PRIVACY POLICY

Last Updated: August 3, 2026

We at Kotoba Technologies, Inc. (“Kotoba,” “we,” “us,” or “our”) have created this privacy policy (this “Privacy Policy”) because we understand that you care about how your information is collected, used, and shared. This Privacy Policy describes how we collect and use personal information in connection with our website located at https://site.kotoba.tech, our mobile application, and the related voice translation services, features, and functionality made available through them (collectively, the "Services"), and when you otherwise interact with us.

This Privacy Policy is incorporated by reference into our Terms of Service, available at Terms of Service. By accessing or using the Services, you acknowledge that you have read and understand this Privacy Policy.

If you are a resident of California, you may have additional rights described in Sections V and VI below.

1. Information We Collect and How We Use It

We collect the following information about you, either because you provide it to us, it is necessary to provide our services, or because it helps us improve and secure the Website. We do not use audio data to identify individuals or authenticate users. However, we may process and store voice-derived data associated with your account solely to generate translated speech in your voice.

1. Your Information That You Provide Us. We collect personal information that you voluntarily provide through our Services, over phone, through written or e-mail correspondence, or other electronic communications to provide you with the services and products you request, notify you about changes to the Services, and fulfill contractual obligations. This information includes the following types of personal information and is used for the purposes described below.

• Identifiers; Contact Information. We collect information by which you may be personally identified, such as your name and email address, including when you choose to authenticate through third-party login services (such as Google or Apple). We use this information to create and manage your account, authenticate your access to the Services, communicate with you regarding your account or the Services, provide customer support, process subscription-related matters through third-party providers, and fulfill contractual and legal obligations.
• Audio, Electronic, or Similar Information. We collect audio recordings or raw audio when you choose to use features that involve audio input. For purposes of this Privacy Policy, “Raw Audio Data” means the audio input or audio recording submitted through the Services before it is converted into text, translation, summary, or other output. “Audio-Derived Text/Data Outputs” means text or data outputs generated from Raw Audio Data, including transcripts, translated text, summaries, and other generated text or data outputs. “Audio Outputs” means translated or generated speech/audio outputs created for playback through the Services.
  • For enterprise customers: Raw Audio Data is processed only to provide voice translation services and generate Audio-Derived Text/Data Outputs and Audio Outputs and is not used for model training. Where third-party AI processing providers are used to process Raw Audio Data for enterprise customers, we configure and contract with those providers so that Raw Audio Data is processed only to provide the requested transcription, translation, or related service and is not used for model training, subject to the applicable data retention controls and limitations under our agreements with those providers. Audio-Derived Text/Data Outputs for enterprise customers are used to provide the Services and for troubleshooting, and are not used for model training, analytics, or general service functionality or accuracy improvement. Audio Outputs are generated and played back in real time and are not retained.
  • For non-enterprise users: For non-enterprise paid users who have opted out of data/model improvement use, Audio-Derived Text/Data Outputs are used to provide the Services and for troubleshooting, and are not used for model training, analytics, or general service functionality or accuracy improvement. For those users, Raw Audio Data collected after the opt-out is not used for model training. For non-enterprise paid users who have not opted out of data/model improvement use, and for free users, we may use Raw Audio Data and Audio-Derived Text/Data Outputs to provide the Services, conduct quality assurance, troubleshoot, improve service functionality and accuracy, perform analytics, and support ongoing training of our machine learning models to improve translation accuracy and related speech processing functionality. As applicable, for model-training purposes, we may disclose Raw Audio Data and Audio-Derived Text/Data Outputs to our affiliates and service providers that process personal information on our behalf. Before using such data for model training, we de-identify the data by removing or transforming personal identifiers, including user ID, device ID, precise geolocation, and timestamps. While we may use user or account-level information for eligibility verification and quality control purposes, we do not train models to target or personalize outputs to specific individuals.
• Sensitive Personal Information. We do not intentionally collect sensitive personal information as defined under applicable law unless such information is incidentally included in audio recordings that you voluntarily submit. If incidentally collected, such information is processed solely for the purpose of providing the requested translation services and is not used for any independent commercial purpose. We do not use sensitive personal information to infer characteristics about you unrelated to the Services.
• Commercial Information. Information relating to your subscription status, purchase history, or transaction confirmation received from third-party payment processors and subscription management providers. We do not directly collect or process payment card information.
• Communications Data. When you sign up for our services or request information, we collect details about your requests and inquiries. We use this information to deliver the products and services you requested and respond effectively to your communications.

