プライバシーポリシー

Burst Inc. (Burst株式会社)
Wizard Bldg. 402, 1-4-3 Sengencho, Nishi-ku, Yokohama, Kanagawa 220-0072, Japan
Representative Director: Ryuji Hisano

· Shopify store: store domain, store name, the access token Shopify issues (stored encrypted), granted scopes, install and uninstall dates
· Products: title, price, currency, images, product page URL, tags, product type, vendor and availability. We do not read product descriptions or inventory counts
· Company details the merchant saves: legal name, address, phone, contact name, contact email and logo. Store name, address and email from Shopify only pre-fill the form and are not recorded until the merchant saves
· Plan and billing: plan, status, period, Shopify or Stripe charge and payment IDs, pack purchases and the qualified invoices we issue. We do not hold card details
· Records of agreement and actions: the email of whoever agrees to the Terms, buys a pack or authorises automatic packs (for Terms agreed in the Shopify app, the store's email)
· For direct dashboard use: login email, display name, and a password (stored hashed) or a Google/Apple account identifier, and last login time. The dashboard uses cookies to keep you signed in and to prevent abuse
· Contact names, contact details and correspondence records from enquiries and sales conversations

· Quiz answers: the options or slider values chosen and the results shown. There are no free-text fields; we do not collect names, emails or phone numbers
· Quiz usage: question views, quiz start and completion, option selections, result views and product clicks, each tied to a random ID created fresh on every page load (session ID). The quiz page sets no cookies. Product images load in the shopper's browser directly from Shopify or the merchant's image host
· Purchases (Shopify app only): through the Web Pixel in section 5, for sessions that were shown a quiz result, we record the order value, currency and date (to the day). We do not record order numbers, customer IDs, names, emails or addresses
· Request logs: to prevent abuse and investigate faults, our servers record the requesting IP address, the URL requested and the time in the hosting provider's logs. IP addresses are not stored in our database

Where a merchant tags answer options with an age or gender tendency, we aggregate answers into an estimated age and gender mix shown in the merchant's report. The estimate is computed as an aggregate when the report is viewed; no per-shopper estimate is stored. Groups of fewer than 20 sessions are not shown. The estimate is indicative only and does not state any shopper's actual age or gender.

The Shopify app adds a Web Pixel to the store. It detects page views and completed checkouts, and runs only when analytics and marketing are both permitted in Shopify's privacy settings (depending on the store's regional settings, this may be permitted without a consent banner). It saves the session ID from the URL the shopper reached from the quiz in the browser (localStorage); when a checkout completes it sends the session ID, order value and currency to us and deletes the saved ID. An ID saved more than 30 days earlier is not sent. If permission is withdrawn, the saved ID is deleted the next time a store page is open.

Providing the Service (showing quizzes, matching products, building reports), syncing products with the Shopify store, billing and issuing qualified invoices, notices such as changes to the Terms, answering enquiries, sales and customer management, preventing abuse, investigating faults, and maintaining and improving the Service. We do not use one merchant's information for another merchant's quizzes or reports. We may, however, create, use or publish statistics that identify no individual and no merchant (Rekotto Terms, Article 8).

Shopper information is provided only to the merchant whose store ran the quiz, as reports and similar. Except as required by law, we do not provide it to any other third party without consent.

We use the following providers, under appropriate supervision, as needed for the purposes above:
· Database: Supabase (Tokyo, Japan region)
· Hosting: Vercel (processing in the Tokyo, Japan region, including request logs)
· Email: Resend (United States), for invoices and notices to merchants, email verification and password reset, and the reports in section 10
· Payments: Stripe (United States), for fees paid by merchants using the dashboard directly; the merchant's email is sent to it
As Resend and Stripe are in the United States, information sent to them is provided to third parties outside Japan. For the United States' data protection regime, see the information published by Japan's Personal Information Protection Commission. Appropriate safeguards are required by contract.
For the Shopify app, store, product and billing information comes to us from Shopify (Shopify Inc.), and fees are paid through Shopify's billing. Signing in with Google or Apple gives us the email and display name from that provider.

· Quiz answers and usage records: deleted automatically, daily, once 400 days old
· Request logs: kept in the hosting provider's logs for up to 30 days, then erased automatically
· Shopify access token: deleted as soon as the app is uninstalled
· After the contract ends: 90 days after a cancellation, or after the paid period ends following an uninstall of the Shopify app, we delete products (including images), quiz content and appearance settings, answers and usage records. Where a store is suspended for non-payment, deletion follows 30 days after the notice of termination, which comes 90 days after suspension. Where there is no paid period (such as launch partners), we delete on request to info@burst-tech.com
· On Shopify's shop data erasure request (shop/redact), we delete credentials. Other information is deleted on the schedule above or on request
· Qualified invoices and their lines: kept 7 years, as required by law
· Login accounts, company details and logo, the store's registration record, plan and billing records, and records of agreement: not covered by the deletions above; kept as long as needed for billing and legal obligations. On request we delete those not required by law

Requests from shoppers who bought from a Shopify store reach us through Shopify (customers/data_request, customers/redact). We read the orders named in the request from Shopify (visit URLs, amount, time and similar) to identify the shopper's quiz sessions; for an access request we email the records, with the order numbers, to the store's email address, and for an erasure request we delete the matching answers and usage records. The order information we read is not stored. As a record of handling the request, the Shopify customer ID remains in the hosting provider's logs. If a shopper took a quiz but did not buy, we hold nothing that identifies them and cannot locate their records.

Shopify access tokens are encrypted with AES-256-GCM. Traffic is encrypted (HTTPS), access to the database and our internal console is limited to our staff and access rights are managed. We take organisational, personnel, physical and technical measures against leakage, loss and damage.

Questions about this policy, and merchants' requests for access, correction, deletion or suspension of use: info@burst-tech.com. We may verify identity or store ownership. No fee is charged.