Privacy Policy

• Registration data: Email address, full name, address, phone number
• Identity verification documents: Images of driver's license, passport, or national ID
• Payment data: Coin purchase history, Stripe payment IDs (card numbers are never stored on our servers)
• Call / stream data: Call duration, recording files (only when recording option is selected), chat logs
• Usage logs: IP address, device information, browsing history

• Providing, operating, and improving the Service
• Identity verification and fraud prevention
• Coin purchase and payout processing (Japanese Payment Services Act compliance)
• Creator reward calculation and bank transfers
• Customer support and service announcements
• Responding to legal disclosure requests

We do not share personal information with third parties except in the following cases:

• With the user's consent
• When required by law
• To protect life, body, or property
• To service providers (Stripe, AWS, etc.) to the minimum extent necessary (providers are bound by equivalent confidentiality obligations)

• Recordings are stored encrypted on AWS S3 (Tokyo region).
• Access is restricted to AWS CloudFront signed URLs; no direct third-party access.
• If a creator publishes an archive, it becomes available to the specified audience. Obtaining consent from all persons appearing in the recording is the creator's responsibility.
• You may request deletion of your recording data upon account termination.

• Coin purchases are processed via Stripe, Inc. Card numbers are never stored on our servers.
• Purchase history (amount, date, plan ID, coins received) is recorded in our database.
• Per the Japanese Payment Services Act, the timestamp of first Terms agreement at coin purchase is retained permanently.

• ID documents are used solely for KYC (Know Your Customer) purposes.
• Image files are automatically deleted from S3 storage within 30 days of verification completion via AWS S3 lifecycle policy. Only the "verified" status and date are retained.
• Documents are shared with third parties only when required by law.

We use cookies and browser storage for session management and service improvement.

▼ PWA-specific technical details

• Session Cookies: Used to maintain login authentication tokens. Deleted on browser close or explicit logout.
• localStorage: Stores user preferences (language, UI theme, last viewed state) on-device only. Not transmitted to our servers.
• IndexedDB: Service Worker may cache data for offline support. No personal information is included.
• Service Worker Cache: Static files (JS, CSS, images) are cached for fast startup. Clearable via "Clear site data" in browser settings.
• Push Notification Token: If you enable push notifications, your device token is stored on our server. Disable via notification settings or browser preferences.
• Home Screen Install (PWA): Installing as an app does not change the type of data collected. No additional tracking occurs.

• Account information: 5 years after withdrawal (legal compliance)
• Payment / coin history: 10 years (Payment Services Act)
• ID document images: Auto-deleted from S3 within 30 days of verification. Only "verified" status retained thereafter.
• Call logs / chat: 1 year after withdrawal
• Recordings: Until deleted by creator, or 90 days after account termination

You may request access, correction, or deletion of your personal data by emailing chatmarket-unei@onestep-corp.com. We will respond within the legally required period after identity verification.

▼ GDPR rights (EU/UK residents)

• Right of Access: Obtain a copy of all personal data we hold about you.
• Right to Data Portability: Receive your data in a machine-readable format (JSON) within 30 days of request.
• Right to Erasure ("Right to be Forgotten"): Request deletion of all personal data except legally mandated records. Completed within 30 days.
• Right to Restriction of Processing: Request that we restrict processing where you contest accuracy or object to the purpose.
• Right to Lodge a Complaint: EU residents may file a complaint with their local Data Protection Authority (DPA).
• Korean users (PIPA): Rights to view, correct, delete, and suspend processing are also accepted at the email above.

We implement access controls, encryption, and periodic security audits to prevent unauthorized access, loss, or destruction of personal information.

ChatMarket Privacy Officer
Email: chatmarket-unei@onestep-corp.com