Privacy Policy

Last updated: 11 July 2026 · Effective: 11 July 2026 · Version 2.0

This Privacy Policy (this "Policy") explains how Freeborn Inc. (株式会社フリーボーン, "Freeborn", "we", "us", or "our") collects, uses, discloses, retains, transfers, and protects personal information in connection with the AI SNS CHAT platform, the website at ai-sns.io and its subdomains, our dashboards, application programming interfaces (APIs), chat widgets, telephony and messaging integrations, and every related product, feature, and service we provide (together, the "Service").

We handle personal information in accordance with Japan's Act on the Protection of Personal Information (個人情報保護法, the "APPI"), the guidelines of the Personal Information Protection Commission of Japan (the "PPC"), and the standards of the PrivacyMark system (登録番号 No. 20002676), and, where they apply to a given user, other data-protection laws described in Section 19 (including the EU and UK GDPR and the laws of certain U.S. states).

Please read this Policy together with our Terms of Service, which govern your use of the Service. By accessing or using the Service, you acknowledge that you have read and understood this Policy. If you do not agree with it, you must not access or use the Service.

1. Who we are and how to contact us

Freeborn is the operator of the Service and, except where this Policy states that a customer acts as the controller of end-user data, the business operator responsible for personal information handled through the Service.

Operator	Freeborn Inc. (株式会社フリーボーン)
Registered office	Esaka Crystal Bldg. 3F, 11-39 Toyotsu-cho, Suita, Osaka 564-0051, Japan
PrivacyMark reg. No.	No. 20002676
Privacy contact	contact@ai-sns.io
Personal Information Protection Manager	Reachable via contact@ai-sns.io

For any question, request, or complaint about this Policy or your personal information, contact our Personal Information Protection Manager at contact@ai-sns.io or by writing to the registered office above.

2. Scope of this Policy and our roles

This Policy applies to personal information we process about the people who interact with us and the Service, including: visitors to our website; account holders and the members of their workspaces; people who contact us for sales or support; and the end users who interact with the AI agents that our customers build and deploy.

Our role depends on the context. When we handle information about our own account holders, website visitors, and prospects, we act as the business operator (controller) that determines the purposes and means of processing. When our customers upload content and deploy AI agents that collect information from their own end users, the customer determines the purposes of that processing and acts as the controller, while we act as a service provider (processor) handling that information on the customer's behalf and under our Terms of Service. Section 20 explains this division in more detail.

This Policy does not apply to third-party websites, products, or services that we do not operate, even where they link to or integrate with the Service. Their own privacy notices govern their processing.

3. Definitions

In this Policy, "personal information" and "personal data" mean information relating to an identified or identifiable individual, as defined by applicable law. "Customer Content" means the data, documents, files, text, website addresses, question-and-answer pairs, prompts, instructions, and other materials that a customer uploads to, or generates through, the Service to train and operate its AI agents. "End User" means a person who interacts with an AI agent that a customer deploys through the Service. "Conversation Data" means the messages, transcripts, metadata, and related records generated when an End User interacts with a customer's AI agent across any channel. "Subprocessor" means a third party we engage to process personal information on our behalf in order to provide the Service.

4. Categories of information we collect

4.1 Account and profile information

When you create an account or are invited to a workspace, we collect your name, email address, and password (which we store only in salted, hashed form). Depending on how you sign in and what you configure, we may also collect a telephone number, a profile image, your role and permissions within a workspace, your language and theme preferences, and identifiers associated with third-party sign-in providers (for example, a Google account identifier when you use social login).

4.2 Billing and transaction information

When you purchase a paid plan, message credits, or add-ons, we collect your plan, subscription status, billing cycle, transaction history, message-credit balances, invoices, and the country and currency used for billing. Full payment-card numbers are collected and processed directly by our payment processors and are not stored on our servers; we receive only limited details such as a token, the card brand, the last four digits, and the authorization result.

4.3 Customer Content and training data

We process the Customer Content you provide to build and operate your AI agents, including uploaded files and documents, pasted text snippets, website addresses we crawl at your direction, question-and-answer pairs, agent instructions and system prompts, actions and workflow configurations, and knowledge sources you connect. Customer Content may itself contain personal information if you choose to include it; you are responsible for having the rights and consents to submit it, as described in Section 20.

