Privacy Policy

Last Updated: October 1, 2026
Effective Date: October 1, 2026

WHEREAS, franky, Inc. ("Company," "we," "us," or "our") develops and operates the Mori Journaling AI platform; and

WHEREAS, the Company is committed to protecting the privacy and Personal Data of individuals who use the Services (as defined herein);

NOW, THEREFORE, this Privacy Policy ("Policy") describes how the Company collects, uses, stores, processes, and discloses Personal Data when Users utilize the Mori Journaling AI device (Model: MRD01) (the "Device"), the Mori companion application (the "App"), and the Company's website located at mori.to (the "Website") (the Device, the App, and the Website are collectively referred to hereinafter as the "Services").

By accessing or using our Services, you ("User" or "you") acknowledge that you have read and understood this Policy. Certain AI-powered features require your explicit consent before data is shared with third-party AI providers. If you do not provide consent, or later withdraw it, those AI-powered features will be unavailable, but you may continue to access existing content and use non-AI features that remain available.

Policy Summary

The following is a summary of the key points of this Policy. For full legal details, please refer to the respective sections.

Information We Collect: Account information (name, email address, etc.), purchase information, voice recording data, usage data, browsing data through cookies, pseudonymous affiliate attribution and conversion data, and the Google integration information described in Section 1-4 when you connect your Google account.
How We Handle Voice Data: Recordings are made locally on the Device, and initial processing such as noise reduction is performed on-Device. Subsequent processing occurs on your smartphone and in the cloud. Audio data is retained in active processing systems for up to seven (7) days, regardless of whether transcription has been completed or remains pending, and is automatically deleted from those systems after the retention period expires. Deleted copies may remain temporarily in restricted backup or recovery systems until removed through their ordinary retention cycles.
AI Processing and Consent: Before data is sent to third-party AI providers, the App explains the data shared, the provider, and when the sharing occurs, and asks for your explicit consent. You may withdraw or provide consent again at any time in the App.
How We Use Your Information: We use your information to provide and maintain the Services; manage accounts; protect the Services; provide customer support; and attribute affiliate referrals and measure conversions. Specifically authorized personnel may review only the minimum necessary portions of relevant transcriptions, summaries, journals, and other AI-generated content when necessary to respond to a User inquiry or bug report, or to investigate the cause of a specifically identified generated-output quality issue and verify a correction. For general quality analysis and service improvement, we use only anonymized and aggregated data from Users who expressly opt in to the voluntary Service Improvement Program.
No AI Training or Unauthorized Use: We will not use your audio data, transcriptions, or AI-generated content for AI model training or any other purpose beyond what is necessary to provide the Services, without your explicit consent.
Data Protection: We implement industry-standard security measures, including encryption in transit and at rest, and strict access controls.
Your Rights: You may request access to, correction of, deletion of, portability of your Personal Data, and opt out of marketing communications.
Data Ownership: All recordings and User Content remain the property of the User.

Definitions

For the purposes of this Policy, the following terms shall have the meanings ascribed to them below:

"Personal Data" shall mean any information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, to an identifiable natural person or household.
"Processing" shall mean any operation or set of operations performed on Personal Data, including but not limited to collection, recording, organization, structuring, storage, adaptation, alteration, retrieval, consultation, use, disclosure by transmission, dissemination, or otherwise making available, alignment, combination, restriction, erasure, or destruction.
"User Content" shall mean all voice recordings, transcriptions, AI-generated journal entries, and any other content created by Users through the Services.
"Device" shall mean the Mori Journaling AI hardware device (Model: MRD01).
"Service Provider" shall mean any third-party entity that processes Personal Data on behalf of the Company for the purposes of providing the Services.

