Privacy Policy

1. Scope of This Policy

This Policy applies to everyone who uses the Services: Japanese nationals, foreign residents of Japan, and people who use the Services from outside Japan.

If you reach the Services through an Institutional Partner (for example, an employer, municipality, or university), that organization may also collect information about you on its own. Its own privacy policy covers that information. Please read that policy too.

This Policy covers Sollo only. Other products from us, such as Menyu, have their own policies. See the Menyu Privacy Policy for Menyu.

2. Information We Collect

2.1 Information You Provide to Us

• Account and profile information: your name, email address, date of birth, gender, and preferred display language. Your name and email address come from the Google or Apple account you use to sign in. You can edit your name. You enter your date of birth and gender yourself during onboarding.
• Region: the prefecture you choose and, if you wish, your municipality or postal code. We use them to show you local government information. You can also let the app fill them in using your device's approximate (coarse) location. That lookup happens on your device. We store only the resulting prefecture and municipality. We never collect GPS coordinates or precise device location.
• Life Navigator inputs: details about your situation that you choose to share to receive guidance. These may include employment status, household and family composition (for example, single-parent status), residency or visa status, income range, and similar life-event details.
• Companion AI data: your conversations, prompts, and feedback to the AI Features.
• Payment information: none at this time. The Services are free during this pilot phase, so we do not collect billing details, card numbers, or other payment information. If we introduce paid plans, we will update this Policy before we collect any payment information.
• Messages and forms: support requests, surveys, and what you write in the feedback, bug-report, and closed-beta sign-up forms on our website or in the app. A closed-beta sign-up asks for your name, email address, Apple ID email address, location, device, preferred language, and reason for joining. It also records your consent. These forms also record the page you were on, your browser type (user agent), and the size of your browser window.

2.2 Information Collected Automatically

• Device and log data: device type, operating system, app version, IP address, and crash or diagnostic logs.
• Usage data: features used, session length, and interaction patterns.
• Your device's language setting, which we use to choose a default display language. We tailor Life Navigator content to the region you select yourself (see Section 2.1). We do not use your IP address or GPS for this. On the website, our analytics providers may infer an approximate, city- or country-level location from your IP address (see Section 12).
• Cookies and similar technologies on the website, described in Section 12.

2.3 Information From Other Sources

If you reach the Services through an Institutional Partner, we may receive limited information confirming that you are eligible for sponsored access. We also use publicly available government and municipal sources to build Life Navigator content. This source material is generally not personal information about you.

2.4 Special Care-Required Information (要配慮個人情報)

Some information you choose to share with Life Navigator or the Companion AI may be "Special Care-Required Information" under Article 2(3) of the APPI. Examples are details about a disability, a health condition, or a past criminal record that matter for a benefits question. We collect this kind of information only through your own explicit, opt-in action, for example when you choose to share it in a chat or form. We apply extra internal access restrictions to it.

3. How We Use Your Information

We use the information described above to:

• Provide and personalize Life Navigator guidance and the Companion AI;
• Operate the Companion AI, and monitor and improve its accuracy and safety;
• Respond to your feedback, bug reports, and requests, and manage closed-beta invitations;
• Detect, investigate, and prevent fraud, abuse, and violations of our Terms of Service, including attempts to bypass AI safeguards;
• Communicate with you about the Services, including updates, security notices, and, where you have consented or the law otherwise permits, marketing;
• Comply with our legal obligations and respond to lawful requests from public authorities; and
• Run aggregated, de-identified analysis to improve the Services, including ward-level or institutional insights that do not identify you.

4. AI Processing and Personalization

When you ask the Companion AI a question or generate a Life Navigator journey, the text you provide is sent first to Sollo's own servers and then forwarded to a third-party large-language-model ("LLM") API provider. That text may include personal details you choose to share. The provider generates the response. We currently use the Alibaba Cloud Model Studio (DashScope) API, running a Qwen model. Your input is sent to that provider and processed there to produce your answer, under the provider's API terms. We may change the provider or model as the product develops. If we do, we will update this Policy to name the new provider.

Our own servers run the search and orchestration around the AI. They are hosted by a cloud infrastructure provider. That provider handles data on our behalf and does not use it for its own purposes (an "entrustment" under Article 27, paragraph 5(i) of the APPI). The LLM API provider above is a separate company that processes your input to generate the AI Output. We keep certain prompts and AI Output for safety monitoring, misuse detection, and quality assurance, for the periods in Section 8.

4.1 Your Companion AI Memory and Personalization

To make the Companion AI more helpful over time, a background step reviews your conversations and saves a short, personal "memory" about you on our servers. The memory can include details you have mentioned, such as your general situation, your residency or visa status, your household, the language you prefer to read in, and the topics you have explored. It also includes a brief one-line summary.

The memory is generated with the same LLM API provider, is private to your account, and is used to personalize future answers. You can view and clear it at any time in the app's settings. Clearing it removes the stored details and summary. Future answers may then be less tailored to you.

5. Purpose Specification and Your Consent

As the APPI requires, we state the purposes for which we use your personal information (see Section 3). We do not use it beyond those purposes without appropriate notice or consent.

Where we rely on your consent, for example for Special Care-Required Information, you may withdraw it at any time through your account settings. Withdrawing may limit your ability to use the related feature.

6. How We Share Your Information

We share personal information only as described below. We do not sell your personal information.

