Privacy policy

UNCHAIN, Inc. (“we”) handles the personal information it collects in providing Pulse in accordance with the Act on the Protection of Personal Information (“the Act”) and other legislation. This policy sets out what information we collect and how, what we use it for, who we give it to, how long we keep it, and how we respond to requests from individuals.

#1. Introduction

We handle personal information in accordance with this policy, as a personal information handling business operator under the Act.

This policy covers the personal information we handle in providing the Pulse desktop app (macOS and Windows), the browser extensions, the web version, the API, integrations with external services and the website published at the-unchain.com (together, “the service”). Recording and transcribing meetings is done in the desktop app; the web version only allows viewing and editing notes that have already been created. It covers users with a service account, members of workspaces, people who took part in meetings a user recorded, people who have contacted us, and visitors to our website.

In the service we hold this information in a form searchable per workspace. Much of what we handle is therefore “personal data” under the Act.

#Our two capacities

In the service we act in two different capacities. That distinction governs how each section of this policy should be read.

For data held on a business plan, it is the contracting company that decides on disclosure and deletion. Data in that category may be treated as not being our “retained personal data”, and requests from individuals should as a rule be made to the company they belong to (Section 10).

#2. Information we collect

The information we collect is set out by category below. The “collected directly from the individual” column indicates whether the information is provided by the individual themselves or reaches us by another route, through a user's actions.

#Other people's information is included

Meeting audio, transcripts and notes contain not only the personal information of the user operating the service but the personal information of the other people who took part in that meeting. That includes names, organisations, contact details, what they said in the course of business, and their voices themselves. The same goes for calendar information: the names and email addresses of participants in an invitation reach us not from those participants but through the user who connected the calendar.

#3. Purposes of use

In accordance with Article 17, paragraph 1 of the Act, we specify the purposes of use as far as possible and handle personal information within the scope necessary to achieve them.

We use personal information for the following purposes.

1. Creating, authenticating, maintaining, changing and deleting accounts
2. Transcribing meeting audio and generating notes, summaries and action items
3. Connecting to your calendar, detecting the start of meetings, and bringing together information ahead of a meeting
4. Sharing notes within the scope the user specifies, and making them searchable within a workspace
5. Sending data on the user's instruction through integrations with external services the user has enabled
6. Generating answers to users' questions in the chat feature
7. Billing, payment, issuing qualified invoices, and dealing with non-payment
8. Responding to enquiries, bug reports and communications about the contract
9. Monitoring the availability of the service, investigating the causes of faults, and detecting and preventing misuse and unauthorised access
10. Analysing how the service is used, in order to improve features and develop new ones
11. Training AI models and evaluating their accuracy (only where the user or an administrator has permitted this in the settings — see “Use for training AI models” in this section)
12. Sending announcements about new features, maintenance, changes to the terms and the like
13. Sending information about the service and related services (we stop where you ask us to)
14. Responding to requirements of law or of government agencies, and exercising rights or dealing with disputes

Of the above, meeting audio, transcripts, notes and uploaded material held in a workspace on a business plan are handled only within the work entrusted to us by the contracting company. Because a processor cannot handle personal data other than for the work entrusted, we never decide on our own initiative to use a contracting company's data for a different purpose.

#Use for training AI models

Training AI models is different in kind from the processing that makes the service work, so it is stated as a separate purpose of use.

• On the free and personal plans, data is used for training by default. Users can turn this off at any time under Settings → Preferences → Data and sharing.
• On business plans (Team and Enterprise), data is not used for training. Because it would go beyond the scope of the entrustment, it is off by default and there is no setting for users to enable it. Administrators can check the setting for the whole workspace.
• Even where data is used for training, it is processed so that no specific individual can be identified.
• A change to the setting applies to data created after the change. Data already incorporated into training cannot be removed afterwards.
• Where we engage an external supplier for transcription or summary generation, we provide in our contract that the data sent will not be used for that supplier's machine learning.

Where the setting is and how to change it are covered in AI models and training data.

Note that Article 30-4 of the Copyright Act permits, within limits, use not aimed at enjoying the thoughts or feelings expressed in a work (including use for information analysis), but that article has a proviso excluding cases that would unreasonably prejudice the copyright holder's interests. We do not rely on what the Copyright Act permits as the basis for training: on the free and personal plans we follow the user's own setting, and on business plans we do not use data for training because it would go beyond the scope of the entrustment.

#4. Sensitive personal information

Meetings can touch on matters that need careful handling — someone's health, their creed, where they come from, past disputes.

Our position is as follows.

