Privacy Policy

This is an English translation provided for reference.
The Japanese version is the authoritative text.
In the event of any discrepancy, the Japanese version shall prevail.

CF Asset Inc. (the "Company") establishes the following Privacy Policy (the "Policy") regarding the handling of Members' personal information in the audio distribution platform "CreatorFans" (the "Service"). All Members who use the Service (including Creators and Fans) shall be deemed to have agreed to this Policy.

Article 1 (Information Collected)

In providing the Service, the Company collects the following information from Members.

Information related to account registration

• Email address, password
• Member name (display name), profile images (icon, header, etc.)

Information related to Creator identity verification and payment

• Real name, date of birth, current address
• Image data of identity verification documents (driver's license, Individual Number Card (My Number Card), passport, etc.)
• Bank account information to which sales proceeds are transferred

Information related to payment

• Payment information such as credit card information (* Payment processing is carried out through an external payment agency, and the Company's systems do not retain complete credit card numbers or security codes.)

Information related to usage status

• Device information (OS, browser type, etc.), IP address, identifiers such as Cookies
• Behavioral history within the Service, such as access logs, purchase history, plan subscription history, and search history

Article 2 (Purpose of Use)

The Company appropriately uses the personal information it collects within the scope of the following purposes.

• To provide, operate, maintain, and improve the Service
• For screening as a Creator and for identity verification procedures
• For billing usage fees for the Service, processing payments, and paying/transferring sales proceeds to Creators
• To respond to inquiries and consultations from Members
• To monitor, prevent, and respond to acts that violate the terms, policies, etc. of the Service (unauthorized access, unauthorized reposting, abuse of chargebacks, etc.)
• To survey and analyze usage of the Service and to create marketing data
• To provide important notices to Members and information about new features, etc.

Article 3 (Special Provisions on the Handling of Creators' Identity Verification Information)

The Service is provided primarily for Members located in Japan. The Company does not actively solicit Members located in the European Economic Area (EEA) or the United Kingdom, but complies with the applicable laws governing use of the Service by Members located in these regions.

• Principle of immediate destruction: Such information is used solely for the purpose of Creator screening and identity verification, and is promptly and irrecoverably deleted from the Company's servers and databases once the screening is completed.
• Principle of non-disclosure: Information such as a Creator's real name and address will never be disclosed to other Members on the Service.

Article 4 (Restrictions on Disclosure of Information Between Creators and Fans)

The Company takes the following measures to ensure the anonymity and safety of Fans using the Service.

• The real name, email address, credit card information, or other confidential information of a Fan who has subscribed to a Creator's plan or purchased content will never be disclosed to that Creator.
• The information about a Fan that a Creator can view is limited to public information such as the "Member name" and "icon image" that the Fan has set on the Service.

Article 5 (Provision of Personal Information to Third Parties)

Except in the cases specified below, the Company will not provide personal information to third parties without obtaining the Member's prior consent, unless otherwise permitted under the Act on the Protection of Personal Information or other applicable laws.

• Where it is necessary to provide information to a payment agency or financial institution in order to carry out payment processing or transfer of sales proceeds for the Service
• Where it is necessary to respond to a request based on law (a lawful inquiry from a public authority such as the police or a court, etc.)
• Where it is necessary for the protection of a person's life, body, or property, and it is difficult to obtain the consent of the individual
• Where it is particularly necessary for improving public health or promoting the sound development of children, and it is difficult to obtain the consent of the individual

Article 6 (Outsourcing of Personal Information)

The Company may outsource all or part of the handling of personal information to external service providers (such as cloud server providers) to the extent necessary to achieve the purposes of use. In such cases, the Company will exercise necessary and appropriate supervision to ensure that the outsourced party maintains the security of the personal information.

Article 7 (Security Control Measures)

The Company takes necessary and appropriate security measures for the prevention of leakage, loss, or damage of personal information and other security management thereof, including access control, encryption via SSL communication, and promotion of the adoption of two-factor authentication (2FA).

