Privacy Policy

This English version of the Privacy Policy is an official translation provided for convenience, and in the event of any conflict or inconsistency between the Japanese version and the English version, the Japanese version shall prevail. Velpha Inc. (the "Company") handles all user data collected through "Velpha" (including pre-registration, associated websites, and applications, whether preview or official release; collectively, the "Service") in strict compliance with the Act on the Protection of Personal Information of Japan (the "APPI"), related ministerial guidelines, and this Privacy Policy (this "Policy"). The statutory terms "personal information," "personal data," and "retained personal data" used herein shall have the meanings ascribed to them under the APPI.

The Company collects the following categories of information depending on the user's utilization of the Service: 1. Pre-Registration Data Email address, confirmation timestamp, assigned registration number, referral sources and milestone counts, optional questionnaire responses (investment experience, brokerages used, asset management challenges), responses and output of the Investing Habits Quiz, referring URL/UTM parameters, and cryptographic session tokens used to maintain registration state. 2. Account and Financial Portfolio Data Email address, user identifiers, profile attributes, authentication credentials, country of residence, birth year, investment objectives, investment horizon, risk tolerance metrics, liquid asset allocation, cash reserve thresholds, target accumulation amounts, detailed security holdings (tickers/codes, quantities, acquisition cost basis), transaction histories, simulation scenarios, and configuration settings. This includes information entered directly or retrieved via user-authorized external API synchronizations. 3. AI Feature Interaction Data User prompts submitted to AI assistants, UI contextual state sent with prompts, AI-generated analytical responses, dialogue histories, and usage metrics. Prior to transmission and persistent storage, personal identifiers (email addresses, phone numbers) and sensitive financial digits (brokerage account numbers) are subject to automated data masking. 4. Environmental and Telemetry Logs IP addresses, cookie identifiers, access timestamps, visited URLs, referring endpoints, device hardware specifications, operating systems, browser versions, interaction events, error reports, and latency telemetry. Distinct handling of voluntary behavioral analytics versus essential diagnostic logging is governed by Articles 4 and 8. 5. Customer Support Communications Feedback submissions, inquiry contents, email contact points, and attachments. Users are instructed never to transmit login passwords, verification codes, or financial institution credentials. 6. Diagnostic Assessment Data Responses to and results of the Investing Habits Quiz and ephemeral browser cookie identifiers, processed independently of whether the user pre-registers. Assessment data is handled separately from direct personal identifiers.

The Company processes collected information within the scope necessary to achieve the following purposes: (1) Administering pre-registration, verification, release updates, digital Launch Pass issuance, referral tracking, community milestone rewards, assessment-driven onboarding, and anonymous distribution statistics; (2) Managing user account registration, identity authentication, login sessions, and account preference persistence; (3) Recording financial holdings and transactions, conducting asset allocation and P&L analysis, executing portfolio simulations, and synchronizing with authorized third-party calendars; (4) Generating contextual AI analytical responses, maintaining conversation threads, and monitoring usage quotas; (5) Delivering customer support, investigating and resolving technical failures, preventing fraudulent or abusive activity, maintaining information security, and ensuring platform reliability; (6) Conducting statistical research and behavioral telemetry, improving algorithms and UI/UX design, and measuring and optimizing advertisements for the Service, in accordance with user preferences under Article 4; and (7) Ensuring compliance with statutory obligations, protecting proprietary rights, and resolving legal disputes. Any material alteration of the purposes of use will remain within a reasonably related scope, with advance notification or publication on the Service.

1. Overview Participation in behavioral telemetry and data analytics intended for service enhancement ("Analytics") is entirely voluntary. Although active by default in the current application, users may exercise their right to opt out at any time. A saved opt-out preference remains permanently effective across future updates. 2. Procedure for Adjusting Settings Users may opt out by navigating to "Settings" → "Personalization" → "Data Use" in the application, toggling "Analytics" off, and selecting "Save Preferences." Toggling the switch alone without confirming save does not commit the preference. Users may re-enable analytics at any time via the same interface. 3. Scope of Analytics Halted This setting governs behavioral tracking via Google Analytics within the authenticated application. Upon saving the off setting, the screen reloads and further telemetry for subsequent sessions is terminated. If the user accesses the application across multiple browser tabs or devices, reloading those interfaces applies the opt-out preference. In addition, among questions sent to the AI feature by users who have saved Analytics as on, those asking for price predictions or similar are counted only by the number of senders, and that number (rounded down to the nearest ten) may be shown in AI responses. 4. Essential Processing Maintained Opting out of Analytics does not impair core platform capabilities (asset recording, portfolio simulations, AI interactions). Core functional processing—including risk analysis derived from portfolio inputs, authentication, security controls, statutory compliance records, and infrastructure error and latency monitoring via Datadog—continues as essential operational processing (see Article 8 for technical specifications). 5. Treatment of Historical Records Opting out does not retroactively expunge historical aggregated metrics or anonymized telemetry. Requests for deletion of retained personal data should be directed to the contact desk in Article 7. Fully aggregated, non-personally identifiable statistics may continue to be utilized. This setting operates independently from pre-registration notices and external calendar integrations. To unsubscribe from announcements, contact contact@velpha.ai from the registered address. 6. Public Website Measurement Policy On public pages (pre-registration, quiz, legal pages), Google Analytics measurement is enabled by default. The script does not load when the browser has a saved off choice. You can enable or disable measurement from "Cookie Settings" in the footer. The choice is stored in a cookie for 180 days per browser and domain; after it expires, the default applies again. Authenticated in-app Analytics preferences are managed separately. Public-page settings never turn a saved off in-app preference on. The game at game.velpha.ai uses its own Google Analytics and Meta Pixel advertising measurement, enabled by default. Turning measurement off on the title screen stops both and stores the off choice in a cookie limited to the game host for 180 days. This setting is separate from pre-registration website Cookie Settings and in-app Analytics preferences. See Article 8 for the pages where Meta Pixel runs and the information transmitted.

1. Subcontracting The Company may subcontract operational functions—including user authentication, cloud infrastructure hosting, database management, transactional email delivery, performance monitoring, and AI inference processing—to specialized third-party service providers. Subcontractors are selected based on strict information security standards and subjected to ongoing contractual oversight. 2. Restrictions on Third-Party Provision The Company will not disclose or provide personal data to third parties without prior user consent, except as permitted under the APPI or other applicable statutes. Transfers of personal data to foreign entities are executed in accordance with statutory requirements, ensuring adequate contractual safeguards and equivalent protective measures. Current foreign vendors and processing locations are set forth in Article 6. 3. External Integrations Where a user explicitly authorizes integration with third-party tools (such as Google Calendar), relevant parameters are transmitted within the approved scope. Integrations may be disconnected at any time via application settings or the external provider's permission portal. 4. Public Information Sharing Registration numbers, Launch Pass graphics, milestone badges, and referral URLs published by users via social media sharing functions enter the public domain. Referrers receive aggregated referral counts; individual identities or email addresses of referred parties are never revealed. Users must never disclose authentication links or tokens publicly.

1. Security Control Measures The Company enforces comprehensive organizational, personnel, physical, and technical safeguards to prevent unauthorized access, leakage, loss, or damage to personal data, including granular role-based access controls, TLS/SSL transport encryption, encrypted storage at rest, continuous audit logging, and regular employee compliance training. 2. Cross-Border Processing and Subcontractors The Company's primary database is hosted in Japan (Amazon Web Services Tokyo Region). Necessary information is also sent to the external services below. A provider's headquarters country does not necessarily identify where information is stored or processed. The following locations reflect our configuration and each provider's published information: • Authentication & Account Management: Clerk, Inc. Authentication data is stored in the United States and may be processed at facilities operated by Clerk and its subprocessors. • Frontend Content Delivery: Vercel Inc. Application processing is configured for Japan, the United States, Canada, and Germany. Content delivery, operations, and related processing may also take place in other countries and regions where Vercel or its subprocessors operate. • Transactional Email Delivery: Resend, Inc. Our sending domain is configured for Japan (Tokyo Region), while email and log data is stored in the United States. • Bot Mitigation & Spam Prevention: Cloudflare, Inc. Information is primarily stored in the United States and the European Economic Area (EEA), and may also be processed in other countries and regions where the Cloudflare group operates. The Company cannot identify in advance which EEA country will be used for each transmission. • Observability & Performance Monitoring: Datadog, Inc. The Company uses Datadog's Japan data center (AP1) for storage and processing. Data may be accessed for support and related operations from countries and regions where Datadog or its service providers operate, including the United States. • Usage Analytics: Google LLC (Google Analytics / Google Tag Manager). Information may be processed in countries and regions where Google operates servers, including the United States. • Game Advertising Measurement & Optimization: Meta Platforms, Inc. (Meta Pixel on game.velpha.ai). Information may be processed in countries and regions where Meta or its service providers operate processing facilities, including the United States. See Article 8 for transmitted information, eligible pages, and opt-out instructions. • AI Inference Infrastructure: Amazon Web Services, Inc. (Amazon Bedrock). The Company uses global inference, which routes requests to supported commercial AWS Regions worldwide. For services whose storage and processing are not limited to a specified country above, global delivery, operations, and subprocessing mean the Company cannot identify every processing country before each transmission. A reference to the United States does not mean that all processing occurs exclusively there. For AI features, input prompts, prior conversational context, and necessary financial parameters (tickers and risk-return statistics) are sent to Amazon Bedrock. The inference country and region are selected for each request and cannot be identified as a single country in advance. Input data is not used to retrain the AI model. The Company reviews relevant data protection regimes and executes appropriate data protection agreements and safeguards. 3. Retention Period and Account Erasure The Company retains personal data only for the duration required to fulfill specified purposes. Upon account deletion, registered assets, transaction histories, preferences, and AI conversation logs are permanently and irreversibly purged from production databases. In-app AI logs remain stored until individual deletion by the user or overall account termination. Authorized personnel may access dialogue records solely to resolve reported defects, investigate security anomalies, or address formal inquiries. Following account or pre-registration termination, limited records may be retained to satisfy statutory obligations, enforce fraud prevention, or address disputes. Residual backup archives are overwritten in standard operational cycles. Expired records are securely destroyed or converted into irreversibly anonymized statistical aggregates.