4.4 Conversation Data across channels

When End Users interact with a deployed AI agent, we process the resulting Conversation Data across every channel you enable, which may include the web chat widget, email, telephone and voice, live chat and helpdesk, and connected messaging platforms. Conversation Data can include message text, attachments, timestamps, channel and session identifiers, the AI responses generated, ratings and feedback, detected topics and sentiment, and any information an End User chooses to share during a conversation, including contact details and, in some cases, leads captured on your behalf.

4.5 Contact and CRM information

The Service lets customers store and manage contacts, leads, and custom attributes about the people who interact with their agents. This information is Customer Content that the customer controls, and it may include names, email addresses, phone numbers, and any custom fields the customer defines.

4.6 Voice and telephony information

Where you enable voice or AI-telephone features, we and our telephony and voice providers process caller and called telephone numbers, call metadata (such as time, duration, and direction), audio streams, call recordings where enabled, and machine-generated transcripts. Section 9 describes these features and the related consent obligations.

4.7 Integration and authorization information

When you connect a third-party service, such as an email inbox, a messaging platform, a payment provider, or a social account through OAuth, we process the access and refresh tokens, account and page identifiers, scopes granted, webhook subscriptions, and the specific data the integration is configured to send or receive. We store connection secrets in encrypted form.

4.8 Usage, device, and log information

We automatically collect information about how the Service is accessed and used, including IP address, approximate location derived from IP address, browser and device type, operating system, referring and exit pages, features used, actions taken, dates and times, and diagnostic and error logs. We use this information for security, rate-limiting, abuse prevention, troubleshooting, and analytics.

4.9 Support and communications information

When you contact us for sales or support, respond to a survey, or otherwise communicate with us, we collect the content of your messages and any information you choose to provide, together with the metadata needed to route and answer your request.

4.10 Cookies and local storage

We use a small number of strictly necessary cookies and browser local-storage entries, including a session token that keeps you signed in and preferences such as your selected language and theme. Section 11 provides details.

5. Sources of information

We collect information from the following sources: directly from you when you register, configure, pay for, or use the Service, or when you contact us; automatically from your device and browser as you use the Service; from End Users when they interact with a customer's deployed agent; from our customers, who provide Customer Content and configure the agents and contacts that generate Conversation Data; and from third-party providers, such as sign-in, payment, telephony, messaging, and infrastructure providers, that pass us information needed to deliver the Service.

6. How and why we use information

We use personal information only for legitimate, specified purposes, including the following.

• To create, authenticate, operate, maintain, and secure your account and workspace.
• To provide the core functionality of the Service, including training, configuring, running, and improving the AI agents you build.
• To generate AI responses and to deliver them to End Users across the channels you enable.
• To capture, store, and display Conversation Data, transcripts, analytics, topics, sentiment, leads, and contacts on your behalf.
• To process payments, subscriptions, message credits, add-ons, refunds where applicable, and to prevent payment fraud.
• To provide customer support, respond to enquiries, and send service, security, and administrative notices.
• To monitor, investigate, and prevent fraud, abuse, spam, prompt-injection, and violations of our Terms of Service, and to enforce usage limits and our abuse-protection controls.
• To measure, analyze, and improve the performance, reliability, and safety of the Service, using aggregated or de-identified data where practicable.
• To develop new features and to conduct internal research, testing, and quality assurance.
• To comply with applicable laws, regulations, lawful requests, and our legal obligations, and to establish, exercise, or defend legal claims.
• With your consent where required, to send you marketing communications about our products and services.

We will not use your personal information for a new purpose that is incompatible with those described above without providing notice or obtaining consent where the law requires it.

7. Legal bases for processing

Where the APPI applies, we identify and, to the extent required, notify or publish the purposes of use (利用目的) for which we handle personal information, and we handle it within the scope of those purposes. Where the EU or UK GDPR applies, we rely on one or more of the following legal bases: performance of a contract with you; our legitimate interests in operating, securing, and improving the Service, provided those interests are not overridden by your rights; compliance with a legal obligation; and your consent, which you may withdraw at any time. Where we rely on legitimate interests, you may ask us for more information about the balancing we have carried out.

