プライバシーポリシー

1. はじめに

このプライバシーポリシーは、Mostly Tiny Ltd（「当社」「われわれ」「当社の」）がお客様がmostlyrender.comを使用する際にお客様の個人データをいかに収集、使用、共有、保護するか、および当該データに対するお客様の権利について説明しています。当社がデータコントローラーとして機能する個人データに適用されます。発効日：2026-10-12。

2. 当社についてとお問い合わせ方法

Mostly Tiny Ltdはお客様の個人データの管理者です。このポリシーについて、またはお客様の権利を行使するために、privacy@mostlytiny.ioでお問い合わせください。

Studio M, Hackney Depot, 5 Sheep Lane, London E8 4QS, United Kingdom

3. Our representative in the European Union

Mostly Tiny Ltd is established in the United Kingdom. We are appointing a representative in the European Union under Article 27 of the EU GDPR and will name them here. Until then, people in the EU can contact us directly at privacy@mostlytiny.io.

4. 当社が収集する個人データ

当社は直接提供いただく情報（例：your email and optional display name (from your Mostly Tiny sign-in); your templates, uploaded images and files, and the data you send to fill them; the images and PDFs we render; pages you screenshot or check, HTML you convert; hashed API keys and usage; webhook addresses; a billing record for paid plans (cards stay with Stripe); support requests; request logs; and, with consent, how you arrived）、mostlyrender.comの使用時に自動的に収集される情報（IPアドレス、デバイスおよびブラウザの種類、表示されたページ、Cookie識別子など）、および第三者から受け取った情報を収集します。

当社は上記のカテゴリーの個人データを本ポリシーに記載された目的のために収集します。

5. Where we get your data

Besides what you give us, we receive your sign-in identity and plan from Mostly Tiny ID, payment status from Stripe, and the content of the web pages you ask us to screenshot or check with the Open Graph checker. We have no advertising partners.

6. データの使用方法と理由

当社は以下の目的でお客様の個人データを使用します：mostlyrender.comおよびサービスの提供、運営、改善、アカウントの作成と管理、お問い合わせへの対応とサポート提供、お客様の体験のカスタマイズ、許可される場合はサービスおよびマーケティングメッセージの送信、サービスの安全性確保と不正行為防止、法的義務の遵守。

7. Lists of people you upload

With generators you can upload a list of people — for example guests' names, titles, companies, email addresses and photos — and render a card or badge for each one. You decide what the list contains and why: you are the controller of that data and we process it on your behalf, only to render your outputs, under our Data Processing Agreement.

If you turn on a Batch QR code for a generator, we send MostlyQR only the fields you choose, so each person gets their own code (and, if you choose, a profile page). When you delete a row, its details are erased from MostlyQR too, and when we delete an archived generator (30 days after you archive it) so are the rest; each code then points to your batch's archive page.

How long we keep it: an uploaded CSV or zip file until we have read it; the rows and images read from it for 30 days after upload; the details of each row until you delete that row or your account, or until we delete the generator (30 days after you archive it); and a generator's outputs, manifests and zip files for 30 days (free plan) or 90 days (paid plans).

If you are on someone else's list, contact the business or organiser that uploaded it first.

8. Screenshots of other websites

When you use the screenshot feature, our servers load the web address you give us and capture it, as a browser would. That website sees a request from our servers, not from you. We only load public web addresses, and you are responsible for having the right to capture and use the page you point us at. Our fetcher identifies itself as "MostlyRender/1.0 (+https://mostlyrender.com/bot)".

9. Free tools (Open Graph checker and HTML to image converter)

Our free tools at mostlyrender.com/tools work without an account. When you check a page with the Open Graph checker, our servers load the address you enter once, read its link-preview tags and the start of its preview image, and send the result back to you. That website sees a request from our servers, identified as "MostlyRenderOGCheck/1.0 (+https://mostlyrender.com/tools/og-image-checker)". We do not keep the address or the result.

When you use the HTML to image converter, our servers render the HTML you paste and send the image back to your browser. We do not keep your HTML or the image. Before it renders, Cloudflare Turnstile checks that the request comes from a person rather than an automated program. To do that, Cloudflare processes your IP address and technical details of your browser and connection (such as its user agent). Cloudflare acts as our processor for this check, and as an independent controller when it uses these signals to improve its bot detection, as described in its Turnstile privacy addendum (cloudflare.com/turnstile-privacy-policy).

To keep the tools free, we limit how often each one can be used. We count your requests under a keyed hash of your IP address, a scrambled form that cannot be turned back into the address without a secret key we hold, and each count is deleted automatically after its time window (one hour for the checker, one day for the converter), usually within about two days. We do this in our legitimate interest in preventing abuse of a free service.

