Sign up
English

Privacy Policy

Adopted: October 29, 2026 · Last revised: November 1, 2026

This English version is a reference translation. The Japanese version is the authoritative text, and it prevails if the two differ.

Read the Japanese version

Information we collect

  1. 株式会社ALGX (the "Operator") collects the following information to provide Sakuranbo AI (the "Service").
  2. Account: the email address and user ID received from the authentication provider, the account ID assigned by the Operator, the creation time, the status (including the time and reason of any suspension), and referral records (referral code, referrer, and referral grants). The Operator does not handle your password.
  3. Age confirmation and consent: the time you stated that you are 18 or older, and the time and version of the Terms of Service you agreed to.
  4. API keys: the full key is not stored. The Operator stores a hash for verification, the last four characters, the name, the spending limit, the expiry date, the revocation time, and the time of last use.
  5. Usage records: for each request, the model, status, amounts held and settled, the API key used, the idempotency key, a fingerprint (hash) of the input, errors, the list of generated outputs, and times, together with balance records (deposit units, usage entries, and holds). The Operator also stores a record of operations on your account (creation, age and terms consent, creating and revoking API keys, registering, changing, stopping and deleting webhook endpoints, allowing and revoking MCP client connections, and changing the low-balance alert setting): the type of operation, the ID of its target, the kind of actor (user, operator, or automated process), and the date and time. This record does not include prompts, generated outputs, webhook URLs, or full API keys.
  6. Input and output: prompts and reference images are processed for generation but are not stored in a database (they remain temporarily in the state of the running process). Chat responses are not stored. Generated images and videos are stored in the Operator's storage.
  7. Reference images: these are received as a URL or a data URI. For images given by URL, the Operator fetches and checks the image, and the AI model provider also fetches it.
  8. Payments: card details such as card numbers are entered directly into the payment provider's form, and the payment provider collects and manages them. They do not reach the Operator's servers. The Operator records the status of the deposit, the amount credited, the yen amount charged, the exchange rate, and the payment provider's transaction IDs. For crypto deposits, the Operator records the deposit addresses assigned to you and, for each transfer received, the sending and receiving addresses, the transaction ID, the amount, the exchange rate to USD, the amount credited, the confirmation status, and whether the deposit is on hold. For Bitcoin, the Operator also records invoices (the USD and BTC amounts, the exchange rate, and the expiry).
  9. Webhooks and connected apps: the webhook URLs you register, the events you subscribe to, encrypted signing secrets, and delivery records (including what was sent and part of the response). For connections with external apps such as MCP clients: the app's registration information, your authorization, and access token records.
  10. Settings: dashboard settings such as the threshold for low-balance alerts.
  11. Reports: the content of reports, optional contact details, and a hash of the reporter's IP address.
  12. Logs: for incident response and operation, the logs that the Operator writes record a one-line summary of each request (the kind of function called, method, status, duration, request ID, account ID, and API key ID) and identifiers such as the job ID, model, and error code. The kind of function is recorded as the shape of the URL (without the values of identifiers); the actual URL, request bodies, email addresses, API keys, and signed URLs are not recorded. Except for reporters, the Operator does not store the IP addresses of requests in its databases. For API requests, the Operator has configured the infrastructure provider's Workers logs not to record URLs. However, the infrastructure provider's systems may keep request records (such as URLs and connection information) for incident response for a certain period, for all requests including API requests.
  13. Cookies: the dashboard uses cookies for display language and theme settings (1 year), for the referrer from a referral link (30 days), and to verify the process of authorizing a connection with an external app. In addition, the authentication provider, bot protection, and payment provider use cookies and similar technologies to keep you signed in and to prevent fraud. No measurement tags or cookies for analytics or advertising are used.
  14. Inquiries: the content of emails you send and the sender's email address.

How we use information

  1. The Operator uses the information it collects for the following purposes.
    • Providing the Service (authenticating accounts, issuing and verifying API keys, running requests and delivering results, processing balances, billing, deposits, and refunds, and running the referral program)
    • Enforcing the acceptable use rules (receiving and handling reports, and restricting and suspending use), and responding as required by law
    • Complying with economic sanctions (checking the sending addresses of crypto deposits against the SDN List of the Office of Foreign Assets Control (OFAC) of the US Department of the Treasury)
    • Answering inquiries and investigating billing errors
    • Important notices about the Service, such as changes to the terms or outages (posted on the website and the dashboard)
    • Aggregation and analysis to investigate failures, prevent fraud, and improve the Service
  2. The Operator does not sell or rent personal information, and does not use it for advertising or personalization.
  3. The Operator changes the purposes of use only to the extent reasonably considered related to the previous purposes, and publishes the new purposes. For changes beyond this extent, the Operator obtains your consent in advance.

