Yomimasu Privacy Policy
Version 1.0
Effective date: 13 October 2026
This Privacy Policy explains how Yomimasu collects, uses, stores, shares and otherwise processes personal data when you use the Yomimasu website, Reader, account features, Premium services and related functionality collectively referred to as the “Service.”
Yomimasu is operated from Switzerland. Swiss data-protection law therefore forms the primary legal framework for Yomimasu. Other privacy laws, including the EU General Data Protection Regulation (“GDPR”), may also apply to particular users or processing activities where their territorial requirements are met.
This Privacy Policy is intended to describe Yomimasu’s processing transparently. Where applicable law requires consent for a particular activity, such consent will be requested separately and will not be inferred merely from use of the Service.
1. Controller
The controller responsible for personal data processed through Yomimasu is:
Email: info@yomimasu.com
References to “Yomimasu,” “we,” “us,” or “our” mean the above mentioned Controller, unless and until the business is transferred to another legal entity in accordance with this Privacy Policy.
2. Personal data we may collect
Depending on how you use Yomimasu, we may process account and authentication information such as your email address, internal user identifier, login information, account status and authentication-provider data.
We may process learning and product-use information, including reading progress, completed texts, Known and Review items, grammar or vocabulary progress, bookmarks, preferences, Reader settings, streak-related information, story interactions, search and filtering activity, Premium status and other information generated through your use of the Service.
We may process payment and subscription information received from payment providers, such as customer identifiers, plan type, transaction status, subscription status, renewal information, refunds, currency and limited billing information. Yomimasu does not ordinarily receive or store complete payment-card numbers or card security codes.
We may process communications that you send to us, including support requests, feedback, bug reports and other correspondence.
We may also automatically process technical and usage information such as IP address, approximate location derived from IP, browser and device information, operating system, timestamps, referring source, application events, error information, security logs and similar technical data.
3. How we use personal data
Yomimasu may process personal data where reasonably necessary to create and administer user accounts, authenticate users, provide Reader functionality, save progress and preferences, provide Premium functionality, maintain bookmarks and learning records, process purchases and subscriptions, provide AI-assisted features, send transactional communications, provide support, diagnose problems, secure the Service, prevent fraud or abuse, enforce access restrictions and Terms of Service, analyse and improve the Service, develop or test functionality, maintain reliability and performance, comply with legal obligations, resolve disputes and establish, exercise or defend legal claims.
Yomimasu may also use aggregated or appropriately de-identified information for product analysis, statistics, research, reporting, development and other legitimate business purposes.
Where information has been irreversibly anonymised so that it can no longer reasonably identify an individual, it may be retained and used without the restrictions applicable to personal data.
4. Legal bases where the GDPR applies
Where the GDPR or another law requires Yomimasu to identify a lawful basis for processing, Yomimasu may rely on performance of a contract, legitimate interests, compliance with legal obligations or consent, depending on the processing concerned.
Contractual processing includes activities necessary to create accounts, provide requested Service functionality, maintain user progress, provide Premium access and administer purchases or subscriptions.
Legitimate interests may include operating, maintaining, securing and improving Yomimasu; understanding use of the Service; detecting abuse; protecting Yomimasu and its users; providing support; developing functionality; and conducting ordinary business operations, provided those interests are not overridden by applicable rights.
Where consent is required, consent will be obtained separately. Consent may be withdrawn prospectively where applicable, without affecting processing lawfully carried out before withdrawal or processing supported by another lawful basis.
5. Accounts and authentication
Yomimasu may use third-party authentication infrastructure, including Supabase and Google authentication.
If you choose to sign in using Google or another authentication provider, Yomimasu may receive information made available by that provider, such as your email address, account identifier, name or profile information.
Yomimasu does not receive your Google password.
Authentication providers may independently process information in accordance with their own terms and privacy practices.
6. Payments and subscriptions
Payments and subscription billing may be processed by Stripe or another payment provider.
Yomimasu may receive information necessary to determine whether a payment succeeded, which plan was purchased, whether a subscription is active, whether a renewal failed, whether a refund occurred and similar billing information necessary to operate Premium access.
Payment providers may process payment credentials, fraud-prevention information and other billing information directly.
Yomimasu may retain transaction-related information where reasonably necessary for accounting, taxation, fraud prevention, disputes, refunds, chargebacks and other legal or business obligations.
7. Analytics, PostHog and non-essential cookies
Yomimasu uses PostHog and may use similar analytics technologies to understand how users interact with the Service, measure feature usage, analyse product performance, diagnose problems and improve Yomimasu.
Analytics may involve processing information such as product events, pages or features viewed, session information, device or browser information, approximate location, technical identifiers and related usage information.
Where PostHog or another analytics provider uses cookies, local storage or comparable technologies that are not strictly necessary for the operation of the Service, Yomimasu treats those technologies as non-essential analytics technologies.