• We do not provide the service for the purpose of actively collecting sensitive personal information.
• Where someone says in a meeting that “so-and-so is undergoing treatment”, and that remains in the transcript, that part may be sensitive personal information as a medical history. A conjectural remark such as “they seem unwell”, on the other hand, is not sensitive personal information.
• The person whose consent is needed for acquiring sensitive personal information is the speaker whose information it is. The consent of a workspace administrator or a meeting organiser cannot stand in their place.
• For meetings where sensitive personal information may be discussed, do not start recording, or pause recording at the point concerned. You can also delete the relevant section after recording.

A breach of personal data containing sensitive personal information is reportable to the Personal Information Protection Commission even where only one person is affected (Enforcement Rules Article 7, item 1). Where you use the service for work likely to involve sensitive personal information — healthcare, HR, legal — we recommend starting recording meeting by meeting and limiting which meetings you record. How to think about this by sector is covered in Use in healthcare, finance and the professions.

#5. Security measures

The measures we take are organised under five headings.

#Organisational security measures

We have rules on the handling of personal data, with the staff who handle it and the person responsible clearly identified. Access records are collected and reviewed periodically so that how data is handled can be established. Reporting lines for a breach are set in advance, and the rules are kept under continuous review.

#Personnel security measures

We have confidentiality arrangements with our staff and provide training on personal data protection when they join and periodically thereafter. Staff involved in running the service are required not to view customers' data beyond what their work requires.

#Physical security measures

Servers handling personal data are housed in data centres with entry control and monitoring. Work devices have disk encryption and screen locking applied, and procedures are set for taking equipment and electronic media off site.

#Technical security measures

Access rights are limited to what work requires, with authentication in place. Personal data is encrypted at rest and in transit. To prevent unauthorised access from outside we separate networks, restrict traffic and detect anomalous behaviour, and we monitor vulnerability information continuously and apply fixes.

#Understanding the external environment

Where we handle personal data in a foreign country, we establish that country's personal data protection regime (including any regime on government access to data) and take measures such as encryption in transit and at rest, limits on retention, and contractual provision that data entered will not be used for anything other than generating the response. The regions data is stored in, the destination countries, the route we use to comply with Article 28 of the Act, and what information we provide at an individual's request are gathered in Section 8.

Matters whose publication would itself risk prejudicing security — the specific method of access control, the detail of measures preventing unauthorised access and the like — are left out of the above (the parenthesis in Article 10, item 1 of the Enforcement Order).

A fuller explanation of each heading is published in Our security arrangements. Which certifications and third-party assessments we hold (ISMS certification, the Privacy Mark, a SOC 2 Type II report and so on) is set out in the table on that page; this policy does not list them individually.

#6. Entrustment

We may entrust the handling of personal data to others within the scope necessary to achieve the purposes of use, and we are also entrusted with handling data by corporate customers. Both directions are explained separately.

#Where we act as your processor

On business plans, the contracting company is the controller and we are the processor. The service is designed to turn the content of audio into text and to summarise that content with AI, which presupposes that we handle the content of the personal data. That is what distinguishes it from external storage services, which work on the basis of a contractual undertaking not to handle the data stored.

Within that arrangement, we do not process personal data beyond the work entrusted. As part of supervising their processor under Article 25 of the Act, we recommend that contracting companies review the measures we describe in this policy and in the data processing addendum (DPA).

#Where we sub-process

In order to provide the service, we sub-process the handling of personal data to suppliers of the following kinds. In each case we have selection criteria, conclude a contract, and keep ourselves informed of how they handle data.

#7. Provision to third parties

We do not provide customers' personal data to third parties except in the following cases.

• Where the individual has consented
• Where the law requires it
• Where it is necessary to protect someone's life, limb or property and obtaining the individual's consent is difficult
• Where it is particularly necessary for improving public health or promoting the sound growth of children and obtaining the individual's consent is difficult
• Where it is necessary to cooperate with a national or local government body, or someone they have engaged, in performing duties prescribed by law, and obtaining the individual's consent would risk impeding those duties
• Where personal data is provided in connection with a business succession following a merger or otherwise (Article 27, paragraph 5, item 2 of the Act)

We do not provide personal data to third parties by the opt-out method under Article 27, paragraph 2 of the Act. Nor do we sell personal data.

Note that provision in connection with entrustment described in Section 6, and provision in connection with a business succession, are not provision to a third party by virtue of Article 27, paragraph 5 of the Act. We do not currently handle personal data under a joint use framework (item 3 of that paragraph).

#Where a user's own action sends data to an external service

The service has integrations that send notes and transcripts to external services. Where such an integration is enabled and data is sent, the destination is another business, not a processor of ours.

The same goes for issuing share links outside a workspace: note that who can view the material then extends beyond your organisation. How to set sharing is covered in Controlling sharing, and the services you can integrate with in List of integrations.

#Records of provision to third parties

The personal data we handle on business plans is handled in connection with entrustment and is not provision to a third party, so no record of provision to a third party is created for it. Where you request disclosure of records of provision to third parties and there is no such record, we tell you so without delay.

