Privacy Policy (Japanese / English)
HEART SHAKER General Incorporated Association (“we,” “us,” or “the Association”) establishes this Privacy Policy (the “Policy”) regarding the handling of personal information of users in connection with the services we provide — ThanksMe, THX!, ThanksRecord, Thanks Power, and ThankRize (individually or collectively, the “Services”). This Policy applies together with, and forms an integral part of, the Terms of Service for the Services.
Note: This English version is provided for reference only. In the event of any discrepancy between this English version and the Japanese original, the Japanese version shall prevail.
—
Article 1 (Basic Policy)
We recognize the importance of the personal information of users of the Services (“Users”) and will comply with the Act on the Protection of Personal Information and other applicable laws and regulations, and will strive to handle and protect such information appropriately.
Article 2 (Information We Collect)
In providing the Services, we may collect the following information:
1. Registration information: name, nickname, date of birth, email address, password
2. Post information: the content of gratitude posts, comments, tags, and images attached to posts
3. Points-related information: history of Thanks Point (TP) earning, use, and exchange, and rank/certification status
4. Prize shipping information: name, address, and phone number, collected only when a User wishes to redeem TP for a prize
5. Sending-feature information: for THX! and Thanks Power, the email address or other contact information of the third party a User designates as the recipient of a gratitude post or TP
6. Device and usage information: IP address, cookies, device information, browser information, usage history, and access logs for the Services
7. Inquiry information: information provided by a User when making an inquiry
8. Other: if we implement a cryptocurrency airdrop funded by TP in the future, the cryptocurrency wallet address and other information necessary for such purpose (the purpose of collection will be separately disclosed at the time of implementation)
Article 3 (Purposes of Use)
We use the information we collect within the scope of the following purposes:
1. To provide, maintain, protect, and improve the Services
2. To process registration, verify identity, and respond to inquiries from Users
3. To publish and share gratitude posts, and to grant and manage TP and rank/certification status
4. To provide the feature that sends gratitude posts and TP to third parties in THX! and Thanks Power
5. To process the exchange of TP for prizes (e.g., Amazon gift cards) and to ship prizes (name, address, and phone number collected for this purpose will be used only to the extent necessary for shipping and for no other purpose)
6. To respond to violations of the Terms of Service and to prevent and investigate unauthorized use
7. To deliver notices, information, and announcements regarding the Services
8. To analyze usage of the Services and to compile statistical data (limited to use in a form that does not identify individuals)
9. To confirm eligibility for, and to carry out the process of granting, any cryptocurrency airdrop we may implement in the future
10. For purposes incidental to any of the foregoing
Article 4 (Principle of Nickname Display)
1. When we publish a User’s gratitude posts or other content on the Services, the display name shown publicly is limited to the User’s nickname, and we will not publish the User’s name on the Services.
2. Notwithstanding the foregoing, we may disclose a User’s name or other registration information where there is a legitimate reason to do so, such as a disclosure request based on law or a lawful request from a court or other public authority.
Article 5 (Provision to Third Parties)
1. Except in the following cases, we will not provide personal information to third parties without obtaining the User’s prior consent:
– Where required by law
– Where necessary for the protection of a person’s life, body, or property, and it is difficult to obtain the User’s consent
– Where cooperation with a national or local government agency, or a party entrusted by such an agency, is necessary for the performance of a legally prescribed function, and obtaining the User’s consent would impede the performance of that function
2. Notwithstanding the foregoing, the following do not constitute provision to a third party:
– Where a User sends a gratitude post or TP to a third party of their own designation through THX! or Thanks Power (such sending is carried out at the User’s own instruction)
– Where, for the purpose of prize redemption, we provide a name, address, and phone number to a business we entrust with prize shipping, to the extent necessary for shipping (this constitutes entrustment under the following article)
Article 6 (Entrustment of Handling of Personal Information)
We may entrust the handling of all or part of personal information to a third party to the extent necessary to achieve the purposes of use. In such cases, we will exercise due care in selecting the entrusted party and will provide necessary and appropriate supervision of that party.
Article 7 (Use of Cookies, etc.)
1. The Services may use cookies and similar technologies for purposes such as improving User convenience and analyzing usage.
2. Users may refuse to accept cookies through their browser settings; however, doing so may make some features of the Services unavailable.
Article 8 (Security Control Measures)
We take necessary and appropriate measures, commensurate with the scale and nature of our operations, to prevent the leakage, loss, or damage of personal information we have collected and to otherwise ensure the security of such information, including the following. Because the Association is operated by a representative and a small number of operating members (including a loosely distributed, volunteer-based structure), the measures below are implemented in a manner suited to that reality.
– Establishment of a basic policy
This Policy itself serves as our basic policy for ensuring the appropriate handling of personal information, including compliance with applicable laws and guidelines and the establishment of a contact point for questions and complaints.
– Establishment of rules for handling personal data
We have clarified the handling method and the responsible operating member for each stage of handling personal data — acquisition, use, storage, provision, and deletion/disposal.
– Organizational security control measures
We limit the operating members who handle personal data and the scope of personal data they may access, and we have established a process for promptly reporting to the representative any fact or indication of a violation of law, this Policy, or our handling procedures.
– Personnel-related security control measures
We inform the operating members who handle personal data of the appropriate handling of such data, and obtain confidentiality agreements from them where necessary.
– Physical security control measures
As the Association operates online without a fixed office, we restrict access permissions for the cloud services used to store personal data and configure settings to prevent viewing by unauthorized persons.
– Technical security control measures
We implement safeguards to protect the information systems that handle personal data from unauthorized external access and malicious software, and use access controls to limit the operating members and the scope of personal information databases each may handle.
– Understanding of the external environment
We implement our security control measures with an understanding of the personal information protection regime in Japan, where personal data is stored.
Article 9 (Information of Minors)
Where a minor uses the Services and provides personal information, such use shall be with the consent of a parent or other legal representative.
Article 10 (Retention Period)
We retain personal information for the period necessary to achieve the purposes of use. Following the cancellation of a User’s registration, we will handle the User’s information in accordance with the Terms of Service and will, except where retention is required by law, erase or anonymize it within a reasonable period. We may also delete personal information before the retention period would otherwise expire, in accordance with the Terms of Service, for operational reasons such as system specification changes, the clean-up of dormant accounts, or the discontinuation or termination of the Services.
Article 11 (Requests for Disclosure, Correction, Suspension of Use, etc.)
1. A User may request disclosure, correction, addition, deletion, suspension of use, or similar action (“Disclosure, etc.”) with respect to their own personal information held by us, in accordance with applicable law.
2. Requests for Disclosure, etc. will be accepted through the contact point and method we designate. We will verify the requester’s identity and respond within a reasonable period in accordance with applicable law.
Article 12 (Contact Point)
For inquiries regarding this Policy or the handling of personal information, please contact:
HEART SHAKER General Incorporated Association — Personal Information Inquiry Desk
info@heartshaker.or.jp
Article 13 (Changes to this Policy)
We may revise this Policy as necessary. Any revised Policy will take effect upon being posted on the Services. We will endeavor to notify Users of material changes through a notice on the Services or other appropriate means.
—
Effective date: July 31, 2026
HEART SHAKER General Incorporated Association
Representative: Representative Director, Kaneto Kanemoto