Vulcanz LLC ("we", "us") complies with Japan's Act on the Protection of Personal Information and related laws, and handles user personal information appropriately. This policy sets out how personal information is handled in the MAPRISE service (maprise.jp). As a business handling personal information, our name is "Vulcanz LLC" (Vulcanz Godo Kaisha), our representative is KANAMORI Toshiki, Representative Member, and our address is Tenjin Sumitomo Life FJ Business Center 5F/6F, 2-8-35 Tenjin, Chuo-ku, Fukuoka, Fukuoka 810-0001, Japan. This revision of the policy was posted on 1 October 2026 and takes effect on 1 November 2026 (the policy as it stood before this revision applies through 31 October 2026). On 6 October 2026 we also added items that had been omitted from this policy although we already handle information in that way (information collected, purposes of use, external transmission, retention periods, etc.) and corrected errors. These describe our current practice accurately and form part of this policy from the date they were posted. In addition, on 25 October 2026 we extended the retention period of system logs (including access logs that contain IP addresses) from up to 90 days for access logs and up to 1 year for system logs in general to up to 10 years, and stated the purposes of use. This handling forms part of this policy from the date it was posted.
1. Information We Collect
- Account information (registered users only): Email address, Google account details (name, profile picture — only when using Google OAuth), selected plan, and whether you use the Service as or for a business (usage category)
- Usage data: Map interaction history (viewport, zoom level, selected layers), AI chat input and responses (see "6. Data Retention" for how long they are kept; conversations of guests and Free-plan users are also kept for a limited period to prevent abuse and handle incidents), the parameters and content of generated PDF reports
- Map app usage records (maprise.jp/app/): the date and time you open the screen, your IP address, browser, operating system and device type (PC, smartphone, tablet, etc.), display language, screen width, the list of layers that were shown right after the screen opened, and layer show/hide operations (including whether you made the operation yourself or it was automatic, such as restoring a saved view or a linked layer). If you are signed in, we attach your user ID and plan. We do not record map positions, search strings or the contents of input fields. If your browser has "Do Not Track" (DNT) or Global Privacy Control enabled, we do not make this record
- Data you register or create: property and location data (name, address, coordinates, notes, etc., registered via My Properties, CSV import, or the shared workspace), and your display name in the shared workspace (Business plan and above, team members only)
- Payment information (only if you apply for a paid plan): your customer ID, plan and billing cycle, contract status and payment status at our payment processor Stripe; billing name and country and, if you enter it, your business tax registration number; and, to prevent repeated use of the free trial, an identifier for your card issued by Stripe (not the card number itself) and a value computed from your email address (a hash). Card numbers, expiry dates and security codes are collected and managed by Stripe; we do not collect or hold them.
- Inquiries: the name, company name, email address, message and plan of interest you enter in the contact form
- Referral partner applications: the company name, contact name, email address, phone number, business description, intended referral targets and message you enter in the application form
- Referral partners: your email address (used to send sign-in links to the partner portal) and the deal information registered in the partner portal (prospect company name, email address and notes)
- Technical data: IP address, browser type, OS version, session ID (sessionStorage, cleared on tab close)
- Sign-in records: IP address, browser and device type, and approximate location inferred from the IP address
- Bot-protection result at account registration (Cloudflare Turnstile) and the IP address used to register
- Records of consent to the Terms of Service and other documents (version of the document, date and time, IP address, browser information)
- Anonymous guest identifier: used only when you submit an AI question from the homepage without logging in (stored in localStorage and a cookie — see "9. Cookies and Local Storage")
2. How We Use Your Information
- To provide and operate the Service, including authentication and security management
- To save and display AI chat history (registered users only)
- To show your display name, in the shared workspace, to members of the same contract as the creator or last editor of reports and other items
- To manage subscriptions and process billing (including sign-up during a trial period)
- To respond to support requests and inquiries
- To analyze usage in aggregate, after processing into statistics that cannot identify any individual
- To improve the Service and develop new features
- To comply with applicable laws
- To prevent abuse (detecting unauthorized sign-ins, fraudulent registrations and improper account sharing, and preventing repeated use of the free trial)
- To record the fact of consent to the Terms of Service and other documents, and to respond to inquiries and disputes about that consent
- To review and respond to referral partner applications, manage partner agreements, calculate referral results and rewards, and issue payment statements
- To record deals registered in the partner portal and check for duplicate registrations
- To understand how the map app is used (which layers and features are used, and from which devices and browsers) and to check for misuse (investigating suspicious access). For this purpose only, the operator may review the records of signed-in users, linked to their user ID, in the operator's admin console (only the operator can view them; showing or exporting email addresses is recorded in an audit log; the records are not used for advertising or provided to third parties)
3. AI Chat and Personal Information
The AI chat feature uses foundation models on Amazon Bedrock (mainly Anthropic Claude; a different foundation model may be used to check whether inputs are safe).
