This is an English translation for reference. The Japanese version is the official text. If the two differ, the Japanese version prevails. Japanese version: プライバシーポリシー

KUBOMI Privacy Policy

Version: 5th edition (first established: October 11, 2026)

Revised: November 11, 2026

Effective: November 11, 2026

The KUBOMI operator (the “operator”) handles the personal information of users and other people in the Web service “KUBOMI” (https://kubomi.app ; the “Service”) in accordance with the Act on the Protection of Personal Information (Japan) (the “Act on the Protection of Personal Information”) and other laws, as set out in this Privacy Policy (“this Policy”).

Article 1 (The operator’s name and address, and contact)

The operator runs the Service as an individual. The operator’s name is given in the Legal notice (Act on Specified Commercial Transactions).
The operator’s address is 〒160-0022 東京都新宿区新宿1-36-2 新宿第七葉山ビル 3F. This is the address of a mail-receiving service (in Japan) that the operator has a contract with, and there is no desk for visitors. Mail sent to this address is first received by that service, which tells the operator that it has arrived, with the sender’s name, and then hands it over to the operator. Please address mail to “KUBOMI”. Certified-content mail (naiyo shomei), restricted-delivery mail (honnin gentei uketori), cash-on-delivery postage (chakubarai) and collect-on-delivery (daikin hikikae) mail cannot be received at this address, so please use another method (regular mail, registered mail, etc.). How to make a request by sending a document by mail is set out in Article 8, paragraph 2. If you request it, the operator will tell you the operator’s phone number without delay (Legal notice (Act on Specified Commercial Transactions)).
Contact for the Service: contact form (https://kubomi.app/en/#/contact)
On the contact form, above the send button, the operator shows an explanation of how your inquiry is handled (including that what you send is sent through Resend in the United States, and received and stored in AOL Mail provided by AOL Media LLC in the United States). Please read this explanation, check “I agree to the handling above”, and then send your inquiry (Article 5).

Article 2 (Information collected, purpose of use and retention period)

The operator collects the following information, uses it for each purpose, and keeps it for each period. Unless otherwise stated, it is kept on the Service’s server (in Japan).

