Shami Ittai

Shami Ittai Privacy Policy

Effective date: 2026-08-31

Last updated: 2026-08-31

This English text is a reference translation provided for convenience. The Japanese version is the authoritative original; in the event of any discrepancy between the two, the Japanese version prevails.

Takumi Nishimura (trading as ondo) (the "Provider") sets out this Privacy Policy (the "Policy") regarding the handling of users' personal information and other data in "Shami Ittai" (the "Service"), a shamisen score digitization and practice-support service.

1. Information We Collect

  • Account information: email address, authentication information (including identifiers provided by third-party sign-in services), display name, and profile settings
  • User Content: score photos and PDFs uploaded by the User, score data created within the Service, audio and video recordings, annotations, and practice records
  • Subscription and billing information: plan status, billing period, and subscription identifiers issued by the billing platform. We do not collect or retain credit card numbers or other payment credentials (see Section 4).
  • Usage and device information: access logs, IP address, browser/OS/device information, operation logs, error logs, and information collected via cookies and similar technologies
  • Inquiries: the name, email address, and content of any inquiry sent to us

2. Purposes of Use

  1. Providing and maintaining the Service (score digitization, score creation and editing, practice-support features, sharing, cloud synchronization and storage)
  2. Performing AI Recognition (from photos and PDFs) and automatic transcription (from audio and video recordings), including the transfers described in Section 3
  3. Managing accounts, verifying identity, and managing subscription status and usage credits
  4. Billing and synchronizing subscription status with billing platforms
  5. Responding to inquiries and sending necessary or important notices
  6. Detecting and preventing misuse and maintaining the security of the Service
  7. Investigating incidents, improving quality, and developing new features (performed statistically, in a form that does not identify individuals)
  8. Complying with applicable law

We do not use personal information beyond these purposes. If the purposes change, we will update this Policy and notify or publicly announce the change.

3. External Transmission for AI Recognition and Automatic Transcription, Including Transfer Overseas (United States) — Important

The "AI Recognition" feature (digitizing score photos and PDFs) and the "automatic transcription" feature (generating scores from audio and video recordings) are processed using the Provider's processing server and external AI providers. When you use these features, your content is transmitted outside the Provider's application servers as follows.

  1. Information transmitted. Depending on the feature, one or more of the following. Account email addresses, names, display names, and other account information are not transmitted.
  • Score image or PDF data (when AI Recognition is used)
  • Audio data (when transcribing from an audio recording)
  • Video data (when transcribing from a video recording — this includes the video imagery, not only the sound)
  • Incidental information needed for processing (page numbers, tuning, reference pitch, tempo, etc.)
  1. Recipients. There are two categories:
  • A score-processing server operated by the Provider: operated by the Provider on Google Cloud Platform (Cloud Run) in a Japanese region. It is under the Provider's control and receives the above data in order to perform the processing. Depending on the processing required, that server may in turn transmit data to the external AI providers below.
  • External AI providers selected by the Provider: providers of generative-AI and machine-learning services used to analyze scores, audio, and video. The providers currently used are Google LLC (located in the United States) and Anthropic, PBC (located in the United States). The providers and models used may change, for example to improve recognition accuracy; this Policy will be updated if they do.
  1. Countries of processing. Processing by the external AI providers takes place on servers in the United States or other countries designated by those providers. Accordingly, the transmissions described in this Section include a transfer of personal data to third parties located overseas. For information on the personal data protection regime in the United States, please refer to the materials published by Japan's Personal Information Protection Commission. Handling by the recipients is governed by their respective API terms and privacy-related policies. The Provider endeavors to use these services under terms under which the transmitted data is not used to train the provider's models.
  2. Purpose. Limited to automated score recognition and transcription (reading notes, fingering positions, time signatures, and similar information from images, audio, or video and converting them into score data).
  3. By using AI Recognition or automatic transcription, the User consents to the transfer to third parties located overseas described in this Section. Users who do not wish for such a transfer can refrain from using these features and instead use manual entry in the bunkafu editor and other features. These features run only when the User explicitly requests them; stored scores, recordings, and videos are not transmitted automatically.
  4. Please avoid incidental capture of personal data (images). A score image alone is not usually personal information, but depending on how it is photographed it may incidentally include names written on the score, student rosters, a school's contact details, or the faces of nearby people. Please frame your photos, or mask unnecessary areas, so that neither your own nor any third party's name, facial image, or other personal information appears in images used for AI Recognition.
  5. Note on recordings (audio and video). Video used for automatic transcription may show the performer's face and appearance, the faces of others nearby, and the interior of the room, and audio may contain conversation and voices. Such data can constitute personal information. Before using automatic transcription, please check what has been captured; if unnecessary material is included, adjust the framing or use audio-only transcription. If a User transmits data in which a third party appears or whose voice is included, the User is deemed to have obtained that third party's necessary consent.

