Privacy Policy

Stats Inc. (the "Company") handles the personal information of Users as set forth below in connection with the use of "S/PASS," the event reception management service provided by the Company (the "Service").

Last updated: 2026-10-19

0. Terms Used in this Policy

The Service is a platform for event organizers ("Organizers") to invite and manage participants ("Participants"). Collaborators who are invited by an Organizer and granted permission to operate the Organizer's Account or events ("Members") are included in Organizers for the purposes of this Policy. In this Policy, "Organizers" and "Participants" are collectively referred to as "Users."

With respect to the personal information of Participants, the Company is in the position of processing such information on the basis of entrustment from the Organizer (as an entrusted party as provided in Article 27, Paragraph 5, Item 1 of the Act on the Protection of Personal Information (the "APPI")), and the Organizer bears ultimate responsibility for its handling. The details of the division of roles between the Company and the Organizer are governed by the Terms of Service and a separately concluded data processing agreement (the "DPA").

1. Business Operator Information

2. Personal Information Collected

In connection with the use of the Service, the Company may collect the following personal information.

2-1. Information Collected Directly from Organizers

• Name (name of the person in charge)
• Company name
• Email address
• Password (stored in hashed form; the plaintext is not retained)
• Multi-factor authentication secret (stored in encrypted form)
• Payment-related information (processed via Stripe; includes the purchase history of Event Slots and the contract status of the Monthly Plan. The Company does not retain credit card numbers themselves)
• If Google SSO (social login) is used, the name, email address, and profile image URL obtained from the Google account
• The email addresses of invitees entered by Organizers when inviting Members, and the names, email addresses, and granted permissions of Members who have accepted invitations
• The email text and images of emails addressed to Participants that Organizers create or edit on the Service

2-2. Participant Information (Information Registered via Organizers)

• Name
• Email address
• Affiliated organization
• RSVP status
• Check-in records (check-in times via QR code)

Participant information is registered for the purpose of invitation and management by Organizers, and the Company processes such information as a contractor (processor) of the Organizer. The specific terms of handling are governed by the Terms of Service and the DPA concluded between the Organizer and the Company.

When a Participant views the RSVP page through a link in an invitation email, the Company also collects the information set forth in 2-3.

2-3. Information Collected Automatically

• IP address
• Browser and OS information (User-Agent)
• Access logs (request paths, response statuses)
• Authentication logs (login times, number of failed attempts)
• Usage data via Google Analytics 4 (identifiers stored in cookies, pages viewed, and interaction events. Information that directly identifies an individual, such as name or email address, is not sent. See Section 11 for details)
• The path by which an Organizer arrived at Account registration (parameters such as the type of link, campaign name, and referral code used when arriving at the introduction website or the sign-up page of the Service, the first page viewed, the name of the referring site, and the date and time thereof. This information is stored in a cookie set by the Company and, upon Account registration, is stored in association with that Account. It is not collected on pages intended for Participants. See Section 11 for details)
• Bulk-sending records (the type and number of emails sent, the email address of the Organizer or Member who performed the sending operation, and the date and time)
• Records of interactions on the introduction website (lp.spass.tokyo) of the Service (pages viewed, interactions such as clicks and scrolling, and device and browser types, via Microsoft Clarity. Content entered into input fields is not recorded. This information is collected only on the introduction website and is not collected on the screens of the Service. See Section 11 for details)

3. Purposes of Use

The Company uses the personal information it collects for the following purposes.

1. Providing the Service and executing its functions (sending invitation emails, issuing QR codes, attendee check-in, etc.)
2. Identity authentication and Account management
3. Prevention of unauthorized use (rate limiting upon consecutive failed login attempts, etc.)
4. Billing and payment processing
5. Notices regarding the Service and support
6. Notifications in the event of a failure or incident
7. For the improvement of the Service and the development of new features, aggregation and use as statistical information that does not identify individuals (including the analysis of usage via Google Analytics 4 and the analysis of interactions on the introduction website of the Service via Microsoft Clarity, as described in Section 11)
8. Understanding the path by which an Organizer came to register an Account, in order to measure the effectiveness of the introduction and promotion of the Service
9. Responding in accordance with laws and regulations

If the Company changes the purposes of use, it will notify Users of the details of the change in advance on the Service or by email.