1. Information We Collect

1-1. Information You Provide

(a) Account Information: Email address and password provided when you create an account with the Services (passwords are managed through a third-party authentication service and cannot be viewed or accessed by the Company in plaintext).
(b) Purchase Information: Billing address, shipping address, and payment details (payment transactions are processed by our third-party payment processor; the Company does not directly store full payment card information).
(c) Support Communications: Information you provide when contacting our customer support team, including but not limited to the content of your communications and any attachments thereto.
(d) User Content: Voice recordings, transcriptions, AI-generated journal entries, and other content you create using the Services.
(e) Voice Feature Data (Voiceprints): Speaker identification is not yet available in the App; this item applies once it becomes available. (i) voice characteristics generated from audio that you voluntarily enroll for the feature that identifies your own voice; and (ii) voice characteristics generated temporarily to determine whether speech contained in a recording is your own. Voice feature data may constitute a personal identification code under the Act on the Protection of Personal Information, and the Company treats it as Personal Data. Data described in (i) is retained until you delete it; data described in (ii) is discarded immediately after use within that determination. Section 11 sets forth the details of such handling.
(f) Contract Management Information: The version number of this Policy that the User has acknowledged, the User's consent or rejection of specific services or features, the version number of the service agreement, and the timestamps of such actions.

1-2. Information Collected Automatically

(a) Device Information: Device model, serial number, firmware version, operating system, Bluetooth connection data, device temperature, and battery status.
(b) Usage Data: Features used, session duration, recording frequency, and interaction patterns within the App.
(c) Log Data: IP address, browser type, access times, and referring URLs when you visit our Website.
(d) Location Data: The Company collects location data only if the User grants location permission in the App.

1-3. Information from Cookies and Tracking Technologies

The Company uses cookies and similar tracking technologies on the Website to collect browsing data and measure affiliate referrals and purchase conversions. Affiliate measurement data may include a pseudonymous profile identifier, order ID, currency, promotion code, discount, and product-level information (including category, SKU, quantity, and subtotal), together with a SHA-1 hash of a normalized email address. The Company does not transmit the raw email address to its affiliate measurement provider. For details regarding the types of information transmitted externally, the recipients of such information, and the purposes of use through the Company's cookies and tracking technologies, please refer to our Cookie Policy.

1-4. Google Account Integrations

Google integration is optional. Mori uses the following information to connect your Google account, display calendar events and participants alongside sessions, and create Google Tasks from Follow-ups you select.

(a) Account and Authentication Information: Mori uses your connected account's email address and account identifier to identify and display the connection. Auth0 handles authentication and holds the Google access and refresh tokens used to maintain authorized access, including while the App is closed.
(b) Calendar and Participant Information: Mori retrieves calendar identifiers and names so you can choose calendars to connect. For the calendars you select, Mori stores event identifiers, titles, descriptions, locations, links, start and end times, status, and attendee email addresses and display names. Where available, Mori uses attendee email addresses to retrieve matching names and profile photo URLs from Google Workspace Directory. This information supports calendar synchronization and the display of related events and participants in your sessions. Calendar and Directory access is read-only.
(c) Google Tasks: When you select Follow-ups and confirm sending them to Google Tasks, Mori sends their titles and applicable due dates to create tasks in your default Google Tasks list. Mori stores the created task identifiers and send status to track the result. This integration does not read, edit, or delete existing Google Tasks.
(d) Storage and Sharing: Mori stores connection records, calendar selections, synchronized event and participant information, and task send records in its cloud systems. Its cloud infrastructure and authentication Service Providers process this information to provide these features. The data protection measures in Section 4 apply to this information. When a session-sharing link includes participants, people with the link may see related event titles and participant names and photos. The shared calendar information excludes attendee email addresses and connected account details. You can change the shared fields or deactivate the link.
(e) Disconnecting and Deletion: You can disconnect an account in Settings > Integrations > Calendar. When disconnection succeeds, Mori deletes the connection record and its synchronized calendars, events, and participants from its active database. This action does not delete recordings, transcripts, summaries, Follow-up send records, or tasks already created in Google Tasks. It also does not delete the Google identity and authorization credentials held by Auth0. You can revoke Google's authorization in your Google Account connections settings. Retention and deletion requests are addressed in Sections 5 and 8; you can contact support@mori.to to request deletion of retained Personal Data, including authentication records.
(f) Limits on Use: Mori does not automatically send synchronized Calendar or Directory data to its AI generation features. Google API data, including data derived from it, is not used for advertising or to develop, improve, or train non-personalized AI or machine-learning models, and is not sold. Mori's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements. Human access is limited to the cases permitted by those requirements: your affirmative agreement to view specific data, security purposes, compliance with law, or aggregated data used for internal operations in accordance with applicable law. These restrictions take precedence over any broader permission for use, human review, or disclosure elsewhere in this Policy, including Sections 2, 3, 6, 9, and 10.