4. Payment Information

  1. Payments are processed through Apple Inc. (App Store in-app purchase), Google LLC (Google Play in-app purchase), RevenueCat, Inc. (Web Billing on the web), or Stripe, Inc. (credit card payments on the web), depending on the channel and the time of subscription. The web currently uses RevenueCat's Web Billing; for subscriptions taken out through Stripe in the past, Stripe remains the payment provider.
  2. Credit card numbers and other payment credentials are collected and managed directly by those companies; we do not collect or retain them.
  3. We receive subscription identifiers, plan type, billing period, and billing state from those companies in order to manage subscription status.
  4. Handling of information by each company is governed by that company's privacy policy.

5. Outsourcing

We may entrust the handling of personal information to external providers to the extent necessary to achieve the purposes of use. We select such providers carefully and supervise them appropriately. The main categories are:

  • Cloud infrastructure, database, file storage, and authentication (e.g., Supabase)
  • Application hosting and delivery (e.g., Vercel)
  • Hosting of the score-processing server (Google Cloud Platform (Cloud Run); operated by the Provider in a Japanese region)
  • AI processing for AI Recognition and automatic transcription (currently Google LLC and Anthropic, PBC; carried out as a transfer to third parties overseas with the User's consent, as described in Section 3)
  • Billing and subscription management (e.g., RevenueCat, Inc. and Stripe, Inc.)
  • Email delivery and inquiry handling

6. Provision to Third Parties

We do not provide personal information to third parties without the User's prior consent, except:

  1. where required by law;
  2. where necessary to protect a person's life, body, or property and it is difficult to obtain consent;
  3. where cooperation with a governmental body performing statutory duties is necessary and obtaining consent would impede those duties;
  4. where information is provided in connection with the outsourcing described in Section 5 (which is not a provision to a third party under Japan's Act on the Protection of Personal Information); or
  5. the transfer to third parties overseas for AI Recognition and automatic transcription described in Section 3 (carried out based on the User's consent).

We do not sell or provide User Content (scores, audio and video recordings, etc.) to third parties for advertising or marketing purposes, and we do not use User Content as training data for our own machine-learning models. Handling by the external AI providers is as described in Section 3.

7. Visibility Through Sharing Features

  1. If a User uses link-based score sharing, anyone who knows the link can view that score. The scope of sharing is controlled by the User, so please handle links with care. Sharing can be stopped at any time from within the Service.
  2. Information registered in the User's profile, such as the display name, may be shown to recipients of a share.

8. Retention and Deletion

  1. We retain information for the period necessary to achieve the purposes of use, under appropriate security controls.
  2. User Content and account information: retained while the account is active. Users may request deletion of individual content or of the account at any time, using features within the Service or by contacting us at Section 11.
  3. On account deletion: except where retention is legally required, we delete the User Content and personal information associated with the account immediately upon completion of the deletion process. Information remaining in backups is erased in the ordinary course as backup retention periods elapse.
  4. Access and error logs: these logs are recorded for misuse investigation, incident response, and operational monitoring, and are stored on the infrastructure of the cloud platform providers we use (hosting, database, and similar providers). Their retention period follows those platform providers' default retention policies (we do not operate our own automated deletion on a separately defined schedule for these logs). We do not use logs for purposes other than those set out in Section 2.
  5. Transaction records: retained for the period required by applicable law.

9. Security Measures

  • Organizational: access to personal information is limited to the minimum necessary persons, with arrangements to monitor how it is handled.
  • Technical: encryption in transit (TLS), access controls on stored data (including row-level access control in the database), appropriate management of credentials, and permission-based access restrictions.
  • Physical: data is stored in data centers of cloud providers that maintain appropriate security measures.
  • Awareness of the external environment: User information may be stored and processed on servers outside Japan, including in the United States. We take necessary and appropriate measures with an understanding of the data protection regimes of those countries.

10. Requests for Disclosure, Correction, or Suspension of Use

  1. Users may request notification of purposes of use, disclosure, correction, addition or deletion of content, suspension or erasure of use, or suspension of provision to third parties, in accordance with Japan's Act on the Protection of Personal Information.
  2. Requests should be sent by email to the contact in Section 11. After verifying the requester's identity, we will respond without delay in accordance with law.
  3. No fee is charged. Where we cannot comply under applicable law, we will explain the reason.

11. Contact

  • Provider: Takumi Nishimura (trading as ondo)
  • Person responsible for personal information: Takumi Nishimura
  • Email: hello@shami.jp

12. Cookies and Similar Technologies

  1. The Service uses cookies and similar technologies (such as local storage) to keep Users signed in, save settings, understand usage, and improve the Service.
  2. Users may disable cookies in their browser settings, but some features, such as staying signed in, may then become unavailable.

13. Changes to This Policy

We may amend this Policy due to changes in law, changes to the Service, or other reasons. For material changes, we will announce the content and the effective date by posting within the Service or by another appropriate means before the change takes effect. If we significantly change the purposes of use, or newly begin transferring information to a third party overseas, we will obtain Users' consent again.