Privacy Policy
This is a reference English translation. If there is any discrepancy, the Japanese version prevails.
DecoTecoPop (hereinafter the "Service"), operated by wksystems LLC (hereinafter the "Company"), recognizes the protection of users' personal information as an important responsibility. This Privacy Policy (hereinafter this "Policy") sets out how we handle the personal information collected through the Service. By using the Service, you are deemed to have agreed to this Policy.
01 Business Operator Information & Covered Regions
The party responsible for the handling of personal information in the Service is as follows.
Covered Regions
The operating business is a Japanese corporation, and the Service is operated in accordance with Japanese law. The handling of personal information is governed primarily by the Act on the Protection of Personal Information (APPI).
Even when the Service is used from outside Japan (in particular the EU, EEA, or the UK), it is provided under Japanese law, and we do not guarantee compliance with laws and regulations specific to each country or region, including the GDPR. Those accessing the Service from overseas should determine, at their own responsibility, whether their use complies with the laws and regulations of their country or region of residence.
02 Personal Information We Collect
The Company collects personal information in the following situations.
(1) When using the Contact Form
- Name
- Email address
- Content of your inquiry
(2) When registering an account or logging in
- Email address
(3) At the time of payment (via Stripe)
Credit card information is processed in a secure environment managed by Stripe, Inc. No card number, expiration date, or security code is ever stored on the Company's servers. The Company obtains only the following information necessary for payment processing.
- Stripe Customer ID
- Date and time of purchase, purchased plan, number of credits granted (transaction records)
(4) Information collected automatically during use of the Service
- IP address
- Browser type and version
- Operating system
- Access date/time and referrer URL
- Page transitions and operation logs within the Service
- Device language settings and time zone
(5) Uploaded image data
- Uploaded images are used solely for conversion processing such as CMYK conversion, color adjustment, bleed addition, and PDF generation.
- Processing is completed in the server's memory, and images are not permanently stored on disk (storage).
- 30 minutes after the session ends or after the last operation, the intermediate conversion data (including the original image, CMYK conversion results, and color-adjustment backups) is automatically deleted from the server's memory.
- We never provide image data to third parties, use it for AI training, or use it for any purpose other than the stated purpose.
Please note that images processed through the Service are limited to images to which the user themselves holds the rights or images for which processing permission has been obtained. Uploading images that infringe the copyright, portrait rights, or other rights of third parties is prohibited; details are set out in the Terms of Use.
(5-2) Text decoration (deco text) editing data
- The text you enter and the decoration settings such as outlines, 3D effects, gloss, and transformations are processed within the user's browser while editing, and are not continuously transmitted to the Company's servers.
- Such data is transmitted to the Company's servers only when you export print-ready data (such as a PDF), and after the export process it is automatically deleted from memory, just like uploaded images (it is not permanently stored on disk).
- For the convenience of re-editing, work-in-progress states may be temporarily saved within the user's browser (localStorage). This is stored only within the user's device and can be deleted by the user at any time.
- We never provide the text you enter or the decorative designs you create to third parties, use them for AI training, or use them for any purpose other than the stated purpose.
(6) Information collected for spam prevention (Google reCAPTCHA)
The contact form of the Service uses Google reCAPTCHA v3, through which Google automatically collects the following information.
- IP address
- Behavioral data such as mouse movements and clicks
- Browser and plugin information
- Page viewing history (within the same session)
This information is processed in accordance with Google's privacy policy.
(7) Anonymized behavioral and usage information
The Company collects and accumulates information regarding the usage of the Service (usage trends such as the features used, operation and screen transitions, the dates/times and frequency of use, and the usage environment) after processing and anonymizing it into a form that cannot identify any specific individual. This is not information used to identify individual users, but statistical behavioral information used to understand overall usage trends of the Service. It is not used for the purpose of identifying individuals by linking it with names, email addresses, or the like.
03 Purposes of Use of Personal Information
The Company uses the personal information it collects for the following purposes. If personal information is to be used beyond these purposes of use, we will obtain the user's consent anew.
- Providing, operating, and improving the Service
- Account management and identity verification
- Processing credit payments and managing transaction records
- Responding to inquiries
- Notifications regarding the Service, service changes, and important matters
- Detecting and preventing unauthorized access, spam, and improper use
- Ensuring security and responding to incidents
- Creating behavioral and statistical information processed and anonymized into a form that cannot identify individuals, and using such information to improve the Service, plan and develop new services, and conduct market research and analysis (including provision to third parties under Chapter 4 (5))
- Fulfilling obligations based on laws and regulations
04 Provision of Personal Information to Third Parties
The Company does not provide users' personal information to third parties except in the cases set out below.
