Privacy Policy

Value Inc. (“we” or “the Company”) recognises the appropriate handling of the personal information of Tenants and End Users as an essential responsibility in providing FormEdge (“the Service”), and complies with the Act on the Protection of Personal Information (APPI) and other applicable laws and regulations.

Terms used in this Policy have the same meaning as in the Terms of Service.

1. “Tenant Information” means the information a Tenant provides to the Company when registering for and operating the Service (company name, name, email address, and the like).
2. “Submission Data” means the information an End User submits through a Tenant’s form.
3. “Technical Information” means IP addresses, browser information, access logs, and the like.

The Company collects the following information.

(1) Information collected directly from Tenants

• Name and company name
• Email address
• Login credentials (the Company does not store passwords itself; authentication is managed by Clerk)
• Payment information (processed through a payment service provider; the Company does not hold it directly)

(2) Information collected automatically through use of the Service

• Technical Information such as IP address, browser type, and date and time of access
• Operation logs such as creating, editing, and publishing forms

(3) Submission Data of End Users

The Company holds and processes the Submission Data of End Users who respond to a Tenant’s form on the Tenant’s instructions. The Company does not make any independent use of its contents. With respect to such Submission Data the Company acts as a contractor (processor) engaged by the Tenant, while with respect to Tenant Information and Technical Information the Company acts as a business operator handling personal information.

The Company uses the information it collects for the following purposes.

1. Providing, operating, and improving the Service
2. Providing support to Tenants and sending notifications
3. Billing and payment processing
4. Detecting and preventing improper use
5. Performing obligations under applicable law
6. Producing statistics that do not identify individuals (for the purpose of improving the Service)

For individuals to whom the EU or UK General Data Protection Regulation (GDPR / UK GDPR) applies, the Company processes personal data on the following legal bases.

• Providing and operating the Service, providing support, and billing: performance of a contract
• Improving the Service, producing statistics, preventing improper use, and ensuring security: the Company’s legitimate interests
• Cookies for access analytics and optional integration features: consent
• Performing obligations under applicable law: compliance with a legal obligation

The Company does not provide Tenant Information or Submission Data to third parties except in the following cases.

1. Where the Tenant has given prior consent
2. Where disclosure is required by law
3. Where it is necessary to protect the life, body, or property of a person and obtaining the consent of the individual is difficult

The Company may outsource operations such as authentication, payment, email delivery, and infrastructure to external providers to the extent necessary to provide the Service. The Company requires its contractors (processors) to implement appropriate security measures and exercises necessary and appropriate supervision over them. The principal contractors are as follows.

• Authentication: Clerk, Inc. (United States)
• Payment: Stripe, Inc. (United States)
• Email delivery: Resend, Inc. (US company; sending servers in Japan (Tokyo))
• CDN, storage, and security: Cloudflare, Inc. (United States; includes storage of attachments)
• Application servers: Railway Corp. (US company; servers in Singapore)
• Database: Neon, Inc. (US company; servers in Singapore)
• Queue and temporary storage: Upstash, Inc. (US company; servers in Singapore)
• AI processing: Anthropic, PBC (United States)
• Service monitoring: Grafana Labs (United States; metrics containing no personal information only)
• Custom domain registration: Openprovider B.V. (Netherlands; only where registration is requested)
• Support desk email: Microsoft Corporation (United States; only where an enquiry is made)

Provision to Meta in connection with the Instagram integration is as set out in Article 6-2. The full list of contractors is published at “Sub-processors”.

As stated above, the Company outsources the handling of personal information to third parties located in foreign countries, namely the United States, Singapore, and the Netherlands. Information on the personal data protection regimes of those countries is available in the Commission’s survey of personal data protection regimes in foreign countries, published on the website of the Personal Information Protection Commission. The Company contractually requires its contractors to implement security measures and has confirmed that measures corresponding to the eight principles of the OECD Privacy Guidelines are in place.

Transfers of personal data from the EU and the UK to Japan are made on the basis of the adequacy decisions granted to Japan.

As an optional feature, a Tenant may connect its own Instagram professional account to the Service. In connection with that integration, the Company obtains and stores the following information through the API provided by Meta Platforms, Inc. (“Meta”).

• The ID and username of the Instagram account
• The access token used to retrieve posts
• Information about the public posts of the connected account (post URL, caption, date and time of posting, and the like; the image and video files themselves are not stored)

This information is used solely for the purpose of displaying Instagram posts on pages the Tenant creates with the Service, and for no other purpose. It is not provided to third parties (except in the cases set out in Article 5).

A Tenant may delete the stored integration information by disconnecting the integration from the Service’s dashboard or by revoking the Service’s access permission on Instagram. For details of the deletion procedure, see “Instagram連携データの削除手順 (Japanese)”.