Information	Purpose of use	Retention period
Email address	Sending sign-in links, identifying your account, matching Free plan accounts, payment procedures (providing it to Stripe, Link, etc.), notices of renewals, changes to the terms, etc., and replying to inquiries	Until you delete your account
Email addresses that requested a sign-in link, and the link information (the link is stored converted so it cannot be reversed; this includes the information of people who did not sign in)	Signing in, and limiting the number of sends (up to 5 emails per hour to the same address)	Deleted within 2 days after the link expires
Google account ID (if you sign in with Google)	Signing in with Google, and matching Free plan accounts	Until you delete your account
Member number (a number the Service assigns internally)	Linking the account with songs, payments and records	Until you delete your account (within the records of consent and provision, the period of those records)
Language setting (Japanese / English; the screen language when you press the language switch while signed in, and when you go to payment for a paid plan; recorded from November 2, 2026 (JST))	To decide the language of the screen and of emails (sign-in emails, renewal notices, etc.)	Until you delete your account
Plan and payment status (plan and billing unit, the Stripe customer ID and subscription ID, renewal time, whether there is a booked change, a cancellation or an account deletion, the date and time of the order, the refund deadline, whether the renewal notice has been sent, and whether a payment has failed)	Providing paid plans, and the procedures for renewal, plan changes, canceling your plan, refunds and deleting your account	Until you delete your account
Referral code (the referral code you enter on the order screen for a paid plan, the date and time you entered it, and the number and start date and time of the subscription you ordered with that code; stored together with your member number. There is no record for people who do not enter a referral code)	Calculating and paying commission to the partner who referred you. It is not provided to outside parties such as Stripe. No cookies or browser storage are used. The partner is told only the totals (counts and amounts) for each code, never your information	Until you delete your account (a record with a subscription number: 60 days from the day you delete your account, for calculating and paying the commission; a record without one: deleted at once when you delete your account)
Song count records (the date, time and plan when a new song was made, and the number of rebuilds; including trial songs)	Applying the caps on the number of songs and rebuilds for each plan	Until you delete your account (records of trial songs: 24 hours from making the song; records of songs moved to an account: until you delete your account)
Records of unlocking (songs that were made downloadable up to WAV through the share link before the change, the method, and the date and time; no new rows are made; the remaining rows are read to check whether that song can be downloaded as WAV)	To keep allowing downloads, including WAV, for songs that remain from before the change	Until you delete your account
Download records (song, version, format, the date and time the transfer started and completed, and whether it completed)	Checking the conditions of the 7-day refund, and handling inquiries about payments and claims of suspicious charges	Until you delete your account (kept even after the song is deleted). If a paid plan payment was made, 1 year from the date of the last payment, even after you delete your account
Audio files (including vocals), file names, songs, and the history of settings	Processing mixing and mastering, providing playback and downloads, investigating problems, and checking claims from rights holders or violations of the Terms of Service	Paid plans: 30 days from making. Free plan: 7 days from making. Trial (not signed in): 24 hours from making. Deleted immediately if you delete them or delete your account
Original song (audio containing the original singing of the song, which you may choose to upload on the tempo page; on the Japanese screen, it is called “honke”; Terms of Service, Article 17-2)	Making the measurement results of the original song (to choose where to align the start of each note of the vocals when rebuilding)	Deleted immediately when the measurement is finished (including when it could not be measured). If the measurement is not finished within 24 hours of upload, deleted within about 1 hour after the 24 hours pass
Measurement results of the original song (values showing the strength of the onsets of sounds, the time offset against the backing track, and the log of the measurement process; the audio of the original song is not included)	To choose where to align the start of each note of the vocals when rebuilding	The same period as audio files (the “Audio files” row above). Deleted immediately if the original song is removed or the song is deleted. If you delete your account, deleted at the same time as audio files
Trial cookie (a value converted so it cannot be reversed (a hash) from the value of the cookie kubomi_trial, which is saved in the browser when a person who is not signed in makes a song in the trial; IP addresses and email addresses are not included)	Confirming who owns trial songs, limiting the number of trials while the cookie is valid (Terms of Service, Article 9, paragraph 6), moving trial songs to the account when you sign in, and applying the overall cap on trials (number per hour). In the records of consent and in activity logs, it is also used as a name in place of the member number	The value used to confirm who owns the song, to limit the number of trials and to move songs is kept for 24 hours from making a song in the trial (the same applies if you sign in and move the song to your account; the cookie is also valid for 24 hours). Songs can be moved only within these 24 hours. However, values included in the records of consent and provision are kept for the same period as those records (the “records of consent and provision” row below). Only a different code made from this value is recorded in activity logs, and it is deleted 1 year from the date recorded (Article 3, paragraph 2). These values and codes left in records are not used for access to songs or for limiting the number of trials
Activity logs (Article 3)	Investigating problems, improving results, reviewing prices and plans, and checking excessive use	1 year from the date recorded
Server logs (errors, etc.; file names may be included; IP addresses are not included)	Investigating problems	Deleted within 30 days from the date recorded
Information to keep you signed in (stored converted so it cannot be reversed)	Keeping you signed in	90 days (deleted immediately if you sign out)
Records of consent and provision (member number (in the trial, the hash of the trial cookie; it is linked to the member number when you sign in and move the song to your account), the Stripe customer ID, the version of the document agreed to, the statement shown and its language (Japanese / English), the date, time and situation of consent, the recipient, the items of information provided, and the date and time of each provision; this includes the consent given when you check “I agree to the handling above” and send an inquiry on the contact form)	Recording that consent was obtained, records under Article 29 of the Act on the Protection of Personal Information, and records of consent to providing information to third parties in a foreign country	3 years from the date consent or provision was last recorded for that member number (even if there is no provision to third parties, 3 years from the date consent was last recorded; records not linked to a member number: 3 years from the date of the record; kept even after you delete your account)
Information for limiting the number of contact form sends (the sender’s IP address, and the reply-to email address with the part from “+” onward removed, each converted with a secret key)	Limiting sends from the same sender (up to 5 times per hour) and to the same reply-to address (up to 3 times per hour; email addresses that differ only after “+” are counted together)	Kept only in the server’s memory, and not saved in files or databases. Erased 1 hour after the last send
Matching hash (the email address normalized by the method in paragraph 4 and the Google account ID, each converted with a secret key), the number of songs made on the Free plan in that month (together with the month counted), and whether the 7-day refund has been used	Preventing duplicate Free plan accounts, and applying the monthly song count and the 7-day refund (once per person) (Terms of Service, Article 6)	While the account exists and for 2 years from the date you delete your account, and then deleted
Information the operator views in the Stripe Dashboard (name, billing address (to the extent entered on the Stripe payment screen), email address, card brand, last 4 digits and expiry date, payment records (date and time, amount, status, refunds, disputes of payments), and information Stripe shows to prevent fraud)	Refunds, inquiries about payments, claims of suspicious charges, handling rescission by a minor, and tax processing	Link and Stripe store it, for the periods each company sets. The operator views it in the Dashboard and does not save it on the Service’s server. Payment records the operator keeps as tax records are kept for the periods set by tax laws and other laws
The content of inquiries (the sender’s email address, the body and attachments of emails; if you use the contact form, this includes the name you entered, the reply-to email address, the type of inquiry, the song and version concerned, the body, and attached files)	Replying to inquiries and requests, and keeping records of them	In the operator’s email inbox (Article 7, item 5), 1 year from the date handling is completed. Those about claims from rights holders: 3 years. The content of the contact form and attached files are not saved on the Service’s server (they are handled only while being sent, and erased when sending is finished)
Bank account for the refund (financial institution, account number and account holder name; only when the refund cannot be made through Link)	Making the refund	The account number is deleted promptly after the transfer is completed, and the date, amount and account holder name of the transfer are kept as a refund record for the periods set by tax laws and other laws
Information for confirmation in requests for disclosure, correction, deletion, etc. or in rescission by a minor	Confirming that you are the person concerned or their legal representative	Copies of documents used for the confirmation, etc. are deleted promptly after the confirmation, and only the fact and the date and time of the confirmation are kept as a record of handling for 1 year
Documents sent by mail (the content of the request, where to send the reply, and the name, address, etc. written in the document; Article 8, paragraph 2)	Replying to requests, and keeping records of them	Not saved on the Service’s server. The operator keeps them as paper documents and disposes of them 1 year from the date handling is completed. Those about claims from rights holders: 3 years. If a copy of a document for confirming identity is included, that copy is disposed of promptly after the confirmation, and only the fact and the date and time of the confirmation are kept as a record of handling for 1 year. If you exchange emails with the operator about this request, those emails are kept and deleted for the same period and in the same way as in the “The content of inquiries” row

