Privacy Policy

Article 1 (Definition of Personal Data)

1. “Personal information” means information defined in Article 2(1) of Japan’s Act on the Protection of Personal Information (APPI): information identifying a living individual, including through easy comparison with other information, and information containing a personal identification code.
2. “Personal data” means personal information forming part of a personal information database or equivalent. “Retained personal data” means personal data for which our school has authority to disclose, correct, or suspend use, within the scope defined in APPI Article 16(4).

Article 2 (Methods of Collecting Personal Data)

Our school may collect personal data through the following methods.

1. Information provided through the official LINE channel during the required consultation before Form A is sent, including LINE account information and consultation messages
2. Information provided through the non-public formal-application Google Form A sent after the LINE consultation and before acceptance, including the applicant/contracting party's name, postal address, telephone number, email address, the learner's name and age category, relationship to the learner, selected plan, application content, confirmation responses, the name entered in the signature field, response timestamp, and form, response, and application IDs
3. Information provided through the non-public confirmed-conditions Google Form B sent after acceptance, including confirmation and consent responses, requested corrections, the name entered in the signature field, response timestamp, and form, response, application, acceptance-notice, individual-conditions, and version IDs
4. Records created or obtained by us concerning review results, acceptance or rejection, delivery and correction of confirmed conditions, application withdrawal, Stripe payment instructions, and contract formation
5. Information provided by email or similar means for pre- or post-contract communications, rights requests, or other inquiries
6. Information automatically obtained during service use (IP address, browser information, access logs, etc.)
7. Information collected through cookies and similar technologies

Article 3 (Purposes of Collecting and Using Personal Data)

The purposes for which our school collects and uses personal data are as follows:

1. To conduct the required official LINE consultation and receive a formal paid-plan application
2. To verify the applicant, contracting party, learner, age category, and, for a learner under 18, the guardian's authority and relationship to the learner
3. To review eligibility and notify the applicant of acceptance, rejection, or another result
4. To prepare, deliver, and correct confirmed service, price, start, renewal, cancellation, refund, and other conditions and obtain express consent
5. To provide Stripe credit-card payment instructions and administer contract formation, service, renewal, billing, plan changes, cancellation, and refunds
6. To retain evidence of applications, names entered in signature fields, confirmations, consents, applicable versions, delivery, withdrawal, and contract formation
7. To provide and operate our services, send important notices, and respond to inquiries
8. To identify and reject use by customers who violate the terms of service or attempt to use the service for fraudulent or inappropriate purposes
9. To allow customers to view and modify their registration information, delete data, and view usage status
10. To prevent fraud, comply with law, protect rights, and handle inquiries, claims, and disputes
11. For service improvement, marketing analysis, advertising delivery, and ad performance measurement
12. For purposes incidental to those mentioned above

Article 4 (Use of Cookies and Analytics Tools)

1. This site uses cookies and similar technologies for analytics, advertising, and measurement. Retention and transmission vary with each service’s features, settings, and browser restrictions. You can reject or delete cookies through your browser settings; rejecting cookies alone does not stop transmission of IP addresses and other information associated with loading images or other network requests.
2. Google Analytics (recipient: Google LLC) receives page URLs and titles, cookie or similar identifiers, and device, browser, and usage information. We use the resulting statistics to understand and improve site use. Our page-view events omit referrer URLs, and we do not load analytics when the URL contains a query string or fragment, or on article search and listing pages. For visits from supported AI search or chat services, we send the service category to analytics and store the first source category and landing-page path in tab-scoped sessionStorage. We take measures to avoid sending names, email addresses, or credentials to analytics.
3. You can use the Google Analytics Opt-out Browser Add-on in supported browsers. See Google’s Privacy Policy for Google’s processing.
4. Pages outside the article section load Google AdSense (recipient: Google LLC). Cookie or similar identifiers, IP addresses, and device, browser, and advertisement impression or interaction information may be transmitted for advertising. Actual display and personalization depend on Google’s and browser settings. You can change personalization preferences through Google Ads Settings.
5. The article section displays A8.net advertisements (recipient: FAN Communications, Inc., Japan). Loading advertising or measurement images and clicking ad links transmits IP addresses, user agents (browser information), cookies, and ad impression, viewing, or click information. The provider uses this for ad delivery and related aggregation; we use reporting to understand advertising results. Cookie transmission depends on browser restrictions. See A8.net’s external-transmission disclosure.