Where applicable law requires prior consent, non-essential analytics cookies or similar storage will be activated only after the user has provided the required consent. Refusing or withdrawing consent to non-essential analytics will not by itself prevent access to the core Yomimasu Service.
Where analytics processing may lawfully occur without consent, for example under an applicable legitimate-interest basis or through a configuration that does not require consent under applicable law, Yomimasu may process analytics information on that basis.
Yomimasu may change its analytics provider, configuration or analytics methods where reasonably necessary for product development, security, reliability, performance, cost or operational purposes.
Necessary cookies, storage and similar technologies may still be used without optional analytics consent where required for authentication, security, sessions, preferences, access control or other essential functionality.
Where Yomimasu provides a cookie or privacy-preference control, users may use that mechanism to manage applicable optional analytics choices.
8. Artificial-intelligence features
Certain Yomimasu features may use artificial-intelligence services provided by OpenAI or other AI providers.
When you actively use an AI-powered feature, information reasonably necessary to perform the request may be transmitted to the relevant provider. This may include Japanese text, relevant linguistic context, the question or instruction submitted by the user and technical information required to provide the feature.
Users should not submit sensitive, confidential or unnecessary personal information through AI features.
As of the effective date of this Privacy Policy, OpenAI states that data submitted through its business/API services is not used to train its models by default. Provider policies, technical configurations and subprocessors may change over time.
Yomimasu may replace or supplement AI providers where reasonably necessary to operate, improve or develop the Service.
9. Emails and communications
Yomimasu may use Resend or another email-delivery provider to send authentication, verification, password-reset, security, transactional and other Service-related communications.
Messages sent to info@yomimasu.com may be forwarded through domain or email infrastructure providers to an inbox monitored by Yomimasu.
Service-related and security communications may be necessary for operation of an account and are not necessarily optional marketing communications.
If Yomimasu sends marketing communications, users will be provided with any unsubscribe mechanism required by applicable law.
Opting out of marketing does not prevent Yomimasu from sending transactional, security, billing, account or legal notices.
10. Service providers and recipients
Yomimasu relies on third-party technology providers to operate the Service.
Current providers may include Supabase for database, authentication and backend infrastructure; Vercel for hosting and application infrastructure; Stripe for payments and subscriptions; PostHog for product analytics; OpenAI for AI-powered functionality; Resend for transactional email; Google for optional authentication; and Namecheap for domain, DNS or email-forwarding infrastructure.
Yomimasu may also use developers, contractors, professional advisers, accountants, insurers or other providers where reasonably necessary to operate, maintain or protect the Service.
Yomimasu may add, replace or remove service providers where reasonably necessary for functionality, security, reliability, availability, cost, development or business operations.
Providers receive only such access or information as is reasonably necessary for their relevant role, subject to applicable contractual and legal requirements.
11. International processing and transfers
Yomimasu is operated from Switzerland, but many technology providers operate internationally.
Personal data may therefore be stored, accessed or processed in Switzerland, the European Economic Area, the United Kingdom, the United States and other jurisdictions in which Yomimasu’s providers or their authorised subprocessors operate.
Where applicable law requires safeguards for international transfers, Yomimasu or its providers may rely on recognised adequacy decisions, standard contractual clauses, Swiss contractual safeguards or another transfer mechanism permitted by law.
Provider infrastructure and processing locations may change over time.
Users may contact Yomimasu for further information regarding applicable international-transfer safeguards.
12. Switzerland and application of the GDPR
Yomimasu is currently operated from Switzerland.
Where Yomimasu offers goods or services to individuals in the European Economic Area or otherwise carries out processing to which the GDPR applies, Yomimasu will comply with applicable GDPR requirements to the extent required by law.
The application of the GDPR to a particular processing activity does not replace applicable Swiss law; multiple legal regimes may apply simultaneously.
Where applicable law requires Yomimasu to appoint a representative or take another jurisdiction-specific compliance measure, Yomimasu will implement such measure as required.
13. Data retention
Yomimasu retains personal data for as long as reasonably necessary for the purposes for which it was collected and for legitimate operational, security, legal and business purposes.
Retention periods may vary according to the nature of the data and the reason it is processed.
Account and learning data may generally remain associated with an account while the account exists.
Following account deletion, personal data may be deleted, anonymised or removed from active systems within a reasonable operational period, except where continued retention is permitted or required.
Yomimasu may retain information after account deletion where reasonably necessary for statutory accounting or tax obligations, payment disputes, refunds, chargebacks, fraud prevention, security investigations, enforcement of agreements, legal claims or compliance with law.
Deletion from active systems does not necessarily result in immediate deletion from backups, disaster-recovery systems, logs or archival systems. Such copies may remain until overwritten or removed through normal retention processes.
Data retained solely in backups will not ordinarily be restored except where reasonably necessary for disaster recovery, security or system restoration.
Aggregated or irreversibly anonymised data may be retained indefinitely.
