Effective date: August 27, 2026 Last updated: August 27, 2026
This Privacy Policy explains how Yu Plus Co., Ltd. ("we," "us," or "our"), the operator of MAFICA (the "Service"), collects, uses, discloses, and protects personal data. This Policy should be read together with the Terms of Service, Cookie Policy, and AI Usage Policy.
We collect only the personal data needed to operate the Service. Specifically:
| Category | Examples | Where it lives |
|---|---|---|
| Account identity | Email address (unique per account), display name, avatar URL, preferred language, timezone | users table |
| Team & Workspace | Role (Owner/Admin/Member/Viewer), Workspace membership, invitation records | Tenancy records |
| Connected-service credentials | OAuth tokens and API keys for integrations you connect (e.g., Shopify, Instagram/Threads, Higgsfield) | Encrypted at rest (see Section 4) |
| Marketplace payout data | PayPal payout email, encrypted payout account details, tax country, encrypted tax ID, KYC review status | Publisher payout profile records |
| Billing records | Credit purchase and usage transaction history, PayPal order references | Credit ledger |
| Business data you provide or connect | Order data, product data, facts, meeting notes, and KPIs you add to Company Memory | Company Memory (with vector embeddings for search) |
| Consent & compliance records | Consent to this Policy and the Terms, data-export requests, data-deletion requests | Compliance records |
| Usage & device data | IP address, browser/device information, pages visited, and similar diagnostic data collected automatically when you use the Service | Server logs, session records |
We do not knowingly collect payment card numbers; card-level payment data is handled entirely by PayPal and never reaches our servers.
We use personal data to: (a) create and administer your account and Workspace; (b) operate the Service's core features, including generating AI recommendations grounded in Company Memory; (c) process Credit purchases and Marketplace payouts; (d) verify Publisher payout eligibility (see Section 7 of the Terms regarding the limits of this review); (e) communicate with you about the Service, including material changes to these policies; (f) detect and prevent fraud, abuse, and security incidents; (g) comply with legal obligations, including Japan's Act on Specified Commercial Transactions and applicable tax and accounting record-keeping requirements; and (h) improve the Service, using aggregated or de-identified data where feasible.
We do not sell personal data, and we do not use your business data to train foundation models operated by our AI sub-processors beyond what is necessary to generate your requested output (see Section 5 and the AI Usage Policy).
Where applicable law requires a legal basis for processing, we rely on: performance of our contract with you (the Terms) for core account and billing functions; our legitimate interests in operating, securing, and improving the Service; your consent, where we ask for it explicitly (e.g., browser notification permission, marketing communications); and compliance with legal obligations (e.g., tax record-keeping).
We share personal data with the following categories of service providers, each acting as a data processor on our behalf and bound by contractual confidentiality and data-protection obligations:
| Sub-processor | Purpose | Data involved |
|---|---|---|
| Anthropic (Claude models) | Powers the AI CEO, AI Employees, Research analysis, and Social Studio caption drafting | The content of your prompts and the Company Memory context retrieved to ground the response |
| Voyage AI | Generates vector embeddings so Company Memory can be searched by meaning, not just keyword | Text content of facts, meeting notes, and KPIs you add to Company Memory |
| Higgsfield | Generates AI images and video for Marketing Capabilities, where you use those Capabilities | Creative prompts and, where applicable, reference assets you supply |
| PayPal | Processes Credit purchases, Marketplace payouts, and (for FanVault-enabled stores) checkout | Payment authorization data handled directly by PayPal; we receive only transaction status and references |
| Shopify | Source of the store, order, and product data you choose to connect | Data you authorize via the Shopify integration |
| Railway | Hosts our backend application and database | All data described in Section 1, as infrastructure host |
| Vercel | Hosts our frontend web application | Session and request data necessary to serve the application |
We disclose personal data beyond these sub-processors only: to comply with a legal obligation, subpoena, or court order; to protect the rights, property, or safety of us, our users, or the public; in connection with a merger, acquisition, or sale of assets (with notice to you); or with your consent.
Our sub-processors, including Anthropic, Voyage AI, and Higgsfield, may process data in the United States or other countries outside your own. Where required by applicable law, we rely on the sub-processor's own compliance mechanisms (such as standard contractual clauses) for these transfers.
We retain personal data for as long as your account is active, and for a reasonable period afterward to comply with legal, tax, and accounting obligations (including transaction and audit records required under Japan's Act on Specified Commercial Transactions and general commercial record-keeping rules). Company Memory content persists until you delete it or delete your account. Credit transaction history is retained even after account deletion for legal and financial audit reasons, as described in Section 8.
You can, at any time from Settings > Privacy & Data Management:
MAFICA is not directed to individuals under 18, and we do not knowingly collect personal data from children. If you believe a child has provided us personal data, contact us and we will delete it.
Questions about this Privacy Policy, or requests regarding your personal data beyond what is available in Settings, can be sent to: support@mafica.jp, or by mail to: Yu Plus Co., Ltd., 4-14 Seto, Seto-cho, Higashi-ku, Okayama-shi, Okayama 709-0861, Japan.
We may update this Privacy Policy from time to time. We will provide reasonable notice of material changes through the Service or by email before they take effect.