2. How We Process Your Voice Data

Your voice and audio data are central to the Mori Journaling AI experience. The Company is committed to handling such data with the highest level of care and in accordance with applicable law.

2-1. On-Device Processing

(a) Audio is initially recorded and stored locally on the Device.
(b) Basic audio processing occurs on the Device prior to any data transfer.

2-2. Cloud Processing

(a) When you utilize AI-powered features (including but not limited to transcription, summarization, and journaling assistance), your audio data shall be transferred to the Company's secure cloud servers via a Bluetooth connection to your mobile device, and subsequently via an encrypted internet connection to the Company's servers.
(b) Audio data transmitted for AI Processing shall be used solely for the purpose of generating the output requested by the User (i.e., transcriptions, summaries, and journal entries).
(c) The Company will not use your audio data, voice characteristics (voiceprints), transcriptions, AI-generated content, or optional comments to train or fine-tune any artificial intelligence or machine learning model of the Company or any third party without your explicit consent. The limited review under Section 9 and the voluntary program under Section 10 do not include AI model training or fine-tuning.
(d) All third-party AI Service Providers engaged by the Company are bound by contractual agreements that expressly prohibit the use of User data for model training or for any purpose other than providing the requested service as set forth in Section 6-1 hereof.

2-3. Data Storage

(a) Your transcriptions and AI-generated content shall be stored in encrypted form on the Company's secure cloud servers.
(b) Audio data shall be retained in active processing systems for up to seven (7) days, regardless of whether transcription has been completed or remains pending, and automatically deleted from those systems after the retention period expires.
(c) After deletion under subsection (b), copies may remain temporarily in restricted backup or recovery systems until removed through their ordinary retention cycles. Such copies shall not be used to provide the Services, and access shall be limited to recovery and security purposes.
(d) You may download or delete your data through the App. However, audio data for which transcription is pending cannot be individually deleted through the App.
(e) You shall retain full ownership of all your recordings and User Content. Nothing in this Policy shall be construed as transferring any ownership rights in User Content to the Company.

2-4. AI Processing Consent and Controls

Before sharing Personal Data with a third-party AI provider, the App requests your explicit consent and explains the data shared, the provider, and when the sharing occurs. The AI-powered features currently use data as follows:

Feature	Data Shared	Provider	When Data Is Shared
Transcription	Recorded audio	Deepgram, Soniox	When a recording is uploaded for transcription
Session summaries	Transcriptions	OpenAI	When a session summary is created or regenerated
Journals	Sessions and transcriptions	OpenAI	When a journal is created at the User's scheduled time
Chat	Sessions, journals, and text entered by the User	Google, Anthropic	When generating a reply in chat

You may withdraw consent at any time in the App by opening Settings > User Info > AI Features & Data Use and turning the setting off. You may provide consent again through the same setting or when the App presents the consent screen before an AI-powered action.

When consent is withdrawn:

the App stops the current recording;
recording may be started again, but newly recorded audio is kept locally and is not uploaded for AI Processing while consent remains withdrawn;
new chat requests, voice input Processing, AI-assisted check-in polishing, and session summary regeneration require consent before they can proceed;
existing sessions, transcriptions, journals, and other previously created content remain available for viewing; and
if consent is provided again, locally queued recordings may be uploaded and processed in sequence.

Withdrawing AI consent does not delete previously transmitted or stored data. Withdrawing consent and requesting deletion of Personal Data are separate actions.

3. How We Use Your Information

The Company shall use your information for the following purposes:

(a) Service Delivery: To provide, maintain, and improve the Mori Journaling AI experience, including but not limited to transcription, summarization, and AI journaling features.
(b) Account Management: To create and manage your account, process transactions, and provide customer support.
(c) Communications: To send you service-related notifications and updates. Promotional communications shall be sent only with the User's prior consent, and you may opt out of such communications at any time pursuant to the procedures described in Section 8 hereof.
(d) Security and Fraud Prevention: To protect the security and integrity of our Services, detect and prevent fraud, and enforce our Terms of Service.
(e) Analytics and Improvement: To understand how the Services are used, analyze generated-output quality trends, and improve prompts, templates, and other service configurations. For general quality analysis and improvement, we use only anonymized and aggregated data from Users who expressly opt in under Section 10 (such data constitutes statistical information and does not constitute anonymously processed information as defined under applicable data protection laws). Such data is processed so that an individual or an individual conversation cannot reasonably be reidentified and is combined to reflect trends across multiple Users or events. A content body is not anonymized merely because a name or User ID has been removed. Personnel may review User Content bodies only under Section 9.
(f) Legal Compliance: To comply with applicable laws, regulations, legal processes, and governmental requests.
(g) Affiliate Measurement: To attribute referrals to affiliate partners, measure purchase conversions, prevent duplicate conversion reporting, and administer the Company's affiliate program.