Article 5 (Changes to Purposes of Use)

1. Our school will only modify the purposes of use of personal data when the modified purpose is considered reasonably related to the original purpose.
2. When the purposes of use change, we will publish the revised purposes on this website.

Article 6 (Disclosure of Personal Data to Third Parties)

We do not provide personal data to third parties without the person’s prior consent except in the following cases:

1. When based on laws or regulations.
2. When necessary to protect a person’s life, body, or property and it is difficult to obtain their consent.
3. When particularly necessary for public health or children’s healthy development and it is difficult to obtain the person’s consent.
4. When cooperation with a national or local government body, or its contractor, is necessary to perform statutory duties and obtaining consent could impede those duties.

Outsourcing within the scope necessary to achieve the purposes of use and transfers accompanying a merger or other business succession may fall outside the statutory definition of third-party provision. We supervise service providers and handle purposes of use after succession in accordance with law. Overseas transfers follow Article 6-3.

Article 6-2 (Service Providers and Processing)

Within the scope necessary for the purposes stated in this Policy, personal data may be processed by the service providers currently confirmed for our public site and contact channels:

• Stripe: The only customer payment method is credit-card payment processed by Stripe. Stripe processes the contracting party's name, email address, and other information necessary for payment. Card numbers, security codes, expiration dates, and other card data are not collected through Google Forms, LINE, email, or Slack and are processed only by Stripe.
• LINE Yahoo Japan: Processes LINE account information and consultation messages when the official LINE channel is used for a free consultation.
• Google Forms (Google LLC, United States): Formal-application Form A is sent after the required LINE consultation and before acceptance. Confirmed-conditions Form B is sent only after acceptance. The information listed in Article 2 is processed for identity and guardian verification, review, result notification, condition preparation and correction, consent evidence, payment instructions, and contract administration. Depending on Google's contract, settings, and subprocessors, it may be processed in the United States or other countries. The form URLs are not published.
• Slack (provider to be verified against the actual contract and official documents before use): For learners aged 16 or older, Slack may process, as necessary for course communications, questions, submissions, and feedback, the learner's name or display name, email address, messages, attachments, learning records, and device or access information. Slack is not used for learners under 16.
• Email service provider: Processes names, email addresses, and message content sent to info@ada-itschool.com for post-contract communications, rights requests, and other inquiries.
• Google LLC (United States) and FAN Communications, Inc. (A8.net, Japan): Process the service-specific information described in Article 4 for analytics, advertising, and related aggregation.
• Cloudflare: Processes IP addresses and access logs for site delivery and security.

Before adopting another service for student handling, we will confirm its purpose, data categories, overseas processing, and necessary settings, and provide any notice or obtain any consent required by law.

Article 6-3 (Overseas Processing)

1. Some service providers are located outside Japan or may process data using facilities outside Japan. The processing country, applicable legal system, and safeguards depend on the service, contract, and settings actually used.
2. Before using an overseas-processing service for student handling, we will confirm the recipient, processing country, relevant legal system, contractual or technical safeguards, and available settings.
3. Based on that confirmation, we will provide information, obtain consent, supervise the provider, or take other measures required by applicable law. If the necessary confirmation or measures cannot be completed, student personal data will not be transferred to that service.
4. The providers actually used and their privacy policies can be confirmed in the enrollment or service instructions or on the relevant service screen.
5. Information entered in formal-application Form A and confirmed-conditions Form B may be processed in the United States or other countries depending on Google's contract, settings, facilities, and subprocessors. When each form is sent individually, we will provide information about the processing and Google's privacy policy where necessary.
6. Before using Slack, we will verify the provider, actual contract terms, storage and processing regions, subprocessors, installed apps and external integrations, any overseas transfer, and applicable safeguards. Until that review and all required notices, consents, contracts, and settings are complete, we will not invite a learner or enter learner personal data into Slack.

