Privacy Policy

Pairtok Co.,Ltd. (株式会社ペアとく, "we", "us", "our") operates formpuppy. This policy explains how we collect, use, and protect your information in accordance with applicable data protection law, including the EU General Data Protection Regulation (GDPR).

1. Data Controller

The data controller responsible for your personal data is Pairtok Co.,Ltd., 〒150-0002 東京都渋谷区渋谷2-19-15宮益坂ビルディング609. Contact: project-7yjo@formpuppy.com.

2. Information We Collect

Account Information

When you sign up, we collect your email address and, if using Google OAuth, your name and profile information provided by Google.

Email Content

Emails sent to your formpuppy address are processed by our service. We store the sender address, subject, body text, and our AI classification results. Email content is used solely for classification and forwarding and is not shared with third parties for any other purpose.

Usage Data

We collect cookie-free performance data (Core Web Vitals) via Vercel Speed Insights and product analytics (page views, feature usage) via PostHog (EU Cloud, cookieless mode). To understand the geographic distribution of visitors, Vercel's Edge Network resolves the visitor's connection IP to a country code; only that two-letter code is shared with PostHog — raw IP addresses are never transmitted to PostHog. No individual users are identified or tracked across sessions. We use Sentry for error monitoring, which captures technical data such as stack traces and browser information when errors occur. No IP addresses or user identifiers are sent to Sentry.

3. Legal Basis for Processing (GDPR Article 6)

We process your personal data on the following legal bases:

• Contract (Art. 6(1)(b)) — processing your account information and email content to provide the service you signed up for.
• Legitimate interests (Art. 6(1)(f)) — anonymized analytics and error monitoring to maintain and improve service quality. These interests do not override your fundamental rights.
• Legal obligation (Art. 6(1)(c)) — retaining records where required by applicable law.

4. How We Use Your Information

• To provide the email filtering and forwarding service
• To classify emails using AI (Anthropic Claude)
• To send you service-related notifications
• To improve our AI classification accuracy
• To monitor and fix errors in our service

5. Third-Party Services and International Transfers

We use the following third-party processors. Some are located outside the EEA; where applicable, transfers are protected by Standard Contractual Clauses (SCCs) adopted by the European Commission.

• Supabase (US) — Authentication and database hosting. Data processed under SCCs.
• Anthropic (Claude) (US) — AI email classification. Only the content of emails submitted to your filter address is sent. Data processed under SCCs.
• Resend (US) — Email receiving and sending. Data processed under SCCs.
• Vercel (US) — Application hosting and performance monitoring (Speed Insights). Data processed under SCCs.
• PostHog (EU — eu.i.posthog.com) — Product analytics in cookieless mode. Country-level geolocation is resolved by Vercel's Edge Network; only a two-letter country code is shared with PostHog — raw IP addresses are never transmitted to PostHog. No individual users are identified across sessions. Data processed under DPA.
• Cloudflare Turnstile (US) — Bot protection on sign-up and login forms. IP address and browser signals are processed by Cloudflare to detect automated requests. Data processed under SCCs.
• Google OAuth (US) — Optional social login only. No tracking or advertising data is shared. Data processed under SCCs.
• Sentry (US) — Error monitoring. Stack traces and browser technical data only; no IP addresses or user identifiers are collected. Data processed under SCCs.
• Stripe (US) — Payment processing for paid plans. Payment data is handled directly by Stripe; we do not store card details. Data processed under SCCs.

We do not sell your data to any third party.

6. Data Retention

• Account information — retained for the duration of your account, then deleted within 30 days of account closure.
• Email content (quarantine) — retained for 90 days, then automatically deleted.
• Error logs — retained for 90 days via Sentry.
• Anonymized analytics — retained for 12 months.

You may request deletion of your personal data at any time by contacting us at project-7yjo@formpuppy.com.

7. Your Rights (GDPR)

If you are located in the EEA, UK, or another jurisdiction with equivalent law, you have the right to:

• Access the personal data we hold about you (Art. 15)
• Request correction of inaccurate data (Art. 16)
• Request erasure of your data ("right to be forgotten", Art. 17)
• Restrict processing in certain circumstances (Art. 18)
• Receive your data in a portable format (Art. 20)
• Object to processing based on legitimate interests (Art. 21)
• Lodge a complaint with your local supervisory authority. In Germany, this is the relevant state data protection authority (Landesdatenschutzbehörde); in the EU, you can find your authority at edpb.europa.eu.

To exercise any of these rights, contact us at project-7yjo@formpuppy.com. We will respond within 30 days.

8. Cookies

formpuppy does not use advertising or tracking cookies. We use strictly necessary session cookies for authentication (Supabase). Our analytics (Vercel Speed Insights and PostHog) operate in cookieless mode and do not track individual users across sessions. No cookie consent banner is required.

9. Security

We use industry-standard security measures including encryption in transit (TLS), row-level security policies in our database, and secure authentication practices.

10. Changes to This Policy

We may update this policy from time to time. Material changes will be communicated by email or a notice on the service. The "Last updated" date at the bottom of this page reflects the most recent revision.

11. Contact

For questions about this privacy policy or to exercise your rights, contact us at project-7yjo@formpuppy.com.