#8. Provision to third parties in foreign countries

Data in the service is, as a rule, stored in a region within Japan. Some processing, such as transcription and summary generation, may however be entrusted to suppliers outside Japan, in which case personal data is transferred abroad. This section covers those transfers, which we make in order to provide the service. Data sent to an integration by a user's own action is treated as provision to a third party in a foreign country by the business that carried out the integration (Section 7).

#It applies to entrustment too

What Article 28, paragraph 1 excludes are the items of paragraph 1 of Article 27; the items of paragraph 5 of Article 27, covering entrustment, business succession and joint use, are not excluded. The reasoning that domestic entrustment is not provision to a third party does not carry over where the counterparty is a third party in a foreign country. An arrangement that entrusts transcription or summary generation to a supplier outside Japan is squarely within Article 28.

What matters is not where the data is stored but whether personal data is provided to a third party in a foreign country. Having servers in Japan is not a reason for saying there is no provision abroad. Sending data to an external supplier for inference can amount to such “provision”.

#The three routes, and the one we use

There are three ways of complying with Article 28, and we use the second.

Meeting records contain the personal information of participants who do not have an account. Since obtaining individual consent to a cross-border transfer from all of them is not realistic, we use the route of ensuring implementation of equivalent measures by contract (the adequate-framework route). Specifically, we conclude contracts with recipient suppliers ensuring the implementation of measures in line with the intent of Chapter 4, Section 2 of the Act, and provide personal data only to suppliers with that framework in place.

#What we do on an ongoing basis

We do three things.

1. We verify periodically how recipient suppliers are implementing the equivalent measures, and the personal data protection regime of the destination country (including any regime on government access to data).
2. Where an impediment to the implementation of the equivalent measures arises, we take the necessary and appropriate measures.
3. Where continued implementation of the equivalent measures becomes difficult to ensure, we stop providing personal data to that supplier.

At an individual's request, we provide information on the seven matters set out in Rule 18, paragraph 3. We are not required to publish these at all times, but we answer requests without delay. Please contact us at the address in Section 17.

#Publishing information about the destination country's regime

Separately from providing information at an individual's request, where personal data is handled in a foreign country, the measures taken in light of an understanding of that country's regime must be kept in a state where individuals can know them, as one of the matters published about retained personal data (Article 32, paragraph 1, item 4 of the Act and Article 10, item 1 of the Enforcement Order). These are two distinct obligations, and we meet both.

The third parties in foreign countries to which we currently provide personal data are as follows.

#9. Retention and deletion

We set a retention period for each category of data and delete it once that period passes.

Automatic transcript deletion is off by default (no automatic deletion). Where it is enabled, the retention period can be set to 1 day, 1 week, 1 month, 3 months, 6 months or 1 year. How to configure it and what remains after deletion are covered in Automatic transcript deletion, and what remains after an account is deleted in Deleting your account.

Even after data disappears from the screen, it remains for a period in recovery backups and audit logs. What remains in an audit log is a record of who did what and when; it does not include the body of notes or transcripts.

Where data has been used to train an AI model and incorporated into the model's weights, it is not technically possible to extract or remove individual data afterwards. With that in mind, we let you choose by a setting whether data is used for training, and tell you in advance that changing the setting does not apply retrospectively (Section 3).

#10. Requests for disclosure, correction and cessation of use

You may make the following requests in relation to your own retained personal data.

#How to make a request

1. Write to privacy@the-unchain.com telling us what you are requesting (which of the above it is) and which data it concerns.
2. To confirm your identity, we ask you to produce the documents we specify. We choose a method that is not unduly burdensome, so far as it lets us match the request to the account information.
3. We also accept requests from representatives: a statutory representative of a minor or an adult ward, and a representative the individual has appointed (Article 13 of the Enforcement Order). In that case, please enclose documents evidencing the authority.

#How and when we respond

Disclosure is made, as a rule, by provision in electromagnetic form — either a download from the service or an attachment to an email. If you would prefer a document, please say so. We check the position and respond without delay after receiving a request.

Where we cannot meet a request in whole or in part, we endeavour to explain why (Article 36 of the Act). We may be unable to meet a request where we cannot confirm your identity, where doing so would risk harming the rights or interests of others, or where it would breach the law.

#Fees

We do not charge a fee for requests for correction, addition, deletion, cessation of use, erasure or cessation of provision to third parties. For requests for notification of the purpose of use and for disclosure, we may charge a fee within a reasonable range reflecting the actual costs.

#What you can do yourself

The following can be done in the service without waiting for a request.

• Exporting notes and transcripts (Exporting notes in bulk)
• Deleting notes, transcripts and your account (Deleting your account)
• Changing your name and email address (Account and email address changes)

#If you are on a business plan

For data held in a workspace on a business plan, it is the contracting company that decides on disclosure and deletion. Requests of that kind should as a rule be made to your organisation's privacy contact. Where you approach us directly, we will direct you to your organisation and tell the contracting company that you have been in touch. What assistance we give and by when is set out in Article 11 of the data processing addendum (DPA).