2. Information You Provide Us About Others. If you submit or upload an audio recording, that recording may contain the personal information of third parties. This information may include the following categories of personal information under California law and is used for the purposes described above. You represent that you have obtained any necessary permissions or consents from individuals whose personal information, voice, or any other aspect of their likeness is included in submitted content.

• Audio, Electronic, or Similar Information. If audio recordings you submit contain personal information about third parties, such information will be processed in the same manner described above. For non-enterprise paid users who have not opted out of data/model improvement use, and free users, this may include use for service improvement and model training purposes.
• Identifiers; Contact Information. Names or other identifying information about third parties that may be included in the recording. We use this information to accurately process and translate the content submitted through the Services.
• Sensitive Personal Information. Sensitive personal information, if voluntarily included in the recording. If incidentally included, such information is processed solely to provide the requested translation services and is not used for any separate purpose. YOU ARE SOLELY RESPONSIBLE FOR ENSURING THAT YOU HAVE OBTAINED ALL NECESSARY PERMISSIONS AND CONSENTS FROM ANY INDIVIDUALS WHOSE PERSONAL INFORMATION, VOICE, OR OTHER ASPECTS OF THEIR LIKENESS MAY BE INCLUDED BEFORE PROVIDING SUCH INFORMATION TO US.

3. Information Collected Automatically. We automatically collect, either ourselves or through third-party providers, certain types of personal information when you visit, use, or navigate the Website. This information is generally considered Internet or Other Electronic Network Activity Information under California law and may also include certain Identifiers.

• Log and Usage Data. This includes device identifiers such as device ID and third-party identifiers including RevenueCat ID for non-enterprise users and AppsFlyer ID, as well as your Internet Protocol (IP) address. It also includes information about your interactions with the Website, such as pages viewed, referring URLs, date and time of visits, browser type, and other usage data collected through server logs and similar technologies. We may also derive general location information from your IP address. We collect this information from your browser and device through server logs and analytics tools when you interact with the Website. We use this information to operate and maintain the Website and Services, monitor performance and errors (including through tools such as Firebase and Sentry), analyze usage trends and engagement (including through analytics providers such as Apple Analytics, AppsFlyer, and RevenueCat for non-enterprise users, or others), enhance functionality, prevent fraud and abuse, and ensure the security and integrity of our systems. These third-party providers act as our service providers and process personal information on our behalf.
• Cookies and Similar Tracking Technologies. We, including through third-party providers such as Google Ads, Apple Search Ads and Meta Platforms, use cookies, software development kits (SDKs), and similar technologies to collect online identifiers and other information such as your IP address, browser type, device type, operating system, pages visited, links clicked, files requested, and other information about your interaction with the Website. We collect this information through cookies and similar tracking technologies placed on the Website by us and by third-party providers. We use this information to analyze Website traffic and usage patterns, measure and improve marketing campaigns, support Website functionality, enhance user experience, monitor system performance and errors, and maintain Website security.
  • You can learn more about how Google uses information collected through advertising technologies by visiting Google’s Privacy Policy at https://policies.google.com/privacy and Google’s Ads Settings at https://adssettings.google.com.

2. How We Share Your Information

We disclose your personal information with the following categories of third parties for the purposes described below. If you are a California resident, please visit Appendix I for a more detailed breakdown of how we disclose and share your information. We do not sell personal information for monetary compensation.

1. Vendors, consultants, and service providers. We may share personal information with third-party service providers that perform services on our behalf, such as Website hosting and maintenance, analytics and performance measurement, customer communications, email delivery, payment processing and subscription management, abuse prevention, security monitoring, and related technical support. We share personal information with these providers only as necessary to provide, operate, secure, troubleshoot, and support the Services, comply with legal obligations, and protect the rights, property, or safety of Kotoba, our users, or others.
2. AI processing providers. We may share personal information with third-party AI processing providers, including providers such as OpenAI and Google, to support AI processing, transcription, translation, speech generation, and related technical functionality. These providers may process audio inputs, transcripts, translations, outputs, and related technical or usage information as necessary to provide their services to us so that we can provide the Services, subject to the audio-specific limitations described in Section I.1.
3. Advertising Partners. We permit advertising partners, including platforms such as Google Ads, Apple Search Ads and Meta Platforms, as well as other similar advertising networks, to set cookies and similar tracking technologies on our Website and other online Services, as described in Section I.3. Through these technologies, such partners collect Internet or Other Electronic Network Activity Information (including identifiers such as IP address, device identifiers, and cookie identifiers) to show you Kotoba advertisements on other websites and applications based on your interactions with our Website. Under California law, this may constitute "sharing" of personal information for cross-context behavioral advertising. For information on how to opt out of such sharing, see Section IV.
4. Affiliates. We may disclose personal information to our affiliates, including KK Kotoba Technologies Japan, where they may provide services to us or process personal information on our behalf in connection with the Services, including for service delivery, customer support, security, troubleshooting, analytics, research and development, model training (where applicable), service improvement, and legal compliance.
5. We reserve the right to share your personal information in the future, subject to the terms of this policy, as follows:

