KRFT Ops privacy policy
This policy sets out how Spring Theories G.K. ("we" or "Spring Theories") handles personal and other information in KRFT Ops (the "Service"). It applies to the Service's iOS and Android applications, to the website at ops.krft.world, to the features reached through the "KRFT Ops" LINE official account, and to the connection to AI services the Customer chooses. Information handled in the KRFT app is covered by the KRFT privacy policy (https://krft.world/privacy-policy). This policy is drawn up in Japanese; the English text is provided for convenience, and the Japanese version prevails.
1. Our role
The information handled in the Service falls into two groups.
- Information we collect and handle ourselves: the account details of the Members who use the Service, and subscription and billing information. For this information we are the responsible business operator under the Japanese Act on the Protection of Personal Information.
- Information we handle on behalf of a Customer (a brewery or another producer using the Service): the Customer's client records, the messages of linked LINE groups, the documents the Customer provides to import its data, and similar data. For this information the Customer is the responsible business operator, and we process it on the Customer's instructions and only to the extent needed to provide the Service.
2. Information we collect
We collect the following information ourselves.
- KRFT account details: name or display name, email address, the identifier of the Apple or Google account used to sign in, and the user ID.
- Membership of a Customer and role, and records of invitations issued and used.
- Device details: the identifier used for push notifications, the app version and the operating system.
- Activity records: an audit trail of who reviewed and approved what, and when, with, where applicable, that person's role and the surface used (web, iOS or Android).
- Getting-started guide usage records, in the applications and in the web app at ops.krft.world/app: the guide steps shown, the actions and help opened (including help asked of the AI assistant), the contact options opened, the operations refused on screen with their reason code, and the hiding and reopening of the guide, recorded with the Member's account, their role, the Customer concerned, the surface used (web, iOS or Android), the display language and the date and time. These records contain no typed text, no client or product name, no amount, address or contact details, and no message or file content.
- Exchanges with the AI assistant: the text a Member sends, the assistant's suggestions and the approval records.
- LINE account link details: LINE user ID, display name, and the linking code sent to our LINE official account.
- Connected AI link details (a "connected AI" is an AI service the Customer chooses and connects to the Service through the connection we provide): the account of the Member who authorised the connection, the name of the connected AI service and the host it connects from, the dates of connection, renewal and revocation, and the kind and number of operations made through the connection.
- Subscription and billing details: the Customer's name, address, billing email address, the type of payment method, and the history of invoices and payments. Card numbers are held by our payment provider; we receive only partial details such as the last four digits and the expiry date.
- The content of enquiries and the contact details given with them.
We handle the following information on behalf of the Customer.
- The names, contact persons, contact details, addresses, trading terms and notes of the Customer's clients (bars, restaurants and other businesses).
- Records of orders, deliveries, invoices and payments.
- Messages posted in linked LINE groups: the sender's display name, LINE user ID and the text.
- The content of the requests a connected AI sends to the Service, and the proposals prepared and the records confirmed through a connected AI.
- The content of the documents (files or links) a Customer loads in the Service, or gives to us, to bring its existing data into the Service: for example a client list, a product list or a stock list, with the names, contact persons, contact details and addresses they contain.
3. Purposes
We use the information we collect for the following purposes.
- Providing the Service: authentication, verifying membership, keeping records, producing 納品書 and 請求書, and sending notifications.
- Producing suggestions through the AI assistant.
- Providing Customer data at a connected AI's request, and preparing proposals and confirming records through a connected AI, in each case within the rights of the Member who authorised the connection.
- Drafting orders from linked LINE groups.
- Preparing the import of a Customer's existing data from the documents it provides, including having an AI model read them.
- Invoicing, confirming payments and managing subscriptions.
- Answering enquiries.
- Preventing misuse, keeping the Service secure and responding to incidents.
- Understanding how the getting-started guide is used and improving how Customers get started with the Service, using the getting-started guide usage records described in section 2.
- Improving the Service, for which we use only statistics in a form that does not identify any Customer.
4. Disclosure to third parties
We do not disclose personal information to third parties except where the law requires it or the person concerned has consented. Entrusting processing to the providers listed in the next section, to the extent needed to provide the Service, is not a disclosure to a third party. Providing Customer data to a connected AI the Customer has connected, at that connected AI's request, is done on the Customer's instructions and is governed by the next section.
5. Processors and providers located abroad
To provide the Service, we entrust the handling of information to the following providers.
| Google LLC (Firebase and Google Cloud) | United States. Data is stored mainly in the Tokyo region (asia-northeast1). | Cloud infrastructure, authentication, database, file storage, push notifications |
|---|---|---|
| Anthropic, PBC | United States | Generating the AI assistant's replies. What is sent is the Member's input and the part of the Customer data needed for the reply. Under our agreement, this is not used to train AI models. Reading the documents a Customer provides to import its data. In that case the whole content of a document may be sent. |
| LY Corporation | Japan | Receiving the messages of linked LINE groups through the LINE official account and the Messaging API |
| Stripe (Stripe Japan K.K. and Stripe, Inc.) | Japan and United States | Issuing invoices, processing payments, customer portal |
| Algolia, Inc. | United States | Searching KRFT's registered venues when a Customer links a client to one |
| Google LLC (Google Maps Platform) | United States | Locating delivery addresses and building delivery routes |
| Brevo (Sendinblue SAS) | France (European Union). Data is stored mainly within the European Union. | Sending email. When an invoice is sent to a client, we send the recipient's email address, the Customer's name as the sender name, the Customer's billing email address as the reply-to address, the subject and body, and the attached invoice PDF. Our billing and usage notices to the Customer are sent to the Customer's billing email address. |
Where the Service offers an integration with a shipping carrier, we pass the details needed for the delivery (the recipient's name, address and telephone number) to that carrier.
Where the Customer connects a connected AI to the Service, the connected AI reads Customer data, prepares proposals and sends confirmations within the rights of the Member who authorised the connection. At a connected AI's request, we provide it only the Customer data that request needs. The Customer data a connected AI reads is processed by its provider under the contract between the Customer and that provider. The provider of a connected AI, even where it is one of the providers listed in this section, is not our processor for what it does as a connected AI, and we are not responsible for that processing.
A connection stops working when the Member who authorised it no longer has access to the Service, and expires after 90 days without use. To have a connection revoked, contact us at the address in section 11.
Before entrusting processing to a provider located in the United States, we confirm by contract that the provider has put in place measures meeting the standards laid down under the Japanese Act on the Protection of Personal Information. Information about the personal data protection regime of the United States is published on the website of the Personal Information Protection Commission of Japan.
Entrusting processing to a provider located in a member state of the European Union is a transfer to a country that the Personal Information Protection Commission of Japan has designated as having a personal data protection regime of a standard equivalent to Japan's.
6. Retention
We keep the information we collect for the duration of the subscription and for 12 months after it ends, after which we delete it unless the law requires us to keep it.
The technical event records created when a linked LINE group's messages are received have their text erased once processed and are deleted within 30 days. Messages brought into the Service are kept as part of the Customer data for the period stated above.
Getting-started guide usage records are kept for 400 days from the day they are recorded, then deleted. The same applies where the subscription ends or the Member's account is deleted.
Invoicing and payment records are kept for the period the law requires.
7. Security
To prevent the leakage, loss or damage of the information we handle, we take the following measures.
- Encryption of data in transit and at rest, through the standard features of our cloud infrastructure.
- Separation of each Customer's data, role-based access control, and a design in which records are written only by server-side processing.
- Retention of an audit trail of activity.
- Careful selection of processors and supervision by contract.
- Restricting the people at Spring Theories who can access the information.
8. Cookies and analytics
The website ops.krft.world uses no third-party analytics or advertising tools. It stores your choice of display language in your browser, in a cookie and in the browser's storage. The web app also stores there your sign-in state, the selected Customer, a reference to the current conversation with the AI assistant and your display settings.
To protect the Service from misuse, the pages where you sign in with a KRFT account (the sign-up page, the page that authorises a connected AI, and the web app) use Google reCAPTCHA, which may set its own cookies and collect information about your browser and device. Google's privacy policy and terms of service apply to that processing.
The demo page (ops.krft.world/demo) sends us nothing by default. Only if you tick the box provided for this does it send us the start of the demo, each step completed, its end and the opening of the sign-up page, with the page's display language. We count these per day. The counts contain no identifier, no IP address and no information about your browser, and are kept for 400 days. You can untick the box at any time.
The Service's applications carry no advertising tracking. They collect the technical logs needed for operation and, like the web app, the getting-started guide usage records described in section 2.
9. Requests for disclosure, correction or suspension of use
A Member who wishes to request the disclosure, correction, addition, deletion or suspension of use of their own information, or the suspension of its disclosure to third parties, may contact us at the address in section 11. We respond in accordance with the law after verifying the requester's identity.
For information we handle on behalf of a Customer (the Customer's client records, LINE group messages, the documents it provided to import its data and the like), please contact that Customer (the brewery or producer). We act on the Customer's instructions.
10. Changes to this policy
We may change this policy. The changed policy applies from the time it is posted in the Service or on our website. We notify Customers of material changes in the Service or by email.
11. Contact
Enquiries about this policy and about how information is handled in the Service may be sent to:
Spring Theories G.K.
Nishi-Shinjuku Mizuma Building 6F, 3-3-13 Nishi-Shinjuku, Shinjuku-ku, Tokyo 160-0023, Japan
Version 2026-09: effective 15 September 2026
Version 2026-10: effective 3 October 2026
Version 2026-11: effective 5 October 2026
Version 2026-12: effective 16 October 2026