4. Data Security

The Company implements industry-standard security measures to protect your Personal Data:

(a) Encryption in Transit: All data transmitted between the Device, the App, and the Company's servers shall be encrypted using TLS 1.2 or higher.
(b) Encryption at Rest: Stored data shall be encrypted using AES-256 encryption.
(c) Access Controls: Access to User Content is limited to specifically authorized personnel. Such personnel may access only the minimum amount necessary to (i) respond to a User inquiry or bug report; (ii) for a User who accepted the revised versions, investigate a specifically identified quality issue or verify a correction; (iii) respond to a security matter; or (iv) comply with law. We do not conduct routine review or random sampling for general quality improvement. We record the purpose, subject, personnel, and date and time of each content review and review access privileges quarterly.
(d) Bluetooth Connection: The Device uses a Bluetooth Low Energy (BLE) connection to transfer data to the App. Data stored on the Device is encrypted using AES-256-GCM prior to transfer.
(e) Infrastructure Security: The Company's cloud infrastructure is hosted with providers that maintain industry-standard certifications (including but not limited to SOC 2 and ISO 27001).
(f) Company Security Certifications: The Company has obtained SOC 2 Type I certification and is currently working toward SOC 2 Type II certification.

NOTWITHSTANDING THE FOREGOING, WHILE THE COMPANY TAKES COMMERCIALLY REASONABLE MEASURES TO PROTECT YOUR DATA, NO METHOD OF ELECTRONIC TRANSMISSION OR STORAGE IS COMPLETELY SECURE. THE COMPANY CANNOT AND DOES NOT GUARANTEE ABSOLUTE SECURITY OF YOUR PERSONAL DATA, TO THE FULLEST EXTENT PERMITTED BY APPLICABLE LAW.

5. Data Retention

(a) Account Data: The Company shall retain your account information for so long as your account remains active. Upon deletion of your account, the Company shall delete your Personal Data within thirty (30) days, except to the extent retention is required by applicable law.
(b) Audio Data: Audio data shall be retained in active processing systems for up to seven (7) days, regardless of whether transcription has been completed or remains pending, and automatically deleted from those systems after the retention period expires. Deleted copies may remain temporarily in restricted backup or recovery systems until removed through their ordinary retention cycles; such copies shall not be used to provide the Services, and access shall be limited to recovery and security purposes. Audio data for which transcription is pending cannot be individually deleted through the App.
(c) Transcriptions and AI-Generated Content: Your transcriptions and AI-generated content shall be retained until you elect to delete them or delete your account.
(d) Usage Data: Aggregated, de-identified usage data may be retained indefinitely for analytics purposes.
(e) Legal Requirements: Notwithstanding the foregoing, the Company may retain certain information as required by applicable law, regulation, or legal obligation, even following account deletion.
(f) Affiliate Attribution Data: A pseudonymous browser profile identifier used for affiliate attribution may remain in local storage for up to 720 days, unless the User deletes browser storage earlier. Conversion records may be retained by the applicable Service Provider in accordance with its privacy policy and the Company's affiliate program requirements.
(g) Voice Feature Data (Voiceprints) and Enrolled Audio: Speaker identification is not yet available in the App; this item applies once it becomes available. Voice characteristics are retained until you delete them or delete your account. Audio collected for enrollment is retained for seven (7) days from collection and is then automatically deleted. Voice characteristics temporarily generated from voices other than yours contained in a recording are not retained.
(h) Google Integration Data: Connection records, selected calendars, and synchronized events and participants are retained to provide the connection and are removed from the active database when you disconnect, as described in Section 1-4(e). Follow-up send records remain with the corresponding Follow-ups after disconnection. Tasks already created in Google Tasks remain in your Google account. Google integration data, including authentication records held by Auth0, is subject to the account-deletion policy in subsection (a) and the deletion request process in Section 8. Disconnecting does not itself purge backup copies or Auth0-held authentication records.

