Uketsuke's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
This Privacy Policy explains how ACALL Inc. (Acall株式会社, "ACALL", "we") handles personal information in Uketsuke (受付), our visitor reception service at app.uketsuke.app, its reception kiosks and related services.
Uketsuke is used by companies (our "customers") to receive their visitors. For information about a customer's employees and visitors, the customer decides why it is collected, and we handle it on the customer's behalf under our agreement with them. For account and security information about people who sign in, we act on our own behalf. We comply with the Act on the Protection of Personal Information of Japan (APPI).
Name, email address, preferred language and role in the company (for example Admin, Receptionist or Member).
Sign-in provider identifiers when you sign in with Microsoft or Google (the account's unique ID and email address), or the one-time codes we email you.
Optional: a face template if you choose to enroll for face check-in, and calendar connections if you connect your calendar (see sections 9 and 10).
Visitors:
Name, company, email address, the person you are visiting, purpose and location of the visit, and visit times (scheduled, check-in and check-out).
Optional, when the customer enables it: a photo taken at check-in.
Optional, only with your consent: a face template used to recognise you at the kiosk on later visits.
Reception kiosks: the device name, its location, a device credential, and check-in events recorded on it.
Calendar data, when a person or customer connects a calendar: events used for pre-registration (title, time, location and attendees).
Technical information needed to run the service securely: IP address, browser or device type, and security logs of sign-ins and administrative changes.
3. How we use information
To provide Uketsuke: pre-register and check in visitors, notify hosts, show the front desk and visitor log, and produce reports for the customer.
To sign you in and keep accounts secure, including detecting misuse.
To operate, maintain and support the service, and to measure its availability.
To comply with law and respond to lawful requests.
We do not sell personal information, we do not use it for advertising, and we do not use customer data to train AI or machine-learning models.
4. Legal basis and consent
We handle personal information within the purposes stated in this policy, as permitted under the APPI. Customer data is handled on the customer's instructions as an entrusted party under the APPI.
Face templates are created only with the explicit consent of the person concerned, which can be withdrawn at any time. Photos are taken only when the customer enables them, and visitors are told at the kiosk.
5. How long we keep information
Visitor photos: up to 90 days (a customer may set a shorter period), then deleted.
Visit records (who visited whom, when): kept for the customer's records while the customer uses Uketsuke, and deleted when the customer's account is closed or on the customer's request.
Face templates: until consent is withdrawn, or after 1 year without a visit (a customer may set a shorter period), whichever comes first.
Data exports requested by a customer: deleted 12 hours after the file is ready (download links are valid for 15 minutes).
Calendar access tokens: until the calendar is disconnected.
Account information: while the account is active; deleted when the person is removed or the account is closed, except where the law requires us to keep it.
6. Where information is stored
Uketsuke stores data in Japan, in the Amazon Web Services Asia Pacific (Tokyo) region. Data is encrypted in transit (TLS) and at rest.
7. Sub-processors and sharing
We share personal information only with the service providers below, only as needed to run Uketsuke, and under contracts that protect it:
Amazon Web Services, Inc. (hosting, storage and email delivery, in the Tokyo region).
Microsoft Corporation (Microsoft 365, Outlook calendars, Microsoft Teams): only when the customer or the person connects them.
Google LLC (Google sign-in, Google Calendar, Google Wallet): only when the customer or the person uses or connects them.
Slack Technologies, LLC (Slack notifications): only when the customer connects Slack.
Within a customer, information is visible to people according to their role (for example, Receptionists see that day's visitors). We may disclose information when required by law.
8. Security
Encryption in transit and at rest; secrets and tokens are additionally encrypted with managed keys.
Short-lived access tokens kept only in memory; sign-in sessions use a secure, HTTP-only cookie.
Role-based access control and isolation of each customer's data.
Face recognition processes face images on the kiosk; only face templates are sent and stored, never face images.
Strict Content Security Policy, no third-party scripts, and audit logs of administrative changes.
9. Face recognition
Face recognition is optional and off unless the customer enables it, and each person must consent before a face template is created. The kiosk turns on its camera only on the screens that need it. You can withdraw consent and delete your face template at any time from your profile, at the kiosk, or by contacting the customer or us.
10. Google user data
When you sign in with Google or connect Google Calendar, Uketsuke receives data from Google APIs:
Data accessed: for sign-in, your basic profile and email address; for Google Calendar, read-only access to calendar events (title, time, location and attendees). We do not change or delete your calendar events.
How we use it: only to sign you in and to pre-register visitors from your calendar events, so they can check in when they arrive.
Sharing: Google user data is not shared with or sold to third parties, except with the service providers in section 7 needed to run Uketsuke, when required by law, or with your consent.
Not used for advertising and not used to train AI or machine-learning models. People at ACALL do not read your calendar data except with your permission, for security purposes, or when required by law.
Storage: tokens and calendar data are stored encrypted in Japan.
Deletion: when you disconnect your calendar in Uketsuke (Profile > Calendar), we delete your Google access tokens and stop syncing. You can also revoke access at Google Account permissions, and ask us to delete your data.
Uketsuke's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
11. Your rights
You may ask for access to, correction of, deletion of, or a copy (data export) of your personal information, and you may withdraw consent (for example for face recognition) at any time. Employees can update their profile and disconnect calendars in Uketsuke; customer admins can export their company's data.
Because customers control the data about their employees and visitors, we may forward your request to the customer concerned. To make a request, contact the company you visited or work for, or email shreyansh.pandey@acall.inc.
12. Cookies
Uketsuke uses only strictly necessary cookies: one that keeps you signed in, and short-lived cookies that protect a sign-in or a connection while it is in progress (for example when you connect a calendar). We do not use analytics, advertising or tracking cookies, and we do not load third-party scripts.
13. Children
Uketsuke is a business service and is not directed at children.
14. Changes to this policy
We may update this policy. We will post the new version here with a new date, and tell customers about significant changes in advance.