- Inputs are processed within Japan.
- Under Amazon Bedrock's design, inputs and responses are not provided to foundation-model providers (such as Anthropic) and are not used to train the foundation models.
- Inappropriate content is filtered.
- Conversations of guest users and Free-plan users cannot be viewed on screen. They are kept solely to prevent abuse and to handle incidents, and are deleted automatically after 14 days (guests) or 30 days (Free plan). We do not review or analyse them for quality improvement or AI training.
4. Data Sharing
We do not share personal data with third parties except:
- With your consent
- When required by law (court orders, lawful requests from authorities)
- With service providers under confidentiality obligations
For customers who use the Referral Partner Program (customers who reserve or apply a referral code at sign-up), after obtaining your explicit consent via a consent button, we notify the referring partner of whether you have a subscription, which plan you selected, your name, and your payment amount (excluding tax). We do not share your card information or details of your service usage (map operation history, AI chat content, etc.) with the referring partner under any circumstances. Consent is captured via the consent button when you reserve or apply the referral code, and the date and time of consent is recorded. Even if you do not consent, you can continue to use the service as usual without using a referral code.
4-2. Personal Data Entrusted to Us by Customers
Where User Data registered in the Service by a user (My Properties, CSV imports, data in the shared workspace, etc.) contains personal data, we handle it as having been entrusted to us by that user (for the shared workspace, by the contract holder), and only to the extent necessary to provide the Service. We do not use it for our own purposes (advertising, AI training, development of new services, etc.).
Because this personal data is not retained personal data held by us, please direct requests for disclosure, correction, suspension of use, and the like to the user who registered the data (for the shared workspace, the contract holder). We provide the cooperation that user or contract holder needs to respond.
We do not view this data except where necessary to respond to a failure, to maintain security, to comply with law, or to provide support at the user's request. When we do view it, we limit the staff who may do so and keep a record of the access.
5. Third-Party Services
| Service | Purpose | Region | Privacy Policy |
|---|---|---|---|
| Amazon Web Services (AWS) | Infrastructure, auth (Cognito), AI (Bedrock), storage (DynamoDB/S3) | Japan (Tokyo / Osaka) | aws.amazon.com |
| Anthropic (Claude) | AI chat processing (runs on AWS's Amazon Bedrock; inputs are not provided to Anthropic) | within Japan | anthropic.com |
| Stripe | Payment processing (collecting and managing card details, billing) | United States (provider: Stripe, Inc., United States; payment services in Japan are provided by Stripe Japan K.K.; PCI DSS compliant) | stripe.com |
| OAuth authentication (only when Google login is selected); recording entries from the contact form and the referral partner application form (Google Apps Script and Google Sheets) | United States (provider: Google LLC, United States; processing region per Google's terms) | policies.google.com | |
| Google Analytics (Google LLC) | Web analytics (understanding usage and improving the Service) | United States (provider: Google LLC, United States; processing region per Google's terms) | policies.google.com |
| Sentry | Error and performance monitoring (detecting and investigating issues; on error only, may capture session replay — a screen recording with text and images masked by default) | United States (provider: Functional Software, Inc., United States; processing region per Sentry's terms) | sentry.io |
| Cloudflare Turnstile (Cloudflare, Inc.) | Bot protection at account registration (preventing fraudulent registrations) | United States (provider: Cloudflare, Inc., United States; processing region per Cloudflare's terms) | cloudflare.com |
Where we entrust the handling of personal data to providers in the table that are located in the United States (Stripe, Google, Sentry, Cloudflare), we confirm, through each provider's data processing terms and the like, that they have in place a system meeting the standards set by Japan's Act on the Protection of Personal Information, and we take the measures necessary to ensure that it continues to be implemented. On request, we will provide information about those measures. For the personal information protection system of the United States, see the materials published by the Personal Information Protection Commission (https://www.ppc.go.jp/enforcement/infoprovision/laws/offshore_report_america/).
6. Data Retention
| Data type | Retention period |
|---|---|
| Account information | 30 days after account deletion, then progressively deleted (except data we are required to retain by law)** |
| AI chat history | Plan-dependent (Guest: 14 days, Free: 30 days (neither can be viewed on screen)* / Starter: 30 days / Pro: 6 months / Business: 3 years / Enterprise: coming soon (timing TBD)). See the feature comparison on the pricing page for details. Retained for registered users only. |
| PDF report generation logs | Up to 1 year** |
| Data you created or saved (saved views, my properties, exported CSV/GeoJSON) | Retained while your account is active. After account deletion, kept for 30 days and then progressively deleted (except data we are required to retain by law)** |
| Shared reports (shared workspace) | Up to 5 years from the date of publication (the contract holder or an administrator can shorten this). Kept so that they can be referred to as business records.** |
| Display names of members who have left (shared workspace) | Replaced with "Former member" 30 days after the member leaves (immediately, if the member asks to waive the opportunity to undo leaving).** |
| Records of consent to the Terms of Service and other documents (version of the document, date and time, IP address, browser information, etc.) | 5 years after the contract ends (to respond to disputes about consent). After you leave the Service, the IP address and browser information are deleted and the user ID is replaced with a form that cannot identify you. |
| Shared Data in the shared workspace | As set out in Article 10 of the Terms of Service (if deletion was agreed when cancelling, deleted once 30 days have passed from the day after the contract end date; if the contract ended without that agreement, kept read-only for 3 months and then deleted).** |
| Operation history (records of data exports and refund requests) | Up to 180 days**. If you delete your account, kept for 30 days after deletion and then progressively deleted. |
| Payment and AI-credit transaction records | Kept for up to 10 years from the day after the filing deadline of the corporate tax return for the relevant business year, taking into account the retention periods required by the Corporation Tax Act and related laws, and then deleted. After account deletion, the user ID contained in these records is replaced with an irreversible substitute value so that no specific user can be identified. |
| Access logs (IP, etc.) | Up to 10 years (kept as system logs for operations and security audits. Used only to investigate unauthorised access and incidents and to respond to audits; never used for advertising or provided to third parties) |
| Map app usage records (IP address, browser, device type, layer operations, etc.) | Up to 120 days |
| Sign-in records (IP address, device type, approximate location) | Up to 2 years (as provided by our authentication platform, Amazon Cognito) |
| Number of registrations per IP address at sign-up (detecting fraudulent registrations) | 30 days |
| Records preventing duplicate registration with the same email address (a value computed from the email address) | Up to 3 years from confirmation of registration (retained after account deletion) |
| Records that the free trial has been used (card identifier and a value computed from the email address; no name or card number) | Kept for 5 years from the last use, to prevent repeated use of the free trial (retained after account deletion) |
| Record of account deletion (a value computed from the email address, date and time of deletion, internal user ID) | Kept for 5 years from the date of account deletion (used so that no initial free AI credits are granted if you register again with the same email address within 30 days of deletion) |
| Records of provision to referral partners (only if you used a referral code) | At least 3 years from the date of provision (as required by the Act on the Protection of Personal Information) |
| Records that an account deletion was carried out*** | As set out in *** |
| Session information | Cleared immediately on tab close (sessionStorage) |
7. Security
- All traffic encrypted with TLS 1.2 or higher
- Authentication managed with an industry-standard authentication method
- Access control follows the principle of least privilege
- Filtering of inappropriate content
- Access to personal data is limited to staff with a business need
- Organizational measures: we appoint a person responsible for handling personal data and regularly check how it is handled
- Human measures: we require those who handle personal data to keep it confidential and handle it properly
