Privacy Policy

1. Who we are

Blink Brief is published by Fluxenic Inc. (“we”, “us”). We decide how your personal data is used: we are the controller under the EU and UK GDPR, and the business operator handling your personal information under Japan’s Act on the Protection of Personal Information (APPI).

• Name: Fluxenic Inc.
• Address: Shibuya Dogenzaka Tokyu Building 2F-C, 1-10-8 Dogenzaka, Shibuya-ku, Tokyo, Japan
• Representative: Tomoya Fujita, Representative Director
• Email: tomoya.fujita@fluxenic.com

2. The free tools

Our free tools run in your browser. The files, text, and lists you use in them stay on your device: we don’t upload, receive, or store them. Some tools keep your settings in your browser’s storage, on your device.

One exception: Live Captions uses your browser’s built-in speech recognition, and the browser may send the audio to its maker (Google for Chrome, Microsoft for Edge, Apple for Safari) to turn it into text, under that company’s privacy policy. We never receive the audio or the captions.

Page analytics (section 3) may count that a tool’s button was pressed, never what you put in.

3. What we collect

• Early-access sign-ups. Your email address and your answers, such as your country, your role, and what you use now. Convika, the platform Blink Brief runs on, stores them. Fluxenic runs Convika too, so they stay with us. With each entry, Convika also stores your IP address, your browser type (User-Agent), and the country the entry came from. It uses the IP address and browser type only to stop spam and keep bots out of the counts, doesn’t show them to us. They are deleted with the entry.
• Reservations. You pay on Stripe’s checkout page, and we never see your full card number. Stripe gives us what you enter there, such as your name, email address, and billing country, and for a business its name, address, and VAT number, with the amount and your card’s brand and last 4 digits.
• Emails. What you write to us, and our replies.
• Page analytics. Convika counts page views, clicks on buttons and links, form sends, how far you scroll, time on the page, and load speed. Each event records the page, the site you came from, campaign tags (UTM), device type, country, browser type, and a visitor ID. It doesn’t record your IP address.
• Cookies. Convika’s cookie banner asks whether you allow analytics cookies.
  • If you allow them, Convika sets _cvk_vid, a random visitor ID kept for 90 days, and _cvk_sid, a session ID kept for 30 minutes.
  • If you decline, or haven’t chosen yet, Convika sets neither. It counts your visit under an ID made from your IP address and browser type with a key that changes every day and is deleted after 2 days. After that, no one, Convika included, can work the ID out again.
  • Your choice is kept in __Host-cvk_consent_analytics for 1 year, and _cvk_consent_essential is always set because forms need it to send. To change your choice, delete this site’s cookies in your browser, and the banner asks again. Convika’s Cookie Policy has the details.
• Server records. Cloudflare keeps a record of each request to Convika’s servers, with the IP address, browser type, and approximate location, for 7 days.

A browser’s Do Not Track signal doesn’t change what the site does; use the cookie banner instead. No advertising network or cross-site tracker runs on Blink Brief.

4. Why we use it, and the legal basis

We use personal data only for these purposes, which are also our purposes of use under the APPI. Under the GDPR, each has the legal basis shown.

• Emailing you about the product you signed up for, when it opens and to ask how you’d use it, and reading your answers to decide what to build. Basis: your consent (Art. 6(1)(a)). You can withdraw it at any time by replying to any of our emails or by writing to us. Withdrawing doesn’t affect what we did before.
• Taking your reservation, delivering the product, refunding you, and emailing you about them. Basis: our contract with you (Art. 6(1)(b)).
• Keeping the payment and refund records that tax law requires. Basis: legal obligation (Art. 6(1)(c)), and our legitimate interest in meeting Japanese tax law (Art. 6(1)(f)).
• Counting visits with analytics cookies. Basis: your consent (Art. 6(1)(a)). Counting visits without cookies. Basis: our legitimate interest in knowing which pages people use (Art. 6(1)(f)).
• Stopping spam and attacks with IP addresses, browser types, and server records. Basis: our legitimate interest in keeping the site and its forms working (Art. 6(1)(f)).
• Answering your emails. Basis: our legitimate interest in replying to you (Art. 6(1)(f)), or our contract when you write about a reservation.

You don’t have to give us anything. Without an email address we can’t tell you when a product opens, and without payment details we can’t take a reservation. We make no decision about you by automated means alone.