(1) When the user consents
We provide personal information to third parties only when consent has been obtained from the user in advance.
(2) Provision to subcontractors (outsourcing)
To the extent necessary to achieve the purposes of use, we may outsource the processing of personal information to the following subcontractors. The Company supervises subcontractors to ensure they take appropriate security control measures.
Purpose: Payment processing
Information provided: Transaction information, email address, Stripe Customer ID
Privacy Policy: https://stripe.com/jp/privacy
Purpose: Access analytics (Google Analytics 4), spam prevention (reCAPTCHA v3)
Information provided: Access logs, behavioral data, device information (in a form that does not directly identify individuals)
Privacy Policy: https://policies.google.com/privacy
(3) Disclosure based on laws and regulations
If we receive a legally based request for disclosure from a court, police, or administrative agency, we may provide personal information to the extent necessary.
(4) Business succession
In the event that our business is succeeded through a merger, corporate split, business transfer, or the like, personal information may be transferred to the successor. In such a case, we will promptly notify users.
(5) Handling of statistical information and anonymized behavioral information
The provisions of the preceding items concern the provision of "personal information." The statistical information and anonymized behavioral information created by the Company (information about usage trends processed so that no specific individual can be identified) does not constitute personal information. Such information may be provided to third parties for purposes such as improving the Service, planning and developing new services, and conducting market research and analysis.
This information is processed through aggregation, statistical processing, and the like into a form that cannot identify any specific individual, and no specific individual will be identified even by the recipient. Personal information such as names, email addresses, or payment information is not provided to third parties through this handling.
05 Use of External Services
Google Analytics 4
The Service uses Google Analytics 4 (GA4) to analyze and improve usage. GA4 uses cookies to collect website traffic data, but the data collected is anonymized and does not directly identify individuals.
- IP addresses are anonymized (the last octet is removed).
- You can refuse collection using the Google Analytics Opt-out Browser Add-on (https://tools.google.com/dlpage/gaoptout).
Stripe (payment processing)
Stripe Checkout, provided by Stripe, Inc., is used for credit card payments. Confidential information such as card numbers is processed and stored in Stripe's secure environment and is not stored on the Company's servers. Stripe complies with PCI DSS (Payment Card Industry Data Security Standard).
Google reCAPTCHA v3
Google reCAPTCHA v3 is used as a countermeasure against spam and bots on the contact form. reCAPTCHA is subject to Google's Privacy Policy and Terms of Service. reCAPTCHA v3 does not display visible challenges (such as image recognition) and determines whether a user is a bot solely through behavioral analysis.
06 Cookies and Tracking Technologies
The Service uses cookies and localStorage for the following purposes.
Essential cookies and storage
- ailiner_user (localStorage): Retains login state and credit balance. Required for session management.
- ailiner_return_url (localStorage): Temporarily stores the automatic redirect destination after payment is completed.
Analytics cookies (Google Analytics)
- _ga, _ga_*: Identifies user sessions. Retention period: 2 years.
- _gid: Identifies users. Retention period: 24 hours.
Disabling cookies
You can disable cookies from your browser settings, but some features may no longer function properly. If you wish to refuse collection by Google Analytics, please use the Google Analytics Opt-out Browser Add-on.
07 Cross-Border Transfer of Personal Information
The Company's subcontractors (Stripe, Inc. and Google LLC) are located in the United States, and this constitutes provision to a third party in a foreign country under Article 28 of the Act on the Protection of Personal Information (APPI).
The United States is not recognized as having a personal information protection system at a level equivalent to that of Japan, and each subcontractor takes appropriate protective measures as follows.
- Stripe, Inc.: Compliance with the EU-U.S. Data Privacy Framework (DPF) and the conclusion of Standard Contractual Clauses (SCC).
- Google LLC: Compliance with the EU-U.S. DPF and appropriate protective measures under the Google Cloud Data Processing Terms.
For details regarding these protective measures, please refer to each subcontractor's privacy policy.
08 Security Measures
The Company takes technical and organizational security control measures against risks such as unauthorized access to, loss, destruction, alteration, or leakage of personal information.
- Encryption of communications: Encrypted communications using SSL/TLS (HTTPS).
- Access restriction: Managing access so that only those who need it for their duties can access personal information.
- Non-retention of payment data: Confidential payment information such as card numbers is not stored on the Company's servers.
