App. The App's storage locations and deletion period following account deletion do not apply to the Site's measurement data or inquiries.

6.1 Storage Location

• Data sent to the cloud for regular receipt management and similar features is stored in databases and storage on the cloud service (Supabase) used by us
• Server region: AWS Tokyo Region (ap-northeast-1)
• All communications are encrypted via TLS (HTTPS)
• Stored data is encrypted at rest on the server side

6.2 Offline Local Storage for Regular Receipt Management

• When there is no internet connection, receipt images are temporarily stored on the device
• Upon connectivity restoration, data is automatically uploaded to the cloud and local data is deleted

6.3 Retention of Cloud Data

• Data is retained as long as the user maintains their account
• After account deletion, all data is completely deleted within 30 days (including deletion from backups)
• If any data is required to be retained by law, it will be deleted after the legally prescribed retention period

6.4 Data Security Measures

We implement the following measures to prevent leakage, loss, and damage of personal information:

6.5 On-device Processing and Storage in Quick Conversion

Quick Conversion uses Google ML Kit to recognize text in photos you take or select, on your device. This feature does not upload the photos, recognized text, amounts being converted, or conversion history itself to our servers or external OCR or AI services. This differs from cloud processing for regular receipt management.

Conversion history (including amounts, currencies, conversion results, rates, and item names) and thumbnails are stored on your device without cloud synchronization by the App. You can delete entries individually or clear the history. When adding a new entry would exceed 100 entries, older entries are removed first. Deleting history also initiates deletion of the associated thumbnails; original photos in your photo library are not deleted. OS backup and restoration depend on your device settings and the operating system.

Google ML Kit does not send photos or recognition results to Google servers, but it sends SDK performance and utilization metrics to Google and may communicate to obtain updates and similar information. The descriptions of app usage logs and related data in Sections 5.1 and 8.1 also apply to Quick Conversion usage and diagnostic data.

7. User Rights

Users may exercise the following rights under the APPI:

7.1 Account Deletion (Data Erasure)

• You can delete your account at any time from the Settings screen in the App
• Account deletion permanently removes all cloud data (receipt images, analysis results, wrap-up texts, change history)
• This action cannot be undone

7.2 Requests for Disclosure, Correction, or Suspension

Under the APPI, you may make the following requests:

1. Request notification of the purpose of use
2. Request disclosure of personal information
3. Request correction, addition, or deletion of personal information
4. Request suspension or erasure of personal information
5. Request cessation of provision of personal information to third parties

Please contact us at the inquiry desk listed at the end of this Policy. We will respond within the period prescribed by law after verifying your identity.

8. Cookies and Tracking Technologies

8.1 The App

The App is not a web application and does not use cookies.

However, we incorporate the following SDKs for service improvement:

We do not perform tracking for advertising targeting in the App.

8.2 The Site

The Site uses Google Analytics to analyze and improve usage, and Google Tag Manager to manage measurement tags. Google Analytics may use cookies to distinguish users and sessions. Information such as page URLs, IP addresses, browser information, and device information may be sent to Google.

See How Google uses information from sites or apps that use its services for details. You can use the Google Analytics Opt-out Browser Add-on to disable Google Analytics measurement. You can manage cookie storage and deletion in your browser settings.

9. Children's Personal Information

The App is not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13. If we become aware that a child under 13 has provided personal information, we will promptly delete such information.

10. International Data Transfers

Data collected through the App may be stored and processed on servers outside Japan (data centers of cloud service providers) to the extent necessary for service delivery.

In accordance with Article 28 of the APPI, we take appropriate measures when providing personal information to third parties in foreign countries, specifically by confirming that adequate systems for the protection of personal information are in place at the data transfer destination.

11. Changes to This Policy

We may revise this Privacy Policy due to changes in laws, service modifications, or other reasons. Users will be notified of changes through:

1. In-app notifications
2. Posting on our website

For significant changes, we will notify users at least 14 days before the effective date. Continued use of the App after a change takes effect constitutes acceptance of the revised Privacy Policy.

12. Governing Law and Jurisdiction

This Policy is governed by and interpreted in accordance with the laws of Japan. Any disputes arising from this Policy shall be subject to the exclusive jurisdiction of the Tokyo District Court as the court of first instance.

13. Contact Us

For inquiries regarding the handling of personal information or requests for disclosure, please contact us at:

• Company: Nue Inc.
• Privacy Officer: Ryunosuke Watanabe
• Email: tabireco@nue-tech.jp

You can also reach us via the Contact Form.