4. Provision to Third Parties

The Company will not provide personal information it has collected to any third party except in the following cases.

1. Where the User has given consent
2. Where based on laws and regulations
3. Where necessary for the protection of the life, body, or property of a person and it is difficult to obtain the consent of the individual
4. Where it is necessary to cooperate with a national government agency or the like in performing affairs prescribed by laws and regulations

5. Contractors (Subprocessors)

In providing the Service, the Company entrusts the processing of personal information to the following Subprocessors. For details, please refer to the List of Subprocessors.

In selecting entrusted parties, the Company confirms that each such provider has an adequate personal information protection framework (third-party certifications such as SOC 2 Type II) and imposes contractual security control obligations on it.

6. Provision to Third Parties in Foreign Countries (Cross-Border Transfers)

The Service stores most data within Japan (AWS Tokyo Region); however, some Subprocessors (Resend / Stripe / Vercel CDN, etc.) are located primarily in the United States, and part of the processing may take place outside Japan.

Pursuant to Article 28 of the APPI, the Company provides the following information regarding the transfer of personal data to third parties in foreign countries.

6-1. Destination Country

Mainly the United States (global in some cases where data passes through the Vercel CDN)

6-2. Personal Information Protection System of the Destination Country

The United States does not have a comprehensive federal-level personal information protection law such as the EU GDPR or Japan's APPI. Personal information protection is governed by a combination of state laws (such as the California Consumer Privacy Act (CCPA/CPRA)) and sector-specific federal laws (such as HIPAA and GLBA).

For a more detailed overview of the system, please refer to the information on foreign personal information protection systems published on the website of the Personal Information Protection Commission.

6-3. Security Control Measures at the Recipients

Each Subprocessor has obtained international information security certifications such as SOC 2 Type II, and the Company requires the following in its entrustment agreements.

• Prohibition of the use of personal data for purposes other than the intended purposes
• Implementation of appropriate technical and organizational security control measures
• Obligation to provide notification in the event of leakage, etc.
• Cooperation with audits and requests for corrective action

If you would like more detailed information, please contact the contact point set forth in Section 12 of this Policy.

7. Security Control Measures

To prevent the leakage, loss, or damage of personal information, the Company takes the following security control measures.

Organizational Security Control Measures

• Appointment of a Personal Information Protection Manager
• Documentation of personal information handling procedures (this Policy and internal rules)
• Regular training of employees

Human Security Control Measures

• Conclusion of confidentiality agreements with employees
• Revocation of access rights upon departure

Physical Security Control Measures

• Entry and exit control, surveillance cameras, and locking of server racks at the data centers (AWS Tokyo Region)

Technical Security Control Measures

• TLS 1.2/1.3 encryption of all communications
• Database encryption at rest (AES-256)
• bcrypt hashing of passwords; multi-factor authentication (supporting two methods: TOTP using an authenticator app and email OTP)
• Access permission control (Supabase Row Level Security)
• Regular application of security patches
• Collection and monitoring of access logs and authentication logs

8. Response in the Event of Leakage, etc.

In the event of leakage, loss, or damage of personal data or any other such incident (collectively, "Leakage, etc."), the Company will promptly take the following actions in accordance with Article 26 of the APPI and other relevant laws and regulations.

1. Reporting to the Personal Information Protection Commission (where the requirements prescribed by laws and regulations are met)
2. Notification to the individuals concerned (where the requirements prescribed by laws and regulations are met)
3. Emergency measures to prevent the spread of damage, and investigation of the cause
4. Consideration and implementation of measures to prevent recurrence

If Leakage, etc. occurs with respect to the personal information of Participants registered by an Organizer, the Company will first promptly notify the Organizer and, in cooperation with the Organizer, take necessary actions such as notifying Participants.

9. Requests for Disclosure, Correction, and Deletion

Users may request the following with respect to their own retained personal data.

• Notification of the purposes of use
• Disclosure (including disclosure of records of provision to third parties)
• Correction, addition, or deletion of the content
• Suspension of use, erasure, or suspension of provision to third parties

Fee: Free of charge (however, where special investigation or handling is required, the Company may charge the actual costs to a reasonable extent)

How to make a request: Please contact support@statsworks.tokyo. After verifying your identity, the Company will respond within the period prescribed by laws and regulations.

