Back to Trust Center

TinySonae — Privacy Policy

Effective: July 1, 2026

Tiny Fish, Inc. (“TinyFish,” “we,” “us,” or “our”) is committed to safeguarding your privacy. This Privacy Policy describes how we collect, use, disclose, and protect your information when you access the TinySonae website, product, and services (collectively, the “Services”). For the TinySonae service, this Policy is supplemented by the TinySonae / Japan (APPI) Supplement below, which controls in case of any conflict.

Personal Information We Collect

We obtain information you directly provide when creating an account, using the Services, contacting us, or otherwise engaging with the TinySonae service. The following categories of information may be collected:

  • Registration Information: name, email address, company name, and account credentials during account creation.
  • Device Information: device type, operating system, browser type, IP address, and unique device identifiers.
  • Usage Analytics: interaction data including pages visited, features used, and session duration.
  • Cookies and Tracking: technologies used to recognize your browser or device, retain preferences, and understand usage patterns.
  • Payment Information: billing address and payment details for paid subscriptions. Third-party processors handle payment processing, and we do not retain complete card information.

How We Use Information

Collected information supports these purposes:

  • Providing the Services: operating, maintaining, and improving the Services, including request processing and customer support.
  • Communications: sending technical notices, updates, security alerts, and (where permitted) promotional messages, with opt-out available.
  • Fraud Prevention: detecting, preventing, and addressing technical issues, security incidents, and fraudulent activity.
  • Legal Compliance: meeting applicable laws, regulations, and legal process, and responding to lawful governmental requests.
  • Product and Model Improvement: creating and using aggregated and de-identified data derived from your use of the Services to analyze, develop, and improve our products, services, and models. This data does not identify you and cannot reasonably be re-identified.
  • Public-Source Reports: when an operator requests a public-source report, TinySonae processes publicly available web content transiently to generate the report; the fetched content is not retained, and only the generated report (with source references) is stored as customer content.

Third-Party Sharing

Information may be shared with third parties in these circumstances:

  • Sub-processors and Service Providers: third parties that host, process, or analyze data to deliver the Services, as described in Section P4 of the Supplement.
  • Reseller: where you access TinySonae through an authorized reseller (for the TinySonae service in Japan, NEC Networks & System Integration Corporation, “NESIC”), we share account, administrative, and usage information with the reseller as needed to manage provisioning, support, and billing. The reseller does not have access to your tenant’s content, incidents, or audit-log data.
  • Affiliates: corporate affiliates, for the business purposes described in this Policy.
  • Payment Processors: to complete transactions.
  • Legal Requirements: where required by law, court order, or governmental request.

We do not sell personal information to third parties.

Sign in with Google

The TinySonae service offers the option to sign in with your Google account. If you choose to do so, Google provides us with basic profile information associated with your Google account — your name, email address, and profile identifier — solely to create and authenticate your TinySonae account. We use this information only to provide and secure the Service, and we do not use Google user data for advertising or disclose it to third parties except as described in this Policy or as necessary to provide the Service. TinyFish’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. You can review or revoke TinySonae’s access to your Google account at any time in your Google account settings.

Your Rights

Your location determines the rights available to you regarding your personal information:

  • EU and UK (GDPR): rights to access, correct, delete, or restrict processing, data portability, and objection to certain processing.
  • California (CCPA/CPRA): rights to know, delete, correct, and opt out of sales (we do not sell personal information).
  • Japan (APPI): rights to request disclosure, correction, addition, deletion, cessation of use, and cessation of third-party provision of your retained personal data, and to lodge a complaint with the Personal Information Protection Commission (PPC). See Section P7 of the Supplement.
  • Other Jurisdictions: additional rights may apply under local law.

Contact us using the information below to exercise your rights.

Data Security

We employ appropriate technical and organizational measures to protect personal information against unauthorized access, alteration, disclosure, or destruction. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Data Retention

We retain personal information for as long as necessary to fulfill the purposes described in this Policy, unless a longer retention period is required or permitted by law. Information no longer needed is securely deleted or anonymized.