14. Account deletion
Users may request account deletion where such functionality or legal right is available.
Deleting an account may permanently remove access to reading progress, Known and Review data, grammar progress, bookmarks, completed stories, preferences and other account-associated information.
Account deletion does not require Yomimasu to erase information that applicable law allows or requires Yomimasu to retain.
Deletion also does not affect rights or obligations that arose before deletion, including payment, refund, subscription, dispute, chargeback or enforcement matters.
15. Security
Yomimasu uses reasonable technical and organisational measures intended to protect personal data against unauthorised access, alteration, disclosure, destruction or loss.
Yomimasu also relies on security measures implemented by its infrastructure providers.
No internet service, database, transmission method or security system can be guaranteed to be completely secure.
Users are responsible for protecting their account credentials, devices and authentication methods and should notify Yomimasu promptly if they believe their account has been compromised.
16. Fraud, abuse and protection of the Service
Yomimasu may process and retain information where reasonably necessary to detect, investigate or prevent fraud, abuse, unauthorised account sharing, circumvention of Premium restrictions, malicious activity, security incidents, automated scraping or other violations of the Terms of Service.
Where permitted by law, information relevant to serious misuse may be retained after account termination or deletion where necessary to prevent repeated abuse, protect users or Yomimasu, or establish, exercise or defend legal claims.
17. Legal disclosures
Yomimasu may preserve, access or disclose personal data where reasonably believed necessary to comply with applicable law, court orders, governmental requests or legal processes.
Information may also be disclosed where reasonably necessary to investigate fraud or security incidents, enforce agreements, protect Yomimasu’s rights or property, protect users or third parties, or establish, exercise or defend legal claims.
Where permitted and appropriate, Yomimasu may challenge requests considered unlawful, excessive or disproportionate.
18. Business transfers and future incorporation
Yomimasu may in the future be incorporated into or operated by a company or other legal entity.
If Yomimasu is involved in an incorporation, restructuring, financing, merger, acquisition, sale, transfer of assets or business, insolvency or comparable transaction, personal data may be transferred as part of that transaction.
A successor entity may continue processing relevant personal data subject to applicable law and this Privacy Policy or any replacement privacy notice required by law.
19. User privacy rights
Depending on applicable law and the user’s location, users may have rights to request information about processing, obtain access to personal data, correct inaccurate information, request deletion, restrict certain processing, object to certain processing, obtain certain data in a portable format, withdraw consent where processing is based on consent and submit a complaint to a competent supervisory authority.
These rights are subject to applicable legal requirements, exemptions and limitations.
Yomimasu may require reasonable verification of identity before fulfilling a request.
Yomimasu may request information necessary to identify relevant records, prevent fraudulent requests or protect the rights and privacy of other persons.
Requests may be restricted, refused, delayed or subject to a permitted charge where applicable law allows this, including where requests are manifestly unfounded, repetitive, abusive or disproportionately burdensome.
Privacy requests may be sent to:
20. Automated systems
Yomimasu may use automated systems to provide recommendations, determine Service states, display appropriate content, identify Premium access rights, detect technical problems or support security and abuse prevention.
Yomimasu does not currently use solely automated decision-making intended to produce legal or similarly significant effects on users.
If this changes in circumstances requiring additional disclosure under applicable law, appropriate information will be provided.
21. Children
Users must be at least 14 years old to create a Yomimasu account.
Where applicable local law requires parental or guardian authorisation for a user below a higher age to validly consent to particular data-processing activities, such authorisation may be required.
Yomimasu does not knowingly seek to collect personal data from children below the permitted age.
If Yomimasu becomes aware that an account or information has been created or submitted contrary to applicable age requirements, Yomimasu may suspend or delete the account and associated data where appropriate.
Parents or guardians may contact:
22. Sensitive personal data
Yomimasu is a language-learning Service and is not designed for users to submit health information, biometric data, political or religious beliefs, information concerning sexual life or orientation, criminal-history information or other particularly sensitive personal data.
Users should avoid entering such information into AI features, feedback fields, support requests or other free-text areas unless genuinely necessary.
Yomimasu may remove unnecessary sensitive information where appropriate.
23. Third-party websites and services
Yomimasu may contain links to third-party websites or services.
Independent third parties may process personal data under their own privacy policies and legal responsibilities.
Yomimasu is not responsible for the privacy, security or content practices of independent third-party services outside Yomimasu’s control.
24. Changes to this Privacy Policy
Yomimasu may update this Privacy Policy to reflect changes in the Service, functionality, providers, infrastructure, business structure, legal requirements, security practices or operational needs.
The current version will be published with an updated effective date.
Where applicable law requires additional notice or consent for a material change, Yomimasu will provide such notice or obtain such consent.
Continued use of Yomimasu does not override any legal requirement to obtain consent where consent is specifically required.
25. Contact and complaints
Questions, concerns or privacy requests may be sent to: info@yomimasu.com