Privacy Policy

1. Services and work covered

This Policy applies to the following services and work.

• Website: ngraph.jp (contact and service application forms, document downloads, the AI adoption assessment, the question box on the top page, the business partner check, the blog, etc.)
• Work under individual contracts: AI Adoption Support (FDE), NGraph Cyber Drill, Local AI Pack, Generative AI Starter Set
• Monthly subscription service: "NGraph," a multilingual menu service for restaurants

2. Information we collect

(1) Information provided by customers

• Company or store name, name, email address, phone number, and address
• Information entered when making an inquiry, application, or document request (preferred dates and times, details of the consultation, etc.)
• Store information provided for the multilingual menu service (address, business hours, menu and dish information, etc.)

(2) Information handled in work under individual contracts

• Customers' internal documents, business data, system configuration information, etc. entrusted to us as the subject of the work (including personal information of officers, employees, business partners, etc. contained in them)
• Email addresses of the customer's employees to whom NGraph Cyber Drill training emails are sent, and records of their responses to the training emails

(3) Information collected automatically through use of the website

• Access logs, IP addresses, and browser and device information
• Browsing data collected using cookies, etc.
• Questions entered in the question box on the top page

3. Purposes of use

• Responding to inquiries and applications, arranging schedules, and preparing quotations
• Performing work under contracts, reporting, and managing contracts
• Providing, operating, and improving the Company's services
• Sending information about the Company's services (you can stop receiving it at any time)
• Understanding and improving how the website is used
• Responding to misuse and to acts that violate laws, regulations, or contracts

4. Information handled in work under individual contracts

Information entrusted to us for AI Adoption Support (FDE), NGraph Cyber Drill, Local AI Pack, and the Generative AI Starter Set is used only within the scope of the purpose of that work, in accordance with the contract and confidentiality arrangements. The scope of handling, the location and period of storage, and the method of return or deletion after the work ends are agreed in writing at the time of contract.

• NGraph Cyber Drill: Checks are carried out only within the scope agreed in writing with the customer. Training emails do not ask for actual passwords or similar information, and we do not collect them. Training results are used only for reporting to the customer and preparing an improvement plan.
• Local AI Pack: Data inside the installed machine is the customer's asset and is managed within the customer's company. The scope the Company handles for installation and maintenance is set out in the contract.
• When external AI services or the like are used in the work, which information is handled by which service is agreed with the customer in advance.

5. Handling in the business partner check (ngraph.jp/check/)

The business partner check feature queries public databases and publicly available information based on the target entered by the user (corporate number, company name, or website URL) and displays the results. Handling specific to this feature is as follows.

• Information collected: The email address entered when saving a PDF, the text entered as the target, and technical information about the access source (browser information, etc.)
• Purposes of use: Providing the PDF save feature, improving this feature, and sending information from the Company (service-related information) to the entered address
• Retention period: The above information is automatically deleted 180 days after it is collected
• Storage location: It is stored in storage (Workers KV) provided by Cloudflare, Inc. (USA)
• Unsubscribing: You can stop receiving information emails at any time by the method stated in the email or by contacting the contact point below
• About the results: The displayed content is the result of checking public information and is not proof or denial of the target company's existence or creditworthiness. Requests to confirm or correct statements about a particular company are accepted at the contact point below

6. External services used (outsourcing)

The Company outsources part of the handling of information to the following external services. We appropriately manage and supervise these contractors, limited to the extent necessary.

• Form reception and email: Google Apps Script and Google Workspace of Google LLC (USA). Content entered in forms is delivered to the Company's email, and an automatic reply email is sent
• Website delivery and storage: Cloudflare, Inc. (USA)
• Generating answers for the question box on the top page: AI services of Anthropic, PBC (USA) or Google LLC (USA). Questions entered are sent to generate answers. The Company does not store the questions. IP addresses are kept for about one hour for rate limiting. Please do not enter personal or confidential information in the question box
• Access analytics: Google Analytics of Google LLC (USA). It uses cookies to aggregate browsing data. It is not used to identify individuals. For how the data is handled, see that company's policy

Note: These businesses are located in the United States. For the US system for protecting personal information, please refer to the information on foreign systems published on the website of Japan's Personal Information Protection Commission.

7. Provision to third parties

The Company does not provide personal information to third parties except in the following cases.

• With the consent of the individual
• When required by law
• When necessary to protect a person's life, body, or property and it is difficult to obtain the individual's consent
• When provided in connection with the outsourcing described in the previous section

8. Security measures

The Company takes the following measures to prevent leakage, loss, damage, etc. of the personal information it handles.

• We limit who handles personal information and restrict access and permissions to what is necessary
• Information entrusted to us by customers is stored only in the location and for the period set out in the contract, and is returned or deleted when the work ends
• When using services of foreign businesses, we take measures after understanding the personal information protection system of that country

9. Cookies

The Company's website uses cookies to improve convenience and understand usage. You can restrict or refuse cookies through your browser settings. Aggregation by Google Analytics can also be stopped with the opt-out add-on provided by Google.

10. Requests for disclosure, correction, suspension of use, etc.

When an individual requests notification of the purpose of use, disclosure, correction, addition or deletion, suspension of use or erasure, or suspension of provision to third parties of personal information held by the Company, we will respond without delay in accordance with the law after confirming the person's identity. Please contact the contact point below.

11. Changes to this Policy

This Policy may be changed in response to amendments to laws and regulations, changes in our services, etc. The changed content applies from the time it is posted on this page.

12. Business information and contact point

NGraph Inc.
Laforet Kitano 201, 1-124 Toiyacho, Fukui City, Fukui 918-8231, Japan
Shingo Takahashi, CEO (Representative Director)
Contact: shingotakahashi@ngraph.jp

Established February 27, 2026 / Revised October 14, 2026