The original song contains the vocals of someone other than the user (the original singer). The operator deletes the original song after measurement as described above, and the vocals cannot be heard from the measurement results of the original song.

If you go through the steps to delete your account during a paid plan billing period, the information marked “Until you delete your account” in the table above is deleted on the last day of the billing period.
The matching hash is in a form from which the original email address, etc. cannot be known, but because it can be matched when the same email address, etc. is entered again, it is handled as personal information. The secret key is kept in a place separate from the database, and only the operator can handle it. The operator reviews the need for keeping it and the period once a year.
For matching, email addresses are compared after normalizing differences between uppercase and lowercase letters and, for Gmail addresses, differences in dots (.) and in the text after “+” (for example, Uta.Mix+demo@gmail.com and utamix@gmail.com are treated as the same address). The operator does not match by device or IP address (the limit on the number of trials is applied by the trial cookie saved in that browser while it is valid; this limit does not use IP addresses either). To limit the number of contact form sends, the operator uses a converted value of the sender’s IP address for only 1 hour (the table in paragraph 1), but does not use it for matching. If you think you were matched by mistake, please contact the operator through the contact form. The operator will check by hand and, if the match was wrong, will reverse it.
Vocals are handled as personal information if they can identify a specific individual. File names are used to show the names of songs and parts. Please do not include words you do not want others to know, such as your real name, in file names.
The Service’s server does not store credit card numbers, names, addresses, phone numbers, or the content of inquiries and attached files.
The operator will not use personal information beyond the purposes set out in this Article. If the operator changes the purpose of use, it will publish the new purpose or notify you of it in accordance with the law.
In the trial (not signed in), the operator does not collect email addresses. In the trial, the operator collects audio files, file names, songs, the history of settings, the measurement results of the original song (the original song is deleted after measurement), the trial cookie, and records of consent. To apply the overall cap on trials, the operator counts only the number of new trials started, and does not use information that identifies individuals.

