Privacy Policy · MailMana · Life Stack Japan

1. Introduction

MailMana ("we," "us," or "our") is a mobile application that helps expatriates living in Japan scan, automatically translate, and search Japanese-language documents including mail, utility bills, tax notices, government correspondence, and other paperwork.

This Privacy Policy explains what personal information we collect, how we use it, who we share it with, and your rights regarding your data. Because MailMana processes documents that may contain sensitive personal information — including financial records, government correspondence, and medical documents — we take data handling seriously.

By using MailMana, you agree to the practices described in this policy.

2. Who We Are

MailMana is operated by Life Stack Japan.

Contact: privacy@mailmana.app

3. What Data We Collect

3.1 Account Information

Email address (used for login)
Encrypted password (we never store plaintext passwords)

3.2 Documents and Content

Scanned images and uploaded files — photos, PDFs, and other documents you capture or upload through the app
Extracted text — the original Japanese text extracted from your documents via OCR
Translated text — English translations generated by our AI pipeline
Document metadata — file name, category, date added, processing status, sender/title fields extracted by AI, and whether a document is pinned or archived
Action items — payments, deadlines, and tasks extracted by AI from your documents
Document sections — structured bounding box data for overlay display on scanned images

3.3 Email Forwarding Content

If you use the email forwarding feature:

The body of emails you forward to your MailMana inbox address
Email metadata (sender, subject, date)
Attachments included in forwarded emails

3.4 Device and Notification Data

Push notification tokens associated with your device(s) — used solely to notify you when document processing is complete
No device identifiers or location data are collected
Product usage statistics (which screens are opened, whether a document contained readable text) are collected and linked to your account by a random identifier. They never contain the content of your documents.

3.5 What We Do Not Collect

We do not collect your name, phone number, address, or payment information
We do not serve ads and do not collect data for advertising purposes
We do not track your behaviour across other apps or websites

4. How We Use Your Data

Purpose	Legal Basis
Process and translate your documents	Contractual necessity (providing the service)
Store your documents for retrieval and search	Contractual necessity
Send push notifications when processing completes	Contractual necessity / Legitimate interest
Detect and deliver emails forwarded to your MailMana address	Contractual necessity
Extract action items (deadlines, payments) from documents	Contractual necessity
Debug service errors and improve reliability	Legitimate interest

We do not use your document content to train AI models. Documents are processed transiently for translation and then stored at rest in your account only.

5. Third-Party Services and Data Sharing

We do not sell your data, and we do not allow any provider to train models on it.

We use specialist providers for the categories of processing below. Each one is bound by a written data processing agreement that limits it to processing your data only to provide the service described, and the country column is where that processing takes place. We will tell you which provider performs any category if you ask at privacy@mailmana.app.

Category	What it receives	Where it processes
Database, authentication and file storage	Your account details, your documents and the text extracted from them	Japan
AI translation and document analysis	The text extracted from your documents	Japan and the European Union
Optical character recognition for images and PDFs	The document file itself	European Union
Job queueing and retry orchestration	For forwarded email, the subject, sender and body; otherwise only identifiers	United States
Document-processing compute	Document content while it is being processed; nothing is kept	Singapore
Inbound and outbound email	Email you forward to your MailMana address, with attachments; the address our account emails are sent to	United States
Crash and error monitoring	Diagnostic and crash information	European Union
Product usage statistics	Usage events, linked to your account by a random identifier. Never your email address, and never the content of your documents	European Union
AI pipeline quality monitoring	Usage measurements and metadata. Document text is removed before it is sent	United States
Push notification delivery	Your device's notification token, and the notification text, which may include a document name or an email subject	United States
Subscription management	Purchase records and your account identifier	United States
Hosting of the page that email confirmation links open	The sign-in link, while it is being opened	United States
Email routing for our support, legal and privacy addresses	Only what you choose to write to us	Routed over a global network; not tied to one country

Purchases are handled by Apple and Google as the sellers. Your payment card details go to them directly and are never seen by us or by our subscription provider.

6. Cross-Border Data Transfers

MailMana is operated from Japan. Your documents and their translations are stored there, and one short AI check of the extracted text runs there too. The two steps that do the heavy reading, text extraction and AI translation, run in the European Union, whose data protection rules Japan recognises as equivalent to its own.

Where your document data goes:

Stays in Japan. Your account, your files and the translated text are stored in Tokyo. One AI step also runs in Tokyo: a check on the extracted text that decides whether it was read from your document or is a description of a picture, so that a photo without text is not filed as a document.
Goes to the European Union. Optical character recognition is performed by our OCR provider in the EU, so the file itself is transferred there and returned as text. The extracted text is then sent to our AI provider in the EU, which translates and analyses it and returns the translation, summary and action items. Crash diagnostics and usage statistics are also handled in the EU. Those usage statistics are linked to your account by a random identifier, so they are not anonymous, but they never contain the content of your documents.
Goes to Singapore. Our processing service runs in Singapore. Document content passes through it while it is being processed and is not retained there.
Goes to the United States. Email you forward to MailMana is received by a US provider, and the job that processes it is queued by a US provider, so the content of forwarded email is transferred to the United States. Subscription records, push notifications, the page that email confirmation links open, and quality measurements of our AI pipeline — with document text removed before they are sent — are also handled in the United States.