6. How We Share Your Information

The Company does not sell your Personal Data. The Company may disclose your information in the following circumstances:

6-1. Service Providers

The Company shares information with third-party Service Providers who assist in operating the Services, as set forth in the table below:

Category	Purpose	Data Shared
Cloud Infrastructure	Data storage and Processing	Encrypted user data, including the Google integration records described in Section 1-4
Google Integration Authentication	Authenticate and maintain the Google account connection	Connected account identity and Google authorization credentials, including access and refresh tokens (Provider: Auth0)
AI Processing (Transcription)	Speech-to-text conversion	Recorded audio (Providers: Deepgram, Soniox)
AI Processing (Session Summaries)	Session summary creation and regeneration	Transcriptions (Provider: OpenAI)
AI Processing (Journals)	Journal entry generation	Sessions and transcriptions (Provider: OpenAI)
AI Processing (Chat)	Chat reply generation	Sessions, journals, and text entered by the User (Providers: Google, Anthropic)
Payment Processing	Transaction handling	Payment information
Analytics	Understanding how the Services are used; measuring impressions and usage of features; product improvement	In-app events (screen views, feature usage, display of the feedback prompt, and the like), including an internal identifier we issue for the User and the type of content concerned. Individual pre-aggregation events contain no name or email address but are linked to the User through that identifier. Comments you enter and the bodies of transcriptions and generated content are not transmitted.
Affiliate Attribution and Conversion Measurement	Referral attribution, purchase conversion measurement, duplicate prevention, and affiliate program administration	Pseudonymous profile identifier; order ID; currency, promotion code, discount, and product-level category, SKU, quantity, and subtotal; and a SHA-1 hash of the normalized email address (Provider: Impact Tech, Inc., operating as impact.com; raw email address is not shared)
Customer Support	Support ticket management	Account and communication data
Email Services (including Mailgun for business inquiries)	Service communications and delivery of business inquiries to our support team	Email address and name; for business inquiries, company name, phone number, company website, inquiry category, products and plans of interest, expected quantity, and the message you submit

All Service Providers are bound by contractual obligations to process Personal Data only as instructed by the Company and in accordance with this Policy.

For further details on each Service Provider, please refer to our Trust Center.

Certain Service Providers listed above are located outside of Japan. With respect to the provision of Personal Data to such foreign entities, the Company shall comply with the cross-border transfer requirements under applicable data protection laws, including Article 28 of the APPI. Information regarding the personal data protection systems in the relevant countries is set forth in Section 7 hereof.

6-2. Legal Requirements

The Company may disclose your information where required to do so by law, regulation, legal process, subpoena, court order, or governmental request.

6-3. Business Transfers

In the event of a merger, acquisition, reorganization, bankruptcy, sale of all or substantially all assets, or other similar transaction, your information may be transferred as part of that transaction. The Company shall provide notice to Users of any such change in accordance with applicable law. A transfer of Google API data as part of a merger, acquisition, or sale of assets requires the User's explicit prior consent under the Limited Use requirements in Section 1-4(f).

6-4. With Your Consent

The Company may share your information with third parties when you have provided explicit, informed consent to such disclosure.

7. Cross-Border Data Transfers

franky, Inc. is headquartered in Tokyo, Japan, and the Services are available in both Japan and the United States. Your Personal Data is stored on cloud infrastructure located in the United States. Your Personal Data may be transferred to, and processed in, countries other than your country of residence, including but not limited to Japan and the United States.

(a) Japan to United States: Data transfers from Japan to the United States shall be conducted in compliance with the Act on the Protection of Personal Information (Act No. 57 of 2003, as amended; "APPI") requirements for cross-border transfers of Personal Data.
(b) United States to Japan: Data transfers from the United States to Japan shall be handled in accordance with applicable United States federal and state privacy laws.
(c) The Company shall ensure that appropriate safeguards are in place for all cross-border data transfers, including but not limited to contractual protections with Service Providers requiring compliance with applicable data protection laws. For further details on data transfer destinations, please refer to our Trust Center.

