Privacy Policy

Last Updated: September 2026

This Privacy Policy describes how Osarizawa ("we," "us," or "our") collects, uses, discloses, and protects your personal information when you access or use the osarizawa.com website and associated Software-as-a-Service (SaaS) platform located at osarizawa.com (collectively, the "Services"). We are committed to complying with the Federal Trade Commission Act § 5, 15 U.S.C. § 45 (FTC Act — unfair/deceptive practices), which requires us to adhere to the privacy promises we make in this policy. By accessing or using the Services, you acknowledge that you have read, understood, and agree to the practices described in this Privacy Policy. If you do not agree with these practices, you must immediately cease using the Services.

The United States does not currently have a single, comprehensive federal privacy statute. Instead, our data practices are designed to comply with a patchwork of federal sectoral laws and state comprehensive privacy laws. This includes the California Consumer Privacy Act as amended by the CPRA (Cal. Civ. Code § 1798.100 et seq.), the Virginia Consumer Data Protection Act (Va. Code § 59.1-575 et seq.), the Colorado Privacy Act (C.R.S. § 6-1-1300 et seq.), the Connecticut Data Privacy Act (Conn. Gen. Stat. § 42-515 et seq.), the Utah Consumer Privacy Act (Utah Code § 13-11-101 et seq.), and other State comprehensive privacy laws (TX, OR, MT, FL, TN, etc.). This policy provides the required notices and describes the rights available to you depending on your state of residence.

This Privacy Policy applies solely to the information we collect through the Services. It does not apply to information collected by third parties or through offline channels. Our Services are generally intended for business and commercial users. If you are an employee or end-user of a business that subscribes to our SaaS platform, please direct your privacy inquiries to your employer, as they act as the data controller for your personal information. For more information regarding our terms of use, please review our Terms and Conditions and Terms of Service.

1. Information We Collect

We collect information necessary to provide, maintain, and improve our SaaS offerings, as well as to comply with our legal obligations. The specific types of personal information we collect depend on how you interact with the Services. Under the notice-and-choice model prevalent in the United States, we collect data directly from you when you voluntarily provide it, such as when you create an account, subscribe to our newsletter, or communicate with our support team.

We collect personal identifiers and contact information, such as your first and last name, email address, phone number, and business address. We also collect professional and employment data, including your job title, company name, and department. If you purchase a subscription, we collect billing information, which is processed securely by our third-party payment processors. While we do not seek to collect financial data covered by the Gramm-Leach-Bliley Act, 15 U.S.C. §§ 6801-6809 (GLBA) for financial institutions, we handle all payment data in accordance with strict industry standards.

Additionally, we automatically collect technical and usage data when you access the Services. This includes Internet Protocol (IP) addresses, browser type and version, time zone settings, operating system, and information about your device. We also collect log data, interaction data, and telemetry regarding your use of the SaaS platform, such as features utilized, clickstream data, and session duration. This information is essential for security, troubleshooting, and analytics purposes.

We may also receive information from third parties, such as marketing partners or data enrichment services, to enhance the data we hold about you or to provide better targeted business services. If you upload data to the Services as part of your business use, you are responsible for ensuring you have the appropriate rights to process that data. We do not knowingly collect sensitive personal information, such as health data covered by the Health Insurance Portability and Accountability Act (HIPAA) where applicable, unless strictly necessary for a specific service feature you have requested.

2. How We Use Your Information

We use the information we collect for legitimate business purposes, including providing the SaaS functionality you have requested, managing your account, and communicating with you about service updates. Specifically, we use your contact information to verify your identity, provide technical support, and send you critical administrative notices, such as security alerts and policy updates. Your usage data is utilized to monitor system health, prevent fraud, and ensure the security of our platform.

We also use your information to improve and optimize the Services. By analyzing how users interact with our platform, we can identify trends, fix bugs, and develop new features. Furthermore, we may use your professional data to send you marketing and promotional communications regarding our SaaS products, provided you have not opted out of receiving such communications. You can unsubscribe from marketing emails at any time by clicking the link provided in the email or by contacting us at [email protected].