• With government authorities, law enforcement agencies, our affiliates and subsidiaries, or our legal counsel to comply with any court order, law, or legal process, including to respond to any valid government or regulatory request;
• To enforce or apply our terms of use and other agreements, including for billing and collection purposes;
• If we believe disclosure is necessary or appropriate to protect the rights, property, or safety of Kotoba, our customers, or others; or
• To a buyer or other successor in the event of a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of Kotoba’s assets.

3. International Transfers

Personal information collected through the Services may be transferred to, stored, and processed in Japan, where our cloud infrastructure is located, and in other jurisdictions where we or our service providers operate. Personal information may be accessed by our Japanese affiliate for purposes of service delivery, customer support, and, for non-enterprise paid users who have not opted out of data/model improvement use, and free users, model training. By using the Services, you consent to such transfers.

4. Your Privacy Choices

1. Opting Out of Sharing Your Information. You may request to opt out of the sharing of your personal information with advertising partners for cross-context behavioral advertising purposes, including when such sharing involves the use of cookies or similar tracking technologies. To submit an opt-out request, you may (i) contact us as set forth in Section IX with “Opt-out” in the subject line where applicable or (ii) visit “Do Not Sell or Share My Personal Information” or on our mobile application, go to Settings in our mobile application and select “Opt-out”. Please note that this right may be required by law only for residents of California and certain other U.S. states.
2. Do Not Track Signals. Some web browsers transmit “Do Not Track” signals. At this time, Kotoba does not respond to Do Not Track signals or similar browser mechanisms.
3. Universal Opt Out Mechanisms. We recognize and honor opt-out preference signals, such as the Global Privacy Control (GPC), where required by applicable law, and treat such signals as a request to opt out of sale or sharing of personal information for the browser or device from which the signal is sent.
4. Opting Out of Model Training. By default, enterprise users are opted out from having their personal information used for model training. Non-enterprise paid users may opt out of having their personal information used for model training at any time through the in-app settings or by contacting us as set forth in Section IX. We will honor such requests on a going-forward basis. For non-enterprise users, de-identified or aggregated data, as well as learned patterns, model weights, or other improvements already incorporated into our models and systems, are not subject to deletion or opt-out.

5. California and Additional U.S. State Privacy Rights

This section summarizes certain privacy rights that may apply to residents of California and other U.S. states that have enacted comprehensive privacy laws. Additional disclosures specific to California residents, as required by the California Consumer Privacy Act (“CCPA”), as amended by the California Privacy Rights Act (“CPRA”), are provided in Section VI below.

Depending on your state of residence and subject to applicable law, you may have certain rights regarding our collection, use, disclosure, and sharing of your personal information. To request to exercise such rights, contact us as set forth in Section IX. Please be aware that these rights may be subject to limitations and exceptions and may vary based on your jurisdiction.

Subject to applicable law, these rights may include:

• The right to confirm whether we process your personal information and to access such personal information.
• The right to request correction of inaccuracies in your personal information.
• The right to request deletion of your personal information.
• The right to request a copy of certain personal information you have provided to us, where required by law.
• The right to opt out of certain types of processing, including processing for targeted advertising purposes, where applicable.
• The right to opt out of profiling or automated decision-making in furtherance of decisions that produce legal or similarly significant effects, where provided by law.
• The right to opt out of the sale or sharing of personal information, as defined under applicable law.
• The right, where provided by applicable law, to limit, opt out of, or otherwise control the use and disclosure of sensitive personal information or sensitive data, as defined under applicable law.
• The right to designate an authorized agent to submit a request on your behalf, where permitted by law.
• The right to appeal a decision regarding your privacy rights request, where required by applicable law.
• The right not to receive discriminatory treatment for exercising your privacy rights.