Article 3 (Activity logs)

The operator records the following information about operations on the Service.
- Signing in (how you signed in, and whether it is the first time)
- Starting a trial, moving trial songs to an account, and refusing a trial (1 song already made with this browser’s trial cookie, or the overall cap)
- Orders, plan changes, canceling your plan, undoing the cancellation, refunds (and the reason if it failed), downloads, unlocking, booking account deletion, and deleting your account
- Notices from Stripe about payments (payment completed, failed, etc.)
- Settings and corrections when making and rebuilding songs (volume, chorus, part roles, etc.)
- Song length, number of files, and processing time
- Error details, and reasons for refusing an upload (file size or number of files, the cap on the number of songs, etc.)
- Date and time, and song number
Activity logs do not include email addresses, IP addresses, browser types or file names. The operator stores logs linked to a different code made from the member number (in the trial, the hash of the trial cookie). While the account exists, the operator can match logs with users. In the trial, the code is used only to link activity logs with each other, and is not used for access to songs or for limiting the number of trials. Activity logs are deleted 1 year from the date recorded (Article 2).

Article 4 (When the operator listens to audio files)

The operator personally may listen to audio files or songs only in the following cases. Normal processing is done automatically by the program, and no person listens.
- To investigate the cause when a user reports a problem or when processing ends with an error
- To check claims from rights holders or violations of the Terms of Service
The operator will not publish or distribute audio files or songs. The operator also will not use them to train AI models.
Because the original song is deleted after measurement, the operator does not listen to it (Terms of Service, Article 17-2).

Article 5 (Providing information to third parties and to third parties in a foreign country)

Except in the cases set out in this Article and cases based on law, the operator will not provide personal information to third parties without the person’s consent.
The operator will not send users’ information, audio files, or original songs to any generative AI provider.

Payment: Stripe / Link

Recipient: The other party to the operator’s Stripe account contract is Stripe Japan, Inc. (Japan). Payment information is actually processed and stored by Stripe, Inc. (US), a group company of Stripe Japan, Inc., and by Sold through Link, LLC (US; “Link”), an affiliate of Stripe, Inc., which bills, processes and receives payment as the Merchant of Record. This section lists the recipients the operator confirmed by contract as of October 11, 2026, and if they change, the operator will revise this Policy.
How this provision is treated: Stripe and Link also use the information for their own purposes, such as preventing fraud, in addition to payment. For this reason, the operator treats this as providing personal information to third parties based on the person’s consent (Act on the Protection of Personal Information, Article 27), and treats providing it to US businesses as providing it to third parties in a foreign country (Article 28 of the same Act).
Information provided and when: (1) When you press the “Go to payment” button on the order screen: your email address and member number. (2) If there is an inquiry about a payment, or a request for a refund or a dispute of a payment, to the extent needed to handle it: information about your use (orders, plan changes, download records). Both are within the scope you agree to on the order screen. If provision beyond this scope is needed, the operator will get your consent again, or will provide it only where based on law.
Purposes of use by the recipients: payment, tax calculation, preventing fraud, and other purposes set out in each company’s privacy policy (https://stripe.com/privacy , https://link.com/privacy )
Information the operator receives: the Stripe customer ID and subscription ID, renewal time, and notices about successful or failed payments, refunds and cancellations of plans
Information that Stripe and Link collect directly on the payment screen (name, billing address, card information, IP address, etc.) is handled under each company’s privacy policy. Under each company’s policy, information may be transferred to the US and to countries where each company’s group companies are located (Ireland, India, etc.).

Sending email: Resend (US)

Recipient: Plus Five Five, Inc. (US; service name Resend)
How this provision is treated: The operator entrusts Resend with sending email. Because the recipient is in a foreign country, the operator provides the information with the person’s consent (Act on the Protection of Personal Information, Article 28).
Information provided: the email address the email is sent to, and the subject and body of emails (sign-in links, renewal notices (renewal time, plan and amount, how to cancel your plan, contact), and notices such as changes to the Terms of Service or prices, or the end of the Service)
Resend stores records of sent emails (the address sent to, subject, body, sending status) in the US for the period Resend sets (on the plan the operator uses, 30 days for emails and logs and 7 days for backups). The operator does not copy and save the records in the Resend dashboard.

