ShutterHub Privacy Policy

This English translation is provided for reference only. In the event of any discrepancy between the Japanese original and this translation, the Japanese version shall prevail.

Plena Inc. (hereinafter referred to as "the Company") establishes this Privacy Policy (hereinafter referred to as "this Policy") regarding the handling of personal information on "ShutterHub" (hereinafter referred to as "the Service"), a photo session booking and photo matching platform operated by the Company.

1. Business Information

• Business name: Plena Inc.
• Business website: https://www.plenaco.com/
• Inquiries regarding personal information protection: the Service inquiry form, or info@plenaco.com

2. Information We Collect

The Company may collect the following information in providing the Service.

1. Account information: name or display name, email address, authentication credentials, user type (role)
2. Profile information: self-introduction, activity area, social media accounts, public images, etc.
3. Identity verification information: documents submitted for age verification and identity verification and verification results (limited to the necessary scope)
4. Transaction and usage information: photo session booking and participation history, instant shooting request (Today Photo) requests, messages, evaluations, information necessary for payment
5. Payment-related information: payment status, transaction identifiers, etc. processed through payment service providers such as Stripe (card numbers themselves are, in principle, stored by the payment service provider)
6. Device and usage information: IP address, browser type, device information, access logs, information obtained through Cookies and similar technologies
7. Location information: latitude, longitude, and approximate address when a user explicitly acquires current location in the Today Photo feature
8. Inquiry information: content submitted for support responses

3. Purposes of Use

Collected information shall be used within the scope of the following purposes.

1. Provision of the Service, identity verification, and account management
2. Processing of photo session bookings, instant shooting matching, messages, payments, refunds, and subscriptions
3. Prevention and investigation of unauthorized use, nuisance conduct, and violations of terms
4. Response to inquiries and transmission of important notices
5. Service improvement, usage analysis, incident response, and security assurance
6. Compliance with laws and regulations and dispute resolution

4. Handling of Location Information (Today Photo Feature)

1. Information collected
   • In the "Today Photo" feature, when a user presses the "Get current location" button, the device location information (latitude and longitude) and approximate address obtained through reverse geocoding shall be used.
   • Location information shall be acquired only when the user takes explicit action and the browser or OS grants permission. Continuous automatic acquisition shall not be performed.
2. Purposes of use
   • Photo matching with nearby Photographers or Models
   • Area display associated with shooting requests (approximate display of waiting count, etc.)
3. Provision to third parties and subcontracting
   • Latitude and longitude may be sent to the Nominatim service provided by OpenStreetMap Foundation for display of approximate addresses.
   • Except as required by law, location information shall not be sold to third parties without the individual's consent.
4. Retention period
   • Location information shall be retained only for the period necessary for the lifecycle of requests and bookings, and detailed location information no longer needed for matching shall be deleted or anonymized within a reasonable period.
5. User choice
   • Use of location information is optional. Even if declined, features other than Today Photo may be used.

5. Cookies and Similar Technologies

The Service uses Cookies and similar technologies to maintain login status, ensure security, and improve the Service. For optional Cookies, please refer to the Cookie consent banner and Cookie Policy.

6. Third-Party Provision, Subcontracting, and Provision to Third Parties in Foreign Countries

The Company may subcontract handling of personal data to the following businesses to the extent necessary to achieve the purposes of use, or share data to the extent necessary for service provision. Except as required by law for disclosure requests, personal data shall not be sold to third parties without the individual's consent.

Business	Category	Services and Data	Primary Location
Supabase, Inc.	Subcontractor	Authentication, database, storage	United States (data storage region: Japan)
Stripe, Inc. (and Stripe Japan, Inc.)	Subcontractor	Payment processing, identity verification, fund transfers	United States · Japan
Vercel, Inc.	Subcontractor	Hosting, access analytics	United States
Functional Software, Inc. (Sentry)	Subcontractor	Error monitoring, session replay upon optional consent	United States
PostHog, Inc.	Subcontractor	Product analytics (page transitions and booking flow reach). Recorded only when consent is given for optional Cookies	United States
Microsoft Corporation (Microsoft Clarity)	Subcontractor	Heatmaps and session replay. Recorded only when consent is given for optional Cookies	United States
OpenStreetMap Foundation (Nominatim)	Use of a public API	Conversion of coordinates or search strings to an approximate address. The Company sends only coordinates and search strings, and does not send names, contact details, or account identifiers	United Kingdom
OAuth authentication providers (Google, X, Discord)	Third party	Authentication when selected by the individual. The Company receives authentication results and basic profile information from such business (the Company does not provide personal data to it)	United States

