Privacy Policy

Established and last revised: July 11, 2026

loFT LLC (the “Company”) handles personal information received through inquiries in accordance with Japan’s Act on the Protection of Personal Information and other applicable laws and guidelines, as described below.

1. Business operator

2. Information we collect

The Company’s Google Form collects the following information:

• Email address (required)
• Name (optional)
• Company name (optional)
• Inquiry details (required)
• Answer to an anti-abuse question

Do not enter sensitive personal information, a Japanese Individual Number, passwords, private keys, or other authentication information that is not necessary for your inquiry.

Information collected by Google in connection with Google Forms is governed by the Google Privacy Policy.

3. Purposes of use

We use the collected information only as necessary for the following purposes:

1. Responding to consultations, questions, and quotation requests
2. Communicating about meetings, proposals, quotations, contracting, and other matters related to an inquiry
3. Managing response history and avoiding duplicate responses
4. Preventing and investigating abusive submissions, misconduct, and security issues
5. Complying with legal obligations and establishing, exercising, or protecting legal rights

We do not use inquiry information for advertising or bulk sales email without the individual’s consent. Any change to these purposes will remain reasonably related to the original purposes and will be published on this page.

4. Processing and storage

Inquiries are received through Google Forms. Responses, related correspondence, and electronic documents are managed in Google Workspace. Only when operationally necessary, the minimum required information may be processed in a Company-managed Google Cloud environment.

The Company manages business documents electronically as a rule. If an inquiry proceeds to a contract, the agreement is also handled through electronic contracting. After execution, contract information is separated from inquiry information under this policy and retained for the period required by the contract and applicable law.

5. Processors and third-party disclosure

The Company may entrust information, to the extent necessary, to Google as the provider of Google Forms, Google Workspace, and Google Cloud; to the website delivery provider; and, if a contract is executed, to an electronic contracting provider. We review applicable contractual terms and published security measures when selecting providers.

We do not disclose personal data to a third party except when:

• The individual has consented
• Disclosure is required by law
• Disclosure is necessary to protect life, health, or property and obtaining consent is difficult
• Processing is entrusted to a service provider to the extent necessary to fulfill the stated purposes
• Disclosure accompanies a business succession

The cloud services we use may process information through facilities or providers located outside Japan. We review the provider’s published information, contractual safeguards, and service settings and apply appropriate safeguards.

6. Security measures

The Company applies the following measures in proportion to the volume and nature of the information handled:

• Governance: The representative is accountable for collection, use, storage, deletion, and incident response.
• Access control: Administrative access to Google Workspace and Google Cloud is limited to required accounts.
• Strong authentication: YubiKey hardware security key authentication protects administrative access to Google Workspace, Google Cloud, and the Company’s on-premises network.
• Encryption: We use encryption in transit and at rest provided by Google Workspace and Google Cloud.
• Physical measures: Electronic documents are the default, and business devices and authentication devices are managed to prevent unauthorized access, theft, and loss.
• Provider oversight: We review published security information and contractual terms for cloud and other service providers.
• Review: Processing methods, access rights, and this policy are reviewed periodically and when the service architecture changes.

We do not publish configuration details that could undermine these safeguards. Publicly disclosable controls are summarized in our Security Whitepaper.

7. Retention and deletion

When an inquiry does not result in a contract, we retain the inquiry information for three years after the final response and then delete it. We may extend this period only as necessary to comply with law, resolve a dispute, or protect legal rights.

If a contract is executed, necessary information is transferred to the applicable contract, accounting, tax, or other legally required records and follows the relevant retention period. Deletion includes checking the response stored in Google Forms and copies in linked Google Sheets, Google Drive, or other locations. Data remaining in provider backups is removed according to the provider’s deletion process and is not used for ordinary business operations.

8. Requests for access, correction, restriction, or deletion

An individual may request notice of purpose, access, correction, addition, deletion, restriction of processing, erasure, or cessation of third-party disclosure concerning personal data that identifies that individual.

Submit a request through the contact form, indicating that it concerns personal information and providing the email address used for the original submission, the approximate submission date, and the request. We will verify identity through matching records or another necessary and proportionate method and respond without undue delay as required by law. We will not request more information than reasonably necessary for verification.

Requests are generally free of charge. If substantial direct costs are required, we will explain the reason and amount before proceeding. If the law does not permit us to fulfill a request, we will explain the reason.

9. Complaints and inquiries

For questions, complaints, or consultations about personal information, use the contact form.

10. Revisions

We may revise this policy in response to changes in law, service providers, or processing practices. Material changes will be published on this page together with the revision date.