Privacy Policy
Effective: October 4, 2026
Banto GK ("we") handles personal information in accordance with Japan's Act on the Protection of Personal Information (APPI) and related laws. This policy covers the Banto AI assistant used through LINE, the banto.me website and customer dashboard, and the customer websites we build and operate (together, "the Service"). This English version is a translation. If it differs from the Japanese version, the Japanese version prevails.
1. Who we are
- Company: 合同会社Ｂａｎｔｏ (Banto GK)
- Address: 135 Nishiki-Omiya-cho, Omiya-dori Shijo-agaru, Nakagyo-ku, Kyoto 604-8365, Japan
- Representative: Alexander David Guse
- Contact: admin@banto.me
2. Information we collect
- LINE: your LINE user ID, display name, and your conversations with Banto (messages, images and files you send).
- Customer account: business name, members' roles, invitation records, contact details such as the email address that receives website inquiries, and website text and photos you give us.
- Google, only if you connect it: your Google account email, an identifier, the permissions you grant, encrypted credentials, and the Gmail, Calendar and Drive content Banto retrieves when you ask.
- Usage and billing: AI usage, credits, plan, and payment records (amount, period, and the payment provider's identifiers). Card details are collected directly by our payment provider, Stripe; we do not hold them.
- banto.me sign-in: the LINE user ID and display name from LINE Login. We do not store LINE access tokens and do not receive email addresses.
- Technical records: processing records kept for security and troubleshooting, such as times and outcomes.
3. How we use it
- To provide the Service: answering your requests, building, publishing and maintaining websites, and delivering email.
- To verify identity and manage sign-in, accounts and permissions.
- To calculate charges and manage billing and payments.
- To respond to inquiries and contact you about the Service.
- To prevent abuse, keep the Service secure, and investigate and fix problems.
- To maintain and improve the Service, including statistics that do not identify individuals.
- To comply with the law.
4. AI processing
To answer your requests, we send the relevant content (conversations, Google content, files) to AI providers: Google Cloud Vertex AI and OpenAI. Requests go through Cloudflare AI Gateway, with gateway logging turned off. We do not use your information to train AI models. Under each provider's business API terms, the content is not used to train that provider's models.
To fix problems, we keep each AI request and response as a diagnostic record in Cloudflare R2 for up to 30 days, after which it is deleted automatically. R2 encrypts these records at rest; we do not add our own encryption. Secrets and one-time links are removed before a record is stored. Staff open a record only to investigate a specific bug, abuse or security issue, to comply with the law, or when you ask us to look, and every opening is logged with its reason.
If you link your own ChatGPT account to Banto, those requests go to OpenAI under that account and its terms.
5. Information collected on customer websites
Websites we operate for our customers may collect visitors' information through inquiry, booking or application forms, or member sign-up.
- The business that runs the website collects this information, and that website's own policy applies to it.
- We handle it only on the business's behalf: to run the website, store the data, deliver notification emails and prevent abuse. We do not use it for our own purposes or give it to third parties.
- Form submissions are stored in a database kept separate for each website, and are emailed to the address the business specifies.
- Forms and sign-up may use Cloudflare Turnstile to block abuse, which sends the visitor's IP address and similar details to Cloudflare.
- Where we provide analytics, we use Cloudflare Web Analytics, which counts visits without cookies, and we do not store IP addresses. If a business chooses to add Google Analytics or similar tools, that provider's policy applies.
6. Sharing with third parties
We do not share personal data with third parties without your consent, except as required by law, when needed to protect life, body or property and consent is hard to obtain, or as otherwise permitted by the APPI.
7. Service providers and processing outside Japan
We entrust the handling of personal data to the following providers, as far as needed for the purposes above.
| Provider | Country | Purpose |
|---|---|---|
| Cloudflare | United States and others | Servers, databases, file storage, email delivery, Turnstile, AI Gateway, logs |
| Google Cloud (Vertex AI) | United States and others | Generating AI answers |
| OpenAI | United States | Generating AI answers |
| Parallel | United States | Web search (search queries are sent) |
| Stripe | United States | Payments |
LINE messages are sent and received through LINE, which LY Corporation provides under its own terms. Google content is retrieved from Google's APIs when you ask for it.
For the U.S. personal-information system, see the information published by Japan's Personal Information Protection Commission. We check each provider's terms to confirm it has arrangements to handle personal data properly. More detail is available on request.
8. Security measures
- Organization and people: the representative is responsible for personal-information handling, and access is limited to those who need it for their work.
- Technical: encrypted connections, Google credentials encrypted at the application layer, LINE user IDs hashed and encrypted, role-based access by business and membership, user identity determined on our servers, and logged access to diagnostic records.
- Foreign environments: we use the providers outside Japan listed in section 7, with awareness of those countries' laws.
9. Retention
| Information | Kept for |
|---|---|
| banto.me sign-in | Up to 8 hours (deleted on sign-out) |
| AI diagnostic records | Up to 30 days (deleted automatically) |
| Banto conversation history and files sent in LINE | Until you reset the conversation (/reset) or delete your account |
| Google credentials | Only while connected; after you disconnect, deleted once Google confirms the access is revoked |
| Usage, payment and activity records | As long as needed for accounting, tax and other legal requirements and to prevent fraud |
| Information collected on customer websites | As the business that runs the website instructs, or until the website is deleted |
10. Cookies
The banto.me homepage uses no cookies and no analytics. Signing in uses only the cookies needed to keep you signed in and to prevent abuse. We do not use advertising cookies.
11. Google user data
Banto's use and transfer to any other app of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google data for advertising, sale or credit decisions, or to develop, improve or train generalized AI or machine-learning models.
12. Your requests
You may ask us to tell you how we use the personal data we hold about you, to disclose it (including records of sharing it with third parties), to correct, add to or delete it, to stop using or erase it, or to stop sharing it. Email admin@banto.me. After confirming you are the person concerned (or their representative), we respond promptly as the law requires. There is no fee.
In LINE, you can also ask Banto at any time to disconnect Google or to reset the conversation.
13. Contact
Questions and complaints about personal information: Banto GK, Privacy Inquiries, admin@banto.me.
We are not a member of an accredited personal information protection organization.
14. Children
The Service is for businesses and is not directed at children under 13.
15. Changes
We may update this policy as the law or the Service changes. We will post significant changes on this page and update the effective date.