Privacy Policy

1. Operator and scope

The Service is operated by TOKYO CONSULTING Inc. for the officers and employees of the Supernova Tokyo group companies. This Policy applies to users of the Service (hosts who publish booking pages and organization administrators), people who book through a booking page ("invitees"), people who contact us, and visitors to the Service's website (https://cal.tokyocorp.net).

2. Information we collect

1. User account information: name, email address, organization (company), profile picture, login information (passwords are stored as irreversible hashes), time zone and display language
2. Information from Google and Microsoft accounts: as described in Sections 4 and 5
3. Booking information: the invitee's name, email address, phone number (if SMS reminders are chosen), answers to the questions configured on the booking page, time zone, booking time and status, and meeting URL
4. Integration information: authentication tokens for meeting services such as Zoom, Slack notification destinations and webhook endpoints
5. Inquiries: company, name, email address, phone number, the message, and referral information (referrer and UTM parameters)
6. Usage information: access logs, IP address, browser type, activity logs, email and SMS delivery logs, and cookies

3. How we use it

1. Providing the Service: computing availability, displaying booking pages, confirming, rescheduling and cancelling bookings, creating calendar events and meeting links
2. Sending confirmation emails, reminders (email / SMS) and notifications
3. Verifying identity, managing accounts and organizations, and automatically joining organizations by email domain
4. Responding to inquiries
5. Preventing abuse, maintaining security and investigating incidents
6. Improving the Service and producing statistics in a form that does not identify individuals
7. Sending important notices such as changes to our terms
8. Complying with legal obligations

4. Google user data

With your consent, the Service accesses the following information through Google APIs and uses it only for the purposes described in this Section.

Email address, name and profile picture

Collected when you sign in with Google and when you connect Google Calendar. Used to verify your identity, create your account, place you in your company's organization by email domain, and display your name in the app.

List of calendars

Collected so that you can choose which calendars are used to compute availability and which calendar new events are written to.

Event times and busy / free status

The start and end times, all-day flag and busy status of events on the calendars you selected, used to show only genuinely free slots on your booking page. Event data retrieved for availability is kept only for as long as the calculation needs it and is not stored beyond that.

Creating, updating and deleting events

When a booking is confirmed we create an event (title, time, attendees, description and a Google Meet link) on the host's calendar, and we update or delete that event when the booking is rescheduled or cancelled. We store the identifier and time of events the Service created so that changes and cancellations can be reflected.

Limits on use

1. Information obtained from Google is used only to provide and improve the Service's features (computing availability, creating, updating and deleting events, and signing in and verifying identity) and for no other purpose.
2. We do not use information obtained from Google for serving or targeting advertisements, for credit or insurance decisions, or for sale to third parties or data brokers.
3. We do not use information obtained from Google to develop, improve or train generalized artificial intelligence (AI) or machine learning (ML) models.
4. Our staff do not read information obtained from Google except with your explicit consent (for example when you ask for support and share your screen), where necessary to investigate security issues or abuse, where required by law, or where aggregated in a form that does not identify individuals for internal operations.

Storage and protection

Google authentication tokens are encrypted with AES-256-GCM before being stored in our database, and all communication is encrypted with TLS. Data is stored in the Tokyo region of Amazon Web Services, access is restricted to staff by role, and operational actions are logged.

Deletion

1. You can disconnect Google Calendar at any time from "Settings > Integrations" in the Service. Disconnecting immediately deletes the authentication tokens and any calendar data held for availability.
2. You can also revoke the Service's access from the third-party apps & services page of your Google Account.
3. When you leave the Service or your organization is deleted, information obtained from Google is deleted together with your account data (Section 10). You may also request deletion through the contact in Section 14.

Compliance with the Google API Services User Data Policy

Supernova Calendar's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

5. Microsoft, Zoom and other integrations

If you connect a Microsoft account (Outlook Calendar, Teams) or Zoom, the same scope and methods as in Section 4 apply: calendar events are used only to compute availability and to create, update or delete events, and meeting services are used only to create meeting links. Authentication tokens are stored encrypted and deleted when you disconnect or leave. Each provider's own handling is governed by its privacy policy.

6. Invitee information

Information entered by invitees on a booking page is processed by us on the instructions of the host (the user who published the booking page and their organization) in order to confirm, reschedule and cancel bookings, create calendar events, and send confirmations and reminders. Invitees can reschedule or cancel at any time from the link in their confirmation email. To request deletion, contact the host or use the contact in Section 14.

7. Sharing with third parties

We do not provide personal data to third parties without consent except where required by law. Booking information is shared between the host and the invitee of that booking (calendar invitations and confirmation emails). Booking information is sent to webhook endpoints and Slack destinations only where a user has configured them.

8. Service providers

We entrust the processing of personal information to the following providers to the extent necessary to achieve the purposes above. We select providers that manage personal information appropriately and supervise them as required.

Amazon Web Services

Servers, database and file storage (Amazon Web Services, Inc., USA; data is stored in the Tokyo region)

Google

Google sign-in, Google Calendar and Google Meet (Google LLC, USA)

Microsoft

Outlook Calendar and Teams via Microsoft accounts (Microsoft Corporation, USA)

Zoom

Creation of Zoom meeting links (Zoom Video Communications, Inc., USA)

Resend

Delivery of confirmation, reminder and login emails (Resend, Inc., USA)

BytePlus

Delivery of SMS reminders (BytePlus Pte. Ltd., Singapore)

Slack

Notifications to organizations and to our operations team (Slack Technologies, LLC, USA; only where a user has configured a destination)

9. Transfers outside Japan

Entrusting processing to providers in the United States and Singapore listed above may constitute a transfer of personal data to third parties in a foreign country. Each provider has implemented measures equivalent to those required under Japan's Act on the Protection of Personal Information. Information on the data protection systems of each country is available on the website of the Personal Information Protection Commission of Japan.

10. Retention and deletion

We retain information for approximately the periods below and delete it afterwards, except where retention is required by law or needed to handle a dispute.

Account and organization data

While you use the Service; deleted within 30 days after you leave or the organization is deleted (backups are deleted automatically 30 days after they are taken)

Google, Microsoft and Zoom tokens

Deleted immediately when you disconnect the integration, leave the Service, or the organization is deleted

Booking data (invitee name, contact details, answers, times)

2 years from the booking date; deleted earlier on request from the host or the invitee unless retention is required by law

Email and SMS delivery logs

1 year from sending

Inquiries

3 years after the inquiry is resolved

Access and audit logs

1 year

11. Security

We protect personal information against leakage, loss and damage through measures including encryption in transit (TLS), encrypted storage of secrets such as authentication tokens (AES-256-GCM), separation of data by organization, role-based access control, logging of operational actions, restrictions on outbound destinations, and staff training.

12. Cookies

We use cookies to keep you signed in, remember the organization you are working in, remember your display language (snc_lang) and prevent abuse. The website may use the browser's session storage to record how you arrived when you contact us. We do not use third-party advertising cookies.

13. Your rights

If you ask us to notify you of the purpose of use of, disclose, correct, add to, delete, suspend the use of, erase, or stop providing to third parties your retained personal data, or to disclose records of third-party provision, we will respond without delay in accordance with the law after verifying your identity. Please use the contact in Section 14.

14. Contact

Contact

TOKYO CONSULTING Inc., Supernova Calendar operations (personal information inquiries)

Email

cal@tokyocorp.net

Form

Contact form

15. Changes

We may revise this Policy in response to changes in the law or in the Service. We will announce material changes in the Service or on this website. The revised Policy takes effect when it is posted on this website.