Privacy Policy

1. This Policy applies to information we collect in providing the Service, including our website, web application and AI app integration (MCP).
2. In this Policy, "personal information" means personal information as defined in Article 2(1) of the APPI. "Platform" means X (formerly Twitter), Instagram, Threads, Facebook or any other social network you connect to the Service, and "Connected Account" means an account on a Platform that you have connected to the Service.
3. If you leave the Service for an external website or Platform, that operator's own terms govern how your information is handled there.

We collect the following information.

(1) Account and sign-in information

• The account identifier, username, display name and profile image URL of the Platform account you use to sign in
• The email address you use to sign in, and, if you sign in with a Google account, that Google account's identifier and email address (we use Supabase's authentication service to verify you, and send verification codes by email)
• Your email address (received from our payment processor when you subscribe to a paid plan; the verified email address we receive from a Platform when the Platform asks for your permission to share it with us and you allow it; or entered by you when you contact us)
• Session information used to keep you signed in, and the times you signed in
• If you set up two-step verification (an authenticator app), information about that registration (we use Supabase's authentication service to verify you)
• Sign-in records for each browser (browser type, IP address and sign-in time), used so you can review sign-ins on your other browsers and sign them out

(2) Information from Connected Accounts

• Access tokens and refresh tokens issued by the Platform (stored encrypted, as described in Article 7)
• Account identifier, username, display name, bio, location, website URL, profile and header images (for your own Connected Accounts, we store the images themselves), verification type, account creation date, pinned post, follower count, following count, post count, and other information the Platform provides as part of the profile
• Post text, posting time, post identifier and URL; the URLs, hashtags, mentions, images and videos (including alt text), polls and places included in posts; the post's language; the app used to post; and edit history
• Engagement metrics for posts (impressions, likes, replies, reposts, quotes, bookmarks, saves, shares, link and profile clicks, video views and similar; the available metrics vary by Platform)
• The usernames of accounts your Connected Account has interacted with (for example, by replying) and the content of those interactions
• If you also connect an Instagram Connected Account through Facebook: your Facebook account identifier, name (including first and last name), name format and profile picture URL; the identifier, name and category of the Facebook Page linked to the Instagram account and the tasks you can perform on that Page; and the list of permissions you granted
• Instagram direct messages: the identifier, username, name, profile picture, follower count, follow relationship and verification status of the people your Connected Account exchanged messages with, and the message text, attachments, replied-to message, time sent or received, and events such as reactions and reads
• When you connect a Facebook Page, we collect information about the Facebook account used to authorize the connection, such as its identifier, name and profile picture; the list of manageable Pages retrieved so you can select Pages; information about each selected Page, such as its identifier, name, username, category, description, website, profile picture, management permissions and follower count; the permissions granted; and the Page access token. For Connected Pages, we retrieve and store post text, image and video information, publication times, URLs, reaction, comment and share counts, and post and daily Page metrics such as views and followers. Available fields depend on the permissions granted and the API response.

(3) Information you enter or upload

• Post data imported from CSV files
• Memos, drafts, scheduled posts, saved posts and their tags
• Images, videos, character images and other files you upload
• Your conversations with the AI agent, and the content of feedback and inquiries
• Drafts, comments and activity records created with the team feature
• The reasons you give when you cancel your plan or delete your account

(4) Public information about other accounts

For accounts you register for comparison or analysis, and for posts containing keywords you specify, we collect the profiles, posts and metrics that are publicly available on the Platform. This includes information about people other than you. We do not collect non-public information.

(5) Payment information

We receive your customer identifier, subscription status, plan and billing period from our payment processor, Stripe. Your card number and other card details are collected directly by Stripe; we neither receive nor store them.

