Cotoa Talk & KeepLEGALCotoa Talk & KeepLEGALEffective: June 5, 2026 / Last revised: September 3, 2026 (authentication, confirmation/change emails, sign-in assistance, support submission, and the active mail service clarified) / Provider: CoreVista-Japan, Inc.
This is a reference English translation. The authoritative version is the Japanese text; if there is any discrepancy, the Japanese version prevails.
CoreVista-Japan, Inc. (the “Company”) sets out the handling of personal information in the voice interpretation and records service “Cotoa Talk & Keep” (the “Service”) as follows.
Audio is temporarily processed for translation, speech recognition, speech synthesis, or transcription and is not stored on the Company’s server beyond those processing purposes. The recording feature may temporarily hold unsent compressed audio on the user’s device to survive transmission failure or interruption. External providers may also temporarily process or retain data for abuse prevention, security, or incident response under their respective terms.
Audio or text processed by the Service may contain special-care-required personal information such as health, medical, disability, welfare, living circumstances, or consultation content. The user understands this possibility and uses the Service with consent. When processing audio containing such information of a counterpart or third party, the user shall explain it to that person and obtain the necessary consent.
To the extent necessary to provide the Service, the Company may provide personal data to the following third parties located abroad.
OpenAI, L.L.C. (United States)
For speech recognition, translation, speech synthesis, and AI processing, audio, text, target information, and related technical information may be sent to its API. Under OpenAI’s published terms, inputs and outputs sent to business services such as the API are not used to train models unless the user or organization explicitly opts in. Under default settings, abuse-monitoring logs may be retained for up to 30 days, subject to legal and security exceptions. The Company applies safeguards appropriate to its applicable contract and configuration.
Stripe, Inc. (United States)
For credit-card payment, purchase history, payment processing, abuse prevention, and refunds/reconciliation, information needed for payment is handled. Card numbers and similar data are processed by Stripe and are not retained on the Company’s servers.
ElevenLabs, Inc. (United States)
Only when the user opts in to the voice-clone feature, the voice samples the user records, the voice characteristics (voiceprint) extracted from them, and the text used to generate translated speech are transmitted. When the user deletes the voice clone or the account, the Company deletes the voiceprint data stored with the provider.
Postmark (ActiveCampaign, LLC) (United States)
Only when Postmark is selected as the mail transport, the destination email address and message content are sent for email verification, registration completion, password reset/change completion, balance recovery, purchase/important notices, and support. The current production environment uses the Onamae.com Mail Service described below.
The United States does not have a comprehensive federal law equivalent to Japan’s Act on the Protection of Personal Information; personal information is regulated by sector-specific federal laws and state laws. The Company refers to information published by the Personal Information Protection Commission of Japan and the recipients’ published privacy policies, data-processing terms, and security documents, and provides users with necessary information.
The Company reviews recipients’ contract terms, security documents, data-processing terms, and privacy policies, and supervises them appropriately under the Act. The Company takes contractual, technical, and operational measures so that recipients do not use the data beyond the purpose of providing the Service.
The Company may outsource all or part of the handling of personal information for provision of the Service, payments, email delivery, server operation, maintenance, and inquiry handling, and supervises outsourcees appropriately under the Act.
The current production environment uses the Onamae.com Mail Service in Japan, provided by GMO Internet, Inc., to send confirmation, registration-completion, password-reset, password-change-completion, and related messages.
The Service may transmit: (1) audio/text to OpenAI for recognition, translation, and synthesis; (1-b) recorded audio and voiceprint data to ElevenLabs when the user consents to and uses the Clone Voice feature (kept until the user deletes the clone; deletion on our side is propagated to the provider); (2) payment-related information to Stripe; (2-b) authentication information (identifier, email, and email-verification state) exchanged with Google, Apple, or Discord when registering or signing in with an external account; (3) account keys, consent state, and settings stored on the device (localStorage, etc.); and (4) logs to the Company’s servers for incident response, abuse prevention, and usage-time management. These are used for providing the Service, payments, balance management, abuse prevention, and safety. If the Company newly introduces advertising, behavioral targeting, or external analytics tags, it will publish the recipient, the information transmitted, and the purpose in this Policy or a separate schedule.
The Service may store account keys, consent state, language, and display settings in localStorage or similar storage. The recording feature temporarily stores unsent compressed audio in IndexedDB, capped at 32 MiB in total and 24 hours from creation, and deletes it after successful upload. Old fragments are removed when the cap is exceeded; a “process later” recording stops when it reaches the cap. Audio files the user explicitly exports are outside this automatic deletion. On a shared device, please log out or clear browser data.
Except where required by law, where the person consents, where necessary for outsourcing, or where otherwise permitted by the Act, the Company does not provide personal information to third parties.
The Company takes necessary and appropriate measures—access control, encryption, log management, permission management, and outsourcee management—to prevent leakage, loss, damage, unauthorized access, and falsification of collected information.
In the call feature, participants’ audio is processed temporarily for translation and is not stored; utterance text and timestamps for live minutes are kept in server memory only during the call and deleted when the call ends. Call connection information (participants’ display names, selected languages, and connection state) is likewise kept only during the call and deleted when it ends. In the record feature, transcripts, imported content, generated documents, and intermediate data are stored on the server, linked to the account, only when the user performs a record/import/save operation (for interpretation/venue sessions, only when “Save” is selected at the end). Documents (summaries, reports, minutes) can be issued in 13 languages (Japanese, English, Chinese, Korean, Spanish, Portuguese, French, German, Italian, Russian, Vietnamese, Indonesian, and Hindi), up to 3 languages per issuance. Unsent recording audio is held under Section 7; an application update alone does not delete that temporary store. The user can delete stored records at any time, and account deletion erases them.
The Company retains personal information for the period necessary to achieve the purpose of use, the period required by law, or a period reasonably necessary for dispute response and abuse prevention, and deletes or anonymizes unnecessary information by reasonable means.
Users may request disclosure, correction, addition, deletion, suspension of use, erasure, or suspension of third-party provision of their own personal information held by the Company, in accordance with law. To request, contact the address below; identity verification information may be required.
Minors must use the Service with the consent of a parent or legal representative.
The Company may revise this Policy in response to legal amendments, changes to the Service, changes to recipients, or operational needs. For material revisions, notice is given via display within the Service or other reasonable means.
The help bot on the sign-in screen displays only pre-approved fixed guidance about sign-in and registration on the user’s device. It does not send questions to generative AI or provide speculative answers. Only when the user presses “Send to Cotoa support” are the entered reply email, message, category, and necessary technical information sent to the Company’s support desk.
CoreVista-Japan, Inc.
Personal Information Protection Manager: Taketoshi Nakao
Email: support_cotoa@corevista-japan.com
Terms ・ Specified Commercial Transactions ・ Back to the Service