Effective August 13, 2026

Privacy Policy

CharacterBank Inc. (hereinafter referred to as the "Company") establishes the following privacy policy (hereinafter referred to as the "Policy") regarding the handling of users' personal information in the game "Knights of Fiona" (hereinafter referred to as the "Game") provided by the Company.

Chapter 1 General Provisions

Article 1 (Definition of Personal Information)

In this Policy, "Personal Information" refers to personal information as defined in Article 2, Paragraph 1 of the Act on the Protection of Personal Information, which is information about a living individual that can identify a specific individual by name, date of birth, or other descriptions contained in such information (including information that can be easily collated with other information and thereby identify a specific individual). The Company does not collect or use personal identifier codes (biometric data, My Number, etc.).

Article 2 (Restrictions on Provision to Third Parties)

The Company will not provide personal information to third parties without obtaining the consent of the individual. However, personal information may be provided to third parties without the individual's consent in the following cases:

  1. When it is necessary for the protection of a person's life, body, or property and it is difficult to obtain the consent of the individual.
  2. When it is particularly necessary for the improvement of public health or the promotion of the sound growth of children and it is difficult to obtain the consent of the individual.
  3. When it is necessary to cooperate with a national agency, a local government, or a person entrusted by them in performing duties prescribed by laws and regulations, and obtaining the consent of the individual is likely to impede the performance of such duties.
  4. When the Company entrusts all or part of the handling of personal information within the scope necessary to achieve the purpose of use.
  5. When personal information is provided due to business succession resulting from a merger or other reasons.
  6. Other cases based on laws and regulations.

Article 3 (Supervision of Trustees)

When the Company entrusts all or part of the handling of personal information to an external operator, it will exercise necessary and appropriate supervision over the trustee to ensure the secure management of personal information at the trustee.

Article 4 (Information Collected)

The Company may collect the following personal information in providing the Game:

  1. Account Information
    • Information on the platform account (meaning Meta, Steam, etc., hereinafter referred to as "Distribution Platform") used by the user to play the Game (user identifiers assigned by the Distribution Platform used by the user to play the Game, such as MetaID, SteamID, etc.).
  2. Device and Technical Information
    • Type of hardware used (VR headset, PC, etc.), OS, performance logs, and crash reports.
    • Technical information about the computer, device, etc. used by the user when utilizing the Game (including terminal identifiers, IP address, information regarding the settings of the information terminal, and other information regarding the operating environment of the computer, device, etc.). The Company may infer the approximate location of the country/region where the user is using the Game based on the IP address.
  3. Gameplay Data
    • Progress of the Game, achievements, and head and hand movements in the VR environment (tracking data). These are used to reflect avatar behavior and optimize operations, and will not be stored for the purpose of biometric identification.
    • Information regarding input and actions performed by the user within the Game (including settings made by the user in the game, specific content of play, date and time of play, total play time, etc.).
  4. Voice Data
    • When a user uses the voice chat function in the Game, voice data may be collected for the purpose of establishing communication and preventing nuisance behavior.
  5. Inquiry Data
    • Content of inquiries and other data when a user makes an inquiry to the Company regarding the Game.

Article 5 (Purpose of Use)

The Company will use the collected information for the following purposes. The Company will not use the collected personal information beyond the scope necessary to achieve the purposes of use defined below without the consent of the individual.

  1. Provision and maintenance of the Game, and synchronization of save data.
  2. Connection between users, voice communication, and matching in multiplayer functions.
  3. Quality improvement, bug fixes, and development of the Game.
  4. Responding to inquiries from users.
  5. Service improvement and content optimization through analysis of Game data.

*The Company may use third-party analysis tools within the scope necessary to achieve the above purposes of use. In doing so, direct personal information such as names will not be provided to the analysis tools, but data used for analysis will be managed appropriately as personal information based on this Policy.

*Cookies are not used in this Game. However, cookies may be used by the Distribution Platform. For the handling of cookies on the platform side, please check the privacy policy of each Distribution Platform.

Article 6 (Protection of Children's Privacy)

In principle, the Game is not intended for children under the age of 13. If the Company finds that it has collected personal information from a child under the age of 13 without appropriate parental consent, it will promptly delete such information. In addition, if age restrictions are set by the Distribution Platform, users shall comply with the regulations of each platform.

Article 7 (Compliance with Distribution Platform Terms)

In addition to this Policy established by the Company, the terms of use and privacy policies of each Distribution Platform used by the user to play the Game shall apply to the use of the Game. For data collected and managed by the Distribution Platform, please check the regulations of said platform.

Article 8 (Security and Safety Management Measures)

The Company takes organizational, human, physical, and technical safety management measures as follows to prevent the leakage, loss, or damage of collected personal information and for other safety management.

  1. A person responsible for the handling of personal information has been appointed, and regular inspections are conducted regarding the status of personal information handling.
  2. Measures such as access control to personal information, prevention of unauthorized access, and encryption of communication paths are taken.
  3. The Company stores personal information on servers in Japan. The above safety management measures are implemented after understanding the system for the protection of personal information in Japan, where the personal information is stored.
  4. In the unlikely event that a serious situation such as the leakage of personal information occurs, the Company will promptly report to the Personal Information Protection Commission and notify the individual in accordance with the provisions of the Act on the Protection of Personal Information.

