Privacy
Privacy Policy
GOS recognises the importance of the privacy of all individuals we have contact with, including clients, customers, business partners and other stakeholders. We hereby declare our code of conduct in accordance with the Act on the Protection of Personal Information, Act No. 57 of May 30, 2003.
1. Purpose of utilisation of personal information
(1) Our business domain
We collect personal information to accomplish the purposes set out below in providing the following services:
- Undertaking operation outsourcing
- Business and operation consultancy
- Business and solution information providing
- Recruitment agency
- Temporary staffing
(2) Purpose of utilisation
When we collect personal information directly in writing, the purpose of utilisation is clearly stated and consent obtained. In other cases, such as indirect collection, we limit utilisation to the following purposes, except where the purpose is obvious or where laws or regulations require otherwise:
- Providing information about our services
- Provision of our services
- Information about seminars or exhibitions relating to our services
- Questionnaires and analysis of surveys
- Contract fulfilment
- Responding to enquiries
(3) Joint utilisation
Where we have a co-organiser for an event such as a seminar, personal information collected for the above purposes may be jointly utilised with that co-organiser. The name of the co-organiser is stated clearly each time personal information is collected, and GOS and the co-organiser are each fully responsible for managing the information they handle. Where collected personal information is to be jointly utilised for other purposes, those purposes are announced to the individual directly or on this website.
(4) Provision to third parties
We do not provide collected personal information to third parties without the consent of the individual, except where:
- required by laws or regulations;
- necessary to protect human life, body or property and it is difficult to obtain consent;
- necessary for the improvement of public health or the promotion of healthy child development and it is difficult to obtain consent;
- cooperation with a governmental institution, local government or their entrusted body is required by laws or regulations, and obtaining consent might hinder the execution of that duty.
(5) Entrustment
We may entrust collected personal information to a third party only where that party has been appropriately evaluated on its capability of personal information management and found to meet our contractor selection standard, and only for the purposes defined in (2) above.
2. Personal data held
| Responsible company | GOS Limited |
|---|---|
| Responsible person | President of GOS Limited |
| Purpose of utilisation | As set out in section 1 above |
3. External account data in the AI Secretary service
With your consent (OAuth), the AI Secretary service accesses mail, calendar and files in your Microsoft 365 or Google account. This data is handled as follows:
- Access takes place only to provide the service (preparing your brief, answering your questions, and performing actions you approve). Your mail, calendar and files stay in your Microsoft 365 / Google account, and we create no permanent copies on GOS servers. However, we may hold part of the content temporarily while it is needed for processing; what is held and for how long is set out in “4. Data held temporarily and retention periods”, and it is deleted automatically when the period ends.
- Until cancellation, GOS retains encrypted access tokens (the keys to your connection), your contract and usage information (a customer ledger with name, company and e-mail address) and the information needed to run the service, such as schedule delegations. Consultation history, minutes and received files are saved to your own drive (OneDrive / Google Drive).
- We never use this data for advertising, never sell or transfer it to third parties, and never use it to train artificial-intelligence models (except for sending it, to the extent necessary, to the processors listed in “7. Processors and recipients” in order to generate replies and so on). Replies are generated through a commercial AI API whose inputs are not used for training.
- Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
- You can disconnect at any time; when you do, GOS deletes the keys it held (for Google, the permission is first revoked on Google's side, then the record is deleted). You can also revoke consent in your Microsoft / Google account settings. What happens when a contract ends is described in “5”.
See also how we handle your data (with a diagram).
4. Data held temporarily and retention periods
The following data is kept in our storage (Cloudflare) only while it is needed for processing, and is deleted automatically when the period below ends.
| Sign-in state | An identifier that keeps you signed in. 14 days (deleted when you sign out) |
|---|---|
| Sign-in confirmation code | A hash of the 6-digit code sent by e-mail. 10 minutes (deleted when used) |
| Actions awaiting approval | The presentation of mail text, events or file content shown to you before you approve. Up to 31 minutes (deleted when executed or cancelled) |
| Reply drafts | The text of a draft reply to a scheduling counterpart. 32 minutes |
| Records of counterparts' replies | A record that a scheduling counterpart replied (we do not hold the body, subject or the counterpart's address). 14 days |
| Files you upload | The text of the file (first 6,000 characters) or an image. 6 hours (an image is deleted as soon as it is loaded in the next conversation) |
| Attachment lookup table | A table that identifies attachments during a conversation. 1 hour |
| Minutes vocabulary | Attendee names, event titles, contact names and company names, used to improve transcription. 6 hours |
| Payroll column mapping | Only the mapping of columns (we do not store salary amounts). 400 days |
| Usage totals | Daily usage and cost totals (they may include an e-mail address or a customer ID). 400 days |
| Diagnostic records | Success/failure and duration of calls to external services (no mail text or names are recorded; the customer ID is hashed). 35 days |
| Contact form submissions | Name, company, e-mail address, phone number, message, sender IP address and browser information. 3 years from receipt, then deleted automatically (submissions received before this handling began do not yet have an automatic deletion date set) |
| Subsidy consultation requests and partner registrations | The content of the request, registered in Airtable. No automatic deletion period is set (to request deletion, use the enquiry contact below). A fallback copy kept in case Airtable registration fails is deleted after 90 days. |
| Contract and billing records | Billing and contract records on Stripe's side, and the minimum items that remain in our ledger (Stripe customer ID, contract IDs, plan, contract status, contract-period dates). As long as required for the contract or by law (they remain after cancellation) |
| Access keys, customer ledger, settings | Encrypted access tokens, the customer ledger, schedule delegations, the minutes filing settings, KPI judgement records and so on. Until cancellation is confirmed (see “5” for what happens then) |
5. What happens to your data when a contract ends
When your contract has ended and no other active contract remains, we handle data as follows.
