mui Privacy Policy

mui Lab, Inc. (the “Company”) handles personal information in accordance with the following
privacy policy (the “Policy”):

1. Definitions
For purposes of the Policy, the following terms shall have the meaning set forth below:(1) “Personal Information” means personal information as defined in Article 2 (1) of the Act
on the Protection of Personal Information (Act No. 57 of 2003, the “Personal Information
Protection Act”).
(2) “Personal Data” means personal data set forth in Article 16 (3) of the PersonalInformation Protection Act.
(3) “Retained Personal Data” means the retained personal data set forth in Article 16 (4) ofthe Personal Information Protection Act.

2. Name and Address of the Company and Name of its Representative
mui Lab, Inc.
295-1, Tawaraya-Cho, Ebisugawa-Dori Yanaginobanba Higashi-Iru, Nakagyo-Ku, Kyoto-Shi,
Kyoto
Representative Director Kazunori Oki

3. Compliance with Laws and Regulations
The Company properly handles personal information in compliance with laws and regulations,
including the Personal Information Protection Act, and guidelines established by the PersonalInformation Protection Commission.

4. Purpose of Utilization
The Company uses Personal Information for the following purpose:(1) Personal Information of customers (in case of corporate customers, including all of theirofficers and employees):① For identification or authentication of customers at the time of registration or login

for services provided by the Company;② For responding to, confirming, or recording customers’ inquiries, consultations,complaints, support, etc.;③ For negotiations with customers and other necessary interactions in the course ofbusiness;④ For management of customers’ information;⑤ For providing the Company’s products and services;⑥ For bills and payments for the Company’s products and services;⑦ For development, maintenance, improvement, and enhancement of the Company’sproducts and services;⑧ For researching, analyzing, and examining for the purposes of development,
maintenance, improvement, and enhancement of the Company’s products andservices (including processing into statistical information, anonymously processedinformation, and pseudonymously processed information, utilization of theprocessed information, and disclosure and publication of the processed information
to the extent permitted by law);⑨ For understanding and analyzing data such as usage history, browsing history,
location information, etc. of the Company’s products, services, apps, websites, etc.
and providing services or information related to services based on such understoodand analyzed data;⑩ For providing information on products, services, campaigns, events, surveys, andother information, advertising, and other marketing activities of the Company or its
business partners by letter, e-mail, chat, or other methods (including measuring theeffectiveness of such activities);⑪ For providing the Company’s services safely (including investigation, detection, andconfirmation of those who are violating laws and regulations, violating contracts,
committing fraud, and other problematic acts, contacting such persons, investigating,detecting, and preventing problematic acts, and responding to such acts);⑫ For notifying customers of changes to the Company’s terms and conditions, policies,etc. regarding the Company’s services; and⑬ For purposes incidental or related to the above purposes of utilization.
(2) Personal Information of applicants for recruitment activities:

① For review and decision of employment;② For contacting, interviewing, and otherwise communicating with applicants; and③ For purposes incidental or related to the above purpose of utilization.
(3) Personal Information of the Company’s employees:① For business communication;② For payment of salaries, etc.;③ For personnel and labor management operations; and④ For purposes incidental or related to the above purpose of utilization.

5. Third Party Provision of Personal Data
The Company will not provide Personal Data to third parties except in the following cases:① cases in which there is a principal’s consent in advance;② cases based on laws and regulations;③ cases in which there is a need to protect a human life, body or fortune, and when it isdifficult to obtain a principal's consent;④ cases in which there is a special need to enhance public hygiene or promote fostering
healthy children, and when it is difficult to obtain a principal's consent;⑤ cases in which there is a need to cooperate in regard to a central governmentorganization or a local government, or a person entrusted by them performing affairs
prescribed by laws and regulations, and when there is a possibility that obtaining a
principal's consent would interfere with the performance of the said affairs;⑥ cases in which it is necessary for a third party that is an organization or group aimed atacademic studies, etc., to handle Personal Data for academic research purposes(including cases in which part of the purpose of handling such Personal Data is foracademic research purposes, excluding cases in which there is a risk of unjustified
infringement on the rights and interests of individuals);⑦ cases in which the handling of Personal Data is entrusted within the necessary scope toachieve the purpose of utilization;⑧ cases in which Personal Data is provided accompanied with business succession caused
by a merger or other reason; and⑨ cases in which Personal Data to be jointly utilized by a specified person is provided tothe specified person (limited to cases in which a principal has in advance been informedor a state has been in place where a principal can easily know to that effect as well as of
the categories of the jointly utilized Personal Data, the scope of a jointly utilizing
person, the utilization purpose for the utilizing person and the name or appellation andaddress, and the name of the representative in case of corporations, of a person
responsible for controlling such Personal Data).