International Data Transfers

Personal information that TinyFish processes in providing the TinySonae service is hosted and processed in Japan — including Customer content, incident data, account information, AI and model inference, system and diagnostic logs, telemetry, transactional email delivery, and backups. TinyFish does not transfer this personal information outside Japan. Because processing remains within Japan, the APPI’s cross-border-transfer provisions do not apply to the TinySonae service.

Children’s Privacy

The Services are intended for adults and are not directed to individuals under 18. We do not knowingly collect information from children.

Updates to This Policy

We may update this Policy from time to time. Material changes will be notified by posting the updated Policy here and updating the “Effective Date.” Continued use of the Services after changes take effect indicates acceptance.

Contact Us

For questions about this Policy or to exercise your rights, contact:

Tiny Fish, Inc. Email: sonae@tinyfish.io Address: 4410 El Camino Real, Suite 220, Los Altos, CA 94022, USA

TinySonae / Japan (APPI) Supplement

This Supplement applies to personal information processed in connection with the TinySonae service and controls over the foregoing Policy in case of any conflict for that service.

P1. Scope & Roles

For customer and end-user (tenant) personal data that TinyFish processes on behalf of a customer, TinyFish acts as an entrusted party (委託先) under APPI Article 25 and the Data Processing Addendum (DPA) governs that processing; the customer is the entrusting party. This Policy describes TinyFish’s own collection and use of personal information (for example, account and usage data).

P2. Applicable Law

For the TinySonae service, “applicable data protection law” includes the Act on the Protection of Personal Information (APPI, Act No. 57 of 2003, as amended) and the cabinet orders, rules, and guidelines issued by the Personal Information Protection Commission (PPC).

P3. Data Residency

All personal information that TinyFish processes in providing the TinySonae service is hosted and processed in Japan. TinyFish’s production environment, AI and model inference, authentication and identity, storage, system and diagnostic logs, telemetry, transactional email, and backups are provisioned in Japan-resident regions. TinyFish does not transfer personal information relating to the TinySonae service outside Japan, and does not rely on any APPI cross-border-transfer mechanism for the service. Sub-processors and their Japan regions are listed in Section P4.

P4. Sub-processors

TinyFish uses the following sub-processors for the TinySonae service, each provisioned in Japan-resident regions: Google LLC (Google Cloud — Vertex AI, Tokyo / asia-northeast1) for AI and model inference; Amazon Web Services, Inc. (Tokyo / ap-northeast-1, with disaster-recovery capacity in Osaka / ap-northeast-3) for hosting, compute, and storage; Supabase, Inc. for authentication and identity; a transactional email provider (Japan region) for invitation and sign-in messages; and a logging and observability provider (Japan region) for system and diagnostic logs. Each processes personal information within Japan. The current list of sub-processors, their regions, the nature of their processing, and change-notification terms are maintained in the Data Processing Addendum (DPA, Appendix 1).

P5. Security

TinyFish maintains an information security program aligned with the ISO/IEC 27001 framework, which serves as the baseline for the technical and organizational measures described in the DPA, and implements the security control measures required under APPI Article 23.

P6. Breach Notification

Upon becoming aware of a leakage, loss, or damage of personal data that triggers reporting obligations under the APPI, TinyFish will, within twenty-four (24) hours, provide the affected customer with the information necessary to enable the customer’s report to the PPC and notification to affected individuals as required under APPI Article 26.

P7. Your Rights under the APPI

Individuals may request disclosure, correction, addition, deletion, cessation of use, and cessation of third-party provision of their retained personal data (保有個人データ) under the APPI. For data processed by TinyFish on behalf of a customer, such requests are directed to and handled by the customer (as the entrusting party), and TinyFish will assist the customer as set out in the DPA. You may also lodge a complaint with the PPC.

P8. Retention & Deletion

Personal data processed on behalf of a customer is retained and deleted as set out in the DPA and the customer’s instructions, including return or deletion on termination.

P9. Contact

Questions about TinySonae privacy may be directed to sonae@tinyfish.io. For data TinyFish processes on behalf of a customer, please also contact the relevant customer as the entrusting party.