- Immediate deletion of image data: Uploaded images are deleted immediately after conversion processing.
- Rate limiting: API rate limits are implemented to block improper requests.
- Regular review: Security policies and systems are reviewed regularly.
However, it is difficult to guarantee complete security in the transmission and reception of information over the Internet. While the Company takes reasonable security measures, it does not guarantee the elimination of all risks.
09 Retention Period of Personal Information
The Company does not retain personal information beyond the period necessary to achieve the purposes of use. Guideline retention periods are as follows.
- Inquiry data (name, email, content): 3 years after the inquiry is completed.
- Account data (email address, etc.): 1 year from the request for account deletion.
- Payment transaction records: 7 years from completion of the transaction (based on statutory retention obligations).
- Access logs (IP address, etc.): 6 months from collection.
- Uploaded image data: Deleted immediately after conversion processing is completed or the session ends.
After the retention period has elapsed, or when the purpose of use has ceased to exist, we will delete or anonymize the information by a secure method without delay.
10 Rights of Users
Users have the right to make the following requests regarding their own personal information held by the Company, based on the Act on the Protection of Personal Information.
(1) Request for disclosure
You may request disclosure of the content of your own personal information (retained personal data) held by the Company.
(2) Request for correction, addition, or deletion
If the content of retained personal data differs from the facts, you may request its correction, addition, or deletion.
(3) Request for suspension of use or erasure
If the data was obtained improperly, is being used beyond the scope of the purpose of use, or is no longer needed, you may request the suspension of use or the erasure of the retained personal data.
(4) Request to suspend provision to third parties
If the data is being provided to third parties in violation of laws and regulations, you may request the suspension of such provision.
About the procedure
Please submit the above requests via the Contact Form. After we have confirmed your identity, we will, as a general rule, respond within 30 days of receipt. Please note that we may be unable to fulfill your request if an exception provided for by law applies.
11 Personal Information of Minors
The Service is not intended for persons under the age of 15. If a person under 15 uses the Service, the consent of a guardian is required. If it comes to light that the Company has unintentionally collected personal information from a person under 15, we will promptly delete such information.
12 Disclaimer
The Service may contain links to the websites of external services (such as Stripe and Google), but the Company is not responsible for the privacy practices of the linked destinations. For the privacy policies of external services, please check the websites of each service.
The Company is not responsible in cases where a user discloses personal information to a third party of their own will, or where a third party obtains personal information through improper means.
13 Contact Point
For opinions or questions regarding this Policy, or for consultations or complaints regarding the handling of personal information, please contact the point below. As a general rule, we will respond within 5 business days.
wksystems LLC (DecoTecoPop Personal Information Management Desk)
Hours: Weekdays 10:00–18:00 (excluding year-end/New Year holidays and public holidays)
14 Commercial Use of Deliverables (Exported Data)
Commercial Use: Fully Allowed for paid SVG/PDF exports. No account needed. Just pay per export and keep your creative business growing.
SVG / PDF data exported for a fee may be used commercially without any restriction. No account registration is required, and you can use the Service simply by paying per export. You may freely use your creations for your creative business, including the sale, distribution, advertising, and printing of the works you produce.
15 Changes to the Privacy Policy
The Company may change this Policy due to amendments to laws and regulations, changes to the Service, or other circumstances.
- The content of any change will be posted on this page and takes effect from the date of posting.
- If we make a change that materially affects users' rights, we will give advance notice by notifying the registered email address or by announcing it within the Service.
- You can always check the latest version of the revised Privacy Policy on this page.
Revision History
| Date | Content |
|---|---|
| June 28, 2026 | Removed the restriction limiting the covered region to "users within Japan" and made the Service available for use from anywhere in the world (the governing law remains Japanese law). Clarified that compliance with overseas laws such as the GDPR is not guaranteed, and that those accessing from overseas must comply with the laws and regulations of their own country or region at their own responsibility. |
| June 28, 2026 | Added a description regarding the handling of text-decoration (deco text) editing data, which is a core feature of the Service (on-device processing, transmission only at export, and localStorage saving). |
| June 18, 2026 | Added a description regarding the commercial use of deliverables (SVG/PDF data exported for a fee). |
| June 9, 2026 | Added a description regarding the handling of anonymized behavioral and statistical information (collection, purpose of use, and provision to third parties). |
| May 22, 2026 | Added detailed descriptions of the handling of image data (clarifying temporary retention including color-adjustment backups) and added the covered region (for use within Japan). |
| May 21, 2026 | Privacy Policy established. |