8. Your Rights and Choices

Depending on your jurisdiction of residence, you may have the following rights with respect to your Personal Data:

8-1. All Users

(a) Access: Request a copy of the Personal Data we hold about you.
(b) Correction: Request correction of inaccurate or incomplete Personal Data.
(c) Deletion: Request deletion of your Personal Data, subject to applicable legal exceptions.
(d) Data Portability: Request your data in a structured, commonly used, and machine-readable format.
(e) Opt-Out of Marketing: Unsubscribe from promotional communications at any time.
(f) Account Deletion: Delete your account and all associated data through the App or by contacting the Company.
(g) Tracking Choices: Manage non-essential tracking through browser controls and the mechanisms described in the Cookie Policy. When the Website detects a Global Privacy Control ("GPC") signal, Impact affiliate tracking is disabled.
(h) AI Processing Consent: Withdraw or provide consent again in the App under Settings > User Info > AI Features & Data Use. Withdrawal stops future transfers to third-party AI providers while preserving access to existing content. It does not by itself delete previously transmitted or stored data.

8-2. California Residents (CCPA/CPRA)

If you are a resident of the State of California, you have additional rights under the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (collectively, the "CCPA"):

(a) Right to Know: You have the right to request information regarding (i) the categories and specific pieces of Personal Data the Company has collected about you, (ii) the categories of sources from which such Personal Data was collected, (iii) the business or commercial purpose for collecting such Personal Data, and (iv) the categories of third parties with whom the Company shares your Personal Data.
(b) Right to Delete: You have the right to request deletion of your Personal Data, subject to certain exceptions as set forth under the CCPA.
(c) Right to Correct: You have the right to request correction of inaccurate Personal Data maintained by the Company.
(d) Right to Opt-Out of Sale/Sharing: THE COMPANY DOES NOT SELL YOUR PERSONAL DATA. If the Company engages in activities that may constitute "sharing" as defined under the CCPA (including but not limited to targeted or cross-context behavioral advertising), you may opt out by (i) transmitting a Global Privacy Control ("GPC") signal through your browser, (ii) using the browser and industry opt-out mechanisms described in the Cookie Policy, or (iii) contacting the Company at support@mori.to for assistance with a sale/sharing opt-out request.
(e) Right to Non-Discrimination: The Company shall not discriminate against you for exercising any of your rights under the CCPA, including but not limited to denying goods or services, charging different prices, or providing a different level or quality of services.

We may process User Content for issue response subject to Section 9. If a User expressly opts in under Section 10, we use anonymized and aggregated data for quality trend analysis and service improvement.

To exercise your rights under this Section 8-2, please contact the Company at support@mori.to. The Company shall verify your identity prior to processing your request and shall respond within forty-five (45) days of receipt (which period may be extended by an additional forty-five (45) days where reasonably necessary, with notice to the User). You may also designate an authorized agent to submit requests on your behalf, subject to proper verification.

8-3. Japanese Residents (APPI)

If you are a resident of Japan, you have rights under the Act on the Protection of Personal Information (Act No. 57 of 2003, as amended; "APPI"):

(a) Right to Disclosure: You may request disclosure of the Personal Data the Company holds about you.
(b) Right to Correction: You may request correction, addition, or deletion of your Personal Data if it is inaccurate.
(c) Right to Cease Use: You may request that the Company cease using or delete your Personal Data if it was obtained through improper means or is no longer necessary for the purposes for which it was collected.
(d) Right to Cease Third-Party Provision: You may request that the Company cease providing your Personal Data to third parties.

For details on exercising these rights, please refer to the Japanese version of this Policy.

9. Limited Review of User Content for Issue Response

(a) Permitted Cases: Specifically authorized personnel may review only the minimum necessary portions of relevant transcriptions, summaries, journals, and other AI-generated content when necessary (i) to respond to a User inquiry or bug report; (ii) to investigate or verify a correction for the specific content on which the User submitted a negative rating after viewing the pre-submission notice; or (iii) to investigate a specifically identified generated-output quality issue identified by other means, or verify a correction.