5. Who handles it for us

These service providers handle personal data for us, only for the work listed:

• Convika (Fluxenic Inc., Japan): hosts the site, stores form entries, and runs page analytics. Because Fluxenic runs Convika, this doesn’t pass your data to another company.
• Cloudflare (United States): runs Convika’s hosting, network, databases, and file storage, and keeps the server records.
• cdnjs (Cloudflare, United States): delivers the PDF library the Inspection Report and Contact Sheet pages use. It sees your IP address and browser type, never your report or your photos.
• Tinybird (United States): stores Convika’s click and form-send events, without your answers, IP address, or browser type.
• Resend (United States): delivers our emails to you, and Convika’s emails to us about new entries.
• Stripe (United States): processes your payment. Stripe also uses payment data for its own fraud prevention and legal duties, under its privacy policy.
• Anthropic (United States): we use Claude, Anthropic’s AI, to read form entries and emails and to write our replies. Claude receives your answers, your email address, and what you write to us, but not your IP address or browser type. We have turned off Anthropic’s setting that lets it use our conversations to train its models.
• Google (United States): our mailbox, tomoya.fujita@fluxenic.com, runs on Google Workspace and holds the emails you send us and Convika’s emails to us about new entries.

We also disclose personal data when the law requires it, for example to a court or a public authority.

6. Transfers outside Japan, the EU, and the UK

We are in Japan, which the European Commission and the UK recognise as protecting personal data adequately. The providers in section 5, other than Convika, handle data in the United States, and Cloudflare also on its network around the world.

Under the GDPR, these transfers rely on the EU–US Data Privacy Framework and its UK Extension where the provider is certified under it, and otherwise on the European Commission’s standard contractual clauses, with the UK Addendum, in the provider’s data processing terms. You can ask us for a copy of these safeguards.

Under Article 28 of the APPI: the United States has no single federal law like the APPI, and data protection there comes from laws for particular sectors and from state laws such as California’s. Japan’s Personal Information Protection Commission describes the US system in a report (in Japanese). Each provider has agreed in its data processing terms to measures equivalent to those the APPI requires, such as using the data only to provide its service to us, keeping it secure, and telling us of breaches. We check these terms once a year. On request, we give you information about these measures (Article 28(3)).

7. How long we keep it

• Sign-up answers: deleted no later than 1 year after you send them, or sooner if you ask.
• IP address and browser type stored with a form entry: deleted with the entry, no later than 1 year after you send it.
• Reservation and refund records: 7 years, or longer where Japanese tax law requires it.
• Emails with us: as long as we need them to answer you, and for a reservation, as long as its records.
• Analytics: the _cvk_vid cookie 90 days and _cvk_sid 30 minutes; events 3 months in Cloudflare, and 400 days in Convika’s archive and in Tinybird; the daily key for visits without cookies, 2 days. Daily totals that hold no visitor ID are kept.
• Server records: 7 days.
• What Stripe keeps: as Stripe’s privacy policy says.

8. Your rights

Wherever you live, you can ask us to:

• tell you what we hold about you and give you a copy, by email or in another form you ask for;
• correct it or add to it;
• delete it;
• stop or limit using it, or stop giving it to others, including when you object to a use based on our legitimate interest;
• show you the records of what we gave to third parties;
• send your data to you or to another company in a common format.

You can also withdraw your consent at any time. These rights come from the GDPR (Articles 15 to 21) and the APPI (Articles 33 to 35).

To ask, email tomoya.fujita@fluxenic.com from the address we hold, or tell us how we can confirm it’s you. There is no fee. We answer within 30 days, and if we can’t do what you ask, we tell you why.

9. Children

Blink Brief is for people at work. Our forms and reservations aren’t meant for anyone under 18. If we learn that a child has sent us personal data, we delete it.

10. Public items under Japan’s APPI

Article 32 of the APPI requires us to make these items public:

• Our name, address, and representative: section 1.
• Purposes of use: section 4.
• How to ask us to tell you the purposes of use, or to disclose, correct, delete, or stop using your data: section 8. There is no fee.
• Where to send complaints about how we handle your data: tomoya.fujita@fluxenic.com.
• Our security measures, below.

Security measures

• Fluxenic’s representative is responsible for how personal data is handled, and this policy sets out our rules for it.
• Only people at Fluxenic who need personal data for the purposes in section 4 can access it.
• We keep personal data in the services in section 5, not on paper, and sign in to them with a password and two-step verification.
• Connections to Blink Brief and to these services are encrypted (HTTPS).
• We store personal data in the United States knowing how data is protected there (section 6), and review our providers’ terms once a year.

11. Questions and complaints

Write to us first at tomoya.fujita@fluxenic.com. You can also complain to a data protection authority:

• in the EU, the authority where you live or work, or where you think the law was broken (list of authorities);
• in the UK, the Information Commissioner’s Office;
• in Japan, the Personal Information Protection Commission.

12. Changes to this policy

We post changes here with a new date. If a change affects how we use data you have already given us, we email you before it takes effect, and ask for your consent where the law requires it.