- Physical measures: personal data is stored in data centers in Japan with controlled physical access, and we take measures against theft or loss of the devices used for work
- Understanding the external environment: because we entrust the handling of personal data to providers in the United States, we take security measures with an understanding of the personal information protection system of the United States
8. Your Rights
Under Japan's Act on the Protection of Personal Information, you may request:
- Disclosure of personal data we hold about you
- Correction, addition, or deletion of inaccurate data
- Suspension of use or erasure (where we no longer need to use the data, where a leak or similar incident has occurred, where your rights or legitimate interests are likely to be harmed, or in case of out-of-purpose use or improper acquisition)
- Suspension of disclosure to third parties
- Disclosure of records of provision to third parties (such as records of provision to referral partners)
Requests are accepted at info@maprise.jp. To verify your identity, please contact us from your registered email address or present an identity document we specify. A request made through an agent requires a document confirming the agent's authority, such as a power of attorney. We reply by email as a rule, within the legally required period. We currently charge no fee for these requests. We may charge a fee in the future, for example if the number of requests becomes extremely large; if so, we will announce the amount in this policy in advance.
9. Cookies and Local Storage
The Service uses the following storage:
- sessionStorage: temporary auth tokens, language preference, decoded user information (email address, name, etc.) cached for on-screen display during your authenticated session — the same account information already disclosed in "1. Information We Collect" — the read/dismissed status of AI credit usage notifications (maprise.credits.notify.*), and the sign-in state of the referral partner portal (maprise.partner.portal.token), and a random identifier used to group map app usage records from the same screen session (mpr_usage_sid; it contains no name or email address) (cleared on tab close)
- localStorage: Used to remember that you have acknowledged the disclaimer for the seismic simulation feature, the chat panel width (maprise_chat_width), cross-tab connection control (maprise_ws_lock_hb), whether you have dismissed the beta announcement banner (version-tracked), whether you have dismissed the "Before you start" notice on the map screen (maprise.guestLegalNotice.v1), a display cache of AI credit consumption history (maprise.credits.*.consumed, tracking monthly usage — the read/dismissed status of related notifications is stored separately in sessionStorage, as noted above), your language preference (lang), and an anonymous guest identifier (maprise_anon_identityId) issued when you submit an AI question from the homepage without logging in — a random identifier issued by AWS Cognito that contains no name, email address, or other directly identifying information. It persists until you clear your browser's storage; contains no other personally identifiable information.
- Cookies: session cookies used to deliver the service; cookies set by Google Analytics for usage measurement (see "13. Transmission of User Information to Third Parties"); a language preference set when you switch the display language (NEXT_LOCALE, valid for 1 year); and a cookie corresponding to the anonymous guest identifier above (maprise_anon_uuid), valid until 23:59 Japan time on the day it is issued and extended each time you use the feature again that day. Both maprise_anon_identityId and maprise_anon_uuid are used solely to track usage counts and prevent abuse by guest users of the AI question feature, and contain no personally identifying information such as your name or email address.
10. Minors
Users under 18 should use the Service with the consent of a parent or other legal guardian, and users under 16 may not sign up for a paid plan (both under Article 3 of the Terms of Service, applying from 13 November 2026). The Service is not intended for users under 13. If we discover an account belonging to someone under 13, we will delete it. The Service is intended for use in relation to real estate in Japan and is operated from Japan; this policy is governed by the Act on the Protection of Personal Information of Japan.
11. Changes to this Policy
We may update this policy as needed. Material changes are announced no later than 30 days before their effective date, by posting on this page and by email to registered users. The latest version is always posted on this page.