• Appeals Process. If we deny your privacy rights request in whole or in part, we will inform you of the reasons for our decision. You may appeal that decision by contacting us as set forth in Section IX with "Appeal" in the subject line. Please include a description of the request that was denied and the basis for your appeal. We will respond to your appeal within the timeframe required by applicable law (generally 45 to 60 days, depending on your jurisdiction). If your appeal is denied, we will provide information on how to contact your state Attorney General or other applicable regulatory authority, where required by law.
• Response Timeframes. We will respond to verifiable consumer requests within the timeframes required by applicable law. For California residents, we will confirm receipt of your request within 10 business days and provide a substantive response within 45 calendar days of receipt. If we require additional time, we will notify you of the extension and the reasons for it. In no event will we take longer than 90 calendar days to respond to a request. Response timeframes may vary for residents of other states in accordance with applicable law.

6. ADDITIONAL INFORMATION FOR CALIFORNIA RESIDENTS.

1. Under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA), we are required to disclose the categories of personal information we collected, disclosed, and sold or shared (as defined by California law) in the previous 12 months. Visit Appendix I for a table describing these practices.
2. Please note that we do not sell personal information as defined under the CCPA and CPRA. However, as described in Section II and Appendix I, we may share certain categories of personal information (Identifiers and Internet or Other Electronic Network Activity Information) with advertising partners for cross-context behavioral advertising purposes. You have the right to opt out of such sharing by submitting a request as described in Section IV.
3. Under California’s “Shine the Light” law (Cal. Civ. Code § 1798.83), California residents who provide us certain personal information are entitled to request and obtain from us, free of charge, information about the personal information (if any) we have shared with third parties for their own direct marketing use. Such requests may be made once per calendar year for information about any relevant third-party sharing in the prior calendar year. To submit a “Shine the Light” request, contact us as outlined in Section IX below, and include in your request a current California address and your attestation that you are a California resident. Please note, however, that we do not, nor have we in the past, shared any personal information with third parties for such purposes.

7. Children and Parents

We do not knowingly collect personal information from children under 13. If you are under 13, do not provide us with personal information. Parents and guardians should monitor their children’s online activity and instruct them not to share personal information without permission. If you believe a child under 13 has provided us with personal information, please contact us as described in Section IX so we can delete it. We do not have actual knowledge of selling or sharing personal information of consumers under 16. If we become aware that we have collected or shared such information, we will promptly delete it.

8. Other Important Information

1. Retention. We retain personal information only as long as reasonably necessary to fulfill the purposes for which it was collected, comply with legal obligations, and resolve disputes. The table below summarizes our retention practices:

2. External Links. The Services may contain links to other sites. We do not endorse or otherwise accept responsibility for the content or privacy policies of those sites.
3. Changes to this Policy. Kotoba reserves the right to modify this Privacy Policy at any time. Any changes will be posted on this page, and the “Last Updated” date at the top of the Policy will be revised accordingly. Your continued use of the Services after any changes are posted constitutes acceptance of the updated Policy.
4. Data Security. We maintain industry-standard encryption for all retained data, both in transit and at rest. To the extent audio recordings, Audio-Derived Text/Data Outputs, or other AI-generated outputs are retained, they are stored using encryption protocols designed to protect against unauthorized access. Audio Outputs are generated and played back in real time and are not retained. We implement technical and organizational measures to safeguard personal information, though no system can guarantee absolute security.

9. Contact Us.

If you have questions or comments about this Privacy Policy, or would like to request to exercise any applicable rights described herein, please contact us:

• By emailing us at: kotoba_product+privacy@kotoba.tech
• By using our web form: https://site.kotoba.tech/contact

Verification and Authorized Agents. Kotoba will verify requests by asking you to provide information sufficient to confirm your identity and match our records. To designate an authorized agent to submit a request on your behalf, you must provide written permission, verify your identity directly with us, or provide the authorized agent with a valid power of attorney, as permitted by applicable law.

Appendix I – Additional Information for California Residents

The table below reflects the categories of personal information collected and processed in the past 12 months and whether the information is disclosed for business purposes or “shared” for cross-context behavioral advertising under the CCPA/CPRA.