10. How we learn where visitors come from

Fathom Analytics counts visits to mostlyrender.com without cookies and without identifying you, including which website, campaign or AI assistant referred a visit. In the UK we rely on the statistical-purposes exception in the Privacy and Electronic Communications Regulations. You can object at any time by switching off "Analytics" in Cookie settings, which turns Fathom off for your browser.

We also keep our own anonymous daily totals of visitors who arrive from an advert: how many land, open our editor, sign up and buy, by ad platform and landing page. The ad platform and page name travel in the web address of our own pages; nothing is stored on or read from your device, no cookie is used, and the totals are never linked to you or your account. Because no storage on your device is involved, this counting continues whatever you choose in Cookie settings.

If you accept Analytics or Marketing cookies, our site also remembers in your browser how you first and most recently arrived (campaign tags, the referring site and the page you landed on) and attaches it to your account when you sign up, so we can see which channels bring us customers. If you do not accept, we keep none of this. The one exception is a referral code, if you followed a friend's referral link: we keep it only to credit that referral.

When you sign up, subscribe or cancel, our servers record that event against your account in PostHog (EU), to measure how our business is doing. We rely on our legitimate interests for this; you can object by emailing privacy@mostlytiny.io.

11. Emails we send you

We email you what you need to use MostlyRender: sign-in links, receipts, billing and security notices, and messages about your account. These are part of the service, so you cannot turn them off while your account is open.

We may also send you tips and offers about MostlyRender. The sign-up form has a box for these, ticked by default: untick it and we never send them. In the UK this is the "soft opt-in" in regulation 22 of the Privacy and Electronic Communications Regulations; our lawful basis under the UK GDPR is our legitimate interest in telling customers about the product they signed up for, and you can object at any time.

We email you about other Mostly Tiny products (MostlyQR, MostlyPDF, MostlySign, MostlyPrivacy and Vekta) only if you asked us to, by ticking a box that is never ticked for you, either when you sign up or later in a product. Our lawful basis is your consent. We send at most one such email a month across all of them.

Every marketing email says why you are getting it, has an unsubscribe link, and supports your email app's one-click unsubscribe button. One click stops that kind of email; the linked preferences page lets you choose exactly what you get, or stop all marketing email from every Mostly Tiny product at once. You can also change this in your Mostly Tiny account at id.mostlytiny.io/settings. Withdrawing is as easy as agreeing, and never affects service email.

To show we had your agreement, we record each choice: which box, the exact wording you saw, when, and a keyed one-way hash of your IP address. We store your choices against a one-way hash of your email address. If an address bounces permanently or a message is reported as spam, we stop all marketing email to it. Our do-not-email list keeps only that hash, never your address, so it continues to protect you after you close your account.

12. 処理の法的根拠

EU GDPR または UK GDPR が適用される場合、私たちはArticle 6に基づく1つ以上の正当な法的根拠に基づいてあなたの個人データを処理します：あなたの同意、契約の履行、法的義務の遵守、重大な利益の保護、公共の利益のためのタスク実行、または当社の正当な利益（または第三者の利益）。ただし、あなたの利益または権利が優先される場合を除きます。

正当な利益に頼る場合、これには当社のサービスの運営とセキュリティ確保、使用方法の理解、および限定的なマーケティングが含まれます。あなたはいつでも異議を唱えることができます。Article 9に基づく個人データの特別なカテゴリー（例えば健康またはバイオメトリクスデータ）を処理する場合、私たちはあなたの明示的な同意または法律で許可されている別の条件でのみこれを行います。

13. あなたのデータを誰と共有するか

私たちは次の者と個人データを共有します：当社に代わってmostlyrender.comを運営するサービスプロバイダーとプロセッサー（例えばGoogle Cloud and Firebase: hosting, sign-in, database, file storage and rendering (where, see "Where your data is stored"); Stripe: payments; Resend: email; Fathom Analytics: cookie-free statistics; PostHog (EU): product analytics in the app; Cloudflare: Turnstile, the bot check on the free HTML to image converter; MostlyID: sign-in and the shared billing record; MostlyQR: tracked short links for dynamic QR codes you add to a template, and a personal code for each row when a generator creates a Batch QR; and MostlyPrivacy: this cookie banner and these documents）で、当社の指示に従ってのみこれを使用できる者；必要に応じて、専門的アドバイザー、支払いプロバイダー、および法執行機関または規制当局；ならびに合併または買収などの企業取引の当事者。私たちはあなたの個人データを販売しません。

14. 国際的なデータ転送

当社のサービスプロバイダーの一部は、EEA、英国、またはオーストラリアの外を含め、あなたの国の外に所在しています。個人データを国際的に転送する場合、私たちは正当な転送メカニズム（例えば適切性決定、EU標準契約条項（該当する場合はUK国際データ転送補遺付き）、または法律で許可されている別の保護手段）に頼り、あなたのデータを保護するための措置を講じます。詳細はprivacy@mostlytiny.ioへのリクエストで利用可能です。

15. Where your data is stored

MostlyRender runs on Google Cloud and Firebase: database in the United States (nam5 multi-region); rendering, uploads and rendered outputs in the UK (europe-west2, London).

