External services and international processing explanation

1. Overview of external processing

This page is a draft before formal effect. Relaying, authentication, AI generation and maintenance process information in addition to the Tokyo DB; processing is not restricted to Japan. Communication and authentication infrastructure may operate from the first page visit. Later checkboxes do not establish grounds retroactively.

Contracts and ongoing safeguards are the intended basis for delegated processing, but contract applicability and foreign-transfer grounds are still under review. Acknowledgement of this explanation is not recorded as foreign-transfer consent. If consent is used, destination countries, legal systems and safeguards must be explained separately before transfer.

2. Authentication, traffic and metadata

Clerk processes names, email, profiles, user/organization IDs and authentication information on US infrastructure. Google login shares only authorized profile information with Clerk. Google also processes information under its own policies. We do not store Google passwords.

Cloudflare relays web traffic, including IPs, authentication, text and audio, for protection and geographic restrictions. Render runs the web app, maintenance and backups in Singapore. The production Prisma Postgres database is in Tokyo, but operations, support and subprocessors are not guaranteed to stay in Japan.

3. Audio generation and storage

Modal receives text, reference voice keys, generation parameters and job information, and reads recordings from R2 to generate audio. Execution location is not pinned; function inputs/outputs, temporary results and logs include US storage. R2 privately stores recordings and generated audio with an APAC location hint, not a country guarantee.

Audio, text and history are retained for 30 days on trial/Starter and 90 days on Creator/Pro. Registered voices and original recordings are scheduled for deletion 90 days after subscription end. Operator-managed encrypted backups have a 30-day deletion setting. Modal has separate retention, including function inputs/outputs up to 7 days and Dict data 7 days after last access. App deletion does not mean immediate erasure across all infrastructure. Legally required transaction records are separate.

Hugging Face distributes models; normal generation does not send it customer text or recordings for inference. Sending another person's recordings or text requires permission or lawful authority. Recording-rights attestation is separate from foreign-transfer consent.

4. Payments and contact

Stripe receives organization, checkout and price identifiers; the user enters name, email, billing and card information in Checkout. Text and recordings are not payment data. Stripe determines some purposes independently, including payments and fraud prevention. Its overseas affiliates and infrastructure mean processing is not Japan-only.

Sentry has no destination configured. Its data and explanation must be reviewed before enabling it. Contact [email protected] for external-processing, deletion or safeguard requests. Do not send passwords, API keys or card numbers.