12. Related Laws and References
This Privacy Policy is operated in compliance with the following laws and guidelines. Please refer to the source URLs for the latest official versions.
| Law / Guideline | Issuer | Source URL |
|---|---|---|
| Act on the Protection of Personal Information (APPI; the current Act — we will review this policy when amendments take effect) | Digital Agency e-Gov Law Search | https://laws.e-gov.go.jp/law/415AC0000000057 |
| PPC Guidelines (General Rules / Cross-border Data Transfer) | Personal Information Protection Commission | https://www.ppc.go.jp/personalinfo/legal/ |
| Personal information protection systems of foreign countries (United States) | Personal Information Protection Commission | https://www.ppc.go.jp/enforcement/infoprovision/laws/offshore_report_america/ |
Response to Data Breach (Reporting to PPC and Notification to Subjects)
- Preliminary report: promptly after becoming aware of the incident (generally within 3-5 days)
- Final report: within 30 days (60 days if for fraudulent purposes)
- Notification to affected individuals: promptly, according to the circumstances
13. Transmission of User Information to Third Parties
We use the web analytics service "Google Analytics" to understand how the Service is used and to improve it. As a result, your user information (cookie identifiers, pages viewed, IP address, etc.) is transmitted to Google LLC. The transmitted information does not include data that directly identifies you, such as your name, address, or email address.
If you do not wish your information to be sent to Google Analytics, you can stop transmission and use through your browser settings or the "Google Analytics Opt-out Browser Add-on" provided by Google. Opt-out add-on: https://tools.google.com/dlpage/gaoptout
On the account registration screen we use "Cloudflare Turnstile", provided by Cloudflare, Inc., to prevent fraudulent registrations by bots. Your IP address, browser and device information, information about how you interact with the screen and the like are transmitted to Cloudflare, Inc. and used to determine whether the operation is performed by a person. Cloudflare's privacy policy: https://www.cloudflare.com/privacypolicy/
On the Service's introductory pages (maprise.jp), we use the error monitoring service "Sentry", provided by Functional Software, Inc., to detect and investigate problems. When an error occurs, information about where it occurred, browser type and OS version, the URL of the page being viewed, and a partial recording of the screen at the time of the error (text in input fields and images are masked by default) are transmitted to that company. Sentry's privacy policy: https://sentry.io/privacy/
To display the background map on the homepage, we fetch map images from a map delivery service provided by MapTiler AG (Switzerland). As a result, your IP address, browser information and the map area being displayed are sent to that company. Its privacy policy: https://www.maptiler.com/privacy-policy/
The company information page embeds "Google Maps", provided by Google LLC, to show our location. When you view that page, your IP address, browser information, cookies issued by Google and similar information are sent to that company. Its privacy policy: https://policies.google.com/privacy
In the map application (maprise.jp/app/), we fetch components and data directly from the servers of the following providers to display the map and screens and to provide features. As a result, the information in the table below is sent to each provider. All of these are needed for the Service to display and work, so they cannot be switched off individually. The referrer information our pages send to other companies is limited to the site origin (https://maprise.jp/); the URL of the page being viewed and search conditions are not sent.
| Recipient (country) | Information sent | Purpose |
|---|---|---|
| unpkg (CDN on Cloudflare, USA), jsDelivr (Prospect One, Poland), Cloudflare, Inc. (cdnjs, USA) | IP address, browser information | Fetching program components used to display the map, charts and AI chat |
| Google LLC (Google Fonts, USA) | IP address, browser information | Fetching on-screen fonts |
| Geospatial Information Authority of Japan, MLIT and other government bodies (Japan) | IP address, browser information, the map area being displayed | Fetching map images such as base maps, aerial photos, elevation and hazard maps (when you use the relevant displays or features) |
| Amazon Web Services (Amazon Location Service, Tokyo Region) | IP address, browser information, the map area being displayed, the text of an address search (when you search for an address) | Base map in English mode; address search |
| ExchangeRate-API (Australia) | IP address, browser information | Fetching exchange rates for US-dollar conversion in English mode |
This section is published as a disclosure regarding the external transmission of user information under Japan's Telecommunications Business Act.
Privacy Contact
MAPRISE — Privacy Officer
Email: info@maprise.jp
Hours: Weekdays 10:00–18:00 JST (excluding weekends and Japanese public holidays)