1. Introduction

This Privacy Policy explains how worXwap合同会社 (“worXwap,” “we,” “us,” or “our”) collects, uses, stores, and protects your personal information when you use the worXwap platform, including our website (worxwap.com), mobile applications, and all related services (the “Platform”).

We are the business operator (個人情報取扱事業者) responsible for your personal information under Japan’s Act on the Protection of Personal Information (APPI). Our identity and contact details are in Section 14.

2. Information We Collect

2.1 Information You Provide

• Account information: First name, last name, username, email address, and password when you create an account.
• Profile information: Profile picture, bio/description, skills you offer, skills you are looking for, country, and portfolio items.
• Deal page content: Service descriptions, images, and other content you upload to your deal pages.
• Swap data: Negotiation messages, agreed terms, uploaded deliverables, and reviews.
• Payment information: When you subscribe on the website, your card details are collected and processed directly by Stripe. We never receive or store your card number. We store only the identifiers Stripe returns to us (customer and subscription IDs), your subscription status, and the billing email you gave Stripe. When you subscribe in the iOS app, Apple processes the payment through the App Store; in the Android app, Google processes it through Google Play. Through RevenueCat we receive your subscription status and an app user ID, never your payment details.
• Communications: Messages you send to other users through the Platform, and messages you send to our support team.
• Calls: a record of each call — who called whom, when, for how long, whether it was audio or video, and whether it was answered. The sound and picture of a call are relayed live between the two of you through Amazon Chime and are not recorded or stored.
• Subtitles and transcripts (only if turned on): while live subtitles or transcripts are on for a call, the call’s speech is converted to text by Amazon Transcribe, and both people see that the call is being transcribed. If you turned transcripts on, your own words are saved as text so both people on the call can read them back afterwards.
• AI translation and summaries: translations of subtitles and saved transcripts, and call summaries you ask for, are produced with Anthropic’s Claude. Your words are only ever sent for this if you allowed it (“AI on my words”, asked before your first call, and changeable at any time on your profile under ⋮ → AI translation, or in the call settings). Summaries you ask for are kept for you.
• Voice recording and AI voice (only if you create one): a short reading you record in the app is sent to Cartesia, which checks that it is the reading and creates an AI voice of you. We do not keep the recording. When Voice Translation is on, the translated text of what you say on calls is sent to Cartesia to be spoken to the other person in your AI voice, always labelled as an AI voice. During a call, the other person’s device lets yours know when it is translating your words and when it is playing them in your AI voice, so you can see it happening; this signal contains no words and is not stored.
• Your call settings: your transcript, translation, Voice Translation and AI choices.
• Your language: the language you choose in the app, and the language your device or browser is set to. We store these only so that we can show the Platform to you in that language and send your notifications and emails in it, and we use them for nothing else.

2.2 Information Collected Automatically

• Content interaction counts: When you view or click a short, deal, or profile, we record that event together with your user ID so we can show creators how their content performs.
• IP address: Our infrastructure providers process your IP address as an unavoidable part of serving requests, and use it for security and abuse prevention. We do not maintain our own log of your browsing within the Platform.
• Approximate country at signup: If your browser does not tell us your region, the signup form asks a third-party geolocation service (ipapi.co, operated by Kloudend, Inc., United States) to suggest your country. Your IP address is sent to that service directly from your browser. We receive only a country code, and you can change it before submitting.

Push notification token: if you allow notifications in the iOS or Android app, we store the token that Apple (Apple Push Notification service) or Google (Firebase Cloud Messaging) issues for your device, only to send you notifications (including incoming calls). Apart from that token, we do not collect device identifiers, operating system, browser type, screen resolution, or session duration, and we do not track your activity across other websites.

2.3 Information From Google Sign-In

If you choose to sign in with Google, Google authenticates you and returns your name, email address, and profile picture URL, which we use to create your account. Google receives the fact that you signed in to worXwap, along with your IP address and browser information. Your Google profile picture is displayed directly from Google’s servers, so viewing a profile that uses one discloses the viewer’s IP address to Google.

2.4 AI Translation of What You Write

worXwap shows what members write in each reader’s own language. The translation is done automatically by AI.

