Privacy policy
KARYOGRAM Inc. (株式会社KARYOGRAM) (“we”) handles personal information as described below in providing the Shopify app Invitation Pass (the “App”).
1. Our role
The App receives membership applications from the customers of a store that installs it (the “Store”) and helps the Store review them. For personal information about a Store’s customers, it is the Store that decides the purposes and means of processing; we process it on the Store’s instructions. If you are a customer of a store, please read that store’s own privacy policy first.
2. Information we collect
About a Store’s customers
- What is entered on the registration form: name, email address, phone number, address, a referrer’s name and contact details, and answers to any other fields the Store has set up
- Files attached on the registration form, where the Store has added an upload field
- Shopify customer data: customer ID, the tag representing approval status, and the number of orders and amount spent (read each time only to show it on the review screen; we do not store it)
About the Store
- The Store’s domain and name, notification email addresses, and the App’s settings
- Which staff member made each review decision, as part of the audit trail
3. Why we use it
- Receiving membership applications and supporting the Store’s decisions
- Sending emails about receipt and the outcome of a review, on the Store’s behalf
- Preventing customers who are not yet approved from completing a purchase
- Investigating faults, preventing misuse, and answering enquiries
We do not use personal information for any other purpose. We do not use it for advertising, marketing or analytics, and we never sell it.
4. Sharing and sub-processors
We do not disclose personal information to third parties without the consent of the individual or the Store, except where the law requires it. We use the following providers to run the App.
| Provider | What they do | Country |
|---|---|---|
| Shopify Inc. | Stores customer data and uploaded files, inside the Store’s own Shopify account | Canada |
| Fly.io, Inc. | Hosts the App’s servers and database (Tokyo region) | United States |
| Resend, Inc. | Sends email | United States |
Where a Store configures a destination under “Integrations”, application and review data is sent to that destination as an instruction from the Store.
For transfers to providers outside Japan, we have confirmed that appropriate safeguards are in place, meeting the standards set by Japan’s Personal Information Protection Commission.
5. How long we keep it
- When a Store uninstalls the App, we delete all of that Store’s data on receiving Shopify’s deletion request — about 48 hours after uninstall.
- When a Store’s customer requests deletion through Shopify, we delete that customer’s application record.
- Email delivery logs are deleted according to Resend’s retention period.
6. How we keep it safe
- All traffic is encrypted (HTTPS), and the database and its backups are encrypted at rest.
- Access to the servers and database is limited to a small number of people, and two-factor authentication is enabled on every service account.
- Every review action is recorded with who did it and when.
- Development and testing use a separate environment and separate data from production.
- We maintain an incident response procedure, and will notify the Store and the relevant authorities promptly if a breach occurs.
7. Access, correction and deletion requests
Requests from a Store’s customers are normally handled through that Store. If you contact us directly, we will work with the Store to respond. A Store should send its own requests to the contact below.
8. Customers in the EEA, the UK and elsewhere
Where the General Data Protection Regulation (GDPR) or a similar law applies, we act as the Store’s processor and handle personal data on the Store’s instructions.
9. Changes
If we change this policy, we will post the change on this page. We will also announce significant changes inside the App.
10. Contact
KARYOGRAM Inc. (株式会社KARYOGRAM)
Representative: Masatoshi Kaneko
Email: info@get-a-bako.com
We will provide our postal address without delay on request.
This English text is a translation provided for convenience. If it differs from the Japanese original, the Japanese version governs.