Privacy Policy
GembaShift ("we", "us") provides KOEMAP, a market feedback analysis service (the "Service"). This policy explains how we handle personal information and other user data in the Service. We comply with the Act on the Protection of Personal Information of Japan and other applicable laws and guidelines.
1. Who we are
- Provider: GembaShift
- Contact for privacy matters: masataka.mayuzumi@gembashift.com
2. Information we collect
| Category | Details |
|---|---|
| User account information | User ID, name (or display name), email address, the customer department the user belongs to, and role. We receive this from our customer, or from the customer's single sign-on identity provider. |
| Usage records and audit logs | Date and time of sign-in and of operations, the operation performed, the identifier of the study concerned, source IP address and browser type. We collect these to detect misuse and to provide customers with a record of activity in their own account. |
| Analysis inputs | Information entered by users to set up a study: vehicle model, target countries, analysis topics and local part names. |
| Public YouTube data | Video metadata (video ID, title, description, publication date, view count, channel name, channel ID, thumbnail) and the text and like count of publicly visible comments. Personal names appearing in comments are masked at the point of storage. |
| Cookies | Used only to maintain the sign-in session. We do not use advertising cookies, behavioural targeting cookies or third-party analytics cookies. |
The Service does not connect to a user's YouTube account. We obtain only data that is already publicly available on YouTube.
3. How we use the information
- To provide the Service: collecting videos, transcription, translation, extraction of mentions, aggregation, and display and export of results
- To authenticate users, manage permissions and keep each customer's data separated
- To detect and respond to misuse and defects, and to maintain security
- To measure usage for billing and reporting under the applicable agreement
- To improve the Service through statistical analysis, using data processed so that individuals cannot be identified
- To respond to enquiries and to send important notices
We do not use personal information for advertising, and we do not sell personal information to third parties.
4. Disclosure to third parties and processors
Except where required by law, we do not disclose personal information to third parties without prior consent, and we never sell it.
To the extent necessary to operate the Service, we engage the following processors. Each is bound by a contract covering confidentiality and security, and we supervise them appropriately.
- Providers of generative AI (large language model) APIs, for summarisation, translation and extraction of mentions from transcripts
- Providers of speech-to-text APIs, for transcribing video audio
- YouTube API Services (Google LLC), for retrieving video and channel metadata and public comments
- CDN and DNS providers, for delivering this website and the Service and for name resolution
- A hosting provider in Japan, for the runtime environment and data storage
Of these, the generative AI and speech-to-text API providers, YouTube API Services, and the CDN and DNS providers may be located outside Japan or process data on servers outside Japan. Where that is the case, we treat it as a transfer of personal data to a third party in a foreign country: we review the data protection regime of the country concerned and put contractual safeguards in place. Data sent to API providers is covered by business terms under which the provider does not use the content for training its models.
The runtime environment and data storage for the Service are located in a region within Japan.
Disclosures regarding YouTube API Services
The Service uses YouTube API Services. By using the Service, you agree to be bound by the YouTube Terms of Service.
For how Google LLC handles information obtained through YouTube API Services, please see the Google Privacy Policy.
The Service does not connect to your YouTube account and handles only publicly available data. You are not required to grant the Service any access to your Google or YouTube account.
You can review and revoke the access you have granted to third-party applications on your Google account at any time through the Google security settings page.
Data obtained from YouTube is used solely for analysis within the Service. We do not distribute or retain the video files themselves.
5. Retention periods
| Data | Retention |
|---|---|
| Metadata obtained through the YouTube API (videos, channels, comments) | Not kept for more than 30 days; after 30 days it is either refreshed from the API or deleted. |
| Transcripts, captured still frames and extracted mentions | According to the customer's configured setting; 365 days by default where no setting is made. |
| Video and audio files | Deleted as soon as processing of that video is complete. They are obtained only for temporary processing. |
| User account information | Until the end of the agreement, then deleted as described below. |
| Audit logs and usage records | For as long as needed for customer reporting and misuse investigation (365 days by default). |
When an agreement ends, we delete the customer's data within the agreed period and issue the customer a certificate confirming the deletion.
6. Security measures
- Organisational: a limited group of authorised staff, records of processing, and a defined incident reporting procedure
- Personnel: confidentiality agreements with staff and processors, and periodic training
- Physical: physical access to the runtime environment is restricted by the controls of our hosting provider
- Technical: encryption in transit (TLS), encryption at rest, per-customer data separation, role-based access control, access logging, and hashed storage of credentials
7. Access, correction and deletion requests
Individuals, or their authorised representatives, may request notification of the purpose of use, disclosure, correction, addition or deletion of their personal data, suspension of use or erasure, or suspension of disclosure to third parties. We may ask for documentation confirming identity.
- Contact: GembaShift privacy enquiries
- Email: masataka.mayuzumi@gembashift.com
User accounts are administered by our customer. Requests made through the customer are also accepted.
8. If your YouTube content appears in the Service
The Service analyses videos and comments that are publicly available on YouTube. If you have a request concerning your own posted content, please contact us at the address above. We will verify the request and promptly remove the content from the cache we hold.
9. Changes to this policy
We may revise this policy to reflect changes in law or in the Service. Revisions are published on this page together with their effective date. We notify customers in advance of material changes.
10. Contact
Questions about this policy are welcome at masataka.mayuzumi@gembashift.com.