• What is translated: public content — deal titles and descriptions, the titles and descriptions of shorts, profile bios and skills, and reviews and replies to reviews — and private content — messages, the terms in Deal Cards, notes added to Swaps, and the messages and descriptions sent with delivered work. Files, images, and videos are not translated.
• Who translates it: the text is sent to Anthropic, PBC (United States), whose AI model Claude produces the translation. Only the text to be translated is sent, and for a chat message the context it needs to be translated as meant: the recent messages of that conversation, the skills on both people’s profiles, and in a Swap the titles of the deals being swapped. Each person’s messages, and titles only the two people can see, go only if that person has allowed AI translation; skills and the titles of public listings go unless that person has declined it. Call subtitles, saved transcripts, the AI voice and call summaries are made with both people’s names, usernames and profile skills as context, so that names are spelled correctly and words are understood as meant, under the same rule as skills. Your other account details, such as your email address, are not sent.
• When: public content is translated when you publish or edit it, so that it is ready for readers of other languages, or when someone views it. Private content is translated only when the other person in the conversation or Swap opens it, or when their notification of a new message is prepared. Text that is already in the reader’s language is not sent to be translated (our own server checks its language first), though it may go along as context as described above, and you always see your own words exactly as you wrote them.
• Your permission: public content is translated unless you have declined AI translation. Private content is translated only if you have allowed it. We ask you once, the first time you post a deal, send a message, or make a call. If you have not allowed it, the other person sees your original words. This is the same permission that covers AI on your words in calls (Section 2.1).
• Stored translations: translations are stored so that the same text is not translated again (see Section 6.2), and a reader’s device may keep copies of translations it has shown. A translation is always labelled as one, the reader can switch back to your original words, and your original is never changed.
• Not used for training: under Anthropic’s commercial terms, text sent for translation is not used to train its models.
• Turning it off: you can change your choice at any time on your profile, under ⋮ → AI translation. When you turn it off, we stop translating your words and stop showing translations of them, and the stored translations of your messages are deleted. Copies already kept on a reader’s device may remain there.

2.5 AI Search

In the app’s search (currently in the iOS app) you can turn on AI search and describe in your own words what you are looking for. AI turns your words into search filters; every result is then read from worXwap’s own listings.

• What is sent: only the question you type while AI search is on, together with our fixed instructions and the list of skills on worXwap. Your name, account details, profile and messages are not sent. Please do not include personal details in your question.
• Who receives it: Anthropic, PBC (United States), whose AI model Claude turns the question into filters.
• When: only when you send a question with AI search on. We tell you what is sent the first time you turn it on, and you can always search without it.
• What we keep: we do not store your question. To apply the daily limit (20 AI searches a day, free for members) we keep a count of how many AI searches you made each day and the time of your last one. Your recent searches are kept only on your device.
• Not used for training: under Anthropic’s commercial terms, questions sent for AI search are not used to train its models.

3. Purpose of Use (利用目的)

We use your information to:

• Provide, operate, and maintain the Platform.
• Create and manage your account and authenticate you.
• Process subscriptions and payments, and manage billing status.
• Facilitate Swaps between users, including discovery, communication, and delivery.
• Provide audio and video calls, and the call features you turn on: live subtitles, saved transcripts, translation, call summaries, and Voice Translation.
• Display your profile, deal pages, shorts, and reviews to other users and to visitors.
• Show what members write in each reader’s language, using AI translation (Section 2.4).
• Turn the questions you type in AI search into search filters, and apply its daily limit (Section 2.5).
• Send you notifications about your account, Swaps, and Platform updates.
• Respond to your support requests and inquiries.
• Investigate reports, enforce our Terms, and detect and prevent fraud, abuse, and security incidents.
• Show creators aggregate view and click counts for their own content.
• Comply with legal obligations.

We do not sell your personal information, and we do not use it for advertising or for automated decision-making that produces legal effects.

4. How Your Information Is Shared and Published

4.1 Publicly Accessible Content

Please read this section carefully, because some content is accessible without logging in.

• Your username, display name, profile picture, bio, skills, country, reviews, ratings, deal pages, and shorts are visible to other users, and profile and deal pages can be viewed by visitors who are not signed in.
• Uploaded files are served from public URLs. Profile pictures, deal images, shorts videos, thumbnails, and files attached to Swaps and messages are stored on a public content-delivery network. Anyone who has the URL can open the file without signing in. Treat anything you upload as potentially public, and do not upload files containing information you need to keep confidential.
• Your email address, password, payment details, and private messages are not published on your public profile.

4.2 Access by worXwap Staff

Authorized administrators can access account records and, where necessary to investigate a report, enforce these Terms, resolve a dispute, or respond to a support request, the contents of messages and Swap submissions. Access is limited to those purposes.