(6) Information collected automatically

• Access logs (IP address, browser type, access time and referring URL) and device information
• Information collected through cookies and similar technologies (Article 6)

(7) Information generated by the Service

• Post classifications, analysis results, suggestions, and text, images, videos and audio created by AI
• Records of offers used, kept to prevent the same person from using offers such as discounts or pauses repeatedly. We store these as irreversible values (hashes) derived from Platform account identifiers and payment identifiers

We use the information we collect for the following purposes.

1. To provide, operate, maintain and improve the Service (including post analysis, scheduled posting, converting images and videos to meet the requirements of the destination platform, connecting and selecting Facebook Pages and showing their metrics, AI suggestions, creating images and videos, managing direct messages, and running the automatic replies you set up)
2. To verify your identity, sign you in and manage your account
3. To bill you, process payments and provide offers
4. To respond to inquiries, provide support and send you notices
5. To prevent misuse, keep the Service secure and respond to violations of our Terms of Service
6. To analyze how the Service is used and create statistics that do not identify any individual
7. To comply with laws and regulations
8. For purposes incidental to the above

We do not use the information we collect for ad targeting outside the Platforms, and we do not sell it to anyone. We do not handle personal information beyond what is necessary for the purposes above without your prior consent.

1. We do not provide personal information to third parties without your prior consent, except in the following cases:
   • When required by law
   • When necessary to protect a person's life, body or property and it is difficult to obtain your consent
   • When especially necessary to improve public health or promote the healthy development of children and it is difficult to obtain your consent
   • When necessary to cooperate with a national or local government body, or a party entrusted by one, in carrying out duties prescribed by law, and obtaining your consent would likely impede those duties
2. When you instruct the Service to post, schedule a post or take another action, we send the information needed for that action to the operator of the Connected Account's Platform (such as X Corp. or Meta Platforms, Inc.).
3. If you invite members to a team in the Service, we show them the information of the Connected Accounts managed by that team, according to their role in the team.
4. If you allow an external AI app (such as Anthropic's Claude) to access the Service through AI app integration (MCP), we send that AI app, at its request, the information within the scope you allowed (such as posts, analysis results, drafts and scheduled posts). The handling of information sent to the AI app is governed by the terms of that AI app's operator. You can revoke the permission at any time by disconnecting the integration in that AI app. You can also turn off permission for draft and scheduled-post actions in the Service's settings.
5. We entrust the handling of personal information to the following processors to the extent necessary for the purposes of use, and we supervise them as necessary and appropriate. Processors marked "if used" are used only when we provide the related feature.

When researching, the AI agent may send search terms to public sources such as encyclopedias, academic papers and news sites. Please do not include your own or anyone else's personal information in conversations with the AI agent.

1. As shown in the table above, we may entrust the handling of personal information to processors located outside Japan. We provide personal information to such a processor on the basis of a system that meets the standards set out in Article 28(1) of the APPI (such as the necessary provisions in our contract with the processor) only where we have confirmed that system. If we provide personal information to a processor that does not meet those standards, we will obtain your prior consent and, when doing so, give you the name of the foreign country where the processor is located, information on that country's personal information protection system obtained by appropriate and reasonable means, and information on the measures the processor takes to protect personal information.
2. For processors that receive personal information on the basis of such a system, we take the measures required under Article 28(3) of the APPI to ensure that equivalent measures are continuously implemented. On request, we will promptly provide information on how that system is established, an outline of the measures the processor takes and how they are implemented, how often and how we check their implementation, and whether the foreign country has any system that could affect the implementation of those measures and, if so, what it is. Please send requests to the contact in Article 13.
3. Anthropic, in principle, deletes the content we send within 30 days of receipt and does not use it to train its AI models without our consent. However, it may keep content longer under its own terms, for example where a violation of its usage policy is suspected or where required by law.
4. In the event of a merger, company split, business transfer or similar event, personal information may be transferred to the successor within the scope of the original purposes of use.
5. We may process the information we collect into statistics that do not identify any individual and use them for analysis and to improve the Service. If we create anonymously processed information under the APPI, we will publish the categories of personal information it contains, as required by Article 43 of the APPI.