Sentry's session replay shall be recorded only when consent is given for optional analytics Cookies through the Cookie consent banner. If consent is not given, session replays are neither recorded nor transmitted. Sentry's error monitoring itself is used regardless of consent, for the secure provision of the Service. PostHog and Microsoft Clarity shall be loaded and recorded only when consent is given for optional analytics Cookies through the Cookie consent banner. If consent is not given, these scripts are neither loaded, recorded, nor transmitted. If the Company subcontracts the handling of personal data to any business not listed in the table above, it will revise this Policy and present the revised content before doing so.

Provision to Third Parties in Foreign Countries

Provision of personal data to businesses located in the United States listed above constitutes "provision to third parties in foreign countries" as defined in Article 28 of the Act on the Protection of Personal Information (APPI). By registering for use of the Service and agreeing to this Policy, you are deemed to have consented to such provision. The United Kingdom is designated, under the APPI and its enforcement rules, as a country having a personal information protection system equivalent to that of Japan; accordingly, provision to businesses located in the United Kingdom is treated as outside the scope of that Article. OAuth authentication providers are not recipients of personal data provided by the Company and are therefore not included in the provision described in this Section.

• Destination countries: United States (subject to Article 28), United Kingdom (outside the scope of that Article by virtue of the equivalent-country designation)
• Personal information protection systems of destination countries: please refer to information published by the Personal Information Protection Commission regarding the systems of each country (https://www.ppc.go.jp/enforcement/infoprovision/laws/).
• Measures taken by recipients: for the businesses categorized as "Subcontractor" in the table above (Supabase, Inc.; Stripe, Inc. and Stripe Japan, Inc.; Vercel, Inc.; Functional Software, Inc.; PostHog, Inc.; and Microsoft Corporation), provision is made under contractual measures including the data processing agreements (DPA) and Standard Contractual Clauses (SCC) published by each business, and such terms are published on each company's website. For the OpenStreetMap Foundation (Nominatim), there are no individual contractual measures, and use is limited to that under the terms of use and privacy policy published by the Foundation; accordingly, the Company sends only coordinates and search strings, and does not send names, contact details, or account identifiers. For OAuth authentication providers, the Company does not provide personal data to them.
• Request to stop provision: please contact the office under Section 9 (OAuth authentication providers, to which the Company provides no personal data, are excluded). However, if provision is stopped, all or part of the Service may become unavailable.

7. Retention Period

The Company shall retain personal information for the period necessary to achieve the purposes of use or for the period required by laws and regulations. Even after withdrawal, information may be retained for a certain period to the extent necessary for legitimate purposes such as payment and tax matters, dispute response, and fraud prevention.

8. Security Management Measures

The Company implements reasonable security management measures, including access control, encryption of communications, and permission management, to prevent leakage, loss, or damage of personal information.

9. Requests for Disclosure, etc.

Individuals may request disclosure, correction, suspension of use, deletion, etc. of their personal information held by the Company. Please contact the Service inquiry form or info@plenaco.com. The Company shall respond within a reasonable period after identity verification.

10. Rights under GDPR, etc.

For residents of the EEA and similar regions, rights such as access, correction, deletion, and data portability may be exercised under applicable laws and regulations. For details, please use the GDPR-related pages on the Service and the inquiry office.

11. Changes to This Policy

The Company may revise this Policy as necessary. If there are important changes, they shall be announced on the Service. Use of the Service after revision shall be deemed agreement to the revised Policy.

---

Established: July 16, 2026 Last revised: September 12, 2026 Effective: September 12, 2026 Version: 2.2