Before you use the service
Read the Terms of Use and Privacy Policy before registering or using the service. See the relevant pages for sales and usage conditions.
English translation of document version public-20261106-01. Translation edition: November 7, 2026. The source document dates below are retained.
- Last updated
- November 5, 2026
- Effective from
- November 6, 2026 (from the start of beta registration)
- Document version
- public-20261106-01
1. Provider and scope
The service provider for ShortMVStudio appropriately manages personal information handled in providing the Service under Japan's Act on the Protection of Personal Information and other applicable laws. This policy applies to the official website, accounts, Windows app authentication and entitlement verification, inquiries and related activities. Contact details appear in the commercial transaction disclosures.
2. Information collected and purposes
| Information category | Main contents | Purpose |
|---|---|---|
| Account | Email address, user ID, email confirmation status, authentication and session information | Registration, identity verification, sign-in, recovery and misuse prevention |
| Registration consent | Account ID, agreed document version, hashes of the Terms and Privacy Policy texts, and server-recorded consent time | Confirming consent, managing registration procedures and response history |
| Entitlements | Plan, period, VMD SHA-256 hash, registration quota and renewal history | Entitlement verification, duplicate registration prevention and credit management |
| Subscriptions & payments | Payment provider customer, subscription and invoice IDs; price, currency, payment and cancellation status | Recurring billing, entitlement updates, refunds, accounting and dispute handling |
| Communications & security | IP address, access time, browser information, error and processing logs | Providing communications, investigating faults and preventing unauthorized access |
| Inquiries | Contact details, message, voluntarily supplied attachments and response history | Responding to inquiries and investigating infringement or defects |
| Report a problem | Report type, affected item, what happened and receipt number; optional version, environment, steps, expected behavior, supporting URLs and contact email | Reviewing reports, investigating defects, improving instructions and necessary follow-up or replies |
| Requests for seller information | Buyer or prospective buyer name, address, phone number, order number (or confirmation of no purchase), reason for disclosure, reply email and response history | Reviewing requests, identity verification, replies and response records |
Passwords and authentication information entered at registration are managed through the authentication service. The Provider will never ask for your password or request that you email it. Card information is handled on the payment provider's screen; ShortMVStudio's application server does not store complete card numbers.
We do not sell collected personal information. Advertising emails are sent only with any legally required consent, separately from necessary registration, subscription and security notifications.
Report a problem is available without sign-in and an email address is optional. We receive only the environment information you enter; the form does not automatically collect or send local materials or logs. Images and videos are accepted through supporting URLs or email attachments, not direct form uploads.
3. Creative materials, projects and exported videos
In normal creation, VRM, VMD, audio, projects and exported videos are handled on your device. VMD quota registration sends a SHA-256 hash calculated from file contents and related information, not the VMD file itself. The hash is not the original file, but is managed as entitlement information linked to your account.
The Provider does not use imported materials for AI training or as inputs to generative AI for backgrounds. Materials separately supplied by users for defect investigation are handled within the explained purpose and scope.
Not sending local creative materials externally does not mean that account authentication, entitlement verification, billing, email delivery or website browsing involve no communications.
4. External services
| Service | Main handling | Purpose |
|---|---|---|
| Supabase | Accounts, authentication, entitlements, registration consent records, processing and security logs | Authentication, database, entitlement APIs and consent record management |
| Stripe | Information entered on payment screens, subscription, invoice and payment status | Payments, recurring billing, payment management and fraud prevention |
| Resend | Recipient email, confirmation and recovery emails, disclosure request and problem report notification text and receipt numbers, optional contact details, and delivery results | Email delivery for account confirmation, recovery, disclosure requests and problem report notifications |
| Cloudflare | Web communications, disclosure request and problem report form entries, delivery and security logs, and analytics when enabled | Website delivery, form reception, security and display performance aggregation |
| Google（Gmail） | Inquiry, disclosure request and problem report contact details, text, receipt numbers, voluntary attachments and response history | Receiving, managing and replying to inquiries, disclosure requests and problem report emails |
External services handle information only as needed for the purpose. When outsourcing handling, the Provider selects appropriate providers and supervises them through contracts and permission management. The provider's terms and privacy policy also apply where it handles information for its own purposes, including payment services.