Inquiry email: AOL Mail (US)

Recipient: AOL Media LLC (US; service name AOL Mail)
How this provision is treated: This is receiving and storing what you send through the contact form. Because the recipient is in a foreign country, the operator provides the information with the person’s consent (Act on the Protection of Personal Information, Article 28).
How it arrives: The content of your inquiry is sent through Resend in the US, received in AOL Mail, and stored. The operator’s replies are also received and stored in the same email service.
Information provided: your name (if entered), the reply-to email address, the type of inquiry, the song and version concerned, the content of the inquiry, and attached files (if any). While you are signed in, your member number is also included.
That company handles the information under its privacy policy (it may process email bodies, attachments, etc. to provide smart features).
On the contact form, above the send button, the operator shows an explanation of this handling. When you check “I agree to the handling above” and send your inquiry, the operator records your consent.

Signing in with Google: Google LLC (US)

When you sign in with Google, the operator receives 3 items from Google: your Google account ID, your email address, and whether the email address has been verified. Of these, the operator saves the ID and the email address. The operator does not receive your name or photo. The operator does not provide users’ information to Google.
The email address received from Google is used as your account’s email address for signing in, notice emails and payment procedures (if there is an account with the same email address, it is linked to that account). It is not used for advertising.

Sharing on X (optional)

Only when you press the share button, the X (formerly Twitter) post screen opens in your browser. Only the Service’s URL (https://kubomi.app) is entered. The operator does not provide users’ information to X. Information that X collects on X’s screen is handled under X’s privacy policy.

The US system for protecting personal information

According to the “Survey of Systems for the Protection of Personal Information in Foreign Countries (United States of America)” by the Personal Information Protection Commission (Japan) (a survey as of October 2021; https://www.ppc.go.jp/enforcement/infoprovision/laws/offshore_report_america/ ; the “Commission’s survey”), the US has no federal law that covers all sectors, and has federal laws for each sector and state laws (such as the California Consumer Privacy Act). The laws of the state where the recipient does business may apply.
Relationship with the 8 principles of the OECD Privacy Guidelines: The Commission’s survey states that, among these laws, some do not set out part of the obligations of businesses or the rights of individuals that correspond to the 8 principles.
Systems that require businesses to store personal information in the country, and systems that require businesses to cooperate with government information-gathering activities, that may seriously affect the rights and interests of individuals: The Commission’s survey does not list any such system.
The Commission’s survey is not exhaustive, and may not reflect later changes to laws, etc. The US is not a country that the Personal Information Protection Commission designates as having a system of a level equal to Japan’s.
This section is based on what the operator confirmed as of October 11, 2026.

Measures taken by the recipients

Stripe / Link: Stripe’s privacy policy (including Link’s services) states that, when Stripe transfers personal data from Japan to businesses in countries not recognized as having a level equal to Japan’s, it concludes written contracts that set out obligations equal to those under the Act on the Protection of Personal Information.
Resend: The contract on handling data between Resend and the operator sets out that Resend handles the content of the emails sent, etc. according to the operator’s instructions, and takes security measures. Information that Resend uses to run its own services (information about accounts and usage) is handled under Resend’s privacy policy.
AOL Mail: This is receiving and storing the content of inquiries. That company handles the information under its privacy policy (it may process email bodies, attachments, etc. to provide smart features).
The operator uses each company’s services after checking these contents. This section is based on what was confirmed as of October 11, 2026.

