Privacy Policy

• Registration data: Email address, full name, address, phone number
• Identity verification documents: Images of driver's license, passport, or national ID
• Payment data: Coin purchase history, Stripe payment IDs (card numbers are never stored on our servers)
• Call / stream data: Call duration, recording files (only when recording option is selected), chat logs
• Usage logs: IP address, device information, browsing history

• Providing, operating, and improving the Service
• Identity verification and fraud prevention
• Coin purchase and payout processing (Japanese Payment Services Act compliance)
• Creator reward calculation and bank transfers
• Customer support and service announcements
• Responding to legal disclosure requests

We do not share personal information with third parties except in the following cases:

• With the user's consent
• When required by law
• To protect life, body, or property
• To service providers (Base44, Stripe, AWS, communications and notification providers, etc.) to the minimum extent necessary
• When an overseas service provider is used, we apply the safeguards and information requirements required by applicable law.

• Recordings are stored encrypted on AWS S3 (Tokyo region).
• Access is restricted to AWS CloudFront signed URLs; no direct third-party access.
• If a creator publishes an archive, it becomes available to the specified audience. Obtaining consent from all persons appearing in the recording is the creator's responsibility.
• You may request deletion of your recording data upon account termination.

• Coin purchases are processed via Stripe, Inc. Card numbers are never stored on our servers.
• Purchase history (amount, date, plan ID, coins received) is recorded in our database.
• Terms-agreement timestamps and transaction records are retained for the period necessary for legal, accounting, payment-processing, and dispute-resolution purposes.

• ID documents are used solely for KYC (Know Your Customer) purposes.
• Image files are automatically deleted from S3 storage within 30 days of verification completion via AWS S3 lifecycle policy. Only the "verified" status and date are retained.
• Documents are shared with third parties only when required by law.

We use cookies and browser storage for session management and service improvement.

▼ PWA-specific technical details

• Session Cookies: Used to maintain login state. Retention varies by the authentication service and browser settings; cookies can be removed by logging out or changing browser settings.
• localStorage: Stores user preferences (language, UI theme, last viewed state) on-device only. Not transmitted to our servers.
• IndexedDB: The browser may store data for offline support or playback state. The contents vary by feature.
• Service Worker Cache: Static files (JS, CSS, images) are cached for fast startup. Clearable via "Clear site data" in browser settings.
• Push Notification Token: If you enable push notifications, your device token is stored on our server. Disable via notification settings or browser preferences.
• Home Screen Install (PWA): Installing as an app does not change the type of data collected. No additional tracking occurs.

• Account information: As long as necessary after withdrawal for legal, fraud-prevention, and dispute-resolution purposes
• Payment / coin history: As required for legal, accounting, and payment-processing purposes
• Identity-document images: As long as necessary for verification and fraud prevention, then deleted under applicable law and our deletion procedures.
• Call logs / chat: As long as necessary for service delivery, support, and dispute resolution
• Recordings: According to publication and sales conditions, creator deletion requests, and account status

You may request access, correction, or deletion of your personal data by emailing chatmarket-unei@onestep-corp.com. We will respond within the legally required period after identity verification.

▼ GDPR rights (EU/UK residents)

• Right of Access: Obtain a copy of all personal data we hold about you.
• Right to Data Portability: Receive your data in a machine-readable format (JSON) within 30 days of request.
• Right to Erasure ("Right to be Forgotten"): Request deletion of all personal data except legally mandated records. Completed within 30 days.
• Right to Restriction of Processing: Request that we restrict processing where you contest accuracy or object to the purpose.
• Withdrawal and objection: Withdraw consent where processing is based on consent and object to direct service communications.
• Right to Lodge a Complaint: EU residents may file a complaint with their local Data Protection Authority (DPA).
• Korean users (PIPA): Rights to view, correct, delete, and suspend processing are also accepted at the email above.

We implement access controls, encryption, and periodic security audits to prevent unauthorized access, loss, or destruction of personal information.

ChatMarket Privacy Officer
Email: chatmarket-unei@onestep-corp.com