Report a problem entries pass through Cloudflare's website reception processing and are emailed through Resend to the Provider's Gmail contact point. An optional email address is used as the reply-to address. Without an email address, the report text and receipt number still use the same delivery route.
5. Handling outside Japan
External service arrangements may involve processing in countries or regions outside Japan. The database storage region may differ from maintenance, email, payment or log processing regions. Subprocessors and processing regions may also change.
Where a transfer constitutes provision of personal data to a third party overseas, we confirm consent or another lawful basis. When using arrangements that continuously ensure equivalent measures, we perform necessary checks and information provision. Where relying on consent, we separately provide legally required information on the destination country, its system and protective measures.
6. Browser storage and analytics
To maintain sign-in across pages, reloads, tabs and returns from payment screens, the website stores authentication session information such as access and refresh tokens in same-site browser storage (localStorage), updating it as needed. This storage process does not save the password itself. Other browsers, profiles and first-time Windows app sign-in are separate.
Explicit sign-out or completion of password reset removes the ordinary web sign-in information stored for that site and browser. Confirmed invalidation by the authentication service also requires signing in again. Deleting site storage through your browser may require another sign-in or restarting a procedure.
Email confirmation and password recovery temporarily store process state and PKCE verification information in the browser so the process can finish in the same browser. Recovery sessions are separate from ordinary web sign-in. Disabling browser storage may prevent persistent sign-in, email confirmation or recovery.
When enabled, the public website uses Cloudflare Web Analytics to aggregate display performance and browsing trends. Cloudflare states that this service does not track people across websites. This analytics script is not loaded on authentication, recovery or payment account screens, disclosure request forms or problem report forms.
External payment pages and similar services may use their own cookies or storage. See the respective provider's explanation.
7. Third-party disclosure
Except where permitted by law, we do not provide personal data to third parties without consent. Outsourcing, business succession and other cases not legally classified as third-party provision are also handled appropriately within the necessary scope. Overseas third-party provision follows the law, including the preceding procedures.
8. Retention and deletion
We retain information for as long as needed to fulfill purposes and contracts, meet statutory retention duties, and handle misuse, refunds or disputes. Unneeded information is appropriately deleted or made nonidentifying.
While the account exists, registration consent records retain the version and contents agreed at registration. Later account changes do not rewrite past consent, and merely revising documents does not record consent to the new version. Current consent records are linked to the account and deleted with it. Backup information follows the retention cycle below.
Accounting, billing or incident records may be retained as necessary after account deletion. Backup information is restricted to recovery purposes and deleted or updated according to its retention cycle. It may not disappear immediately from every backup.
9. Security safeguards
We take necessary and appropriate measures against unauthorized access, leakage, loss and damage through authentication, separation of permissions, access controls, secret management and change records. Measures are reviewed according to actual handling, including providers.
If an incident such as a leak occurs, we prevent further harm, investigate causes and prevent recurrence, and report to authorities or notify affected people as required by law. We answer inquiries about the outline of safeguards to the extent that doing so does not harm operations or security.
10. Requests for disclosure, correction or suspension of use
Under applicable law, individuals may request notice of purposes, disclosure, correction, addition, deletion, suspension of use, erasure, cessation of third-party provision or disclosure of provision records for retained personal data. Contact support, including for account deletion.
We verify identity and respond without delay in accordance with law. If we cannot fulfill part of a request, we explain why. We do not request more identity information than necessary. Any required fee and amount are explained before application.
11. Contact and revisions
For privacy inquiries or requests, contact ShortMVStudio@gmail.com. The same contact point accepts general inquiries and Operator consultations.
Revisions to this policy and their effective dates are announced on the official website or similar channels. We obtain consent for changes that legally require it.