Article 8 (Use of Cookies, etc.)

The Service may use Cookies and similar technologies to understand usage status and improve convenience. Members can refuse to accept Cookies through their browser settings, but in that case, some functions of the Service may become unavailable.

Article 9 (Requests for Disclosure, Correction, Suspension of Use, etc. of Personal Information)

Members may request the Company to disclose, correct, add to, delete, or suspend the use of their own personal information (collectively, "Disclosure, etc."). After confirming that the request is from the Member concerned, the Company will respond without delay in accordance with the Act on the Protection of Personal Information. However, this shall not apply where the Company is not obligated to provide Disclosure, etc. under applicable laws.

(* Note that identity verification data that has already been deleted pursuant to Article 3 is not subject to Disclosure, etc.)

Article 10 (Contact for Inquiries)

For opinions, questions, requests for Disclosure, etc., or other inquiries regarding the handling of personal information relating to this Policy, please contact the following.

• Operator: CF Asset Inc.
• Department in charge: CreatorFans Support Desk
• Email address: support@creatorfans.co

Article 10-2 (Special Provisions for Members Located in the European Economic Area, etc.)

• The Service is provided in Japanese primarily for Members located in Japan, and is not intended to be directed at residents of the European Economic Area (EEA) or the United Kingdom.
• Notwithstanding the preceding item, where the EU General Data Protection Regulation (GDPR) or the UK GDPR applies to the use of the Service by a Member located in the EEA or the United Kingdom, the provisions of this Article shall apply to the handling of that Member's personal data. Where the provisions of this Article conflict with other provisions of this Policy, this Article shall prevail in relation to that Member.
• The controller of personal data is CF Asset Inc. (1-9-7-3B Tokumaru, Itabashi-ku, Tokyo 175-0083, Japan). The contact point for inquiries regarding this Article shall be the support desk specified in Article 10 (support@creatorfans.co).
• The Company processes personal data based on the following legal grounds.
  • (1) Performance of a contract: processing necessary for Member registration, provision of content, payment, and provision of call and DM services
  • (2) Compliance with a legal obligation: processing necessary for identity verification (including age verification), and the performance of tax, accounting, and other obligations under applicable law
  • (3) Legitimate interests: processing necessary for the prevention of fraudulent use, ensuring security, and improving the Service (limited to the extent that it does not unduly prejudice the interests and rights of Members)
  • (4) Consent: optional processing such as Cookies, and other processing based on consent
• Members located in the EEA or the United Kingdom have the following rights with respect to their own personal data, subject to the requirements and exceptions set forth in applicable law. Such rights may be exercised by making a request to the contact point set out above, and the Company will, after confirming that the request is from the individual concerned, respond within the period specified by applicable law.
  • (1) Right of access
  • (2) Right to rectification
  • (3) Right to erasure
  • (4) Right to restriction of processing
  • (5) Right to data portability
  • (6) Right to object to processing
  • (7) Right to withdraw consent (without affecting the lawfulness of processing based on consent before its withdrawal)
  • (8) Right to lodge a complaint with a supervisory authority
• The Company processes personal data within Japan. Transfers of personal data from the EEA and the United Kingdom to Japan are made based on the adequacy decision for Japan adopted by the European Commission in 2019 and the equivalent decision made by the United Kingdom. The Company handles personal data originating from the EEA in accordance with the Supplementary Rules established by the Personal Information Protection Commission.
• The retention period for personal data shall be the period necessary to achieve each purpose of use or the period specified by applicable law. With respect to Creators' identity verification data, the principle of immediate destruction set forth in Article 3 shall apply.

Article 11 (Revision of the Privacy Policy)

The Company may change or revise the content of this Policy without prior notice, in response to changes in laws and regulations or business necessity. This Policy, as revised, shall become effective from the time it is posted on the Service, and use of the Service after such a change shall be deemed to constitute agreement to the revised Policy.

Effective date: May 1, 2026
Last revised: July 24, 2026
CF Asset Inc.