Article 6-4 (Use of External Generative AI Services)

1. External generative AI is not used to answer students, review their work, summarize meetings, or otherwise handle students.
2. For internal research or general drafting only, we may use public information or information that has been sufficiently anonymized and abstracted so that no individual, school, company, or repository can be identified and no confidential information remains.
3. Names, contact details, age, school information, meeting content, chat content, learning records, work product, non-public source code, authentication information, third-party information, and any other personal or confidential information must not be transferred to or entered into external generative AI services.
4. Before considering future use for student handling, we will first determine and disclose the vendor, purpose, data categories, retention, training use, processing country or region, security measures, deletion method, and any explanation or consent required from the student or guardian, and update this Policy and our procedures.

Article 7 (Security Management of Personal Data)

We apply the following controls to the extent they can be confirmed and implemented for the information and services actually used.

1. The public website uses HTTPS for communications.
2. Access to personal data is limited to people who need it for their work, and sharing is kept to the minimum necessary.
3. Authentication, permission controls, and other available security settings are configured according to the actual contract and features of each service.
4. If a possible leak or similar incident is identified, we will restrict access, assess the impact, notify affected persons, and take other action required by law and the circumstances.
5. Before a minor uses Slack, we will verify separation between learners; direct-message rules; the roles of guardians, a second responsible adult, instructors, and contractors; apps; Slack Connect; external invitations; public links; file sharing; access removal when personnel leave; and the availability of records needed for incident review. If the required separation and permission controls cannot be implemented, Slack will not be used for minors.

Article 8 (Personal Data Retention Period)

We retain personal data only for as long as necessary for the relevant purpose. The main criteria are:

• Contracting-party, student, and learning records: As needed to perform the contract and handle post-termination inquiries, claims, or disputes.
• Inquiry information: As needed to answer and provide reasonable follow-up.
• Contract, consent, payment, billing, and accounting records: For the period required by tax and other applicable laws.
• Rejected applications or applications withdrawn before successful payment: Deleted or anonymized when no longer needed, except to the extent retention is required by law or necessary for fraud prevention, inquiries, claims, or disputes.
• Access logs: As needed for site operation, security review, and the settings of the relevant provider.

A period may be extended to meet a legal retention obligation or as necessary for a claim, dispute, incident, fraud investigation, or protection of rights. When information is no longer needed, it will be deleted or anonymized within a reasonable period. Data in backups is isolated from normal use, is not reused except where needed for recovery, and is removed according to each service's overwrite or expiration cycle.

Under Slack's current free-plan rules, eligible data from the most recent 90 days is available for viewing and search. If we adopt the one-year retention setting, data older than 90 days may become unavailable without being immediately deleted, and data older than one year is permanently deleted on a rolling basis. If we adopt the 90-day deletion setting, covered data is deleted after 90 days. The actual setting and its application to messages, files, canvases, and lists will be provided in the individual conditions or service instructions before use; no learner personal data will be entered before verification.

For an ordinary cancellation, Slack access is stopped by member removal or another method at the contract end date and time. Removal does not immediately delete posts or files. Information in Slack follows our selected retention settings, our available permissions, and Slack's features. Separately managed contract, consent, payment, billing, accounting, dispute, incident, fraud-investigation, and rights-protection records are retained for the period required for each purpose.