8. Artificial intelligence, model providers, and automated processing

The Service uses artificial-intelligence models, including large language models provided by third parties such as Anthropic, OpenAI, and Google, to generate responses from the messages and Customer Content processed through the Service. To generate a response, relevant inputs may be transmitted to the applicable model provider under agreements that restrict their use of that data to providing the service to us.

We do not use Customer Content or Conversation Data to train our own or any third party's foundation models, and we contractually require our model providers not to use data processed on our behalf to train their general models.

AI outputs are generated automatically and may be inaccurate, incomplete, or unsuitable for a particular purpose. The Service is a tool to assist you; it is not a substitute for professional judgment or advice. Where automated processing produces a decision that would have legal or similarly significant effects on an individual and the law grants a right to human review, the relevant controller (which, for End-User interactions, is our customer) is responsible for providing it.

9. Voice, telephony, and call recordings

If you enable voice or AI-telephone features, calls to or from your AI agent may be processed, synthesized using text-to-speech technology (including ElevenLabs, where enabled), transcribed, and, where you enable it, recorded and stored so that you can review call logs and transcripts.

Recording and monitoring of calls are subject to law, which in many places requires that participants be notified or that their consent be obtained. Where a customer enables call recording or transcription, that customer is responsible for providing any legally required notices and for obtaining any required consents from callers. We provide configuration options to support this, but we do not provide legal advice about the requirements that apply to you.

10. Email, messaging, and connected integrations

If you connect an email inbox or messaging platform, we process the messages routed to and from your AI agent so that it can read incoming messages and send AI-generated replies. Inbound webhooks deliver messages to the Service, and outbound messages are sent through the connected provider or through our email-delivery provider. We process only the data needed to operate the integration you have configured, and your use of each connected platform remains subject to that platform's own terms and privacy notice.

Which platforms. You choose which of these to connect; none is enabled until you configure it. Messaging platforms, where we process the messages sent to and from your agent: your website widget, LINE, LINE WORKS, Microsoft Teams, Chatwork, Google Chat, Zoom Team Chat, WhatsApp, Slack, Discord, Telegram, KakaoTalk, WeChat, Viber, Facebook Messenger, Instagram, SMS, telephony and email. Knowledge and record systems, where we read the content you point us at so your agent can answer from it: kintone, Microsoft SharePoint, Notion, Google Business Profile, and the files, websites and help-desk exports you upload.

What each connection can reach. A messaging connection processes the message text, the platform's own identifier for the sender and the conversation (so replies go to the right thread), and any attachment a person sends. A knowledge connection reads the documents, pages or records in the scope you grant it — a SharePoint site, a Notion page shared with our integration, a single kintone app — and stores the extracted text as a training source in your workspace. Where you explicitly enable it, a kintone connection may also CREATE records on your behalf; that is off by default and is a separate setting from reading.

Credentials. The tokens, secrets and keys you paste to connect a platform are encrypted at rest and are used only to operate that integration. They are never sent to a model provider and are not shown back to you in full once saved.

Disconnecting. Removing a connection stops all further processing through it immediately. Content already imported as a training source, and conversations already recorded, remain in your workspace until you delete them — and deleting an agent moves it to your workspace Trash, where a complete copy is retained for 30 days before it is permanently removed. See Data retention.

11. Cookies and similar technologies

We use strictly necessary cookies and browser local storage to keep you signed in, to remember your language and theme preferences, and to keep the Service secure. We do not use third-party advertising cookies, and we do not sell information collected through cookies.

Name	Purpose	Type
aisns_token	Keeps you signed in to your account	Session / strictly necessary
aisns-lang	Remembers your selected language	Local storage / preference
theme preference	Remembers light or dark mode	Local storage / preference
aisns-fx-usd	Caches a currency exchange rate for pricing display	Local storage / functional

You can delete or block cookies and clear local storage in your browser settings, but the Service may not function correctly without the strictly necessary session cookie.

12. How we share information and our subprocessors

We do not sell personal information, and we do not share it except as described below. We share personal information only with parties that are bound by appropriate confidentiality and data-protection obligations.