Compliance with legal obligations is a primary use of your information. We process data to comply with federal and state laws, respond to legal requests, and cooperate with law enforcement agencies. If you engage in a transaction through the Services, we use your billing information to process payments, issue invoices, and maintain accurate financial records in compliance with the Restore Online Shoppers' Confidence Act, 15 U.S.C. §§ 8401-8405 (ROSCA), which governs negative-option billing practices and requires clear disclosure and consent.

In certain circumstances, we may use your information to enforce our agreements, including our Terms and Conditions. We continuously evaluate our data processing activities to ensure they align with the Uniform Commercial Code (UCC) Article 2 as adopted by the states and the Uniform Computer Information Transactions Act (UCITA, adopted only in MD/VA/LA) where applicable to digital goods and SaaS contracts. We will not process your personal information for purposes that are materially inconsistent with the purposes disclosed in this policy without providing you with prior notice and an opportunity to opt-out where required by law.

3. Information Sharing

We do not sell your personal information to third parties for monetary consideration. However, under the California Consumer Privacy Act as amended by the CPRA (Cal. Civ. Code § 1798.100 et seq.), the term "sharing" includes making personal information available to third parties for cross-context behavioral advertising. We may share your personal information with various categories of third parties to facilitate the operation of our SaaS platform. These categories include cloud hosting providers, customer support tools, analytics platforms, and payment processors.

We share your information with these service providers and vendors under written contracts that strictly limit their use of the data to performing services on our behalf. We prohibit our vendors from using your personal information for their own purposes. We may also share your information with our affiliates, subsidiaries, and parent companies for internal administrative and operational purposes. In the event of a merger, acquisition, reorganization, or sale of substantially all of our assets, your personal information may be transferred as part of that transaction, subject to the confidentiality and data protection obligations described in this policy.

We may disclose your personal information to comply with applicable laws, legal processes, or government requests. This includes responding to court orders, subpoenas, or lawful requests from public authorities. We reserve the right to disclose information to protect our rights, property, safety, or the safety of our users and the public. We may also share information to investigate and prevent fraud, security breaches, or other malicious activity.

Our disclosure practices are designed to comply with the SAFE WEB Act permanently reauthorized 2015 (21st Century DOJ/Apps Act-era codification, 15 U.S.C. § 8401 note), which facilitates cross-border cooperation between consumer protection agencies. If we are required to share data under state comprehensive privacy laws (TX, OR, MT, FL, TN, etc.), we will ensure such disclosures are limited to what is strictly necessary and permitted by law. For more details on how we handle tracking technologies that may involve sharing data with advertising networks, please review our Cookie Policy.

4. Cookies and Tracking

We use cookies, web beacons, pixels, and other tracking technologies on the Services to recognize your browser, remember your preferences, measure the effectiveness of our campaigns, and understand how you use the platform. Cookies are small data files stored on your hard drive or device that help us improve your browsing experience and gather aggregate usage statistics. We employ both session cookies, which expire when you close your browser, and persistent cookies, which remain on your device for a set period or until you delete them.

We categorize our use of tracking technologies into strictly necessary, functional, performance, and targeting/advertising cookies. Strictly necessary cookies are essential for the basic functionality of the SaaS platform and cannot be disabled. Performance and functional cookies allow us to count visits and traffic sources so we can measure and improve site performance. For advertising cookies, we honor industry opt-out mechanisms, such as the Digital Advertising Alliance (DAA) and AdChoices frameworks, to provide you with choices regarding interest-based advertising.

Under the California Consumer Privacy Act as amended by CPRA — 'Do Not Sell or Share My Personal Information' / Global Privacy Control obligations (Cal. Civ. Code § 1798.120, § 1798.135), we are required to respect Global Privacy Control (GPC) signals transmitted by your browser. If we detect a GPC signal, we will treat it as a request to opt-out of the "sale" or "sharing" of your personal information for cross-context behavioral advertising. You can also manage your cookie preferences at any time through our cookie consent banner or your browser settings.