6. Security control action for Personal Data
(1) The Company takes necessary and safe security control action for the management of
Personal Data, including preventing the leakage, loss, or damage of Personal Data.
(2) The Company exercises necessary and appropriate supervision over its employees
handling Personal Data and trustees (including re-trustees) entrusted with handling
Personal Data to ensure the security control of Personal Data.
(3) An overview of the security control action taken by the Company is as follows:① Establishment of basic handling methods when acquiring, using, and storing PersonalData;② Organizational security control action (e.g., selection and assignment of persons
responsible for handling Personal Data);③ Human security control action (e.g., training of the Company’s employees who handle
Personal Data);④ Physical security control action (e.g., implementation of measures to prevent theft orloss of electronic devices handling Personal Data); and⑤ Technical security control action (e.g., measures to control access to electronic
devices handling Personal Data).

7. Handling of Personal Data in foreign countries
If the Company entrusts the handling of Personal Data to an external party located outsideof Japan, the Company takes the necessary and appropriate security control action andrequires in the contract with the trustee equivalent to the security control action for
Personal Data at the trustee.

8. Requests for disclosure, etc. of Retained Personal Data
Procedures, etc., in the event of a request, etc., as described in (1) below, involving Retained

Personal Data, are as described in (2) below.
(1) Contents of requests., etc.
a. Request for notification of purpose of utilization.
b. Request for disclosure.
c. Disclosure of records when having provided Personal Data to third parties.
d. Request for correction, addition, or deletion of contents.
e. Request for utilization cease or deletion.
f.

Request for cease of provision to a third party.

(2) Procedures, etc.
a. Please contact the “Inquiries” described in Section 11 below.
b. Please submit identification documents designated by the Company, based on
which the Company will verify your identity (in the case of a request from arepresentative, this will include verification of the right of representation).
c. The Company will decide whether or not to respond to the request.
d. Based on the decision in c., the Company will respond to the request, etc. (if theCompany does not respond to the request, etc., the Company will notify thereof).
A fee of 1,100 yen per request (including consumption tax) plus postage and otheractual costs will be charged. Payment of the fee shall be made by bank transfer to theaccount designated by the Company (bank transfer fees shall be borne by thecustomer) or by any other method designated by the Company.

9. Automatically acquired information
For the purposes of Section 4 above, the Company may automatically acquire the following
information:(1) Terminal information
The Company may acquire information unique to the terminal used by the customer(e.g., ID or other individual identification information).
(2) Access log information
The Company may acquire the customer’s access log information (IP address, login
time, etc.).
(3) Location information

The Company may acquire location information sent from the customer’s smartphone,tablet, or other information terminal. The customer may stop the transmission oflocation information by changing the settings on the customer’s information terminal,
but the customer may not be able to use all or part of the services provided by theCompany.

10. Use of cookies, etc.
For the purposes of Section 4 above, the Company may use cookies or other identifiers.
By using cookies, etc., the Company may acquire the customer’s action history (URLaccessed, contents, order of reference, etc.), but the information acquired will not containany information that can identify the customer personally.
The customer may reject the sending and receiving of cookies, etc. by setting their browsers,etc. However, in this case, the customer may not be able to use all or part of the services
provided by the Company.

11. Acquisition and use of user data on external services(1) Information collection modules
For the purpose of Section 4 above, the Company acquires user information through thefollowing information collection modules incorporated into the mui Mobile App:
① Google Analytics
Name of the provider of the information collection module: Google LLC and its wholly subsidiary
User information to be acquired: usage of the Company’s application
Utilization of user information by information collection module provider: User information will be stored on a server system managed by Google.
For more information regarding Google Analytics, please refer to the following:<Privacy Policy>
https://policies.google.com/privacy② Amazon Pinpoint
Name of the provider of the information collection module: Amazon Web Services, Inc.

Utilization of user information by information collection module provider: User information acquired by the Company will be transferred to the server
installed by Amazon Web Services, Inc.(“AWS”).
For more information regarding Amazon Pinpoint, please refer to the following:<Privacy Policy>
https://aws.amazon.com/compliance/data-privacy-faq/(2) When the customer uses the Company’s services and desires to use authentication or anyservice in conjunction with the following external services, the Company may acquire thecustomer’s user data registered with the external service (name, telephone number, email address, ID and other information related to external services that the customer has
authorized the Company to acquire):① “Google Account” provided by Google LLC;
② “Google Calendar” provided by Google LLC;
③ “Amazon ID” provided by Amazon.com, Inc.;④ “Apple ID” provided by Apple Inc.; and⑤ Other external services as determined by the Company.
The Company uses the acquired user data of the customer for the purposes described inSection 4 above.
The customer shall, at its own responsibility, use the external services while managing
the ID, etc. of the external services, and the Company shall not be liable to nor
responsible for the customer regarding the external services.

12. Inquiries
If the customer has any questions, comments, or concerns regarding the Company’s handlingof Personal Information, please contact us by e-mail at the following address. The Company
does not accept inquiries in person or by telephone:【Inquiries】
mui Lab, Inc.
support@muilab.com

13. Changes to the Policy(1) The Company may change the Policy at any time.

(2) The Company makes efforts to review and continuously improve the Policy in order tofurther ensure the proper handling of Personal Information.

The Policy was initially released on January 29, 2020.
The Policy was updated on May 20, 2020, Feb 5 2021 and February 15, 2023.