We share information with Subprocessors that process it on our behalf to provide the Service, under contracts that require them to protect it and to use it only for that purpose. Our categories of Subprocessors include the following.

Category	Purpose	Examples
Cloud hosting and infrastructure	Running and storing the application	Hugging Face and cloud infrastructure providers
AI model providers	Generating AI responses	Anthropic, OpenAI, Google
AI model routing	Conversation text and agent instructions, sent to generate a reply with the AI model chosen for an agent. OpenRouter passes the request on to the vendor of that model.	OpenRouter
Realtime voice and transcription	Voice audio and text from spoken conversations, sent for speech-to-speech replies, transcription and text-to-speech	OpenAI, xAI (Grok)
Avatar video	A photo you upload to create an avatar, and the agent's spoken audio, sent to render the talking-avatar video	Simli
Payments	Processing payments and subscriptions	Stripe, PayPal
Email delivery	Sending and receiving email	Resend
Telephony and messaging	Voice, SMS, and messaging channels	Twilio and connected messaging platforms
Voice synthesis	Text-to-speech for voice agents	ElevenLabs

We may also disclose information: to comply with applicable law, regulation, legal process, or an enforceable governmental or lawful public-authority request; to enforce our Terms of Service and other agreements; to detect, prevent, or address fraud, security, or technical issues; and to protect the rights, property, or safety of Freeborn, our users, or the public. In connection with a merger, acquisition, financing, reorganization, or sale of assets, personal information may be transferred as part of that transaction, subject to this Policy or a successor policy that protects it to an equivalent standard.

Where we act as a processor for a customer, we share Conversation Data and contacts with that customer, who is the controller of that information.

13. International and cross-border transfers

Freeborn is based in Japan, and some of our Subprocessors are located in other countries. Where we transfer personal information across borders, including from Japan or the European Economic Area, we take the measures required by applicable law so that the information continues to be protected to an equivalent standard. These measures may include transferring to countries recognized as providing an adequate level of protection, putting in place contractual protections such as the European Commission's standard contractual clauses, and, where the APPI requires it, providing information about and, where necessary, obtaining consent for the transfer.

14. Data retention

We retain personal information only for as long as it is needed for the purposes described in this Policy, after which we delete or irreversibly de-identify it, unless a longer retention period is required or permitted by law (for example, for tax, accounting, or legal-defense purposes).

• Account information is retained while your account is active and for a limited period afterward to allow for reactivation, dispute resolution, and legal compliance.
• Customer Content, Conversation Data, and contacts are retained while your account is active and are deleted or de-identified within a commercially reasonable period after deletion by you or after account termination, subject to backup-rotation cycles.
• Deleting an agent does not delete it immediately. When you delete an AI agent, a complete copy — its settings, its training sources, its conversation history and its leads — is placed in your workspace Trash and can be restored by you for 30 days, after which it is permanently removed. This exists so that an accidental deletion is recoverable; if you need something removed sooner, the workspace owner can delete it from the Trash immediately and that removal is final.
• Off-site backups of the platform database are retained on a rolling basis and are overwritten as newer backups are taken. Content you have deleted may persist in an unrestored backup until that rotation completes.
• Billing and transaction records are retained for the period required by applicable tax and accounting law.
• Security, audit, and log data are retained for the period needed for security and diagnostic purposes.

You can delete Customer Content and your account at any time. Deletion propagates to routine backups on our rotation schedule.

15. Information security

We implement organizational, technical, and physical safeguards appropriate to the risk, taking into account the state of the art and the nature of the information. These measures include encryption of data in transit, salted hashing of passwords, encryption of stored integration secrets, access controls and the principle of least privilege, network and application-level protections, rate-limiting and abuse-prevention controls, logging and monitoring, and staff confidentiality obligations. No method of transmission over the Internet or of electronic storage is completely secure, and we cannot guarantee absolute security, but we work continuously to protect your information and to improve our safeguards.

16. Data breach notification

If we become aware of a security incident that compromises the confidentiality, integrity, or availability of personal information in a manner that triggers a legal obligation, we will investigate the incident, take reasonable steps to mitigate it, and notify the Personal Information Protection Commission, affected individuals, affected customers, and any other authorities as and when required by applicable law and within the timeframes it prescribes.