Please be aware that the use of certain tracking technologies, such as session replay tools or pixel trackers, may be subject to scrutiny under state wiretapping and pen register statutes. We operate in compliance with the Electronic Communications Privacy Act, 18 U.S.C. § 2511 (limited application) and state wiretapping/cpw statutes (e.g., California Invasion of Privacy Act § 631, session-replay litigation). We do not use tracking technologies to intercept private communications without consent. For a comprehensive breakdown of the specific cookies we use and how to disable them, please visit our Cookie Policy.

5. Your Rights and Choices

Depending on your state of residence, you may have specific rights regarding your personal information. Under the notice-and-choice model used in the US, you generally have the right to opt-out of certain processing activities, while opt-in consent is required only for selling/sharing personal information (CPRA/GPC) and tracking children under 13 (COPPA). If you are a resident of a state with comprehensive privacy legislation, you have additional rights regarding access, deletion, and correction of your data.

If you are a California resident, the California Consumer Privacy Act as amended by the CPRA (Cal. Civ. Code § 1798.100 et seq.) grants you the right to know what personal information we have collected about you, the categories of sources, the business purpose for collecting it, and the third parties with whom we share it. You have the right to request deletion of your personal information, subject to certain exceptions. You also have the right to correct inaccurate personal information and the right to opt-out of the sale or sharing of your personal information.

Residents of Virginia under the Virginia Consumer Data Protection Act (Va. Code § 59.1-575 et seq.), Colorado under the Colorado Privacy Act (C.R.S. § 6-1-1300 et seq.), Connecticut under the Connecticut Data Privacy Act (Conn. Gen. Stat. § 42-515 et seq.), and Utah under the Utah Consumer Privacy Act (Utah Code § 13-11-101 et seq.) have similar rights to access, correct, delete, and obtain a copy of their personal data. These states also provide the right to opt-out of targeted advertising, the sale of personal data, and profiling in furtherance of decisions that produce legal or similarly significant effects.

To exercise any of these rights, please submit a verifiable consumer request by contacting us at [email protected] or +19852141751. We will process your request within the timeframes required by applicable law (typically 45 days). We will not discriminate against you for exercising your privacy rights. If you are an authorized agent submitting a request on behalf of a consumer, we may require proof of your authorization. For more information on opting out of targeted advertising, you may also utilize the DAA/AdChoices opt-out tools or enable Global Privacy Control in your browser.

6. Data Security

We implement comprehensive administrative, technical, and physical safeguards designed to protect your personal information from unauthorized access, alteration, disclosure, or destruction. Our security measures include encryption of data in transit using TLS (Transport Layer Security) and encryption of data at rest within our secure cloud infrastructure. We utilize firewalls, intrusion detection systems, and regular security vulnerability scanning to monitor and protect our SaaS environment.

Access to your personal information is strictly limited to authorized Osarizawa personnel who require such access to perform their job duties. Our employees are subject to confidentiality obligations and undergo regular security awareness training. We also require our third-party service providers to maintain appropriate security standards and enter into data processing agreements that mandate the protection of personal information.

Despite our robust security measures, no system or transmission over the Internet can be guaranteed to be 100% secure. We continuously assess and update our security protocols to address emerging threats and comply with evolving industry standards. In the event of a data breach affecting your personal information, we will notify you and the appropriate regulatory authorities in accordance with applicable state breach notification laws.

If you are using our SaaS platform to process sensitive data, you are responsible for configuring access controls and permissions within the platform appropriately. We strongly recommend enabling multi-factor authentication (MFA) for all user accounts. Any failure by you to maintain the security of your account credentials may compromise the security of your data, and we disclaim liability for breaches resulting from such failures.

7. International Data Transfers

While Osarizawa is based in the United States and primarily processes data within the US, our SaaS infrastructure and third-party vendors may operate globally. If you access the Services from outside the United States, you acknowledge that your personal information will be transferred to, stored, and processed in the United States. The data protection laws in the United States may differ from those in your country of residence.

For international transfers, we rely on valid transfer mechanisms where required, such as Standard Contractual Clauses (SCCs) or other legally recognized frameworks, to ensure an adequate level of protection for your personal information. We work closely with our global vendors to ensure they implement similar safeguards. By using our Services, you explicitly consent to the transfer and processing of your personal information in the United States and other jurisdictions where we operate.