(b) Review Based on the User's Own Action: Review under (a)(i) is performed at the User's request. Review under (a)(ii) treats a negative-rating submission made after viewing the pre-submission notice as consent to review that specific content for investigation; it does not extend to other content. Both may occur before acceptance of the revised versions.

(c) Other Specific Quality Issues: Review under subsection (a)(iii) is limited to content generated after acceptance. An existing User is ineligible until accepting through the in-App screen.

(d) Restrictions and Records: We do not conduct routine review or random sampling for general quality improvement. We record the purpose, subject, personnel, and date and time of each review.

9-2. Excluded Activities

Review under this Section does not include human listening to audio for quality evaluation; review of voiceprints or voiceprint enrollment audio; use of pre-acceptance content under Section 9(a)(iii); bulk export; disclosure to external evaluators; creation of long-term evaluation datasets; or training or fine-tuning any AI model. Before any such activity, we will describe its purpose, data scope, retention period, and recipients and complete any procedure required by applicable law.

10. Voluntary Service Improvement Program

(a) Voluntary Participation: We offer a voluntary program for quality trend analysis and service improvement. A User may expressly opt in through Settings, may use the Services without participating, and may opt out at any time. Until available, no User is treated as a participant.

(b) Data Used: We use only anonymized and aggregated data from Users who expressly opt in. A content body is not anonymized merely because a name or User ID is removed, and we do not use such bodies in the Program.

(c) Excluded Processing: Participation does not permit personnel to review content bodies and does not constitute consent to train or fine-tune any AI model.

(d) Withdrawal: A User may withdraw through Settings at any time. Data generated after withdrawal will not be newly used.

11. Voice Characteristics (Voiceprints) and Speaker Identification

Speaker identification is not yet available in the App. When it becomes available, the following applies.

We generate voice characteristics from audio that a User voluntarily enrolls to identify the User's own speech. Enrollment is optional. Voice characteristics may constitute a personal identification code under the Act on the Protection of Personal Information and are treated as Personal Data. We use them only for speaker identification. Voiceprints are retained until deletion; enrolled audio is retained for seven (7) days and then automatically deleted. A User may request deletion of voice characteristics and enrolled audio through the method we designate, and may re-enroll. Characteristics temporarily generated from other voices are discarded immediately and are not retained.

12. Feedback You Submit

We collect ratings, selected reasons, and optional comments to identify specific quality issues and improve the Services. The underlying recording, transcription, summary, journal, or chat body is not sent automatically. Feedback is retained until account deletion. Before a User submits a negative rating, we display a notice that personnel may review the body of that specific content to investigate the issue. A submission made after viewing that notice is treated as consent to review only that content (Section 9(a)(ii)); it is not consent to review other content and does not enroll a User in Section 10. Optional comments are not used to train or fine-tune AI models.

13. Children's Privacy

The Services are intended exclusively for adults. The Services are not directed to, and shall not be used by, individuals under the age of eighteen (18) or individuals who have not reached the age of majority in their jurisdiction, whichever is greater. The Company does not knowingly collect Personal Data from such individuals. If you believe the Company has inadvertently collected information from such an individual, please contact us at support@mori.to. Upon verification, the Company shall promptly delete such information.

14. Third-Party Links and Services

The Services may contain links to third-party websites or services that are not owned or controlled by the Company. The Company shall not be responsible for, and this Policy does not apply to, the privacy practices of any such third parties. The Company encourages Users to review the privacy policies of any third-party services they access through the Services.

15. Changes to This Privacy Policy

The Company reserves the right to modify or update this Policy from time to time in its sole discretion. The Company shall notify Users of material changes by posting the updated Policy on the Website and, where appropriate, by sending a notification through the App or via email. Your continued use of the Services following the posting of any changes shall constitute your acceptance of the updated Policy. For Google API data, we will notify you and obtain your consent before accessing data not previously disclosed or using data in a new way or for a different purpose; continued use alone does not provide that consent. If any provision of this Policy is held to be invalid or unenforceable, the remaining provisions shall continue in full force and effect.

16. Contact Us

If you have questions, concerns, or requests regarding this Policy or the Company's data practices, please contact us:

Email: support@mori.to
Website: mori.to

franky, Inc.
5th Floor, 1-13-9, Tomigaya, Shibuya, Tokyo, Japan
Representative Director: Yu Akasaka