Pursuant to the APPI, users hold the right to request disclosure, correction, addition, deletion, suspension of use, erasure, or cessation of third-party provision regarding their retained personal data and third-party transfer records. Requests may be submitted to contact@velpha.ai and will be processed without undue delay following statutory identity verification. Where legal exceptions apply, the Company will promptly communicate the rationale. In-app analytics preferences can be adjusted directly pursuant to Article 4. AI interaction threads can be removed individually within the conversation interface, and account deletion may be initiated under "Settings" → "Account." For pre-registration cancellation or email unsubscription, please contact the support desk from the registered address.

The Service deploys cookies and similar technologies for session integrity, usability enhancement, security validation, telemetry, and advertising measurement. Responses and results of the Investing Habits Quiz are stored in local browser cache for persistence and synchronized with a browser cookie identifier on the server to aggregate overall distribution statistics. These records exclude direct identifiers such as names or email addresses, linking to an email address only if saved concurrently with pre-registration or completed in an authenticated session. In accordance with the Telecommunications Business Act of Japan (External Transmission Regulations), disclosures regarding external service integrations (tags/SDKs) are specified below. Disabling cookies via browser settings may restrict authentication and core features.

Clerk | Authentication & Identity Management

Recipient: Clerk, Inc. Transmitted Data: Account identifiers (email address), session tokens, IP address, device and browser attributes. Purpose: User authentication, session management, identity verification, anti-hijacking controls. Classification: Essential infrastructure for service operation (exempt from voluntary Analytics opt-out).

Cloudflare Turnstile | Fraud Prevention & Bot Mitigation

Recipient: Cloudflare, Inc. Transmitted Data: IP address, browser/device telemetry, interaction timestamps, page verification parameters. Purpose: Prevention of automated bot attacks, spam submissions, and credential abuse. Classification: Operates on public registration and inquiry forms (exempt from voluntary Analytics opt-out).

Datadog RUM | Application Performance & Error Monitoring

Recipient: Datadog, Inc. Transmitted Data: Visited URLs (query parameters and fragment identifiers stripped), session identifiers, browser/device metrics, error stacks, rendering latency. Session replay is explicitly disabled on sensitive pages (pre-registration, quiz, legal, authentication). Purpose: Real-time detection and resolution of platform crashes, latency bottlenecks, and stability maintenance. Classification: Essential diagnostic infrastructure (continues regardless of voluntary Analytics opt-out).

Google Analytics / Google Tag Manager | Behavioral Usage Analytics

Recipient: Google LLC Transmitted Data: Cookie identifiers, accessed paths, page flow sequences, referring domain origins, client device parameters, pseudonymized internal analytics tokens. Direct personal identifiers, financial balances, and raw quiz answers are never transmitted. Purpose: Aggregated traffic analysis, UI/UX optimization, and feature engagement evaluation. Classification: Public-page measurement is enabled by default and stops when the browser has a saved off choice. You can change it in the footer's "Cookie Settings"; the choice is stored in a cookie for 180 days. Authenticated in-app measurement requires a saved on Analytics preference, which public-page settings never change (see Article 4 for opt-out instructions).

Meta Pixel | Advertising Measurement

Recipient: Meta Platforms, Inc. Transmitted Data: Cookie identifiers, IP address, client device parameters, the game page URL (including campaign labels and the ad click identifier), referrer, and the facts that a page was viewed, the game was started or finished, or the link to the Velpha homepage was clicked. A link click does not confirm arrival at the destination. Email addresses, names, usernames, referral IDs, quiz answers and results, game mode, outcome, end age, play result contents, game asset values, share IDs, and financial information are never transmitted. Purpose: Measuring and optimizing advertisements for the Service through the game. For how Meta Platforms, Inc. handles this information, see its Privacy Policy (https://www.facebook.com/privacy/policy/). Classification: Runs only at the root URL (/) of the game at game.velpha.ai, when the URL has no fragment and only supported campaign labels and the ad click identifier, and the referrer is empty, another site's origin, or the same eligible root URL. It never runs on share pages, pre-registration or quiz pages, or the authenticated app. It is enabled by default and stops, together with the game's own Google Analytics, when measurement is turned off on the game title screen. The off choice is stored in a cookie limited to the game host for 180 days.

Modifications to external recipients or transmitted categories will be reflected in periodic updates to this Policy.

Personal Information Handling Business Operator: Velpha Inc. Head Office: 1-12-4 Ginza, Chuo-ku, Tokyo 104-0061, Japan Representative Director: Shusuke Takamizawa Contact Desk: contact@velpha.ai The Company reserves the right to amend this Policy in response to statutory revisions, technological developments, or operational requirements. Amended versions will be published on the Service with an updated effective date. Material alterations will be communicated via email or prominent on-site notice. Amendments to this Policy will not automatically revert an active analytics opt-out preference.