This Privacy Policy describes how Marsh Harbor Deck Co., Ltd. collects, uses, stores, and protects your personal information when you use our website, applications, and services. We are committed to your privacy. We do not sell, rent, or trade your personal data to third parties for any purpose.
Marsh Harbor Deck Co., Ltd. ("Marsh Harbor Deck," "we," "us," or "our") is a technology company incorporated under the laws of Japan, with its principal place of business at 6-10-11 Jingumae, Shibuya-ku, Tokyo 150-0001, Japan. We operate an AI companionship platform accessible at marshharbordeck.com and through our mobile and desktop applications (collectively, the "Service").
This Privacy Policy applies to all users of the Service, regardless of their country of residence. It governs the collection, use, processing, storage, and transfer of personal information we receive from you when you visit our website, create an account, subscribe to a plan, interact with our AI companions, or communicate with our support team.
By using our Service, you acknowledge that you have read and understood this Privacy Policy and consent to the data practices described herein. If you do not agree with any aspect of this Policy, please discontinue use of the Service and contact us at hello@marshharbordeck.com to request deletion of any data we hold about you.
This Policy should be read in conjunction with our Terms of Service, which govern your use of the Service generally. In the event of any conflict between this Policy and the Terms of Service with respect to data privacy, this Policy shall prevail.
We collect several categories of information in connection with your use of the Service. We collect only the information that is necessary to provide, maintain, improve, and secure the Service.
We use the information we collect for the following purposes, each of which has a corresponding lawful basis under applicable data protection law:
We do not use your personal conversation content to train our AI models without your explicit, opt-in consent. Model training data programs are voluntary, clearly labeled, and can be opted out of at any time from your account settings.
The security of your personal information is of paramount importance to Marsh Harbor Deck. We implement industry-leading technical and organizational measures to protect your data against unauthorized access, disclosure, alteration, and destruction.
All data transmitted between your device and our servers is encrypted using TLS 1.3, the current industry standard for transport layer security. All data stored on our servers — including conversation content, memory data, and account information — is encrypted at rest using 256-bit AES (Advanced Encryption Standard) encryption. Encryption keys are stored separately from data in a dedicated key management service (KMS) with hardware security module (HSM) backing.
Voice data, where applicable, is encrypted end-to-end during transmission and stored in encrypted form. Marsh Harbor Deck employees cannot access the plaintext content of your voice recordings without your explicit permission.
Our infrastructure is hosted in ISO 27001-certified data centers located in Japan and the European Union. We maintain SOC 2 Type II certification, which is independently audited annually. Our security practices include role-based access control (RBAC), comprehensive audit logging, regular penetration testing by independent security firms, automated vulnerability scanning, and a formal incident response plan.
As a Japanese corporation, Marsh Harbor Deck operates in full compliance with the Act on the Protection of Personal Information (APPI) of Japan, including the 2022 amendments that strengthened data subject rights and introduced mandatory breach notification requirements. Our data processing practices have been reviewed and approved by our Japanese legal counsel, and we maintain a registered Personal Information Protection Manager as required by law.
In the event of a personal data breach that is likely to result in a high risk to your rights and freedoms, we will notify you and the relevant supervisory authorities without undue delay, and in any event within 72 hours of becoming aware of the breach, as required by GDPR Article 33 and applicable Japanese law.
Marsh Harbor Deck does not sell, rent, trade, or otherwise transfer your personal information to third parties for their marketing or commercial purposes. This is a foundational commitment, not merely a current policy choice.
We share your information only in the following limited circumstances:
We use cookies and similar tracking technologies to operate the Service, remember your preferences, and understand how you use our platform. You have meaningful control over these technologies.
We do not use advertising cookies, retargeting pixels, or any tracking technology designed to build profiles for commercial advertising purposes. You can manage cookie preferences at any time through the Cookie Settings link in the footer of our website.
Depending on your country of residence, you have a range of rights regarding your personal information. Marsh Harbor Deck honors these rights for all users globally, not merely those in jurisdictions that legally require it.
To exercise any of these rights, please contact us at hello@marshharbordeck.com with the subject line "Privacy Rights Request." We will respond within 30 days (or within 45 days where legally permitted). You may also access, export, and delete most data directly from your account settings under the "Privacy & Data" section.
Marsh Harbor Deck's Service is intended solely for individuals who are 18 years of age or older. We do not knowingly collect, use, or store personal information from individuals under the age of 18.
During the registration process, users are required to confirm that they are 18 or older. We use a combination of self-certification, payment card verification (which itself requires cardholder age verification), and, in certain jurisdictions, additional age verification mechanisms to enforce this requirement.
If we become aware that we have inadvertently collected personal information from a person under the age of 18, we will take immediate steps to delete that information from our systems and terminate the associated account. If you believe we may have collected data from a minor, please contact us immediately at hello@marshharbordeck.com.
Parents and guardians who have concerns about their child's potential use of the Service are encouraged to contact us. We take the protection of minors extremely seriously and will cooperate fully with parental requests.
Marsh Harbor Deck is headquartered in Tokyo, Japan, and our primary data processing occurs within Japan and the European Union. If you access our Service from outside these regions, your personal information may be transferred to, stored in, and processed in Japan or the EU.
For transfers of personal data from the European Economic Area (EEA) to Japan, we rely on the European Commission's adequacy decision for Japan (adopted in January 2019), which confirms that Japan provides an adequate level of data protection. For transfers to other countries, we use Standard Contractual Clauses (SCCs) as approved by the European Commission.
For transfers of data from the United Kingdom, we rely on the UK-Japan Digital Economy Agreement and applicable UK GDPR transfer mechanisms. For users in California and other US states, transfers are governed by our compliance with CCPA and applicable state privacy laws.
Regardless of where your data is transferred, we apply the same privacy standards described in this Policy. All international transfers are subject to binding legal agreements that require recipient parties to protect your data in accordance with these standards.
We retain your personal information only for as long as necessary to fulfill the purposes for which it was collected, comply with our legal obligations, resolve disputes, and enforce our agreements.
Marsh Harbor Deck integrates with a small number of carefully selected third-party services to operate the platform. Each of these providers has been evaluated for their data security and privacy practices, and all are bound by Data Processing Agreements.
The Marsh Harbor Deck Service may contain links to third-party websites or services that are not operated by us. This Privacy Policy does not apply to those third-party services. We encourage you to review the privacy policies of any third-party services you access through our platform.
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make changes, we will update the "Last updated" date at the top of this Policy and, where the changes are material, take additional steps to notify you.
For material changes — those that significantly affect how we use your personal information or your rights with respect to that information — we will:
Your continued use of the Service after any non-material update to this Policy will constitute your acceptance of the updated terms. If you do not agree with an updated Policy, you may close your account and request deletion of your data at any time.
We maintain an archive of previous versions of this Privacy Policy on our website. You may contact us at any time to request a copy of a previous version.
If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please do not hesitate to contact us. We are committed to resolving privacy inquiries promptly and transparently.
If you are an EU/EEA resident and are not satisfied with our response to a privacy inquiry, you have the right to lodge a complaint with your local supervisory authority. A list of EU data protection authorities is available at edpb.europa.eu. For Japanese data protection matters, you may contact the Personal Information Protection Commission (PPC) at ppc.go.jp.
We are committed to working cooperatively with supervisory authorities and to complying with any advice or direction given by such authorities in relation to data that is processed outside of applicable legislation.
Our team is dedicated to answering your privacy questions honestly and completely. Reach out anytime — we respond to all privacy inquiries within 2 business days.
Contact Our Privacy Team