MediBang Paletta Privacy Policy

Version Update Date: February 12, 2026
Effective Date: February 12, 2026

MediBang Inc. (hereinafter referred to as “the Company”) considers the protection of user privacy and personal information (meaning personal information as defined in Article 2, Paragraph 1 of the Act on the Protection of Personal Information (hereinafter referred to as the “Personal Information Protection Act”); the same applies hereinafter) as a top priority. In your use of the MediBang Paletta application operated by the Company (hereinafter referred to as “this Application” or “this Service”), the Company may collect and use user information.

This Privacy Policy (hereinafter referred to as “this Policy”) aims to explain how the Company collects, uses, stores, shares, and protects users’ personal information, as well as how users can manage this information. Before using this Service, please read this Policy carefully, especially the items indicated in bold, and fully understand it.

1. Methods of Collection and Use of Personal Information

Adhering to the Personal Information Protection Act and other relevant laws and regulations, the Company collects and uses your personal information in accordance with the principles of legitimacy, legality, and necessity.

1.1 Purpose of Use

The Company collects and processes personal information only for the purposes described below. Note that if purposes of use for personal information are separately stipulated in the terms of service, etc., provided by the Company, such purposes shall also be included.

1. To provide this Service.
2. To operate contests and other services provided through this Service, and for the payment of prize money and shipping of prizes, etc.
3. To conduct surveys, campaigns, etc.
4. To respond to inquiries regarding this Service.
5. To respond to acts that violate the Terms of Service of this Service.
6. To send marketing emails containing information regarding this Service.
7. To use as reference material for the enhancement and improvement of this Service and for advertising placement, etc.
8. To create statistical data regarding user usage patterns, etc., in a range that cannot identify individuals.
9. To deliver behavioral targeting advertisements using ad distribution providers such as Google and Yahoo!.
10. To analyze attribute information, behavioral history, etc., acquired by the Company to understand customers’ hobbies, preferences, etc.
11. For purposes incidental to the above purposes of use.

To measure the effectiveness of advertisements, the Company may acquire information on advertisements clicked before visiting the Company’s site (such as click date and advertising operation site) from tools operated by third parties and match it with order information.

1.2 Advertising

To provide you with free or personalized services, the Company may use advertising identifiers (IDFA, Ad ID, etc.) and Cookies to analyze your usage status and display advertisements.

Advertising SDK Information:

2. Cookies and Similar Technologies

The Company uses Cookies and similar technologies (such as Google Analytics) to save your settings, authenticate your identity, and analyze service usage status to improve the user experience.

• Google Analytics: The Company uses Google Analytics for traffic analysis. This service collects non-personally identifiable information through Cookies. If you wish to refuse, you can block the collection of Cookies by installing the browser plug-in provided by Google.

3. Sharing, Transfer, and Disclosure of Information

3.1 Third-Party Services and SDKs

To realize functions such as advertising, payment, and statistical analysis, this Application integrates third-party SDKs. These third parties may collect your device information (IDFA, IP address) and network status. Your information is shared only for legitimate, appropriate, and necessary purposes. Major third-party SDKs include the following:

Google & Firebase Suite

• Firebase Analytics: User behavior analysis
• Firebase Crashlytics: Crash report collection
• Firebase Messaging: Push notifications
• Firebase Remote Config: Remote configuration management
• Firebase Dynamic Links: Deep links
• Google Analytics: Data analysis
• Google AppMeasurement: App monitoring

4. Data Storage and Cross-Border Transfer

4.1 Storage Location

The Company is headquartered in Japan. You agree that personal information generated during the use of this Service (account information, work data on the cloud, etc.) may be transferred to, and stored/processed on servers in Japan or other countries/regions.

4.2 Cross-Border Protection

The Company strictly complies with relevant laws and regulations and takes security measures such as encryption and access control to protect data safety.

4.3 Storage Period

Personal information processed by the Company will be retained by the Company for the period necessary to achieve the purposes stipulated in this Policy and the period necessary to fulfill obligations under laws and regulations.

5. Implementation of Appropriate Security Management Measures

Regarding personal information held by the Company, in order to prevent unauthorized access, tampering, leakage, loss, or damage, the Company takes necessary and appropriate security management measures, such as appointing a personal information management officer, maintaining internal discipline, educating employees, managing entry and exit, restricting equipment brought in, restricting access to information, and measures to prevent unauthorized access. For questions regarding security management measures, please contact the window in Section 9.

6. Your Rights

Based on relevant laws and regulations, you have the following rights:

• Access and Correction: You can access or correct registered information from the “Profile Settings” page within the app.
• Deletion and Withdrawal: You can request the deletion of personal information.
• Withdrawal of Consent: You can withdraw your consent to the privacy policy at any time. However, the withdrawal of consent does not affect the legality of handling based on the consent prior to its withdrawal.

7. Protection of Minors

If you are a minor, please read this Policy together with your guardian and use this Service upon obtaining the guardian’s consent.

8. Requests for Disclosure, Correction, etc., of Personal Information

When the Company is requested by a user regarding the user’s personal information held by the Company for notification of the purpose of use, disclosure (including disclosure of records when providing to or receiving from a third party of personal data), correction, addition, deletion, suspension of use/erasure, or suspension of provision to a third party based on the Personal Information Protection Act, the Company will respond in accordance with the Personal Information Protection Act after confirming that the request is from the user themselves. When making such a request, please contact the window in Section 9.

9. Contact Us

If you have questions, complaints, or suggestions regarding this Privacy Policy or the handling of personal information, please contact us via the following method:

• Company Name: MediBang Inc.
• Contact Email: [email protected]
• Address: Shibuya Place 2F, 1-10-5 Dogenzaka, Shibuya-ku, Tokyo, Japan

10. Name, Address, and Representative Name of the Personal Information Handling Business Operator

[Name] MediBang Inc.

[Address] Shibuya Place 2F, 1-10-5 Dogenzaka, Shibuya-ku, Tokyo

Representative Director: Hideyuki Takashima