1Introduction
Ryu-raku Co., Ltd. ("we," "us," or "our") operates the MUTE service ("Service"). We are committed to protecting your personal information. This Privacy Policy describes what information we collect, how we use it, how we protect it, and your rights.
By using the Service, you agree to the collection and use of information as described in this Policy.
2Data Controller
Company Ryu-raku Co., Ltd.
Service MUTE
Location Osaka, Japan (see Company Page)
Contact Contact Form
Website https://www.ryu-raku.co.jp/
3Information We Collect
3.1 Information You Provide at Registration
- Your name
- Company name or business name
- Website domain
- Email address
- Registration date and time
3.2 Information Automatically Collected
- Bot detection logs (source IP address, User-Agent string, first 100 characters of honeypot field input, timestamp, source country code)
- Login link tokens and session tokens (temporary random strings issued at login)
- Spam IP list (source IP addresses identified as bots, the name of the detection layer, and the reporting registered domain)
⚠ We do not collect personal information of your website visitors (names, addresses, phone numbers, etc.). Bot log values are limited to the first 100 characters and auto-deleted after 30 days. Source IP addresses identified as bots are retained for 90 days as a spam IP list, in order to protect other registered domains from the same bot, and are then deleted automatically.
3.3 Information We Do Not Collect
- Credit card or payment information (processed directly by Stripe)
- Personal information of general visitors to your website
- Passwords (we use passwordless authentication)
3.4 If You Use the Shopify App
When installing MUTE via the Shopify App, installation is completed through Shopify's OAuth authentication. We collect your store domain, email address, and shop name. We do not access customer data, order information, product data, or any other store data.
4How We Use Your Information
| Purpose | Data Used |
|---|---|
| Providing and operating the Service | Name, company, domain, email |
| Account authentication and login | Email, session token |
| Plan and subscription management | Email, registration date |
| Service notifications and report emails | |
| Bot log aggregation and reports | Bot log data |
| Fraud detection and prevention | IP address, User-Agent |
| Service improvement and statistical analysis | Anonymized aggregate data |
| Legal compliance | As required by law |
5Data Retention
| Data Type | Storage Location | Retention Period |
|---|---|---|
| User registration data | Cloudflare KV (USA) | Deleted when you close your account |
| Bot detection logs | Cloudflare KV (USA) | 30 days (auto-deleted) |
| Login link tokens | Cloudflare KV (USA) | 10 minutes (auto-deleted) |
| Session tokens | Cloudflare KV (USA) | 1 hour (auto-deleted) |
| Spam IP list | Cloudflare KV (USA) | 90 days (auto-deleted) |
| Email logs | Resend, Inc. (USA) | Subject to Resend's data retention policy |
Aggregate data created for statistical analysis may be published, for example in research reports, after being processed so that no individual or registered domain can be identified. We never publish IP addresses, registered domains, or the content entered into forms.
6Disclosure to Third Parties
We do not sell or share your personal information, except in the following cases
- With your prior consent
- When required by law or court order
- To protect life, safety, or property
Sub-Processors
| Provider | Purpose | Location | Privacy Policy |
|---|---|---|---|
| Cloudflare, Inc. | API server, KV storage, CDN | USA | Link |
| Xserver Co., Ltd. | Web hosting | Japan | Privacy Policy |
| Resend, Inc. | Email delivery infrastructure | USA | Privacy Policy |
| Stripe, Inc. | Payment processing | USA | Link |
7International Data Transfers
Part of our infrastructure uses Cloudflare's services in the United States. Registration data and bot log data may be transferred outside Japan. We take appropriate measures to ensure compliance with applicable data protection laws, including Japan's APPI and GDPR where applicable.
8Cookies and Local Storage
We store your session token in browser local storage to maintain your login state. We do not use advertising or tracking cookies.
9Security
- TLS/HTTPS encryption for all communications
- Secret key authentication for API requests
- Short login link expiry (10 minutes) and session expiry (1 hour)
- Automatic deletion of the spam IP list (90 days)
- Automatic deletion of bot logs (30 days)
- Cloudflare global security (DDoS mitigation, WAF)
10Your Rights
You may have the following rights regarding your personal information
- Right to access your personal data
- Right to correct inaccurate data
- Right to erasure ("right to be forgotten")
- Right to restriction of processing
- Right to data portability
- Right to object to processing
To exercise these rights, please contact us via the Contact Page. We will respond within 30 days.
11Children's Privacy
The Service is not directed to individuals under 13. We do not knowingly collect data from children under 13.
12Changes to This Policy
We may update this Privacy Policy. For material changes, we will notify you via the Service or email at least 14 days before the change takes effect.