Appligon K.K. (株式会社Appligon), a company incorporated in Japan, the operator of the Service ("we", "us" or "our") handles personal information collected through "NEOFANS" (the "Service") as set out below.
1. Information We Collect
- Account information: email address, display name, profile image, and the identifier of any external service used to log in (Google)
- Identity verification information (Creators only): name, date of birth, images of identity documents and a selfie, and the bank account details needed to receive earnings
- Payment information: purchase history, amounts, and transaction IDs returned by payment service providers. Card numbers never pass through our servers (they are handled directly by the payment service providers)
- Usage information: history of viewing, purchases, follows and messages; device and browser type; IP address; access times; cookies
- Posted information: Content posted by Creators, and messages and Tip notes sent by Fans
- Report information: the reason for and content of reports
2. Purposes of Use
- Providing the Service (login, displaying Content, payments and payouts to Creators)
- Age verification, identity verification, and preventing and responding to fraud and violations of our Terms
- Keeping records required by law and responding to inquiries from authorities
- Answering inquiries and sending important notices
- Creating drafts using the Creator's own data in the Creator feature (AI Secretary)
- Improving the Service and statistical analysis (performed in a form that does not identify individuals)
3. Handling of Identity Documents
Identity documents and selfies are stored in encrypted storage that only staff performing verification can access. They are automatically deleted 90 days after the review is completed (approved or rejected). The name, date of birth and review result are kept as records required by law.
4. Disclosure to Third Parties
We do not provide personal information to third parties except in the following cases:
- With the User's consent
- To service providers necessary to provide the Service, such as payment service providers, cloud providers and email delivery providers, to the extent necessary
- As required by law, or upon a legitimate request from a court, the police or similar authority
- Where necessary to protect a person's life, body or property
Between Creators and Fans, the Fan's display name and message content are shown to the Creator. A Fan's email address or real name is never shown to Creators. A reporter's information is never passed on to the reported party.
5. Processing by AI
Only when a Creator has enabled it, the AI Secretary feature sends that Creator's sales, messages and posts to an external language-model provider to create drafts. The data sent is used only to create drafts, and the provider is not permitted to use it for training. Fans' messages are not sent to AI for any purpose other than drafts by an AI Secretary the Creator has enabled.
6. Cookies
We use cookies to keep you logged in, remember age verification, record referral links (30 days) and compile usage statistics. If you disable cookies in your browser, you will not be able to log in.
7. International Transfers
Data is stored on servers of cloud providers in Japan, the United States, the United Kingdom and the EU. Appropriate safeguards based on applicable law are applied at each destination.
8. Retention Period
Account information and transaction records are kept for the period required by law (in principle seven years) even after account deletion, and are then deleted. Identity documents are handled as described in section 3.
9. Your Rights
You may request disclosure, correction, deletion or suspension of use of your personal information (for residents of the EEA, the UK and Switzerland, see also section 12). You can delete your account from My Page. For other requests, contact us at the address below. We will respond within a reasonable period after verifying your identity.
10. Security
We protect personal information with encryption in transit (TLS), encryption at rest, least-privilege access control and log monitoring.
11. Changes
We will announce changes to this Policy on the Service. Material changes will be announced at least 14 days before they take effect.
12. Residents of the EEA, the UK and Switzerland (GDPR)
We process personal data of residents of the European Economic Area, the United Kingdom and Switzerland in accordance with the EU General Data Protection Regulation (GDPR), the UK GDPR and the UK Data Protection Act 2018, as follows.
- Controller: We are the controller of your personal data. Our contact details are in section 13. Our address is disclosed without delay upon request.
- Legal bases: We process data to provide the Service, payments and Creator payouts for the performance of a contract (Art. 6(1)(b) GDPR); for age and identity verification, record keeping and responding to authorities to comply with a legal obligation (Art. 6(1)(c)); for fraud prevention, security, service improvement and statistics on the basis of our legitimate interests (Art. 6(1)(f)); and for optional notification emails and the AI Secretary on the basis of your consent (Art. 6(1)(a)). We do not use advertising cookies or third-party tracking (cookies are limited to those necessary to provide the Service and our own statistics, as described in section 6). Facial images processed for identity verification are used only to confirm age and identity, on the basis of your explicit consent.
- Your rights: You have the following rights.
- Right of access (to obtain your personal data and a copy of it)
- Right to rectification
- Right to erasure ("right to be forgotten")
- Right to restriction of processing
- Right to data portability (to receive your data in a machine-readable format and transfer it to another provider)
- Right to object (to processing based on legitimate interests and to direct marketing)
- Right not to be subject to a decision based solely on automated processing
- Right to withdraw consent at any time (without affecting the lawfulness of processing before withdrawal)
- Right to lodge a complaint with the data protection supervisory authority in your country (in the UK, the Information Commissioner's Office, ICO)
- How to make a request and response time: Please send requests by email to the address in section 13. After verifying your identity, we respond within one month of receipt (for complex requests, we may extend this by up to two further months, with an explanation). Requests are free of charge in principle.
- International transfers: Personal data may be processed on servers and by service providers outside the EEA and the UK, including in Japan and the United States. Japan benefits from adequacy decisions by the European Commission and the UK. For transfers to other countries, we use appropriate safeguards such as the European Commission's Standard Contractual Clauses (SCCs) and the UK International Data Transfer Addendum (IDTA). A copy of the safeguards is available on request.
- Retention: As described in section 8, we keep data only for the period necessary for its purposes and the period required by law.
- Data breaches: If a personal data breach is likely to result in a high risk to your rights, we will notify the supervisory authority and the affected persons without undue delay as required by law.
- Persons under 18: The Service is not intended for persons under 18, and we do not knowingly collect personal data of persons under 18.
13. Contact
NEOFANS Support
support@neofans.net
(Operated by Appligon K.K. (株式会社Appligon), a company incorporated in Japan. Our address is disclosed without delay upon request.)