Privacy Policy

JUMP, LLC (the "Company") establishes this Privacy Policy (the "Policy") regarding the handling of users' personal information in the calendar scheduling service "OneSlate" (the "Service") provided by the Company.

The Service was rebranded from "MulCal" on April 28, 2026. Personal information collected under the MulCal name is also handled in accordance with this Policy.

Article 1 (Basic Policy)

The Company complies with the Act on the Protection of Personal Information and other relevant laws, regulations, and guidelines, and handles personal information appropriately. The Company implements technical and organizational safety measures to ensure that users can use the Service with confidence.

Article 2 (Information Collected)

The Company collects the following information in connection with the provision of the Service.

(1) Authentication Information

• Google and Microsoft OAuth tokens (access_token, refresh_token)
• User's email address
• User's display name (obtained from connected accounts)

(2) Calendar Data

• Start and end times of events on connected calendars (limited to availability detection purposes only)
• Event details such as titles, attendees, locations, and descriptions are NOT stored on the Company's servers

(3) In-Service Data

• Configuration information of booking pages created by users
• Confirmed booking information (guest name, email address, selected time slot, answers to user-defined questions)
• Usage logs (login timestamps, feature usage)

(4) Automatically Collected Information

• IP address (for usage statistics by country, fraud detection; deletable upon request)
• User agent information (browser and OS type)
• Access timestamps and referrer URLs

(5) Cookies and Similar Technologies

• Session cookies for login persistence
• Analytics cookies for usage analysis (which users may disable)

Information NOT Collected

• Credit card numbers and bank account information (processed by payment processor Stripe; the Company does not collect this)
• Photos, biometric information
• Precise location data

Article 3 (Purposes of Use)

The Company uses the collected information solely for the following purposes:

1. Provision of the Service (consolidating availability across multiple calendars, creating and publishing booking pages, automatic addition of confirmed bookings to calendars)
2. Automatic synchronization of "blocker events" between connected calendars (only time slots are synced; original event details are NOT included)
3. Providing user support and responding to inquiries
4. Improving the Service, developing new features, and analyzing usage statistics
5. Preventing fraud and ensuring security
6. Sending important notifications (terms changes, maintenance, security alerts)
7. Compliance with applicable laws

Article 4 (Use of Google API Data — Limited Use Compliance)

The Company adheres to the Google API Services User Data Policy, including the Limited Use requirements, when using information received from Google APIs.

Specifically, we comply with the following:

• Limited Use Purposes: Data obtained from Google APIs is used only for purposes directly related to providing the Service, as set forth in Article 3.
• No Transfer or Sale to Third Parties: We do not transfer or sell data obtained from Google APIs to any third party other than the Subprocessors listed in Article 6.
• No Advertising Use: We do not use data obtained from Google APIs for displaying ads, ad targeting, or for sale to advertising purposes.
• Restricted Human Access: We do not allow our employees or contractors to read data obtained from Google APIs, except with explicit user consent, for security purposes, as required by law, or in aggregated/anonymized form.

Use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Article 5 (Disclosure to Third Parties)

The Company will not disclose personal information to third parties without the user's consent, except in the following cases:

1. When required by law
2. When necessary for the protection of human life, body, or property, and obtaining the user's consent is difficult
3. When particularly necessary for improving public health or promoting the sound development of children, and obtaining the user's consent is difficult
4. When cooperation with a national or local government agency or its delegate executing duties prescribed by law is necessary

Article 6 (Subprocessors)

The Company entrusts certain operations to the following processors. Each processor is bound by data protection obligations equivalent to or higher than those of the Company.

The list of subprocessors may be updated as the Service evolves. Significant changes will be communicated through updates to this Policy.

Article 7 (Cross-Border Data Transfer)

In connection with the use of the Service, users' personal information may be transferred to, stored, and processed on processor servers located outside Japan (primarily in the United States). The Company verifies the data protection regimes of destination countries and implements appropriate safety measures.

Each processor protects data based on industry-standard data protection frameworks (e.g., Standard Contractual Clauses).

Article 8 (Retention Period and Deletion)

The Company retains personal information for the duration that the user maintains an account.

When a user deletes their account, the Company will delete all personal information within a reasonable period (typically within 30 days), except for information required to be retained by law (e.g., transaction history).

Users can disconnect their calendars and delete related data at any time from the Service settings screen.

Article 9 (Safety Management Measures)

The Company implements the following safety measures to prevent leakage, loss, or damage of personal information.

Technical Safety Measures

• Encryption of communications (HTTPS / TLS)
• Encryption of sensitive information in databases
• Principle of least privilege for access permissions
• Regular security audits and vulnerability assessments

Organizational Safety Measures

• Access permission management
• Limiting personnel handling personal information
• Inspection of personal information handling status

Physical Safety Measures

• Access control at data centers (operated by processors)
• Encryption of data at rest

Article 10 (Response to Data Breach)

In the event of leakage, loss, or damage of users' personal information ("Data Breach"), the Company will promptly take the following actions:

1. Investigate the facts and identify the cause
2. Identify the scope of impact and prevent further damage
3. Report to the Personal Information Protection Commission (when required by law)
4. Notify affected users
5. Develop and implement measures to prevent recurrence

Article 11 (User Rights)

Users may exercise the following rights regarding their personal information:

• Right to Disclosure: To request disclosure of personal information held by the Company
• Right to Correction, Addition, or Deletion: To request correction when personal information is inaccurate
• Right to Suspension or Erasure: To request suspension of use or erasure of personal information
• Right to Suspend Third-Party Disclosure: To request suspension of disclosure to third parties

To exercise these rights, please contact us at the address listed in Article 15. After verifying your identity, we will respond within a reasonable period.

Minor corrections and data deletions can also be performed by users themselves through the Service settings screen.

Article 12 (Cookies and Tracking Technologies)

The Service uses cookies and similar technologies for the following purposes:

1. Maintaining login sessions
2. Storing user preferences (language selection, etc.)
3. Analyzing usage (collecting anonymized statistical data)

Users can restrict or disable cookies through their browser settings. However, disabling cookies may cause some features of the Service to not function properly.

Article 13 (Use by Minors)

The Service is not intended for use by individuals under 13 years of age. If we become aware that we have collected personal information from a person under 13, we will promptly delete such information.

Users aged 13 to 17 should use the Service with the consent of a parent or legal guardian.

Article 14 (Changes to this Policy)

The Company may revise this Policy from time to time due to changes in laws, improvements to the Service, etc.

When making revisions, the Company will post the revised Policy on the Service. For significant changes, the Company will notify users in advance via email or in-service notifications.

The revised Policy will become effective at the time it is posted on the Service (or on the announced effective date for significant changes).

Article 15 (Contact Information)

For inquiries regarding this Policy or to exercise rights regarding personal information, please contact us:

• Operator: JUMP, LLC
• Representative: Junichiro Ono
• Address: 5F EX Ebisu-Nishi Building, 2-8-4 Ebisu-Nishi, Shibuya-ku, Tokyo, Japan
• Email: info@rirry.co.jp

(Note: Inquiries are handled by our affiliated company.)

Effective Date: April 29, 2026 Last Updated: April 29, 2026

This English version is a reference translation. The Japanese version is the official and binding text. In case of any discrepancy, the Japanese version shall prevail.