For Meta’s handling of information in connection with the integration, please refer to Meta’s privacy policy.

The Service provides the following AI-based features. All such processing is carried out through the API of Anthropic, PBC, one of the Company’s contractors (processors).

1. AI form generation and AI page refinement: the instructions entered by the Tenant and the body text of the target page are sent to the Anthropic API and the generated result is returned. Submission Data is not sent.
2. Spam screening: only where a Tenant on a paid plan enables it for a given form, Submission Data is sent to the Anthropic API for the purpose of screening.

For both features, under the terms of Anthropic’s commercial API the content sent is not used to train AI models.

Where a Tenant connects an AI client (such as ChatGPT or Claude) to the Service via MCP or the API, that AI client may read Submission Data to the extent permitted by the Tenant. In that case, the handling of information by the AI provider is governed by the contract between the Tenant and that provider, and that provider is not a contractor (processor) of the Company.

The Service uses cookies to the extent necessary to provide the Service, including maintaining login sessions, preventing improper use, and remembering consent status.

Users (Tenants and End Users) may disable cookies through their browser settings, in which case some features of the Service may become unavailable.

The Company uses Google Analytics (Google LLC) to improve the Service. Cookies for access analytics are used only where consent has been given through the consent banner displayed on the Company’s website and dashboard. Where consent is not given, no cookies are used and measurement is carried out only in a form that does not identify individuals. Consent may be changed at any time from “Cookie settings” at the bottom of the website. For Google’s handling of information, please refer to Google’s privacy policy.

The content, recipients, and purposes of information transmitted from a user’s device to external providers are published at “External Transmission of User Information”.

Where a Tenant places third-party analytics tags (such as Google Analytics) on its own forms, the collection and handling of information by those tags is carried out under the Tenant’s responsibility, and the Tenant is also responsible for informing End Users and obtaining any necessary consent. The Company bears no responsibility in this respect.

The Company stores Tenant Information and Submission Data in an appropriately secure environment.

Where a Tenant terminates its account, the Company deletes Submission Data within 60 days after termination. Tenant Information is deleted after termination, except for information the Company is required by law to retain.

Retention periods are as follows.

• Tenant Information: deleted after termination, except where retention is required by law (transaction records and the like).
• Submission Data and attachments: deleted within 60 days after termination.
• Workspaces on the free plan that have not been used for a long period: may be suspended and deleted in accordance with Article 7 of the Terms of Service.
• Backups: retained for a short period solely for recovery purposes and erased once that period has elapsed.
• Records of consent to access analytics (cookies): retained for one year.

The Company implements appropriate technical and organisational security measures, including access control, encryption of communications, and supervision of contractors (processors), in order to prevent leakage, loss, or damage of the information it collects.

The Company may store information on servers in foreign countries (such as the United States and Singapore), and implements security measures having ascertained the personal data protection regimes of those countries (understanding of the external environment).

However, the Company does not guarantee complete security for communications over the internet.

A Tenant may make the following requests with respect to its own Tenant Information held by the Company.

• Notification of the purpose of use
• Disclosure
• Correction, addition, or deletion
• Suspension of use or erasure

Please direct such requests to the contact below. The Company will respond within a reasonable period after verifying the identity of the requester.

Individuals to whom the EU or UK General Data Protection Regulation (GDPR / UK GDPR) applies additionally have the right to request access to, rectification of, and erasure of their personal data, restriction of processing, data portability, to object to processing, and to withdraw consent. The Company will in principle respond to such requests within one month.

You may lodge a complaint about the Company’s handling of personal data with a supervisory authority (in Japan, the Personal Information Protection Commission; in the EU and the UK, the supervisory authority of your country of residence). The Company has no establishment in the EU and has not appointed a representative in the EU (Article 27 GDPR). Please direct enquiries to the contact set out in Article 13.

Requests for disclosure, correction, deletion, and the like relating to the Submission Data of End Users should in principle be made to the Tenant, which is the business operator handling that data. The Company, as a contractor (processor), will assist with such requests on the Tenant’s instructions.

The Service is not intended for use by persons under 18 years of age. Minors should use the Service only with the consent of a parent or guardian.

The Company may revise this Policy in line with amendments to laws and regulations or changes to the Service. In the case of a material change, the Company will give prior notice by email or by notification within the Service.

The revised Policy takes effect on the date shown as the “Last updated” date at the top of this page.

For enquiries regarding the handling of personal information, please contact us at the following.

Value Inc., Personal Information Enquiries Desk
Email: info@value-it.co.jp

For enquiries regarding use of the Service (support desk), please contact support@formedge.app.

This Policy takes effect on June 25, 2026.