#11. Matters published about retained personal data

The statutory disclosures, and where each appears in this policy, are as follows.

Where you would like any of the matters in this table that are not set out in this policy to be published, please contact the address in Section 17 and we will answer without delay.

#12. What we do if there is a breach

What we do is as follows.

1. On detecting an incident, we begin investigating immediately and take measures to prevent the harm spreading and to restore the position.
2. For personal data we handle in our own right, we make the preliminary and final reports to the Personal Information Protection Commission and notify the individuals concerned. Where notifying individuals is difficult, we publish the incident or take other alternative measures necessary to protect individuals' rights and interests.
3. For personal data we handle as a processor on a business plan, we notify the contracting company as controller promptly after learning of the incident. Where a processor notifies the controller, the processor's own reporting obligation to the Commission falls away (the proviso to Article 26, paragraph 1 of the Act). Reporting to the Commission and notifying individuals are done by the contracting company, and we provide the information needed. The notification deadline and what is reported are set out in Article 12 of the data processing addendum (DPA).
4. “Promptly” for the preliminary report is indicated by the guidelines as roughly within three to five days. The 30 and 60 days for the final report are deadlines set by the Rules. The two are different in kind, and we keep them distinct in our internal procedures as well.
5. We publish the outcome of our investigation into the cause and the measures taken to prevent recurrence where appropriate.

Because transcripts can contain sensitive personal information, an incident can be reportable under Rule 7, item 1 even where only one person is affected. With that in mind, we have built measures including encryption at rest into our security design (Section 5).

#13. Cookies and external transmission

This section covers two things: the use of cookies and the like on our website and in the web version, and causing information to be sent from users' computers to businesses other than us (external transmission).

#Use of cookies

We use cookies and similar technologies (“cookies”) on the service's website and in the web version.

Whether cookies are accepted can be changed in your browser settings. Disabling essential cookies prevents you signing in to the service.

#Disclosures concerning external transmission

The information we cause to be sent from users' devices to businesses other than us in connection with use of the service is as follows.

Meeting audio, transcribed text and the body of notes are not among the information transmitted externally for the analytics purposes above. They are handled only to the extent needed to provide the service.

#14. Personal-related information

Where you browse our website without being signed in, the browsing history we collect through cookies is normally personal-related information as far as we are concerned. Where we provide that information to a third party and it is anticipated that the recipient will acquire it as personal data, we carry out the confirmations above and create a record of them.

Browsing history while signed in to the service, on the other hand, can readily be collated with account information and is therefore personal information as far as we are concerned. In that case Sections 7 and 8 apply. Note that which rules apply changes between being signed out and signed in.

#15. Use by minors

The service is designed for recording meetings at work and is not intended for use by minors.

Terms of service — where someone below the minimum age set there uses the service, they should sign up with the consent of a person with parental authority or another statutory representative. Where we find that we have collected personal information from someone below that age without a statutory representative's consent, we delete it promptly. If you think that may have happened, contact privacy@the-unchain.com.

Where meeting participants include minors, the user doing the recording and the organisation they belong to need to take the necessary care and obtain consent in relation to those participants' personal information.

#16. Changes to this policy

We may change this policy because of amendments to legislation, changes to the service's features, changes in our processor relationships or other circumstances.

• The changed version applies from the moment it is published on this page at the-unchain.com.
• Where we change a purpose of use, we do not change it beyond a scope reasonably recognised as related to the purpose before the change (Article 17, paragraph 2 of the Act). Where we do change it, we notify individuals of the changed purpose or publish it (Article 21, paragraph 3).
• Where a change significantly affects individuals' rights and obligations, we tell you before it starts to apply, by a notice in the service or by email.
• Past versions are made available for reference on this page, with the date of each revision.

Note that the Act Partially Amending the Act on the Protection of Personal Information and Related Acts was promulgated on 17 July 2026, and the position may change in future.

#17. How to contact us

Enquiries about this policy and the handling of personal information, access requests and complaints are received at the following.

We check and endeavour to handle appropriately and promptly any complaint we receive. If you are not satisfied with our response, you may make a submission to the Personal Information Protection Commission.

#18. For customers outside Japan

This policy is written under Japan's Act on the Protection of Personal Information. Where you use the service from outside Japan, the law of the country or region you live in may give you rights beyond those set out in this policy. If you wish to exercise such a right, contact privacy@the-unchain.com; we will look into it and respond in accordance with the applicable law. For corporate contracts, please also review the terms in the data processing addendum (DPA).

#19. Dates of adoption and revision

• Adopted: Please contact us
• Last revised: Please contact us

UNCHAIN, Inc.

#Related articles