Privacy Policy

Last updated: October 31, 2026

This policy explains how CloudEffects LLC ("CloudEffects," "we") collects, uses and shares personal information about our customers, their Users and visitors to our websites, and the choices and rights you have. It applies to our websites, the OS iXanagi console, our API and our support channels (the "Services").

When we act for our customers. Customers use OS iXanagi to run their own websites, messages and stores, and in doing so process information about their own End Customers. For that data, our customer decides how it is used and is responsible for it, and we process it only on their instructions under our Data Processing Addendum. If you are an End Customer of a business that uses OS iXanagi, please read that business's privacy policy and contact them to exercise your rights.

• Customer: a business that has an OS iXanagi account. User: a person the Customer allows to use the account.
• End Customer: a visitor, buyer or contact of a Customer's website, messages or store.
• Customer Content: what Customers and Users put into OS iXanagi, such as knowledge, pages, messages, product data and files.
• Usage Data: information about how the Services are used, such as features used, requests and logs.
• Aggregated data: statistics that cannot reasonably be linked to a person or a Customer.

We do not receive full card numbers. Stripe processes card data. We do not ask for sensitive information such as health, religion or government ID numbers; please do not put it into the Services unless your use requires it and the law allows it.

We use personal information to:

1. provide, operate and maintain the Services, including your account and the features you use;
2. protect the Services and our customers: authenticate users, enforce permissions, prevent fraud and abuse, and enforce our Acceptable Use Policy;
3. process payments and calculate the taxes on them;
4. answer support requests and communicate about your account;
5. keep audit records of actions taken in your Tenant, including AI proposals and approvals;
6. improve the Services and create aggregated data;
7. send service notices, and, where permitted, marketing you can opt out of;
8. comply with law and respond to lawful requests.

We do not sell personal information or share it for cross-context behavioral advertising. If we want to use personal information for a purpose not listed here, we will ask for your consent unless the law allows otherwise.

When you use AI features, the content needed to answer your request is sent to our AI providers listed on the Sub-processors page. They process it to return a result and do not use it to train their models. We do not use Customer Content to train AI models. AI proposals, approvals and the resulting actions are recorded in your Tenant's audit log.

Our websites and console use cookies and similar technologies to keep you signed in, remember settings, analyze how the sites are used and measure the results of our ads. The companies that receive this information, what they receive and how to opt out are listed on our External Transmission page. You can block cookies in your browser; some features may then stop working.

Do Not Track and Global Privacy Control. We do not sell personal information or share it for cross-context behavioral advertising, so these signals have nothing to opt you out of. Our sites do not currently change how they work when they receive a Do Not Track or Global Privacy Control signal. To stop analytics and advertising measurement, use the opt-out methods on the External Transmission page or block cookies in your browser.

We share personal information only:

• with sub-processors that help us run the Services (hosting, AI, payments, email), under contracts that limit their use to our instructions — see Sub-processors;
• with services you choose to connect, such as Google, LINE, Meta or a marketplace, at your direction;
• with your organization: Users' activity in a Tenant is visible to that Tenant's administrators;
• when the law requires it, or to protect the rights, safety or property of people or of CloudEffects;
• in a merger, acquisition or sale of assets, with notice to you;
• with your consent.

Where the law requires a legal basis for processing (for example in the European Economic Area and the United Kingdom), we rely on: performing our contract with you (sections 3.1, 3.3, 3.4); our legitimate interests in securing and improving the Services and keeping records (3.2, 3.5, 3.6), balanced against your rights; your consent (non-essential cookies and some marketing), which you can withdraw at any time; and legal obligations (3.8).

We are based in the United States and process data in the AWS US West (Oregon) region. Our sub-processors are also in the United States. If you are outside the United States, your information is transferred to and processed in the United States, under contracts with our sub-processors that require them to protect it. Additional information for residents of Japan is in section 13.

We may keep information longer where the law requires it, or to resolve a dispute or protect against fraud, only for as long as that need lasts. When we no longer need personal information, we delete it or turn it into aggregated data.

We protect personal information with technical and organizational measures, described on our Security page — for example tenant isolation, permission checks on every request, encryption of stored credentials and audit logs. No system is perfectly secure. If a personal data breach occurs, we will notify the authorities and the people affected as the law requires.

Depending on where you live, you may have the right to:

• access the personal information we hold about you and receive a copy in a portable format;
• correct inaccurate information;
• delete your information;
• object to or restrict certain processing, or withdraw consent;
• opt out of marketing — use the link in each email.