17. Your rights and choices

Subject to applicable law and to verification of your identity, you may exercise the following rights in relation to your personal information: to request notification of the purposes of use; to request access to and a copy of your information; to request correction, addition, or deletion; to request that we stop or limit using it or providing it to third parties; to object to certain processing; to request portability of information you provided to us; and to withdraw a consent you previously gave, without affecting processing already carried out.

To exercise these rights, contact us at contact@ai-sns.io. We will respond within the period required by applicable law. We may need to verify your identity before acting, and we may decline or limit a request where the law permits, for example where it would adversely affect the rights of others or where we are legally required to retain the information. If you use the Service as an End User of a customer's AI agent, many requests about your Conversation Data are directed to that customer as the controller, and we will assist the customer as required.

You will not receive discriminatory treatment for exercising any of these rights.

18. Children's privacy

The Service is intended for businesses and is not directed to children. We do not knowingly collect personal information directly from children under 16 as account holders. Where a customer deploys an AI agent that may interact with children, that customer is responsible for complying with the laws that apply to children's data. If you believe that a child has provided us personal information without appropriate authorization, contact us and we will take reasonable steps to delete it.

19. Region-specific disclosures

19.1 Japan (APPI)

We handle personal information as a business operator under the APPI, within the scope of the notified or published purposes of use, and we honor requests for disclosure, correction, suspension of use, and cessation of third-party provision as the APPI provides. Our PrivacyMark registration number is No. 20002676.

19.2 European Economic Area and United Kingdom (GDPR)

Where the EU or UK GDPR applies, you have the rights described in Section 17 as they are set out in the GDPR, and you may lodge a complaint with your local supervisory authority. Our legal bases are described in Section 7, and our transfer measures are described in Section 13.

19.3 United States

Where U.S. state privacy laws apply, you may have rights to know, access, correct, delete, and obtain a portable copy of your personal information, and to opt out of certain processing. We do not sell personal information and do not share it for cross-context behavioral advertising. You may exercise applicable rights by contacting us at contact@ai-sns.io.

20. Customers as controllers and end-user data

When a customer uses the Service to build and deploy an AI agent, the customer decides what Customer Content to provide, what the agent does, and what information it collects from End Users. For that processing, the customer is the controller and Freeborn is the processor acting on the customer's documented instructions under our Terms of Service.

As a customer, you are responsible for: having a lawful basis and any required consents to submit Customer Content and to collect and process End-User data through the Service; providing your End Users with a privacy notice and any disclosures required by law, including where AI is used, where calls are recorded, and where messages are processed; honoring your End Users' privacy rights; and configuring the Service appropriately, including retention and access settings. We will assist you in meeting your obligations to the extent the Service and applicable law require.

21. Marketing communications

Where permitted by law and, where required, with your consent, we may send you communications about our products, features, and offers. You can opt out at any time by using the unsubscribe mechanism in the message or by contacting us at contact@ai-sns.io. We will still send you non-promotional service, security, and administrative messages that are necessary to operate your account.

22. Third-party links and services

The Service may link to or integrate with websites and services that we do not control. We are not responsible for the privacy practices of those third parties, and this Policy does not apply to them. We encourage you to review the privacy notices of any third-party services you use.

23. Changes to this Policy

We may update this Policy from time to time to reflect changes in the Service, our practices, or the law. When we make material changes, we will post the updated Policy on this page with a new "Last updated" date and, where appropriate, provide additional notice, such as by email or an in-product notice. Your continued use of the Service after the changes take effect constitutes acceptance of the updated Policy, except where additional consent is required by law.

24. Governing law and complaints

This Policy is governed by the laws of Japan, without prejudice to any mandatory rights you have under the law of your country of residence. If you have a concern about how we handle personal information, please contact us first at contact@ai-sns.io so that we can try to resolve it. You may also contact the PrivacyMark granting body or the Personal Information Protection Commission of Japan, and, where the GDPR applies to you, your local supervisory authority. For the agreement that governs your use of the Service, see our Terms of Service.

© 2026 AI SNS IO · Freeborn Inc.