1. We handle information obtained from Platforms in accordance with each Platform's terms of service and developer terms (including the X Developer Agreement and Policy, the Meta Platform Terms and the Meta Developer Policies).
2. We use the permissions of your Connected Accounts only for the actions you instruct the Service to take (such as posting, scheduling posts and retrieving information). We never ask for or store your Platform passwords.
3. We use information obtained from Platforms only to provide the Service. We do not sell it, provide it to data brokers or other third parties, or use it for ad targeting outside the Platforms.
4. When we become aware that a post has been deleted or changed on a Platform, we delete or update it in the Service as well. For posts obtained from X, we do so within 24 hours of becoming aware of the change, as X requires.

1. The Service uses cookies and similar technologies to keep you signed in, save your settings, keep the Service secure and analyze usage. You can disable cookies in your browser settings, but some features of the Service may then not work properly.
2. The Service uses Google Analytics 4, provided by Google LLC. Google Analytics uses cookies (such as _ga and _ga_*) to collect the URLs and titles of the pages you view, referring URLs, access times, your actions on the page, and browser and device information. We do not send your name, email address, Platform account information, post text or the contents of imported CSV files. Google signals and signals for ad personalization are turned off. The collected information is handled under Google's policies (How Google uses information from sites or apps that use our services). To measure registrations after reading an article, we store the identifier, language and viewing time of the most recently viewed public article in your browser’s local storage. On new registration, we send the article identifier and language to Google Analytics if it was viewed within the preceding 30 days. We clear the stored information after successful sign-in or registration. You can also remove it by clearing this site’s browser data.
3. For visitors from the European Economic Area (EEA), the United Kingdom and Switzerland, we do not load Google Analytics or store its cookies until you consent. We determine your country from your IP address as identified by Vercel Inc., and store a cookie (ritomira_consent_region, kept for one day) indicating that you are visiting from one of these regions. On your first visit we show a notice where you can accept or reject, and we store your choice in a cookie (ritomira_consent) for about six months. You can change your choice at any time from the bottom of each page or from Cookie settings. If you withdraw your consent, we stop loading Google Analytics and delete cookies such as _ga and _ga_*, together with the article and other information stored in your browser as described in the preceding paragraph. Visitors from other regions can also choose Reject in the same notice to stop Google Analytics from loading.
4. You can stop Google Analytics from collecting data by installing the Google Analytics Opt-out Browser Add-on. Doing so does not affect your ability to sign in to the Service.
5. The Service uses Vercel Web Analytics, provided by Vercel Inc., to count page views without using cookies.
6. Apart from those described in this Article, the Service does not use third-party cookies for advertising. If we introduce any other analytics or advertising tool not described in this Article, we will update this Policy.

We take the following measures to prevent leaks, loss or damage of personal information and otherwise keep it secure.

If a leak or other incident involving personal information occurs, we will promptly investigate and take the necessary measures, including notifying affected individuals and reporting to the Personal Information Protection Commission of Japan.

We keep personal information for as long as necessary to achieve the purposes of use and for any period required by law. The main retention periods are as follows.

1. You or your representative may request that we notify you of the purposes of use of, disclose, correct, add to or delete, stop using or erase, or stop providing to third parties, the retained personal data we hold about you ("Disclosure and Other Actions").
2. Please send requests for Disclosure and Other Actions to the contact in Article 13. After verifying your identity, we will respond without delay in accordance with the law. You can also delete information about your account and Connected Accounts as described in Article 10.
3. We may be unable to comply with a request in the following cases. If so, we will tell you so and why.
   • Where it could harm the life, body, property or other rights or interests of you or a third party
   • Where it could seriously interfere with the proper conduct of our business
   • Where it would violate the law
4. We do not charge a fee for requests to notify you of the purposes of use or for disclosure.