Getting and recording consent

On the sign-in screen, above the “Send the sign-in link” and “Sign in with Google” buttons, the operator shows links to the Terms of Service and this Policy and a consent statement, and, as a separate statement, a consent statement for providing your email address to Resend in the US to send sign-in and notice emails, together with a link to this Article.
On the paid plan order screen, above the “Go to payment” button, the operator shows, in the same way, a consent statement for providing the above information to companies of the Stripe group (including Stripe, Inc. and Link in the US) for payment, together with a link to this Article.
In the trial (not signed in), above the “Create” button on the screen where you add audio files, the operator shows links to the Terms of Service and this Policy and a consent statement. In the trial, the operator does not collect email addresses and does not provide personal data to third parties in a foreign country, so it does not show the consent statements for providing information to Resend, Stripe and Link. The operator links the records of consent to the hash of the trial cookie instead of the member number, and links them to the member number when you sign in and move the trial song to your account.
On the contact form, above the send button, the operator shows an explanation of how your inquiry is handled and the “I agree to the handling above” checkbox. When you check it and send your inquiry, the operator records your consent.
As the “records of consent and provision” in Article 2, the operator records consent and the date, time and items of each actual provision after that, together with items that identify the person (member number, the Stripe customer ID, and a value made by converting the email address used to sign in with a secret key), and keeps them for the period set out in the same Article (3 years from the date consent or provision was last recorded for that member number; records not linked to a member number: 3 years from the date of the record). The operator keeps these identifying items with the records for the same period even after you delete your account, so that the person can be identified from the records. Records of provision to Resend (sign-in emails) for Free plan users are handled in the same way. For entrusting to Resend, the operator keeps records of consent and records of supervising the contractor.
If you do not agree, you cannot use the trial, sign in, or subscribe to a paid plan.

Article 6 (Cookies and sending information outside)

The Service uses the following cookies.
- kubomi_session: to keep you signed in (valid for 90 days)
- kubomi_gstate: to prevent impersonation when signing in with Google (valid for 10 minutes; deleted when sign-in is completed)
- kubomi_trial: in the trial for people who are not signed in, to confirm who owns the song and to limit the number of trials while the cookie is valid (valid for 24 hours; set so that JavaScript cannot read it (HttpOnly), and saved only when you make a song in the trial; the server keeps only a value converted so it cannot be reversed)
- kubomi_lang: to remember the screen language (Japanese / English) you chose (valid for 1 year; set so that JavaScript can also read it to decide the screen language (not HttpOnly), and saved only when you press the language switch, whether or not you are signed in)
The Service does not use cookies or services for analytics or advertising (such as Google Analytics).
The following information is saved only in your browser and is not sent to the server: the download format you chose, the player volume, and whether you closed guidance messages.
When you open a page of the Service, your browser sends information outside as follows. The operator does not receive this information.

Sent to	Information sent	Purpose
Google LLC (Google Fonts; fonts.googleapis.com, fonts.gstatic.com)	IP address, browser type and similar information, the domain of the page shown, etc.	Showing the text (fonts) of the page

Google handles this information under Google’s privacy policy and other rules (Google’s explanation: https://developers.google.com/fonts/faq/privacy ).

The Stripe payment screen, the Google sign-in screen and the X post screen open only when you press a button. On these screens, each company uses cookies and similar technologies.

Article 7 (Security measures)

To prevent leaks, loss or damage of personal information and for other security purposes, the operator takes the following measures.

Setting a basic policy: This Policy sets out how personal information is collected, used, kept, provided and deleted.
Organizational and personnel security measures: Only the operator personally handles personal information. However, mail sent to the operator’s address is received by the mail-receiving service in Article 1, paragraph 2, and handed over to the operator. Only the operator can enter the Service’s server, the Stripe Dashboard and the Resend dashboard.
Physical security measures: The Service’s data is stored on servers in Japan rented from KAGOYA.
Technical security measures: encrypted communication (HTTPS), sign-in without passwords, storing sign-in links and information on sign-in status converted so they cannot be reversed, converting the matching hash with a secret key and keeping the key separately, a system that does not handle credit card information, automatic deletion of audio files and songs (24 hours for trial songs), storing the trial cookie converted so it cannot be reversed, settings so that IP addresses are not recorded in the access logs of the operator’s servers (the application and the HTTPS relay), a design that does not include email addresses, IP addresses or file names in activity logs, a design that does not save the content of the contact form or attached files on the server, and a design that keeps the sender information used to limit the number of sends only in memory
Understanding the external environment: The Service’s data is stored in Japan. Because the operator uses US businesses (Stripe and Link, Resend, AOL Media LLC), the operator checks the measures taken by the recipients after understanding the US system described in Article 5. What you send through the contact form is sent through Resend in the US, and received and stored in AOL Mail provided by AOL Media LLC in the US (Article 5). That company handles the information under its privacy policy (it may process email bodies, attachments, etc. to provide smart features). The operator deletes the content of inquiries, confirmation documents, etc. that it keeps for the periods and in the ways set out in Article 2.