• Service providers (entrustees): cloud hosting and computing providers, the LLM API provider that generates AI responses (see Section 4), the database and notification tools we use to receive and handle your feedback, and customer-support tools. Each is bound by contractual confidentiality and security obligations, or by the provider's API terms, consistent with the APPI. We do not currently use payment processors, because the Services are free during this pilot. We will add this category if we introduce paid plans.
• Discord (feedback): when you send feedback or a bug report, what you wrote, its category or details, and the page you were on are posted to a private Discord channel that our team uses to read and act on reports. Each post also carries technical details: the language you were using, the app version, and a reference number. For a closed-beta sign-up, we post your device and preferred language, but not your name, email addresses, location, or reason for joining. The email address you enter in a form is never posted there. It stays in our database. Discord is operated by Discord Inc. in the United States.
• Cloudflare (anti-spam): the anti-spam check on our forms sends your IP address, browser user agent, and other device signals to Cloudflare, so it can confirm you are not a bot. Cloudflare is operated by Cloudflare, Inc. in the United States. Your message is never sent to Cloudflare.
• Analytics and fonts: Google and Vercel receive limited information from the website, as described in Section 12.
• Institutional Partners: limited, aggregated, de-identified usage statistics about their sponsored population, unless you separately and explicitly consent to share more.
• Other users: none. The Services do not currently include messaging, posts, or any other user-to-user features, and we do not share your personal information with other users.
• Legal and safety purposes: to comply with applicable law, respond to valid legal process, or protect the rights, safety, or property of Sollo, our users, or the public.
• Business transfers: in connection with a merger, acquisition, financing, or sale of assets, with continued protection of your information consistent with this Policy.

7. Cross-Border Data Transfers

Some of our providers run servers outside Japan. This includes our cloud hosting and AI infrastructure and the LLM API provider named in Section 4. It also includes Cloudflare, Discord, Google, and Vercel, which are based in the United States and receive the website data described in Sections 6 and 12.

When personal data goes to a recipient outside Japan, we rely on one of the grounds in Article 28 of the APPI:

• your consent, given after we tell you about the destination country and the protections there;
• the recipient has a system that meets the standards set by Japan's Personal Information Protection Commission (PPC) for protecting personal data on an ongoing basis, and we check it at least once a year; or
• the destination is a country or region that the PPC recognizes as offering an adequate level of protection.

You can ask us at any time, using the contact details in Section 16, which countries our current providers operate in and which of these grounds applies.

8. Data Retention

We keep different kinds of information for different lengths of time, depending on why we collected it:

Where this Policy or the law requires longer retention for a specific purpose, we keep the relevant information only for as long as that purpose requires.

9. Your Rights Under the APPI

Subject to identity verification and any legal exceptions, you have the right to:

• Request disclosure of the personal information we hold about you and the purposes for which we use it;
• Request correction, addition, or deletion of inaccurate personal information;
• Request that we stop using or delete personal information that is used beyond the stated purposes, was obtained unlawfully, or is no longer needed for the purposes it was collected for;
• Request that we stop providing your personal information to third parties;
• Ask which categories of recipients outside Japan receive your information, and what protections are in place; and
• File a complaint with us or with Japan's Personal Information Protection Commission (PPC).

If you live outside Japan, you may have additional rights under your local law (for example, the GDPR in the EEA or UK). We will honor them to the extent they apply to our processing of your information. To use any of these rights, contact us using the details in Section 16. To delete your account, see sollo.my/delete-account.

10. Data Security

We use technical and organizational measures to protect your personal information. They include encryption in transit, access controls, and restricted internal access to sensitive categories such as Special Care-Required Information. No system is completely secure, and we cannot guarantee absolute security. If we learn of a data breach that affects your rights or interests, we will notify you and the PPC as the law requires.

11. Children's Privacy

The Services are for users aged 18 and older, as our Terms of Service state. We do not knowingly collect personal information from anyone under 18. If we learn that we have, we will take steps to delete it.

12. Cookies and Similar Technologies

Our website uses the following services. For each one, this list says what it receives from your browser, who receives it, and why.

• Essential browser storage. Your browser keeps your cookie choice (accept or reject) on your device, so the banner does not ask again. We do not receive it.
• Google Analytics (Google), only if you accept analytics in the cookie banner. It receives information about the pages you visit and how you use the site, together with your IP address and your browser and device details. It sets cookies in your browser. We use it to understand broad usage patterns, such as which pages are visited and how people move through the site. If you reject analytics, the Google Analytics script is not loaded.
• Vercel Web Analytics (Vercel Inc.), on every page, whatever you choose in the banner. It counts visits. It receives the page you visit, the page you came from, your browser and operating system, and an approximate location (country or city) worked out from your IP address. Vercel states that it does not use cookies and does not follow visitors across days or across sites.
• Cloudflare Turnstile (Cloudflare), on pages with a form. It receives your IP address, browser user agent, and other device signals, so it can confirm you are not a bot before we save your message.
• Google Fonts (Google), on every page. Your browser loads our fonts from Google's servers, so Google receives your IP address and browser details when a page loads.

You can reject analytics cookies in the banner and keep using the site. You can change your choice at any time with the "Cookie settings" link in the page footer. We do not use third-party advertising cookies to build cross-site advertising profiles of you.

13. International Users

The Services are designed mainly for residents of Japan, both Japanese nationals and foreign residents, and are operated from Japan. If you use the Services from outside Japan, your information will be processed in Japan and, as described in Section 7, possibly in other countries where our service providers operate.

14. Sensitive Life-Event Data: Our Commitment

15. Changes to This Policy

We may update this Policy from time to time. If we make a material change, we will give notice through the Services or by other reasonable means before the change takes effect.

16. Contact Us

Send questions, requests, or complaints about this Policy or our handling of your personal information to: