Privacy Policy

We use the information we collect to:

• Create and manage your account
• Match your profile with relevant job opportunities
• Facilitate communication between candidates and companies
• Process payments for subscription plans
• Send service emails you need in order to use the Service, such as scout notifications, new message alerts, and account and security notices
• Send an optional job newsletter with opportunities that may suit your profile
• Translate profile and job content between Japanese and English, so that candidates and companies can read each other’s content in their own language
• Extract structured details from a resume you upload, when you ask us to fill in your profile from it. Nothing is written to your profile until you review the suggestions and apply them
• Measure which channels and campaigns bring people to Atarashift
• Improve and develop the Service
• Comply with legal obligations

You control each category of email independently from your account settings, and our job newsletter also includes an unsubscribe link in every message. Turning off the newsletter does not stop scout and message notifications, which we send because they are part of the service you signed up for; you can turn those off separately in your settings. Account and security notices cannot be turned off while your account is open.

We do not sell your personal information to third parties.

We share your information only in the following circumstances:

• With companies you interact with: Your profile information is visible to verified companies using the platform when you make your profile discoverable.
• Service providers: We use trusted third-party services that process data on our behalf and are bound by their own privacy policies:
  • Supabase — database, authentication, and file storage
  • Stripe — subscription payments
  • Vercel — hosting and analytics
  • Resend — transactional email delivery
  • OpenAI — machine translation of profile and job content between Japanese and English, and, when you use resume autofill, extraction of structured profile details from a resume you upload. Content sent to OpenAI is processed only to return the result and is not used to train its models.
  • Google — Google Analytics and Google Sign-In
• Legal requirements: We may disclose your information if required by law or to protect the rights and safety of our users.

We are based in Japan, but the providers listed in Section 3 operate infrastructure outside Japan, principally in the United States. Using the Service therefore involves transferring your personal data to third parties located in foreign countries.

Under Article 28 of Japan’s Act on the Protection of Personal Information (個人情報保護法), we provide the following information about these transfers:

• Destination countries: primarily the United States. Supabase and Vercel may also process data in other regions depending on infrastructure configuration.
• Information on the destination’s data protection regime: the United States has no comprehensive federal data protection law equivalent to the APPI or the GDPR; protection is provided by a combination of sector-specific federal law and state law.
• Measures taken by the recipients: each provider is engaged under a data processing agreement that restricts processing to our instructions and requires security measures consistent with recognised international standards, including Standard Contractual Clauses where applicable.

You may request further details of these transfers by contacting us at the address in Section 11.

We retain your personal information for as long as your account is active or as needed to provide the Service.

You can delete your account at any time from your account settings, or by contacting us. When you do:

• Your profile stops being visible to companies immediately and no longer appears in candidate searches.
• Any résumé or CV file you uploaded is permanently deleted from our storage, together with its metadata.
• Your email address is replaced with an anonymised placeholder, so the remaining record can no longer be used to identify or contact you. This also frees your email address for future re-registration.
• A deactivated profile record is retained in our database, marked as deleted and excluded from all company-facing access.

Two things are not removed by deleting your account. Messages you already sent to a company remain in that company’s inbox, in the same way an email you have sent cannot be recalled. Copies of data may also persist in encrypted infrastructure backups for a limited period before being overwritten in the normal backup cycle.

If you want the deactivated record erased as well, contact us at the address in Section 11 and we will action it. We respond to deletion and other data requests within 30 days.

We implement industry-standard security measures to protect your personal information, including encryption in transit (TLS) and at rest. Access to personal data is restricted to authorized personnel only. However, no method of electronic transmission or storage is 100% secure, and we cannot guarantee absolute security.

Depending on your location, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you.
• Correction: Request correction of inaccurate or incomplete data.
• Deletion: Request deletion of your personal data.
• Portability: Request a machine-readable copy of your data.
• Objection: Object to certain uses of your data.

To exercise any of these rights, please contact us at the email address below.

We use two categories of cookies and similar technologies:

• Essential cookies: required to operate the Service, such as maintaining your login session. These cannot be disabled without breaking core functionality.
• Analytics cookies: set by Google Analytics to measure how the Service is used, as described in Section 1.2. In the EEA and the UK we ask before setting any of them, and declining does not limit your use of the Service in any way.

To remember your choice so we do not have to ask again on every visit, we store the following on your device. None of it is used to track you, and all of it is readable only by Atarashift:

• Your choice itself, together with the date you made it, in your browser’s local storage. In the EEA and the UK, we ask you again if you accepted more than six months ago. Turning analytics off always stays in effect until you change it yourself.
• A cookie named atarashift.analytics-allowed holding only 1 or 0, so that our servers know whether analytics is currently permitted. Without it, a sign-in completed on our servers could set an analytics cookie before your choice was known. It never outlives the choice it mirrors, so it expires at the same time, within six months at most.
• Your approximate country, derived from your IP address and kept for the current browser tab only. We use it solely to decide whether we are required to ask you before setting analytics cookies, and we do not store it on our servers or attach it to your account.
• A short-lived cookie named ga_pending_event, set only when you sign in and only if analytics is already permitted. It carries a single word describing the sign-in so that it can be counted once, and it is deleted as soon as it is read, normally within a second.

You can change your choice at any time using the Cookie settings link in the footer of any page.

We do not use advertising cookies, and we do not sell or share cookie data with advertising networks. You can configure your browser to refuse cookies, but refusing essential cookies will prevent you from signing in.

The Service is not directed to, and may not be used by, individuals under the age of 18. This matches the eligibility requirement in our Terms of Service.

We do not knowingly collect personal information from anyone under 18. If we become aware that someone under 18 has created an account or otherwise provided us with personal information, we will delete the account and the associated data promptly. If you believe a minor has provided us with personal information, please contact us at the address in Section 11.

We may update this Privacy Policy from time to time. We will notify you of significant changes by posting the new policy on this page and updating the "Last updated" date. Your continued use of the Service after changes are posted constitutes your acceptance of the updated policy.

If you have any questions or concerns about this Privacy Policy or our data practices, please contact us: