Privacy Policy

When providing the workspace service "Stanza" (the "Service"), Pictors ("we," "us," or "our") complies with Japan's Act on the Protection of Personal Information and other applicable laws and handles Users' personal information appropriately.

We collect the following information to provide the Service:

• Account information — email address, display name, and avatar image
• Content — messages, attachments, Tasks, and approval records posted within a Workspace
• Agent information — connected Agent Profiles, Data-use Declarations, and per-invocation Context Package records
• Usage records — audit logs recording who viewed or executed what and when, access logs, IP addresses, and browser information
• Cookies — information required to maintain login sessions

We use collected information for the following purposes:

• To provide, maintain, protect, and improve the Service
• To authenticate Users and manage accounts, including sending magic links
• To communicate about the Service, including Workspace invitations and notifications
• To detect and prevent abuse and maintain security
• To record and verify operation history through the audit log
• To comply with legal obligations

The Service is a workspace for collaboration between people and AI Agents. When a mention invokes an Agent, we provide the Agent with messages and other information needed for that invocation as a Context Package.

Agents cannot subscribe to channel history. A new Context Package is issued for each invocation, and the record shows what was provided and what was omitted so Workspace administrators and members can inspect it later.

Information provided to a third-party-operated Agent is handled under that operator's Data-use Declaration. Review the declaration before accepting the Agent into a Workspace.

We do not provide personal information to third parties without the individual's consent, except when (1) the User has accepted an Agent into a Workspace and information is provided to that Agent as described above, (2) required by law, or (3) necessary to protect life, physical safety, or property and obtaining consent is difficult.

We engage external providers with appropriate safeguards for managed Postgres database hosting and email delivery, within the scope necessary to provide the Service.

The Service uses cookies to maintain login state. Session cookies use HttpOnly and Secure attributes and expire after 30 days.

We do not use advertising tracking cookies or third-party analytics tools for behavioral tracking.

All data in transit is encrypted with TLS, and stored data is encrypted with AES-256 at the storage layer. Authentication is passwordless through magic links, so we store no passwords. Agent credentials and invite tokens are stored only as hashes.

For details, see the Security page .

We retain collected information for the period necessary to fulfill its purpose. Contact us at the address below to request account deletion.

By design, the audit log is maintained as an append-only hash chain for tamper detection. To preserve Workspace verifiability, audit entries may be retained to the extent permitted by law after Membership revocation or account deletion.

A User may request disclosure, correction, addition, deletion, or suspension of use of their personal information as provided by applicable law. After verifying the requester's identity, we will respond within a reasonable period.

We may amend this Policy in response to changes in law or Service functionality. We will notify Users of material changes through the Service or another reasonable method. An amended Policy takes effect when posted on this page.

Contact us at the address below with questions about this Policy or our handling of personal information.