1. Introduction
Iris is a personal AI agent for everyone who lives, works or travels in Japan. This Privacy Policy explains how we collect, use, store and share your information, and the rights you have over that information.
By using the Service, you agree to the handling described in this Privacy Policy. If you do not agree, please stop using the Service.
2. Information we collect
2.1 Account information
- Name or nickname, email address and mobile phone number
- LINE account identifier (if you sign in with LINE)
- Subscription and billing status (card numbers are processed by the payment provider; we do not store full card numbers)
2.2 Information you provide
- Task instructions, conversations, preference settings and feedback you give to Iris
- Files, images and records you upload
2.3 Data from third-party services you connect
When you connect and authorise a service, Iris may read and act on the following data within the permissions you grant, in order to carry out the tasks you ask for:
- Email (such as Gmail): reading confirmation emails for bookings, orders, bills and itineraries, or sending emails on your instruction
- Calendar (such as Google Calendar): reading your schedule, checking for conflicts and adding bookings
- LINE messages (the interactions needed when you use Iris through LINE)
- Payment and saved-card information (used when Iris pays for you; charges are made by a licensed payment provider)
You can revoke these permissions at any time (in the Service's "Connections" settings, or on each service's account permissions page). Related features may stop working once revoked.
2.4 Information collected automatically
- Usage logs: IP address, device type, operating system, access times and feature usage
- Crash diagnostics and performance data
- Cookies and similar technologies (see Section 11)
2.5 Special terms for data from Google APIs
Iris's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
- Google user data is used only to provide or improve the features you have enabled. It is not used for advertising or to train general-purpose AI models.
- It is not sold or transferred to unrelated third parties.
- No person reads it, except with your explicit consent, where necessary for security or legal compliance, or once it has been aggregated and anonymised.
3. How we use personal information
We use your information only for the following purposes:
- Providing and operating the Service, and carrying out the tasks you ask for (bookings, orders, purchases, ticket requests, payments and so on)
- Providing personalised, proactive service through contextual memory (remembering your preferences, schedule and past tasks)
- Connecting to and acting on the third-party services you authorise
- Improving the quality of the Service and its AI models (without identifying specific individuals)
- Providing customer support
- Keeping the Service secure, preventing fraud and abuse, and meeting legal obligations
4. Provision to third parties (APPI Article 27)
We do not provide your personal information to third parties except:
- With your prior consent
- Where required by law (such as a lawful request from a public authority)
- Where necessary to protect a person's life, body or property and it is difficult to obtain your consent
- To contractors (see Section 6), to the extent needed to achieve the purposes of use
5. Provision to third parties in foreign countries (APPI Article 28)
The Service may provide some personal information to service providers outside Japan, mainly:
- AI model providers (for large language model inference; servers may be located in the United States or other countries and regions)
- Cloud infrastructure and data analytics providers
When providing information to a third party in a foreign country, we give the information required under APPI Article 28, and either provide it only to providers that have an appropriate system for protecting personal information or obtain your separate consent. For the specific recipients and safeguards, please contact us as described in Section 14.
6. Entrustment to contractors
We may entrust the handling of personal information to external contractors (cloud services, model services, customer support and so on). In that case, we require them by contract to take security measures and supervise them as necessary.
7. Security measures
We take organisational, personnel, physical and technical security measures, including:
- Encryption in transit (TLS 1.2 or higher) and at rest (AES-256)
- Access control and authentication based on the principle of least privilege
- Keeping personal data out of logs and error reports
- Management and supervision of contractors
8. Retention and deletion
We keep your personal information only for as long as needed to achieve the purposes of use. You may request deletion at any time through the contact in Section 14. When you disconnect a third-party service, the related tokens are revoked immediately, and cached third-party content is deleted within a reasonable period (in principle, within 30 days).
9. Your rights (APPI Articles 33–35)
For the "retained personal data" we hold, you may request:
- Disclosure: what personal data we hold about you
- Correction, addition or deletion: correcting data that is inaccurate
- Suspension of use or erasure: where there are grounds set out in law, such as unlawful acquisition or use
Please make requests through the contact in Section 14. After verifying your identity, we will respond in accordance with the procedures and time limits set out in law (in principle, within 30 days). Identity verification may take some time. Thank you for your understanding.
10. Minors
The Service is intended for users aged 13 and over. Users aged 13 to 17 must have the consent of a parent or legal guardian. Situations limited to adults aged 18 and over, such as matchmaking, dining that serves alcohol and nightlife, are available only to users aged 18 and over who have completed identity verification (eKYC). We do not knowingly collect personal information from minors without the consent of a parent or guardian.
11. Cookies and analytics tools
The Service and website may use cookies and analytics tools to improve usability and understand how they are accessed. You can manage cookies in your browser settings.
12. AI and automated decisions
Iris makes suggestions and takes actions based on AI models. Its output is an aid to your own judgment and is not professional advice on legal, financial, medical or similar matters. We do not make decisions that have a legal or similarly significant effect on you based solely on automated processing. If you have questions about how we use AI, please contact us as described in Section 14.
13. Responding to leaks and similar incidents (2022 APPI amendments)
If personal information is leaked, lost or damaged (including incidents that must be reported), we will report it to the Personal Information Protection Commission as required by law, notify the individuals concerned as required, and take steps to prevent further harm.
14. Contact and complaints
- For enquiries about personal information or to exercise your rights, please use "Contact us" in the Service or the email address below.
- Email: privacy@worldx.co.jp
- If you are dissatisfied with how your personal information is handled, you may also contact the Personal Information Protection Commission.
15. Changes to this Policy
We may update this Policy from time to time. The updated version will be posted on this page with a new effective or revision date. We will notify you of significant changes by appropriate means, such as an in-app notice. Continuing to use the Service after an update means you accept the updated Policy.