Sign-in uses Firebase Authentication, which Google runs only in the United States, and a Mostly Tiny account you sign in with is held by Mostly Tiny ID, whose database is in the United States. Our website is served from Google's global network (Firebase Hosting).

Transfers to Google LLC in the United States rely on the UK Extension to the EU-US Data Privacy Framework (and, for data under the EU GDPR, on the EU-US Data Privacy Framework), to both of which Google LLC is certified. If you are in the EU, your personal data reaches our servers in the UK under the European Commission's adequacy decision for the UK (Implementing Decision (EU) 2021/1772, as amended by Implementing Decision (EU) 2025/2574).

16. お客様のデータを保持する期間

当社は、本ポリシーに記載された目的に必要な期間のみ個人データを保持し、その後削除または匿名化します。データ保有期間の設定基準には、データの性質と機密性、処理目的、ならびに法的・会計的・報告義務が含まれます(templates and uploads until you delete them or your account; rendered outputs for 30 days (free plan) or 90 days (paid plans), at unguessable public web addresses you can embed and share; lists of people: see "Lists of people you upload"; usage for the current and previous billing periods; billing records as tax law requires; request logs briefly for security; free-tool counters up to two days)。

17. 当社がお客様のデータを保護する方法

当社は、転送時の暗号化、アクセス制御、定期的な見直しを含む適切な技術的および組織的措置により、個人データを損失、誤用、不正アクセスから保護します。転送または保存方法は完全に安全とは限らないため、当社は完全なセキュリティを保証できません。

18. クッキーと類似テクノロジー

当社はmostlyrender.comでクッキーと類似テクノロジーを使用しています。使用するクッキーの目的、有効期間、制御方法については、当社のクッキーポリシーをご参照ください。

19. 自動意思決定

当社は、法律で許可されている場合を除き、プロファイリングを含む自動処理のみに基づいて、お客様に関する法的または同様の重大な影響を生じさせる決定を行いません。当社がそうする場合は、お客様にお知らせし、関係するロジックを説明し、人間による確認を受ける権利を提供します。

20. 児童のプライバシー

mostlyrender.comは児童を対象としていません。デジタル同意年齢（GDPR下では16歳、国によっては13歳までの低い年齢）を下回る児童の個人情報は意識的に収集しません。また、16歳未満であることが判明している消費者の個人情報を意識的に販売または共有しません。児童がデータを提供したと考えられる場合は、privacy@mostlytiny.ioまでお問い合わせください。削除いたします。

21. GDPRに基づくあなたの権利

EU または UK GDPR が適用される場合、あなたには次の権利があります。通知を受ける権利、個人データへのアクセス権、不正確なデータの訂正を求める権利、データ削除を求める権利、処理の制限を求める権利、データ移植可能性の権利、および処理への異議申し立て権（ダイレクトマーケティングへの異議申し立てを含む）。同意に基づいて処理が行われている場合、事前に行われた処理に影響を与えることなく、いつでも同意を撤回することができます。

これらの権利を行使するには、privacy@mostlytiny.ioまでお問い合わせください。1か月以内に対応いたします。複雑または多数のリクエストについては最大2か月延長される可能性がありますが、その場合は最初の1か月以内にお知らせします。また、データ保護監督当局に苦情を申し立てる権利も有しています。

22. 英国の監督当局

英国にお住まいの場合、UK GDPR および2018年データ保護法が適用され、ico.org.ukの情報コミッショナー事務所（ICO）に苦情を申し立てることができます。

23. How to complain to us

If you are unhappy with how we have handled your personal data, email privacy@mostlytiny.io with "Complaint" in the subject. We will acknowledge your complaint within 30 days, look into it, and tell you the outcome without undue delay. You can also complain to the Information Commissioner's Office at any time.

24. If you are in the United States

We do not sell or share personal information for advertising, and we treat a Global Privacy Control signal from your browser as a refusal of any non-essential cookies. To ask what we hold about you, or to have it corrected or deleted, email privacy@mostlytiny.io.

25. ポリシーの変更

このプライバシーポリシーは随時更新される場合があります。更新版は新しい発効日とともにここに掲載し、重大な変更がある場合はお知らせするために合理的な措置を講じます。

26. お問い合わせ

個人データの取り扱いに関する質問、リクエスト、または苦情については、Mostly Tiny Ltdにprivacy@mostlytiny.ioでお問い合わせください。

Studio M, Hackney Depot, 5 Sheep Lane, London E8 4QS, United Kingdom