Privacy Policy

1. Operator, scope and contact

Information about the operator is available at https://uniquex.co.jp/about. Inquiries and requests concerning personal information are accepted at privacy@eunoos.com.

eunoos is currently provided to residents of Japan. It is not offered to residents of the EEA or the United Kingdom.

2. Information we collect

We collect or process the following information in connection with the service:

• Account and authentication information, including email address, Google account identifier, account creation time, session information and information temporarily required for OAuth authentication.
• Connected-account information, including account and calendar identifiers, display names, time zones, OAuth access and refresh tokens, and token expiry times.
• Synchronization settings, including source and destination calendars, privacy mode, title template, filters, synchronization period, processing status and copy mappings.
• Calendar event information required for synchronization, including start and end times, availability, recurrence and status. Depending on the privacy mode and event, this may also include the title, description, location and attendee email addresses.
• Usage and security information, including synchronization time and result, internal identifiers, error information that excludes event bodies, request metadata and other records required for stable and secure operation.
• Access and effectiveness measurement information, consisting only of the UTC day or week, a pre-approved landing-page variant, source, campaign, event type, call-to-action placement and aggregate request count. The marketing database does not store IP addresses, User-Agent strings, referrers, full URLs, search terms, cookies or device identifiers, user identifiers, advertising click identifiers, Google account information or calendar information. During authentication, the approved categories are associated with a random OAuth state for no more than 10 minutes; no per-person event history is retained.
• Inquiry information, including the sender’s email address, name, message, attachments and delivery information.

3. Purposes of use

We use the information described above for the following purposes:

• To register and authenticate users and manage sessions and connected accounts.
• To read and write calendar information and perform, retry and manage synchronization according to settings selected by the user.
• To provide account, connection and data deletion functions.
• To maintain, protect and improve the reliability of the service; investigate failures; prevent unauthorized use; and enforce these Terms of Service.
• To measure aggregate requests to landing-page variants and aggregate starts and completions of the sign-in flow by approved source and campaign, and to evaluate and improve advertising content, service explanations and the path to starting the service. We do not use this information for per-person profiling, retargeting or personalized advertising.
• To respond to inquiries and requests concerning personal information and to keep records necessary for those responses.
• To comply with laws and regulations and protect the rights and safety of users, third parties and the operator.

4. Google API data

eunoos accesses Google identity information for sign-in and Google Calendar information only after the user authorizes the requested scopes. Google Calendar information is used only to perform the synchronization rules configured by the user and related service functions.

eunoos’ use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Information received from Google APIs is not sold, used for advertising, or used to train or improve generalized machine-learning or artificial-intelligence models.

Google account identifiers, email addresses, ID-token contents, OAuth tokens and Google Calendar information are not used for access or effectiveness measurement and are not joined to campaign information. An OAuth completion is recorded only as an aggregate count of successful eunoos sign-in processing and is not provided to an advertising or analytics provider.

5. Service providers and third-party disclosure

The operator uses Cloudflare, Inc. for hosting, content delivery, database, queue, security-log, server-side access-aggregation and email-routing functions, and Google LLC for sign-in, Google Calendar integration and receipt of routed inquiry emails. Each service provider receives only the information necessary for the relevant function and is subject to appropriate oversight as required by applicable law.

When a user configures a destination calendar, eunoos writes the selected information to that calendar at the user’s direction. The information is then also handled under the account permissions and terms applicable to that destination.

Except for outsourcing, user-directed processing, business succession, or another case permitted by law, we do not disclose personal data to a third party without the individual’s prior consent. We do not sell personal data or provide it to data brokers, advertising networks or analytics providers.

6. Processing outside Japan

Cloudflare and Google operate infrastructure and use group companies and subprocessors in multiple countries. Personal data may therefore be processed outside Japan when we use their services.

The operator confirms the relevant data-protection systems and provider safeguards and exercises necessary and appropriate oversight in accordance with the Act on the Protection of Personal Information. Information the operator can provide concerning overseas processing is available upon request at the contact address above.

7. Retention and deletion

We retain personal information only for as long as necessary for the purposes stated in this Policy. Account information is retained until account deletion, and connection information, OAuth tokens, synchronization settings and active copy mappings are retained while the relevant connection is active.

Calendar event caches are removed after the connection is deleted and are also periodically reduced by retention controls. Records used to prevent recreation of a deleted copy are retained for 30 days, and synchronization and failed-job records for 90 days. Sessions expire within 30 days and after 14 days of inactivity; temporary OAuth information expires after 10 minutes.

Daily aggregate access and effectiveness counts are retained for 90 days, and weekly aggregates generated from them for 13 months. The approved landing-page and campaign categories associated with an OAuth state expire after no more than 10 minutes and are deleted when the state is consumed or by subsequent scheduled cleanup. Aggregate counts have no per-person correspondence and therefore cannot be searched or deleted for an individual user.

Inquiry correspondence is ordinarily retained for no more than three years after the last exchange. Information may remain temporarily in backup or recovery history until it is overwritten under the provider’s retention cycle. We may retain information for a longer period when required by law or reasonably necessary to resolve a dispute or security incident.

8. Cookies and similar technologies

eunoos uses only cookies necessary for authentication, session maintenance and protection of OAuth flows. We do not use cookies, localStorage, fingerprinting, browser beacons or third-party advertising or analytics tags for access and effectiveness measurement. Measurement uses ordinary requests to fixed eunoos URLs and server-side aggregate counting; it does not cause the user’s device to send measurement data to an advertising or analytics provider. If necessary cookies are disabled, sign-in and calendar connection may not function.

9. Security measures

The operator takes necessary and appropriate organizational and technical measures, including access control, separation of user data, encryption of OAuth tokens and event bodies at rest, hashing of session tokens, management of encryption keys as server-side secrets, and controls intended to prevent sensitive content from being included in logs.

If a personal data incident occurs, we investigate and contain it and report to the Personal Information Protection Commission and notify affected individuals when required by law.

10. User requests

Users may disconnect a calendar or delete their eunoos account from the service. Disconnecting stops synchronization and starts deletion of the relevant tokens, metadata, cache, mappings and settings. The user can choose whether eunoos should attempt to delete destination copies; some remote copies may remain if deletion fails at the provider.

Requests for notification of purpose, disclosure of retained personal data or third-party provision records, correction, addition, deletion, suspension of use, erasure, suspension of third-party provision, or other rights available under applicable law may be submitted to privacy@eunoos.com. We may verify the requester’s identity and may decline all or part of a request where permitted by law, in which case we will explain the reason as required.

11. Changes to this Policy

The operator may revise this Policy in response to changes in the service or applicable law. The revised Policy and its effective date will be posted and, when required by law or appropriate in light of the change, advance notice will be provided or consent obtained.