Retention

  1. Input such as prompts and reference images remains, in encrypted form, in the state of the running process and is deleted 1 day after the process completes, or 3 days after it fails. It is decrypted only inside the process that runs the generation, and it cannot be read from the Operator's admin console, the infrastructure provider's console, or the logs. It is not stored in a database. Chat responses are not stored.
  2. Generated images and videos are stored for 7 days. After that, their URLs are no longer returned, and the files are deleted from storage within about 24 hours.
  3. Output URLs contain a hard-to-guess string, and anyone who knows a URL can download the file without authentication until it expires. Even after deletion, files you saved, the browser caches of people who opened the URL (up to 1 hour), and copies passed to others cannot be deleted.
  4. AI model providers may keep the input and output they receive on their own conditions and for their own periods. The Operator cannot shorten the retention periods on the provider side.
  5. Account information, API key records (including after revocation), usage records, balance records, and deposit records are kept while the account exists, and after closure for as long as the law requires them to be kept.
  6. Webhook delivery records are kept for 30 days.
  7. Logs are kept for 7 days, and aggregated measurement data for 3 months.
  8. Records of reports are kept for as long as needed to handle them and to prevent fraud.
  9. Display setting cookies expire after 1 year, and referrer cookies after 30 days.
  10. The Operator takes the following security measures to prevent leaks of personal data.
    • Technical measures: API keys and reporters' IP addresses are stored as hashes, and webhook signing secrets and the prompts and reference images that remain in the state of a running process are encrypted. Fingerprints of inputs are keyed hashes. Request bodies and keys are not written to logs, access to the admin console is restricted, and admin operations are recorded. Communications are encrypted with HTTPS.
    • Understanding the external environment: the Operator uses infrastructure, authentication, payment, email, and business chat systems provided by companies in the United States, and AI models provided by companies in the United States and Singapore. Because the infrastructure provider processes requests in data centers around the world, not every country where data is stored or processed can be identified. The Operator takes security measures based on an understanding of the personal information protection systems of the United States and Singapore.
    • The basic policy, internal rules, and organizational, human, and physical measures are explained without delay on request to the contact address.

Sharing with processors

  1. Except in the cases listed in Article 27, Paragraph 1 of the Act on the Protection of Personal Information, the Operator does not provide personal data to third parties without your consent.
  2. To the extent needed to provide the Service, the Operator entrusts the handling of personal data to the following companies and supervises them.
    • Cloud infrastructure provider (Cloudflare): handles the information above in general as the platform for the website, API, databases, storage, logs, and receiving email.
    • Authentication provider (Clerk): handles email addresses, authentication information, and device and session information for sign-in, account management, and bot protection.
    • Payment provider (Stripe): for card payments, the Operator passes the amount, currency, transaction references, and email address. As described under Information we collect, the payment provider collects card details directly.
    • Business chat provider: to notify the Operator that an email has arrived at the contact address, handles the sender, the subject, and the beginning of the body (up to 500 characters).
    • Email provider: to receive and store, in the Operator's inbox, the emails to the contact address that the cloud infrastructure provider forwards, handles the whole email (the sender, subject, body, and attachments).
  3. For generation, prompts and reference images are sent to the AI model provider of the model you choose. The information sent is handled on that provider's conditions and for its periods.
  4. The processors and AI model providers include companies outside Japan (the infrastructure, authentication, payment, email, and business chat providers are US companies, and the AI model providers include companies in the United States and Singapore). Personal data is provided to third parties in foreign countries in accordance with Article 28 of the Act on the Protection of Personal Information. Data may be stored and processed in data centers outside Japan.
  5. The dashboard loads the following external systems, and information is sent directly from your device to each company.
    • Authentication provider (Clerk) and bot protection (Cloudflare Turnstile): device and browser information, interaction information, IP addresses, and so on, for processing sign-in and preventing fraud
    • Payment provider (Stripe): the card details you enter, device and browser information, IP addresses, and so on, for processing payments on the deposit screen and preventing fraud
  6. The Operator may provide necessary records to the relevant authorities when it responds to inquiries or warrants based on law, and when there is an imminent danger to a person's life or body (including serious harm to a child).

Your rights

  1. Under the Act on the Protection of Personal Information, you can request, for the personal data that the Operator holds about you, notification of the purposes of use, disclosure (including disclosure of records of provision to third parties), correction, addition, or deletion, suspension of use or erasure, and suspension of provision to third parties.
  2. Requests are accepted at the contact address. The Operator confirms your identity by checking that the request was sent from your registered email address and, if you have made a deposit, that the date and amount of your latest deposit match, and responds without delay as the law provides. There is no fee.
  3. On the dashboard, you can download your usage history as CSV, revoke API keys, delete webhooks, and disconnect external apps yourself.
  4. Account closure and deletion of information are accepted by request to the contact address. However, records that the law requires to be kept (such as balance and deposit records) and records preserved under the law cannot be deleted. Deletion from storage may take some time.
  5. The Service is intended for people 18 or older, and the Operator does not knowingly collect information about people under 18. If you believe that information about someone under 18 has been registered, contact the contact address. The Operator will check it and delete it.
  6. Complaints about how information is handled are accepted at the contact address. You can also consult the Personal Information Protection Commission of Japan.

Contact

  1. The contact address for inquiries, requests, and complaints about the handling of personal information is support@sakuranbo.ai.
  2. The business handling personal information is 株式会社ALGX. Its address and the name of its representative are provided without delay on request.
  3. Reports of content that violates the acceptable use rules are accepted on the report page.
  4. When this Policy changes, the Operator announces the new content and its effective date on this page before the effective date.
  5. The Japanese version of this Policy is the authoritative text, and the English, Chinese, and Korean versions are reference translations.