4.3 Service Providers

We use the following providers to operate the Platform. Each receives only what it needs for its function:

• Supabase (database, authentication, and server functions) — hosted in Singapore. Holds your account, profile, messages, Swaps, and reviews.
• Amazon Web Services (media storage, video transcoding, and content delivery) — storage and processing in Japan (Tokyo region), delivered through a global CDN with edge servers in many countries. Holds your uploaded videos, images, and attachments.
• Amazon Web Services — Amazon Chime and Amazon Transcribe (calls and speech-to-text) — call audio and video relayed in Japan (Tokyo region); call set-up in the United States. Transcribe receives a call’s audio only while subtitles or transcripts are on for that call. We have opted out of Amazon using this audio to improve its services.
• Anthropic, PBC (Claude AI — translation of what members write, of subtitles and transcripts, call summaries, and AI search) — United States. Receives the text being translated or summarised, and for chat messages and calls the context described in Section 2.4: public content unless its author declined AI translation, and messages, other private content, and call speech only from people who allowed AI on their words. For AI search, it receives only the question you type (Section 2.5). Under Anthropic’s commercial terms, this data is not used to train its models.
• Cartesia AI, Inc. (AI voice — creating your voice and speaking your translated words) — United States. Receives your voice recording, and the translated text of your words while Voice Translation is on. Keeps your AI voice until you delete it. We have asked Cartesia not to use your data to train its models.
• Apple (App Store purchases and push notifications, in the iOS app), Google (Google Play purchases, and push notifications through Firebase Cloud Messaging, in the Android app) and RevenueCat, Inc. (subscription status for App Store and Google Play purchases) — United States.
• Stripe (payment processing and subscription management) — processed in the United States and other countries where Stripe operates. Receives your name, email address, and payment details.
• Resend (transactional email delivery) — United States. Receives your email address and the contents of notification emails we send you.
• Google (sign-in and profile-picture hosting, if you use Google Sign-In) — United States.
• Kloudend, Inc. (ipapi.co) (country suggestion during signup) — United States. Receives your IP address.

4.4 Embedded Third-Party Content

Some pages embed content served by third parties. When such a page loads, your IP address and browser information are disclosed to those parties even if you do not interact with the content. This currently includes portfolio previews embedded from Behance (Adobe, United States) and country flag images hosted on GitHub (United States).

4.5 For Legal Reasons

We may disclose your information if required by law, regulation, legal process, or governmental request, or where disclosure is necessary to protect the rights, safety, or property of worXwap, our users, or the public.

4.6 Business Transfers

If worXwap is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you before your information becomes subject to a different privacy policy.

5. Transfers to Third Parties Outside Japan (外国にある第三者への提供)

As set out in Section 4.3, your personal information is stored and processed outside Japan — in particular in Singapore (Supabase) and the United States (Stripe, Resend, Google, Kloudend, Anthropic, Cartesia, Apple, RevenueCat, and Amazon Web Services for call set-up). Content delivery may also place cached copies of uploaded media on servers in other countries.

Information about the personal-information protection regimes of those countries is published by Japan’s Personal Information Protection Commission at ppc.go.jp. Singapore has a comprehensive data protection law (the Personal Data Protection Act 2012). The United States has no single comprehensive federal data protection law; protection depends on sector-specific and state laws and on the contractual commitments made by each provider.

Each provider listed in Section 4.3 is engaged under its standard data processing terms, which require it to implement appropriate security measures and to process personal information only on our instructions or as needed to provide its service.

By creating an account, you consent to the transfer of your personal information to the providers and countries described above. If you do not consent, please do not create an account — we cannot operate the Platform without these providers.

6. Data Retention and Deletion

We retain your personal information for as long as your account is active or as needed to provide the Platform.

If you delete your account, we delete or anonymize your account record, profile, and associated database records within 30 days, except where we must retain information for legal, accounting, tax, or security purposes. In particular:

• Reviews and Swap records may be retained in anonymized form so that other users’ histories stay intact.
• Moderation and safety records (including reports and administrative action logs) are retained so that enforcement decisions remain auditable.
• Billing records held by us and by Stripe are retained as required by tax and accounting law.
• Files you uploaded may remain on our storage and content-delivery network after the corresponding record is deleted. If you need specific uploaded files erased, contact us at privacy@worxwap.com and we will remove them.

