Choun Enterprise Privacy Policy (RCM)

1. Scope

Choun Enterprise (RCM) is a limited-distribution business application for authorized organization accounts. It is used only by administrators and support agents to manage customer conversations. RCM does not provide consumer social networking, ticket management, or advertising services.

2. Data we process

RCM processes only the data needed to authenticate authorized staff, provide chat functions, secure the service, and deliver notifications:

• staff account data, including names, email addresses, roles, and account status;
• customer names and email addresses included in customer conversations;
• chat messages, internal notes, and attachments;
• device identifiers and APNs push tokens, notification preferences, and device-session records; and
• product interaction data, such as message read state, unread counts, feature actions, timestamps, app version, and security logs.

RCM does not request or store staff account passwords on the device after sign-in.

3. How data is used

We use this data to authenticate users, enforce administrator and support-agent permissions, display and manage conversations, transfer or archive conversations, deliver attachments, synchronize read and unread state, send requested push notifications, prevent abuse, investigate service errors, and meet legal obligations.

4. Advertising and tracking

RCM does not serve advertising, sell personal data, build advertising profiles, or use advertising SDKs. RCM does not track users across apps or websites owned by other companies.

5. Service providers and disclosure

Data is available to the organization operating the configured RCM tenant and its authorized administrators and support agents. We may provide the minimum necessary data to contracted infrastructure providers, including hosting, network security, storage, and Apple Push Notification service providers. We do not disclose data for advertising. We may disclose data when required by law or necessary to protect the service and its users.

6. Retention and deletion

Conversation data and attachments are retained according to the organization’s service and legal requirements. Device sessions expire after 180 days of inactivity unless renewed; revoked sessions and invalid push tokens are disabled. Security records may be retained for a limited period for abuse prevention and incident investigation. Authorized organization administrators can request account, conversation, or device-session deletion where applicable.

7. Security

RCM uses encrypted network transport, short-lived access tokens, rotating refresh tokens, device-specific secure storage, role checks, and access logging. No security control eliminates all risk. Organizations must protect staff credentials and revoke devices that are lost or no longer authorized.

8. Your choices and requests

Users can disable message previews, revoke device sessions, sign out, and ask their organization’s RCM administrator to correct or delete eligible data. Privacy questions and requests may be sent to info@kanun.co.jp. We may need to verify the requester’s identity and authority.

9. Children and changes

RCM is a business application and is not directed to children. We may update this policy when the service or legal requirements change. The effective version is identified by the date shown above.