Privacy Policy

Effective date: September 18, 2026

Estaluna ("we", "us") receives personal information from our customers and from people who call them when we provide the Estaluna AI answering service and operate our website. We comply with Japan's Act on the Protection of Personal Information and other applicable laws, and we handle personal information in accordance with this policy.

This English text is provided for convenience. If it differs from the Japanese version, the Japanese version prevails.

1. Who we are

Name: Estaluna

We will provide our address and the name of our representative without delay upon request to the contact point in Section 12.

2. Scope

This policy applies to:

• our website (pages under https://estaluna.ai/)
• the management console (https://app.estaluna.ai/)
• the Estaluna AI answering service

3. What we collect, and our role

3-1. Information about our customers' representatives

We collect and use the following information as a personal information handling business operator in our own right.

When you sign up and create an account

Company name, your name, email address, phone number, password (stored as a cryptographic hash; we do not retain the password itself), the phone number calls are forwarded to, and settings such as display language

When you contact us or request information

Company name, your name, email address, phone number, the content of your enquiry, and whether you want to receive our newsletter

When you pay for the service

Information required for billing. Card numbers and other payment credentials are collected directly by our payment processor; we do not hold them.

Automatically, as you use the service

IP address, browser and device information, pages viewed, identifiers set by cookies, and records of actions taken in the management console

3-2. Information about people who call our customers

When someone calls a company that uses our AI answering service, we receive:

• the caller's phone number
• the call recording and the transcript generated from it
• the call summary, the type of enquiry, the date and time of the call, and whether the call was transferred to a person
• details spoken during the call, such as a name, a request, or reservation details

4. Purposes of use

We use the information we collect for the purposes below. We will obtain your consent before using it beyond these purposes.

• Providing the AI answering service: answering calls, transferring calls to a person, and recording and summarising enquiries
• Allowing our customers to review call content, history and summaries in the management console
• Responding to enquiries, information requests and applications, and contacting you about them
• Calculating and charging fees, and administering contracts
• Detecting and preventing abuse and misuse, and keeping the service secure
• Investigating faults, improving quality and answering accuracy, and developing new features
• Sending information about our services to people who have opted in (you can unsubscribe at any time using the link in each message)
• Measuring whether the email we send is opened, and improving what we send
• Understanding how the console is used, and finding and fixing places where setup gets stuck
• Complying with laws and responding to breaches of our terms of service

5. Call recording and AI processing

This section is published as the notice required under Japan's Telecommunications Business Act and as the publication of purposes of use required under the Act on the Protection of Personal Information. When you call a company that uses our AI answering service:

• the call is recorded;
• the audio is transcribed by AI in real time and used to generate the AI's responses and a summary after the call;
• part of this processing takes place on external cloud services we engage, including providers located outside Japan. See External transmission and third-party services for details.

If you have a request about how a recording or transcript is handled, please contact us at the contact point in Section 12, or contact the company you called.

6. Disclosure to third parties

We do not disclose personal information to third parties without your prior consent, except:

• where required by law;
• where necessary to protect a person's life, body or property and it is difficult to obtain consent;
• where cooperation with a national or local government body carrying out its statutory duties is required and obtaining consent would impede those duties;
• where information is transferred as part of a merger or other business succession.

We may outsource part of our operations to external providers to the extent necessary to achieve the purposes above. Outsourcing is not a disclosure to a third party, but we require our providers to maintain security by contract and supervise them appropriately.

7. External transmission and cookies

Our website uses cookies and similar technologies to analyse how the site is used, and information is transmitted to external providers as a result. We also use external cloud services to provide the service. The information transmitted, the recipients and the purposes are published in External transmission and third-party services.

We use Google Analytics for this analysis, with Google Signals (a Google Advertising Feature) enabled. This feature combines first-party cookies with third-party cookies set by Google for advertising, and lets us view estimated age, gender and interest categories in aggregated, statistical form. We do not receive any information that identifies an individual. See Section 1 of External transmission and third-party services for details, including how to opt out.

For some of the email we send — such as the welcome message that follows sign-up — we include a small image (1x1 pixel) that is not visible in the message so that we can tell whether the email was opened. When that image loads, the time of the open and the connection details your mail software sends (such as your IP address) are transmitted to Resend, our email delivery provider. We use this only to check whether what we send is useful and to improve it. If you would rather not be counted, turn off automatic image loading in your mail software; the message is fully readable without images. We do not track opens on email you need in order to complete something, such as a password reset.

In the console at app.estaluna.ai we use PostHog to analyse usage. The path of the screen you view, the text of buttons you click and an identifier for your company (a random string) are sent to PostHog. We do not send names, email addresses, phone numbers, company names, call content, transcripts or anything you type into a search box. Phone numbers and call IDs that appear in the path of contact and call screens are masked, and URL parameters other than the few we need for analysis are removed, before the address is sent. To find where setup gets stuck we may also record on-screen interaction only on screens that show no call information, such as sign-up, login and pricing; we do not record on call history, contacts or settings screens. See section 1 of External transmission and use of external services for details.

You can refuse cookies in your browser settings. Some features of our website may not work if you do.

8. Transfers to third parties outside Japan

We use cloud services provided by companies located outside Japan, so personal information may be handled abroad.

Before using such providers, we confirm that they have established the framework necessary to take, on an ongoing basis, measures equivalent to those required of a personal information handling business operator in Japan under the Act on the Protection of Personal Information, and we review that framework periodically.

We will provide the names of the countries concerned, information about their personal data protection regimes, and details of the measures in place without delay upon request to the contact point in Section 12.

9. Retention

We retain personal information only for as long as necessary to achieve the purposes of use and for any period required by law. After that, we delete it or dispose of it in a way that cannot be reversed.

For call recordings and transcripts, the service enforces a maximum retention period and automatically deletes data once that period has passed.

10. Security measures

We take the following measures to prevent leakage, loss or damage of personal information:

• encryption in transit (TLS) and encryption of stored data
• role-based access control and records of who accessed what and when
• an operating rule against writing personal information to logs in readable form
• selection criteria for service providers and supervision by contract
• training for the people who handle personal information

If we become aware of a leak or a risk of one, we will report it to the Personal Information Protection Commission and notify affected individuals as required by law.

11. Your rights

You (or your agent) may ask us to notify you of the purposes of use, to disclose your retained personal data, to correct, add to or delete it, to suspend its use or erase it, to stop disclosing it to third parties, and to disclose our records of third-party provision.

Please send requests to the contact point in Section 12. We will verify that you are the individual concerned or their authorised agent, and respond without delay as required by law. There is no charge.

12. How to contact us

For questions about this policy, for the requests described above, or for any other matter concerning personal information:

• Contact form
• Email: info@estaluna.ai

13. Changes to this policy

We may change this policy to reflect changes in the law or in our service. Changes take effect when they are published on this page. We will give advance notice on our website or in the management console before making a significant change.

14. Governing law

This policy is governed by and interpreted in accordance with the laws of Japan.

Effective date: September 18, 2026