As a general rule, Participants should submit requests to the Organizer that registered them. The Company will respond based on instructions from the Organizer. If a Participant submits a request directly to the Company, the Company will guide the Participant to have the request handled through the Organizer.

10. Retention Period

Personal information is retained to the extent necessary to achieve the purposes of use. For handling after the termination of the contract, please refer to the Data Retention and Disposal Policy.

11. Cookies and Similar Technologies

The Service uses cookies and similar technologies for the following purposes.

• Maintaining login sessions
• Security (CSRF protection, rate limiting)
• Analysis of Service usage (Google Analytics 4)
• Recording the path by which Organizers arrive at Account registration (the Company's cookie)
• Analysis of interactions on the introduction website of the Service (Microsoft Clarity; introduction website only)

About Google Analytics 4

To understand and improve the usage of the Service, the Company uses "Google Analytics 4," an access analytics tool provided by Google LLC. Google Analytics uses cookies to collect information such as pages viewed, interactions, and IP addresses in a form that does not identify individuals. Collection takes place on all screens of the Service (including the RSVP page for Participants), but information that directly identifies an individual, such as name or email address, is not sent. The Company does not use this information for ad delivery or behavioral targeting.

For information on Google's collection and handling of information, please refer to the following.

• How Google uses information from sites or apps that use its services: https://policies.google.com/technologies/partner-sites
• Google Privacy Policy: https://policies.google.com/privacy

If you do not wish information to be collected by Google Analytics, please install the Google Analytics Opt-out Browser Add-on (https://tools.google.com/dlpage/gaoptout) in your browser, or disable cookies in your browser settings.

About the Recording of Registration Paths

To measure the effectiveness of the introduction and promotion of the Service, the Company stores, in a cookie set by the Company (spass_attr, valid for 90 days), parameters such as the type of link, campaign name, and referral code used when arriving at the introduction website (lp.spass.tokyo) and the sign-up page of the Service, the first page viewed, and the name of the referring site and the date and time. Names, email addresses, and the like are not stored. Only if an Organizer registers an Account is this information stored in association with that Account. This information is not recorded on pages intended for Participants (the RSVP page and the entry QR code page). If you do not wish to be recorded, please disable cookies in your browser settings.

About Microsoft Clarity

To improve the introduction website (lp.spass.tokyo) of the Service and make it easier to understand, the Company uses "Microsoft Clarity," a behavioral analytics tool provided by Microsoft Corporation. Microsoft Clarity uses cookies to collect information such as pages viewed on the introduction website, interactions (clicks, scrolling, mouse movements, etc.), device and browser types, and IP addresses, and creates recordings that can replay the interactions (session recordings) and heatmaps. It is not used on the screens of the Service (screens after login, and the RSVP page and entry QR code page for Participants).

Content entered into the input fields of forms such as inquiry and document request forms (name, email address, etc.) is recorded in masked form in accordance with the specifications of Microsoft Clarity and is not sent to Microsoft. The Company does not use the information collected to identify individuals or for ad delivery or behavioral targeting.

Microsoft Clarity sets Microsoft cookies (including _clck and _clsk, which are set on the Company's domain, as well as Microsoft third-party cookies such as MUID). For information on Microsoft's handling of information, please refer to the following.

• Microsoft Privacy Statement: https://www.microsoft.com/en-us/privacy/privacystatement
• Cookies set by Microsoft Clarity: https://learn.microsoft.com/en-us/clarity/setup-and-installation/clarity-cookies

If you do not wish to be recorded, please disable cookies in your browser settings (if cookies are disabled, Microsoft Clarity will not set cookies), or block communications to Microsoft Clarity (clarity.ms) using your browser's tracking prevention feature or the like.

About Cookies for Advertising Purposes

The Company does not use cookies for the purpose of ad delivery or behavioral targeting. The Company also does not use the Microsoft third-party cookies set by Microsoft Clarity on the introduction website for ad delivery or behavioral targeting.

12. Contact

For questions, complaints, or other inquiries regarding the handling of personal information, please contact the following.

Stats Inc. Personal Information Protection Desk Email: support@statsworks.tokyo

13. Revisions

This Policy may be revised in response to changes in laws and regulations or changes in the content of the Service. If the Company makes material changes, it will provide notice in advance on the Service or by email.

Revision history