- Deleted: access keys (for Google, the permission is first revoked on Google's side; Microsoft offers us no way to revoke it, so we delete only the connection record we held); in the customer ledger, your name, company, e-mail address, preferred form of address, partner code and so on, and your sign-in sessions; schedule delegations, reply drafts, actions awaiting approval, minutes vocabulary and filing settings, uploaded file content, KPI judgement records, payroll column mappings and research counts; the registration of the automatic watchers (for the per-customer internal records the watcher holds, we leave a “deletion marker” and the watcher removes them on its periodic rounds).
- Kept in anonymised form: in the customer ledger, the Stripe customer ID, contract IDs, plan, contract status and contract-period dates. Your name, e-mail address and the rest are erased.
- Kept as billing records: the records on Stripe's side (we neither change nor delete them).
- Remaining: daily usage totals (they cannot be looked up per customer, so they cannot be deleted individually, and expire automatically after at most 400 days); the count of Google consent slots (it uses the e-mail address, or an irreversible string derived from it, and remains after deletion); diagnostic records (35 days); contact form submissions and subsidy consultation requests (as in “4”). We do not touch files in your own drive.
6. Deleting your data yourself
After your contract has ended, you can request the deletion described in “5” yourself from “Delete your data” on My Page. You review what will be deleted on screen and confirm with a 6-digit code (valid for 10 minutes) sent to your registered e-mail address, and then it is run. It cannot be undone. It cannot be run while your contract is active, and we never cancel a contract for you. The items listed as “Remaining” in “5” remain after this action too.
7. Processors and recipients
To provide the service, we send your data to the following providers, within the stated purposes.
| Anthropic (generating AI replies) | Your questions, content read from your connected accounts (mail, events, files), uploaded files, the full transcript of a meeting (to write the minutes), KPI account names and computed results, and the body of a scheduling counterpart's reply (for classification) — to the extent needed to generate a reply. |
|---|---|
| Cloudflare (hosting, temporary storage, speech-to-text) | Serving this site, storing the data in “4”, transcribing meeting recordings (audio is passed only for transcription and is not stored by us), and checking for automated submissions on the contact form (Turnstile). |
| Resend (sending e-mail) | Sign-in codes; notices about contracts and cancellation; notifications of contact, subsidy-consultation and partner-registration submissions. |
| Stripe (payments) | Information needed to start and manage your contract. You enter card numbers directly on Stripe's page; they do not pass through our servers. |
| Airtable (customer management) | Subsidy-diagnosis consultation requests and partner registrations/referrals (company, name, e-mail address, phone number, diagnosis details and so on). |
| Twilio (handling of calls to our office line) | The caller's number and voicemail recordings when someone calls our office line. |
| Microsoft / Google (the accounts you connect) | Reading your own mail, calendar and files with your consent, and performing the actions you approve. |
8. Transfers abroad
The processors above include providers outside Japan.
9. Cookies and similar
While you are signed in, we set a cookie named “gos_sid” in your browser to identify your signed-in state. It lasts 14 days and is set so that JavaScript cannot read it (HttpOnly). It is removed when you sign out. In addition, some settings are kept only in your browser and are not sent to us (the position of the guide window, document checklists, a temporary save of a recording's transcript, and so on).
10. Enquiries
Please contact us with any question, complaint or request — including disclosure, correction, addition or deletion of personal information we hold:
GOS Limited
6th Floor KS Bldg., 4-5-20 Kojimachi, Chiyoda-ku, Tokyo 102-0083, Japan
Tel: +81 (0)3 5212 6055 (09:30–17:00, Monday to Friday, excluding national holidays)
Web: enquiry form
Last revised: 15 October 2026