You can view and correct most account information in the console. For anything else, email legal@cloudeffects.com. We verify your identity before acting, may ask an authorized agent for proof of authority, respond within the time the law requires, and will not treat you differently for exercising your rights. If you are not satisfied, you may complain to your local data protection authority.

We do not sell or share personal information, and we do not use sensitive personal information to infer characteristics about you. The categories we collect, their sources and purposes, and the recipients are described in sections 2, 3 and 6, and how long we keep them in section 9. Residents of California and other states with consumer privacy laws may request access, correction and deletion as described in section 11, and may appeal a decision we make by replying to it. How our sites respond to Do Not Track and Global Privacy Control signals is described in section 5.

When we process End Customer data for a Customer, we act as that Customer's service provider under our Data Processing Addendum.

The following items are published under Japan's Act on the Protection of Personal Information (the "APPI") and related laws.

(1) Business operator. CloudEffects LLC, 400 Hauser Blvd, Los Angeles, CA 90036, USA. Representative: Koshiro Nakagami.

(2) Purposes of use. As listed in section 3. We do not handle personal information beyond those purposes without your consent, except where the law allows.

(3) Provision to third parties. We do not provide personal data to third parties without your prior consent, except where the law allows. Entrusting data to our sub-processors and transfers as part of a business succession are not provision to third parties under Article 27(5).

(4) Third parties in a foreign country (Article 28). We store and process personal data in the United States, and our sub-processors are in the United States. The United States has no comprehensive federal privacy law; privacy is protected by sector-specific federal laws and state laws such as the California Consumer Privacy Act. The Personal Information Protection Commission (PPC) publishes information about foreign systems on its website. We require our sub-processors by contract to take measures equivalent to those the APPI requires of a business operator, and once a year we check how they carry them out, by reviewing each sub-processor's published security and privacy commitments and audit reports, and changes in the laws that apply to them. On request, we will provide information about these measures.

(5) Security control measures. In addition to section 10:

• Basic policy and rules: this policy is our basic policy for handling personal data. How we handle it at each stage — collection, use, storage, provision, deletion — is set out in this policy (sections 2, 3, 6 and 9), our Data Processing Addendum and our Security page.
• Organization: our Representative, Koshiro Nakagami, is responsible for personal data protection. Anyone who learns of a possible leak, loss or damage reports it to him, and he decides on reports to the PPC and notices to the people affected.
• Personnel: everyone who handles personal data, including contractors, is bound by a written confidentiality obligation and is taught how to handle it.
• Physical measures: data is kept in our cloud provider's data centers, and we operate no servers of our own.
• Technical measures: tenant isolation, permission checks on every request, encryption of stored credentials and audit logs.

Understanding the foreign environment: we handle personal data in the United States, and take our measures with an understanding of the United States' system described in (4).

(6) Personally referable information (Article 31). We do not provide cookie identifiers or similar information to a third party that is expected to obtain it as personal data, unless we have confirmed that your consent has been obtained as the law requires.

(7) External transmission (Telecommunications Business Act). The information sent from your device to outside companies is listed on our External Transmission page.

(8) Requests for disclosure and other actions (Articles 32-35). You may request notification of the purposes of use; disclosure of your retained personal data (including in electronic form, if you choose); correction, addition or deletion; suspension of use or erasure; suspension of provision to third parties; and disclosure of records of provision to third parties. Send requests to legal@cloudeffects.com. We will verify your identity (and, for an agent, a power of attorney), respond without delay, and give our reasons if we do not act on all or part of the request.

(9) Data breaches (Article 26). If a breach occurs that the law requires us to report, we will report it to the PPC and notify the people affected.

(10) Marketing email. We send advertising email only to people who have agreed to receive it, with a way to opt out, as the Act on Regulation of Transmission of Specified Electronic Mail requires.

(11) Complaints and inquiries. legal@cloudeffects.com

The Services are for businesses and are not directed to children under 16. We do not knowingly collect personal information from them. If you believe a child has given us personal information, contact us and we will delete it.

We will post changes here and update the date at the top. If a change is material, we will notify you by email or in the console at least 30 days before it takes effect, unless the law requires a change sooner.

legal@cloudeffects.com, CloudEffects LLC, 400 Hauser Blvd, Los Angeles, CA 90036, USA.