Privacy Policy
Last updated: 2026-05-07
1. Scope
This Privacy Policy applies to the use of Bismo (all services under bismo.ai and mcp.bismo.ai, including the Web app, MCP server, and API) operated by Nihonbashi AI Lab.
2. Information we collect
● Account information: email, display name, and profile image obtained via Google OAuth ● Usage logs: access timestamps, IP addresses, User-Agent strings, and request paths ● MCP grant history: scopes / client_id / revocation timestamps for AI agents authorized via OAuth (mcp_client_permissions table) ● Subscription information: tier data obtained via Stripe (only after billing goes live; card numbers are held by Stripe and never visible to Bismo) ● Anonymous workspace UUID: stored in localStorage to associate workspaces during unauthenticated use ● No retention of search query content: We do not persist the search arguments you send via MCP / API / Web (company names, corporate numbers, subsidy keywords, product descriptions, etc.) in our database. Usage logs record only access timestamps, IP, User-Agent, and the endpoint name — never the query content itself. One exception: the table, the values you fill in, and the lookup results you submit as a case are stored so that you can resume, review, and export that case (see section 5). ● Search demand signals (aggregate only): For service improvement we retain only non-identifying aggregate signals (industry / region / HS chapter / law type / daily search-count bucket). No workspace identifier, timestamp, or raw query is included.
3. Purposes of use
● Providing and improving the service ● Analyzing usage (aggregate data only, no personal identification) ● Billing and subscription management ● Detecting and responding to misuse ● Compliance with laws and dispute response
4. Processors and third-party recipients
We do not provide personal information to third parties as a rule. The following processors receive information to the extent necessary to deliver the service. 1. Supabase, Inc. (Delaware, USA; data hosted in AWS ap-northeast-1 region) — Postgres DB / Auth (JWT & session cookies) / Edge Functions / Storage / Custom Domain (mcp.bismo.ai) 2. Lovable AB (Stockholm, Sweden) — Web frontend (bismo.ai) hosting, build delivery, Publish platform 3. Cloudflare, Inc. (California, USA) — CDN / edge / TLS / DDoS protection (sub-processor of Lovable AB) 4. Google LLC (California, USA) — Google OAuth (sign-in) / Vertex AI Gemini (AI inference) / Vertex AI Search (grounding) / Google Fonts (fonts.googleapis.com; IP and User-Agent are sent to Google) 5. Stripe, Inc. (Delaware, USA) — Payment processing (currently being prepared; once billing goes live, customer / card / billing address data will be sent) 6. Anthropic, PBC (California, USA) — Relays user queries / tool calls when accessed via the Claude.ai Custom Connector 7. GMO Internet Group, Inc. (Onamae.com, Japan) — DNS Each processor maintains information management standards equivalent to or higher than ours, and contracts limit the scope of use.
5. Special provisions for MCP connections
When an AI agent (Claude.ai / Claude Desktop, etc.) connects via OAuth 2.1 + PKCE, we retain the following: ● client_id: AI agent identifier (issued via Dynamic Client Registration) ● The kind of permission granted (reading public data / paid AI lookups and case actions) ● Grant and revocation timestamps [Available via MCP] ● Reading public data: data retrieved from public APIs (gBizINFO / J-Grants / National Tax Agency / e-Stat / government procurement / tariff rates, etc.), each with its source. No subscription required. ● Paid AI lookups and case actions: running lookups that involve AI inference, and creating, reviewing, resolving, and receiving your cases. Available on the Standard and Enterprise (paid) plans. Results are reference material, not determinations, so use them with cite_required = true / requires_expert_verification = true under expert review. [Not available via MCP] ● Reports generated and stored inside the web app (company research, advisory reports, etc.) are never exposed via MCP. They are accessible only inside the web app for subscribers. ● Your cases and their exports, by contrast, are available both in the web app and via MCP. [How your input is handled] ● Search arguments for public data (company names, corporate numbers, keywords, etc.) are used only to execute the search and are not persisted in our database. Execution routes through public APIs (gBizINFO / J-Grants, etc.) and the connecting AI platform, but nothing is retained on the Bismo side. ● Input for a one-off AI lookup (product descriptions, etc.) is not persisted on our side after the response is generated (usage records hold only metadata such as token counts and cost). ● When you use the case tools, the table you hand over, the values you fill in, and the lookup results are stored as your case, so that you can resume, review, and export it. A stored case is visible only from your own workspace. ● The text you enter for a lookup (product description, materials, intended use, and so on) is sent to an external AI provider (listed in section 4 of this policy) in order to produce the candidates. ● Audit logs record only the workspace identifier, event type, count, and status — never the query content (company name, keyword, product description) or URLs.
6. Cookies, localStorage, and external resources
● Authentication session: Supabase Auth session token ● Anonymous workspace UUID: temporary workspace association for unauthenticated use ● i18n language preference: ja / en selection ● Google Fonts (fonts.googleapis.com / fonts.gstatic.com): loaded externally from index.html to deliver fonts; IP address and User-Agent are sent to Google LLC We do not use third-party tracking cookies. We do not perform retargeting for ad delivery.
7. Safety management measures
● All traffic is encrypted with TLS 1.2 or higher ● Database access is controlled with Supabase RLS (Row Level Security) ● OAuth complies with OAuth 2.1 + PKCE + Resource Indicators ● Billing is processed via Stripe (PCI DSS Level 1) once live; we never store card numbers ● Our infrastructure provider Supabase holds SOC 2 Type II certification (this is the subprocessor's certification, not a third-party audit of Bismo itself; Bismo's own audit is under consideration as future work)
8. User rights
● Disclosure / correction / deletion / suspension of use: accepted via the contact channel ● Deletion of cookies and localStorage: can be performed in your browser settings ● Revocation of MCP grants: can be performed immediately at /account/mcp-grants ● Account deletion: accepted via the contact channel (related data is deleted within 30 days)
9. Consent to cross-border data transfer
By using this service, the user is deemed to have consented to the following cross-border third-party transfers (Article 28 of the Act on the Protection of Personal Information). ● USA: Supabase Inc. / Cloudflare Inc. / Google LLC / Stripe Inc. / Anthropic PBC ● Sweden: Lovable AB We use these processors only within the scope where, to our verification, their jurisdictions provide personal information protection equivalent to or higher than that of Japan. Please refer to each provider's official site for the detailed protection level and Privacy Policy.
10. Contact
Nihonbashi AI Lab Email: info@kokai.ai This Policy may be revised without prior notice. Material changes will be announced on bismo.ai.