6.1 Calls, transcripts and AI

• Call records are kept while your account exists, because they appear in your chats.
• Saved transcripts are kept until deleted. “Delete my words” removes your words from a call’s transcript for both people, together with any AI summaries made from that call. Translations of transcript lines are deleted with them.
• Call summaries are kept for the person who asked for them until the call’s words are deleted or their account is deleted.
• Your AI voice is kept by Cartesia until you delete it in the call settings or delete your account; the deletion is sent to Cartesia.
• AI search: your questions are not stored by us. The daily count of your AI searches and the time of your last one are kept while your account exists.
• Anthropic keeps what it receives for a limited period (up to 30 days) for safety and abuse monitoring, and then deletes it.
• All of the above is deleted when you delete your account.

6.2 Translations

• Translations of messages are kept with the message, and are deleted when the message is deleted, when its author withdraws permission for AI translation, or when the author’s account is deleted.
• Other translations are stored under a fingerprint of the original text, not linked to any account, and are deleted automatically once they have not been used for 90 days — including after the original has been deleted.

6.3 Deleting your account

How to delete your account — in the app, on the website or by email — and what is deleted and what is kept: worxwap.com/delete-account.

7. Security Measures (安全管理措置)

We take the following measures to protect personal information:

• Organizational: Administrative access is limited to authorized personnel, and administrative actions are recorded in an audit log.
• Technical: All traffic is encrypted in transit (HTTPS). Data is stored in managed services with access controls and row-level security rules that restrict each account to its own records. Passwords are stored only as salted hashes by our authentication provider. Card details never reach our servers.
• Awareness of the external environment (外的環境の把握): We are aware that personal information is held in Singapore and the United States as described in Section 5, and we take that into account when selecting and reviewing providers.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If a breach occurs that is likely to harm your rights, we will notify you and the Personal Information Protection Commission as required by law.

8. Your Rights

8.1 All Users

• Access and update your personal information through your account settings.
• Request a copy of your data.
• Delete your account and associated data.

8.2 Users in Japan (APPI)

You may request disclosure (開示), correction (訂正), addition, deletion (削除), cessation of use (利用停止), or cessation of third-party provision of your retained personal data, and disclosure of records of third-party provision.

Procedure: send your request to privacy@worxwap.com from the email address registered to your account, stating what you are requesting. We may ask for additional information to confirm your identity. We respond without undue delay and normally within 30 days. We do not charge a fee for these requests.

8.3 Users in the European Economic Area and the United Kingdom (GDPR)

If you are in the EEA or UK you also have the rights to erasure, restriction of processing, data portability, objection to processing, and withdrawal of consent. Our legal bases are: performance of our contract with you (operating the Platform and your subscription), your consent (where asked), our legitimate interests (security, abuse prevention, and improving the Platform), and compliance with legal obligations. You may lodge a complaint with your local supervisory authority.

8.4 Complaints (苦情の申出先)

If you are dissatisfied with how we handle your personal information, contact privacy@worxwap.com. In Japan you may also contact the Personal Information Protection Commission.

9. Cookies and Local Storage

We use cookies and browser storage only to operate the Platform. We do not use advertising cookies, and we do not use third-party analytics services.

• Authentication cookies: keep you signed in. Required — the Platform cannot function without them.
• Preference storage: remembers settings such as your theme.
• Local caching: to keep the app responsive, your browser stores copies of data you have already loaded — including conversations, the name and picture of people you are talking to, and drafts. This stays on your device and is not sent anywhere.

On a shared or public computer, cached content may remain in the browser after you sign out. Clear your browser data before handing the device to someone else.

10. Children’s Privacy

The Platform is intended for users aged 18 and over. We do not knowingly collect personal information from anyone under 18. We do not verify age at registration, so if you believe a person under 18 has created an account or provided us with personal information, contact privacy@worxwap.com and we will delete it promptly.

11. Third-Party Links

The Platform may contain links to third-party websites or services. We are not responsible for their privacy practices, and we encourage you to review their policies. Content embedded from third parties is described in Section 4.4.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you through the Platform or by email, and update the “Last Updated” date above. Your continued use of the Platform after changes take effect constitutes acceptance of the updated Privacy Policy.

13. Language

This Privacy Policy is provided in English. In the event of any discrepancy between translated versions, the English version shall prevail.

14. Contact and Business Identification

Under APPI Article 32 we identify ourselves as follows:

• Business operator: worXwap合同会社 (worXwap LLC)
• Representative: Heikki Minik Holm, Representative Member (代表社員)
• Registered address: Roppongi KS Bldg. 5F, 3-16-12 Roppongi, Minato-ku, Tokyo 106-0032, Japan
• Privacy and data rights: privacy@worxwap.com
• General support: support@worxwap.com