Privacy Policy
IMAKAI Inc. ("we", "us") operates Apotsumu (アポツム), a form-based B2B outreach service, and Apotsumu Scheduling (アポツム日程調整), an online scheduling service (together, the "Service"). This policy explains how we collect, use, store, share and delete personal information on the Service and this website. This is an English translation of our Japanese privacy policy; if the two differ, the Japanese version prevails.
1. Information we collect
- Application information: company name, name, email address, phone number and inquiry details.
- Account information of customer organizations: members' names, email addresses, roles and authentication information.
- Sender information: the company name, person name, contact details and reply address used as the sender of outreach messages.
- Sending records: message text, date and time, recipient company, evidence that a form accepted the message, and records of replies and meetings.
- Opt-out requests: the recipient company's name and domain, and the requester's contact details.
- Booking information: the name, email address, company, department, phone number, questions and answers entered by people who book on a booking page, the booked time, and the language and time zone used. The time a booking page was opened (for aggregate statistics).
- Online business cards: the name, company, title, contact details and photo a member puts on their card (visible to anyone with the card URL), and the details a visitor enters when exchanging cards. View and save counts are recorded per day and source only; we do not record information that identifies the viewer.
- Scheduling polls: the name, optional email address, comments and answers entered by participants.
- Connected services: when a customer connects Google Calendar, Outlook (Microsoft 365) or Zoom for scheduling, the email address of the connected account, the access and refresh tokens (stored encrypted), and the busy times of the connected calendar. We do not read the titles or contents of calendar events.
- Access logs: IP address, browser type and operation history.
2. How we use information
- To provide the Service, verify companies and identities, and respond to inquiries.
- To send outreach messages, confirm acceptance, record results and prevent duplicate sending.
- To handle opt-out requests and prevent sending again after an opt-out.
- To accept bookings, send confirmations, changes and cancellations, and notify the customer who owns the booking page (booking information is provided to that customer).
- To display online business cards and pass exchanged contact details to the card owner.
- To prevent abuse, handle complaints and keep the Service secure.
- To bill customers and aggregate usage.
- To improve the Service, in a form that does not identify individuals.
3. Google user data (Google Calendar and Google Meet)
Apotsumu accesses a Google account only when a member of a customer organization connects it from the admin screen (Scheduling → Booking page settings → Calendar & meetings), and only for the scheduling features below.
- Data we access: the email address of the connected Google account (
openid,email); the busy/free times of the member's primary calendar (calendar.freebusy); and the events that Apotsumu itself creates for bookings and scheduling polls (calendar.events.owned). Withcalendar.events.owned, Apotsumu creates these events on the primary calendar, reads them back to get the Google Meet link, and updates or deletes them. It does not read, list, change or delete any other events. - How we use it: busy times are used to hide unavailable time slots on the member's booking page. When someone books, Apotsumu creates an event on the member's calendar (adding the booker as an attendee and creating a Google Meet link if the member chose these options), updates it when the booking is rescheduled, and deletes it when the booking is cancelled. The Meet link is sent to the booker and the member.
- How we store it: tokens are encrypted and stored only in the customer organization's dedicated database. The latest busy times (start and end times only, without titles or details) are kept in the same database as a cache: they are refreshed at most every 2 minutes and replaced on each refresh, are reused for up to 24 hours only if Google cannot be reached, and are deleted when the member disconnects Google. We store the ID and Meet link of each event we create, together with the booking.
- How we share it: we do not sell Google user data, use it for advertising, use it to train AI or machine-learning models, or transfer it to other customers or third parties, except as needed to provide the features above, to comply with law, or with the user's consent.
- Deletion: when the member disconnects Google from the admin screen, we revoke the token with Google and delete the stored token and email address. A user can also remove Apotsumu's access at any time at myaccount.google.com/permissions. To ask us to delete other data, contact us at the address below.
Apotsumu's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
4. Microsoft and Zoom
- Outlook (Microsoft 365): like Google Calendar, we read busy times, create, update and delete booking events, invite the booker, and create Microsoft Teams meetings.
- Zoom: we read the connected Zoom user's basic profile (user ID and email address), and create, update and delete a Zoom meeting for each booking. The meeting link is sent to the booker and the member. When the member disconnects Zoom, or removes the Apotsumu app in Zoom, we revoke the token and delete the stored token and email address.
For these features, the booker's name, email address, company and questions are registered as event or meeting details in the customer's Google Calendar (Google LLC), Outlook (Microsoft Corporation) or Zoom (Zoom Communications, Inc.) account.
If a customer uses the "pre-meeting notes" feature, the booker's questions and department, the proposal sent, and public information about the booker's company are processed by AI (OpenAI) to create the notes. The booker's name, email address and phone number are not sent to the AI. Data from Google, Microsoft or Zoom is not sent to the AI.
5. Notifications, analytics and API set up by customers
A customer may, at its own discretion, send booking and poll information to Slack, Chatwork or a webhook URL it specifies, add Google Analytics or Google Ads tags to its booking pages, or read and operate bookings through the REST API or MCP server with an API key. In these cases the information is sent on the customer's instructions, and its handling at the destination is governed by that destination's terms.
6. Disclosure to third parties
Except as required by law, we do not provide personal information to third parties without the person's consent. We never let one customer see another customer's activity or data.
7. Service providers
We use the following service providers to the extent necessary to provide the Service. Some of them are located in the United States. We confirm that they maintain systems that meet the standards set by Japan's Act on the Protection of Personal Information, and supervise them appropriately.
- Cloud infrastructure, data storage and email delivery: Cloudflare, Inc. (United States)
- AI processing for summaries, proposals and opt-out detection: OpenAI (United States). Used only when a customer turns on AI features, under terms where inputs are not used for training and responses are not retained by OpenAI.
- Payments: Stripe, Inc. (United States). Card details are collected directly by Stripe and never pass through our servers.
8. Retention
We keep personal information only as long as needed for the purposes above and delete it without delay when it is no longer needed. Sending evidence during trials is kept for 30 days and audit logs for 180 days. Tokens for connected services are deleted when the connection is removed. Minimal identifiers needed to honor opt-out requests may be kept after a contract ends to prevent sending again.
9. Security
Each customer organization's data is kept in a separate, dedicated runtime and database. Communication is encrypted, tokens are encrypted at rest, administrative operations require multi-factor authentication, and inputs are masked in logs.
10. Your rights
You may ask us to disclose, correct, stop using or delete personal information we hold about you. Contact us at the address below; we will verify your identity and respond in accordance with applicable law.
11. Contact
IMAKAI Inc.
Representative Director: Manuel Otake
Shibuya Dogenzaka Tokyu Bldg. 2F-C, 1-10-8 Dogenzaka, Shibuya-ku, Tokyo 150-0043, Japan
Email: support@apotsumu.com (weekdays 10:00–18:00 JST, excluding Japanese public holidays and Dec 29–Jan 3). See also Support.
12. Changes
We may update this policy as needed. We will announce important changes on this website.