Safeguards. Life Stack Japan is a Japanese business, so transfers of your personal data out of Japan are governed by Japan's Act on the Protection of Personal Information (APPI). APPI allows us to transfer your data abroad only where one of three conditions holds, and we rely on the first two:

To the European Union. The Personal Information Protection Commission has designated the EU as having a data protection regime equivalent to Japan's, and the EU has made the same finding about Japan. Transfers to our providers in the EU need no further mechanism.
To Singapore and the United States. Neither country holds that designation, so we transfer to our providers there on the basis that each has put in place a system meeting the standards the Commission has set. Each one is bound by a written data processing agreement that imposes on it the same obligations APPI imposes on us: to use your data only to provide the service we have engaged it for, to keep it secure, to tell us of any breach, to bind any sub-processor it uses to the same terms, and to delete the data when the service ends. Those agreements are built on the European Commission's Standard Contractual Clauses, which the Commission's guidance recognises as one way of establishing that system.

We do not rely on your consent for any of these transfers, and we do not rely on the EU–U.S. Data Privacy Framework, which governs transfers from the EU rather than from Japan.

Keeping the safeguards in place. APPI also requires us to make sure those commitments continue to be honoured. We review each provider's data processing agreement and the law of the country it operates in at least once a year and whenever the provider changes its terms, and we would stop or change a transfer if a provider's commitments, or the law where it operates, could no longer be relied upon. Nothing of the kind has occurred to date.

Your right to ask. If you are in Japan, you may ask us, for any transfer of your personal data outside Japan, which provider and country the data goes to, what that country's data protection rules are, what measures the provider has taken to protect your data, and how and how often we check that those measures remain in place. Write to privacy@mailmana.app and we will answer in writing.

7. Data Retention

Data	Retention period
Documents and translations	Retained until you delete them, delete your account, or your account is closed for inactivity (see 7.1)
Account credentials	Retained until you delete your account, or it is closed for inactivity (see 7.1)
Push notification tokens	Retained while your device is registered; removed when you sign out, delete your account, or your account is closed for inactivity
Email forwarding token	Retained until you delete your account, or it is closed for inactivity (see 7.1)
AI observability traces	Subject to the provider's retention policy (typically 90 days)
Error monitoring logs	Subject to the provider's retention policy (typically 90 days)

7.1 Inactive Accounts

Paid accounts are never deleted for inactivity. While you hold an active subscription — including a billing grace period, and any time remaining on a period you have already paid for — your account is never eligible for deletion, however little you use it. The period below only begins once your subscription has ended.

If you do not use MailMana for 12 consecutive months, we will close and permanently delete your account. Signing in or adding a document counts as use, and either one resets the 12-month period. If you previously subscribed, the 12 months are counted from the end of the last period you paid for, not from your last sign-in.

We will never delete an account without warning you first. Before the deletion date we send:

a first notice 90 days before
a reminder 30 days before
a final reminder 3 days before
a confirmation once the account has been deleted

Signing in at any point during those 90 days cancels the deletion and starts the 12-month period again. If the deletion goes ahead, it removes exactly the same data as deleting your account yourself (see section 8), and it is permanent and irreversible.

This inactive-account policy is not yet in force. No account has been or will be deleted for inactivity until we announce a start date in the app and give at least 90 days' notice beforehand.

8. Deleting Your Data

You can delete your account directly from the Settings screen in the app. When you delete your account:

All document images are deleted from storage
All document records, translations, action items, and metadata are deleted from the database
Your authentication account is removed
Your push notification tokens are removed

This deletion is permanent and irreversible.

You may also delete individual documents at any time from within the app.

9. APPI Compliance (Japan)

MailMana is designed with Japanese residents in mind and takes compliance with Japan's Act on the Protection of Personal Information (APPI) seriously.

Text extraction (OCR) and AI translation and document analysis are performed by third-party services in the EU, under the Personal Information Protection Commission's designation of the EU as an equivalent jurisdiction described in Section 6. Document images are transmitted to the OCR service, and the extracted text to the AI service
We maintain data processing agreements with all third-party service providers
Cross-border transfers of data to service providers outside Japan occur as described in Section 6 above
Users have the right to request disclosure, correction, or deletion of their personal information by contacting us at the address in Section 2

Note: This policy was drafted based on the 2022 APPI amendments. We recommend periodic legal review to ensure ongoing compliance.

10. Security

We take reasonable technical and organisational measures to protect your data:

All data is transmitted over HTTPS/TLS
Database-level row security ensures each user can only access their own documents
Authentication is managed by a dedicated auth provider; passwords are never stored in plaintext
File uploads are validated for size (max 10 MB) and content before processing

No system is perfectly secure. If you become aware of a security concern, please contact us at the address in Section 2.

11. Children's Privacy

MailMana is not directed at children under 13 years of age. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will delete it.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this document. For significant changes, we will notify you through the app. Continued use of MailMana after changes take effect constitutes your acceptance of the revised policy.

13. Contact

If you have questions about this Privacy Policy or wish to exercise your data rights, please contact:

Life Stack Japan
Email: privacy@mailmana.app

Privacy contact: privacy@mailmana.app