Article 8 (Requests for disclosure, correction, deletion, etc.)

What you can do yourself: You can delete songs at any time from the song list. You can go through the steps to delete your account from your account page.
For retained personal data, you can make requests for notice of the purpose of use, disclosure (including disclosure of records of provision to third parties), correction, addition or deletion of the content, suspension of use or erasure, and stopping provision to third parties by contacting the operator through the contact form (Article 1, paragraph 3). If it is difficult for you to use the contact form, or if you do not agree to how the contact form handles your inquiry (sending through Resend and AOL Mail; Article 5), you can make a request by sending a document by mail to the operator’s address (Article 1, paragraph 2). In the document, please write what you request and where to send the reply (email address or postal address). The types of mail that cannot be received are as set out in Article 1, paragraph 2. The operator does not charge a fee. For the “Information the operator views in the Stripe Dashboard” in the table in Article 2, the operator will also answer to the extent it can view. You can also make requests to Link and Stripe for the information they hold.
For users, the operator confirms that you are the person concerned by having you send your request through the contact form with your registered email address as the reply-to address, and having you reply to the confirmation email the operator sends to that email address. For requests by a representative, the operator confirms this by a document that shows the authority of representation. For this confirmation, the operator will not ask for ID documents or similar beyond what is needed.
The operator also accepts requests from people who are not users of the Service (such as people whose vocals are in audio files). The operator confirms that the requester is the person concerned by the requester’s name and contact details, information that identifies the song in question, an explanation that the song contains the requester’s vocals, and so on. Disclosure is limited to the parts related to the requester’s vocals. The operator does not disclose the whole song or other information of the user who uploaded it, to the extent that the law allows non-disclosure. If the song in question has been deleted because its storage period ended or for similar reasons, the operator will tell the requester so.
The operator makes disclosure by the method the requester specifies (providing electronic records, such as by email attachment, sending documents by mail, or other methods). If disclosure by the specified method would cost a large amount or is otherwise difficult, the operator makes disclosure by delivering a document, and tells the requester so. If the operator cannot respond under the law, it will tell the requester the reason.
Information kept after you delete your account is as follows.
- Payment records held by Link and Stripe (kept under each company’s policy; if you want them deleted, please also ask Link (link.com))
- Resend’s sending records (for the period Resend sets)
- Download records (if a paid plan payment was made; deleted 1 year from the date of the last payment)
- Activity logs (deleted 1 year from the date recorded)
- Server logs (deleted within 30 days from the date recorded)
- Records of consent and provision (deleted 3 years from the date consent or provision was last recorded for that member number; records not linked to a member number are deleted 3 years from the date of the record; records that include the hash of the trial cookie are also deleted at the same time)
- The matching hash, the number of songs made on the Free plan in that month, and whether the 7-day refund has been used (deleted 2 years from the date you delete your account)
- The content of inquiries (in AOL Mail, for the period in Article 2)
- Refund records, and payment records the operator keeps under tax laws and other laws

Article 9 (Promotional emails)

The operator does not currently send promotional emails. If the operator starts sending them, it will get users’ consent in advance. The operator sends sign-in links and notices of renewals, changes to the terms, etc. as communications about transactions.

Article 10 (Contact for complaints and questions)

You can make complaints and ask questions about the handling of personal information by contacting the operator through the contact form. If the form is difficult for you to use, you can also send them as a document by mail to the operator’s address (Article 1, paragraph 2).

Contact for the Service: contact form (https://kubomi.app/en/#/contact)

Please read the explanation above the send button, check “I agree to the handling above”, and then send your inquiry.

Article 11 (Changes to this Policy)

The operator may change this Policy in response to changes in laws, changes to the Service, and so on.
When changing this Policy, the operator announces the effective date and the changed contents by posting them on the Service before the effective date. For important changes, such as an increase in the information collected or in the recipients, the operator also notifies you at your registered email address, and where required by law, gets your consent again.
For this Policy, the Japanese text is the official text. Even when a translation is provided, if the contents differ, the Japanese version of this Policy prevails.

The text of the 2nd edition (effective October 22, 2026) is the 2nd edition. The text of the 3rd edition (effective October 24, 2026) is the 3rd edition.