You can delete your account, or disconnect a Platform and ask us to delete the information we hold, at any time.

(1) Delete your account in the Service

1. Sign in to the Service and open Settings.
2. Choose "Delete account" and follow the instructions on the screen. You may be asked to sign in again to confirm it is you.
3. As soon as we receive your request, your account is suspended and you are signed out on all devices. Any paid plan is canceled at that time.

(2) Disconnect the Service on the Platform

You can revoke the permissions you granted to the Service as follows (as of October 2026; the steps may change when a Platform updates its interface).

• Instagram: Settings → "Apps and websites" (on the web, https://www.instagram.com/accounts/manage_access/) → under "Active", select Ritomira and choose "Remove".
• Facebook: your profile picture → "Settings & privacy" → "Settings" → "Business integrations" → select Ritomira and choose "Remove". This applies both to Facebook Page connections and to Instagram connections made through Facebook.
• Threads: Settings → "More settings" → "Website permissions" → select Ritomira and choose "Remove".
• X: Settings → "Security and account access" → "Apps and sessions" → "Connected apps" → select Ritomira and choose "Revoke app permissions".

If you disconnect the Service on Instagram, Threads or Facebook, or ask us to delete your data from those settings, we start deleting the information about the relevant Connected Accounts when we receive the Platform's notification. If you ask us to delete your data, we will give you a confirmation code and a URL where you can check the status of the deletion.

If you also connected an Instagram Connected Account through Facebook, we delete the following information when you disconnect the Service on Facebook, ask us to delete your data from Facebook, or choose "Disconnect" for the Facebook connection on the Service's settings screen. The information about your Instagram Connected Account remains until you disconnect the Service on Instagram.

• The Facebook account and Page information (Article 2(2)), the list of permissions you granted, and the access tokens
• The hashtags registered for that Connected Account, the posts and statistics obtained for them, and the record of hashtag searches
• The public information about accounts registered as competitors. However, we keep it if you can still use a Facebook connection through another of your Connected Accounts
• The collaboration invites received by that Connected Account and the record of your answers

If you have connected Facebook Pages, a disconnection or data deletion notification from Facebook causes us to delete the Connected Page information, access tokens, imported posts and metrics, drafts, scheduled posts and uploaded media associated with the Facebook account used to authorize the connection. If that account connected multiple Pages, those Pages are included. Deleting data in Ritomira does not delete posts already published on Facebook or the Facebook Pages themselves.

(3) Ask us by email

Email support@nexus-ai.jp with the username of the Platform account whose data you want deleted (for a Facebook Page, include its name and URL or identifier). We will act on your request after confirming that you are the account holder or a person duly authorized for that account.

(4) Deletion timeline

Within 30 days of receiving a request under (1), (2) or (3), we delete the information about your account or the relevant Connected Account (including access tokens, profiles, posts, metrics, and information you entered or uploaded). Information remaining in system backups is deleted when the backup retention period ends.

(5) Information we do not delete

• Contract, billing and payment records (kept for the period required by law, as described in Article 8; Stripe also keeps payment records)
• Records of account deletion requests and records of offers used (hashes)
• Statistics that do not identify any individual
• Drafts, comments and activity records you left in other users' teams. These stay as team records, with the author shown as "Former member" so that you cannot be identified

(6) After you disconnect

Once you disconnect, the access tokens we hold become invalid and we can no longer access the Connected Account. Any scheduled posts will not be published.

The Service is not intended for anyone under 13. If you are under 18, please use the Service only with the consent of a parent or other legal guardian. If we learn that we have collected personal information from anyone under 13, we will delete it promptly.

1. We may change this Policy when laws change, when the Service changes, or as otherwise necessary.
2. The changed Policy takes effect when it is posted on the Service. For significant changes, we will let you know before they take effect, by a notice in the Service or another clear method.

Please send any questions, complaints or requests for Disclosure and Other Actions about how we handle personal information to the contact below.