Article 9 (Disclosure of Personal Data)

1. A person may request notification of the purposes of use of their retained personal data, disclosure of that data, and disclosure of third-party provision records subject to the APPI. We verify identity and, for a representative, authority, and respond without delay in accordance with law.
2. We disclose by an electronic record or another method designated by the requester as provided by law. If that method is difficult because of significant cost or other circumstances, we notify the requester and use a lawful alternative such as a written document.
3. We may withhold notification or all or part of disclosure only where permitted by law. Disclosure exceptions include a risk to the life, body, property, or other rights and interests of the requester or another person; significant interference with the proper conduct of our business; and violation of another law.
4. If we do not notify or disclose, or the requested retained personal data or records do not exist, we notify the requester without delay and endeavor to explain the reason for not fulfilling the request.

Article 10 (Correction and Deletion of Personal Data)

1. A person may request correction, addition, or deletion of their retained personal data if its content is factually incorrect.
2. Unless another law provides a special procedure, we investigate without delay within the scope necessary for the purpose of use and make the required corrections based on the result.
3. We notify the person without delay of the correction and its content or of a decision not to correct. If we decline all or part of the request, we endeavor to explain the reason.

Article 11 (Suspension of Use of Personal Data)

1. A person may request suspension of use or erasure of their retained personal data under the APPI where it has been handled unlawfully, including use beyond the stated purposes, improper use, or unlawful acquisition. A person may request an end to third-party provision that violates the applicable restrictions.
2. A person may also request suspension of use, erasure, or an end to third-party provision under the APPI when we no longer need the data, a legally reportable leak or similar incident has occurred, or handling risks harming their rights or legitimate interests.
3. We investigate as necessary and, where the legal requirements are met, act without delay to the extent necessary to correct the violation or protect the person’s rights and interests. If action is difficult because of significant cost or other circumstances and an alternative can protect those rights and interests, we take the alternative permitted by law.
4. We notify the person without delay whether we act or decline all or part of the request, and endeavor to explain any refusal. For legally required records and similar information, we assess retention duties and the legal grounds for the request; a request does not automatically erase every record.

Article 12 (Personal Data of Minors)

1. For a learner under 18, we verify the parent or legal guardian as the contracting party and payer and the young person as the learner, and obtain the consent required for the contract and personal-information handling.
2. We may share with that guardian contract and billing information, whether meetings occurred, learning themes, submission status, progress, next goals, and other information necessary to continue learning.
3. We do not ordinarily share full chat or meeting transcripts, full source code, credentials, private consultations, or third-party information. If sharing beyond that scope is needed, we explain the purpose, information, and method and obtain the required consent.
4. For a learner aged 18 or older, we do not share information with a guardian without the learner’s prior consent. Withdrawal of consent stops future sharing.
5. Slack is used only for learners aged 16 or older. We verify date of birth or age before invitation. A learner under 16 is not invited to Slack and receives email or another individually specified alternative.

Article 13 (Changes to Privacy Policy)

1. We may change this Policy in accordance with law and this Policy within purposes reasonably related to the original purposes or otherwise permitted by law.
2. Before a change takes effect, we notify its content, affected scope, and effective date on this website or through the registered contact channel. Where consent is required by law, the change does not apply until that consent is obtained.
3. We retain prior policy versions and applicability records. Updating the version number or revision date does not retroactively change existing consent or contractual conditions. Information collected earlier is handled in accordance with the purposes stated at collection and applicable law.

Article 14 (Information Concerning Retained Personal Data)

We provide the following information under APPI Article 32:

• Operator and personal information administrator: 宮本 一央 (trade name: Ada Foundry; service name: Ada IT School). The operator’s address is provided without delay upon a request from the person concerned.
• Purposes of use: The purposes in Article 3.
• Requests: Contact the office below with the request and information needed to identify its subject. We individually explain the documents needed to verify identity and representative authority, without imposing an excessive burden, and respond without delay under Articles 9–11. Requests are free of charge.
• Complaints: Contact the office below. You may also contact Japan’s Personal Information Protection Commission.

Article 15 (Contact Information)

For inquiries and requests for disclosure, correction, erasure, or suspension of use, please contact the following office.