We monitor international legal developments regarding cross-border data flows and adjust our transfer mechanisms as necessary to maintain compliance. If a government authority requests access to your data through an international legal process, we will carefully review the request and respond only where legally compelled to do so, challenging any overly broad or unlawful requests.

If you are a user from the European Economic Area, the United Kingdom, or Switzerland, please be aware that this Privacy Policy is tailored to comply with US law. We process limited international data strictly necessary to provide the SaaS services to our global business clients. For any inquiries regarding international data transfers, please contact our privacy team using the information provided in the Contact Information section below.

8. Children's Privacy

Our Services are designed for general business and commercial audiences and are not intended for use by children. We do not knowingly collect personal information from children under the age of 13. The Children's Online Privacy Protection Act, 15 U.S.C. §§ 6501-6506 (COPPA), imposes strict requirements on the collection of personal information from children, and we operate in full compliance with these mandates.

In accordance with the COPPA Rule as amended effective June 2025 (16 C.F.R. Part 312, 2025 amendments), we have implemented age-gating mechanisms where appropriate and do not knowingly permit users under 13 to create accounts or transmit personal information to us. If we become aware that we have inadvertently collected personal information from a child under 13, we will promptly delete that information from our systems and terminate the child's account.

For users located in states with specific age-appropriate design codes or regulations regarding minors, we apply additional protections. We do not use personal information of minors in a manner that we know will result in targeted advertising or profiling that could be detrimental to their well-being. Parents or guardians who believe their child has provided us with personal information are encouraged to contact us immediately at [email protected] so we can investigate and take appropriate action.

If our SaaS platform is used by an educational institution, we may act as a "school official" under the Family Educational Rights and Privacy Act (FERPA) and related state laws. In such cases, we process student data strictly in accordance with the educational institution's instructions and applicable privacy laws. We do not sell student data or use it for commercial advertising purposes.

9. Changes to Policy

We reserve the right to update or modify this Privacy Policy at any time to reflect changes in our business practices, legal requirements, or technological advancements. When we make material changes to our privacy practices, we will update the "Last Updated" date at the top of this page and provide a prominent notice on the osarizawa.com homepage or within the SaaS dashboard. We encourage you to review this policy periodically to stay informed about how we collect, use, and protect your information.

What constitutes a material change will be determined at our sole discretion, but generally includes the addition of new categories of data collection, new uses of existing data, or significant changes to your privacy rights. If we materially change our practices regarding the sale or sharing of your personal information, we will provide you with clear notice and an opportunity to exercise your right to opt-out, as required by the California Consumer Privacy Act as amended by the CPRA (Cal. Civ. Code § 1798.100 et seq.) and other state laws.

For non-material changes, such as clarifications or administrative updates, we will simply update the policy without separate notice. Your continued use of the Services following the posting of any changes to this Privacy Policy constitutes your acceptance of the updated terms. If you do not agree with the revised policy, you must discontinue using the Services.

We will maintain an archive of previous versions of this Privacy Policy. If you wish to review a prior version, you may request a copy by contacting us at [email protected]. This policy is governed by our Terms and Conditions and Terms of Service, which contain the governing law and dispute resolution provisions applicable to any disagreements regarding our privacy practices.

10. Contact Information

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact our Privacy Office using the information below. We are committed to resolving any issues promptly and transparently. Our designated privacy team is available to assist you with exercising your rights under federal and state laws.

You may contact us via email at [email protected] or by phone at +19852141751. If you prefer to send written correspondence, please address your letters to the attention of the Privacy Officer at One World Trade Center, 285 Fulton Street, New York, NY 10007, United States. We strive to respond to all legitimate inquiries within 30 days of receipt.

For verification purposes, when contacting us regarding your personal information, please include your full name, email address associated with your account, and a detailed description of your request. If you are a California resident exercising your right to opt-out of the sale or sharing of your personal information, you may also submit your request through our designated online form or by enabling Global Privacy Control (GPC) in your browser.

Osarizawa is the data controller responsible for your personal information. We are dedicated to maintaining the trust you place in us when using osarizawa.com. By providing your contact information, you consent to us communicating with you regarding your inquiry. We will not use the information you provide for unrelated marketing purposes without your explicit consent.