Article 9 (Retention Period)

The Company will store collected personal information only for the period necessary to achieve the purpose of use. Specifically, the retention period is determined according to the following criteria. However, if retention is obligated by laws and regulations, the necessary information will be stored for the period specified by such laws and regulations. Personal information for which the retention period has elapsed will be promptly deleted.

  1. Account information, gameplay data, and voice data

    Retained until the user deletes the account or until a reasonable period has elapsed after the termination of the service.

  2. Device and technical information

    Deleted after being retained for a maximum of one year from collection.

  3. Inquiry information

    Retained for a maximum of three years after the response is completed.

Article 10 (Disclosure, etc., of Retained Personal Data)

  1. When the Company receives a request from a customer for notification of the purpose of use of retained personal data, disclosure of retained personal data or records of provision to third parties, correction, addition or deletion of the content of retained personal data, suspension of use, erasure, or suspension of provision to third parties (hereinafter referred to as "Disclosure, etc."), the Company will respond to such Disclosure, etc. upon submission of the identity verification documents defined below.

[In case of a request from the individual who is the subject of the retained personal data (All of (1) and (2))]

  1. A copy of any one of the following: driver's license, My Number card, pension handbook, passport, or copy of resident record (within 3 months of issuance).
  2. Registered platform account information.

[In case of a request from a representative (All of (1), (2), (3), and (4))]

  1. A copy of any one of the following: the individual's driver's license, My Number card, pension handbook, passport, or copy of resident record.

  2. The individual's registered platform account information.

  3. A copy of any one of the following: the representative's driver's license, My Number card, pension handbook, passport, or copy of resident record (within 3 months of issuance).

  4. A power of attorney (in the case of a representative by mandate) or a document proving qualification such as a certified copy of the family register (in the case of a statutory auditor).

    1. For requests for notification of the purpose of use of retained personal data or requests for disclosure of retained personal data, a fee (1,000 yen per case) will be charged. The Company will issue an invoice, so please transfer the fee to the designated bank account stated in the invoice. The response will be provided after confirming the transfer. Even in cases of non-disclosure or non-notification of the purpose of use, the Company will not refund the fee.
    2. Please note that the Company may not be able to respond to requests for Disclosure, etc. in the following cases:
      1. When there is a deficiency in the request form or documents for identity verification.
      2. When identity verification cannot be performed.
      3. When the request falls under the grounds for exclusion based on the Act on the Protection of Personal Information.

Article 11 (Changes to This Policy)

The Company may revise this Policy due to amendments to laws and regulations or compatibility with new distribution platforms. The revised policy shall take effect from the time it is posted within the Game or on the official website.

Article 12 (Inquiries)

For inquiries regarding the handling of personal information by the Company, requests for Disclosure, etc., complaints, etc., please contact the following window.

CharacterBank Inc. Inquiry Window for Personal Information Protection

199 Kanshaden-cho, Shimogyo-ku, Kyoto-shi, Kyoto

E-mail: [email protected]

Reception hours: 10:00–17:00 Monday–Friday (excluding holidays)

Chapter 2 Special Provisions

Article 13 (Special Provisions for Residents of the European Economic Area (EEA) and the United Kingdom)

1. Special Provisions

If the user resides in a member state of the European Economic Area (hereinafter referred to as "EEA") or the United Kingdom, this Article shall apply in priority to Chapter 1 of this Policy based on the EU General Data Protection Regulation 2016/679, the UK Data Protection Act 2018, and other national and international data protection and privacy laws and regulations in the EEA and/or the UK (hereinafter collectively referred to as "Data Protection Laws"). However, even in this case, Chapter 1 of this Policy shall apply to matters not provided for in this Article.

2. Source of Personal Data Collection

The Company obtains personal data of users from the following sources:

  1. Direct acquisition from the user

    Information provided through input in the Game, email, written documents, telephone, etc.

  2. Automatic acquisition

    Information automatically collected when the user uses the Company's website or the Game (browsing history, IP address, terminal information, etc.).

  3. Acquisition from third parties

    Information provided by Distribution Platforms or advertising distributors.

3. Legal Basis for Processing Personal Data

The Company processes personal data based on the following legal bases prescribed by Data Protection Laws:

  1. Performance of contract and preparation for conclusion

    When processing is necessary to fulfill contractual obligations with the user, or when processing is necessary to perform procedures requested by the user prior to entering into a contract (consultations regarding the Game, etc.). This includes the provision of the Game, payment procedures, and customer support related to these.

  2. Legitimate interests

    When processing is necessary for the legitimate interests pursued by the Company or a third party, and these interests are not overridden by the user's rights under Data Protection Laws. This includes bug fixes for the Game, detection/prevention of fraudulent acts, analysis for maintenance/development/improvement of the Game, and marketing activities.

  3. Compliance with legal obligations

    When necessary to fulfill legal obligations to which the Company is subject (tax reporting, responding to orders from courts or public agencies, etc.).

  4. Consent

    When the user has given clear prior consent for a specific purpose.

4. Obligation to Provide Personal Data

Provision of specific personal data may be essential as a contractual requirement for the user to utilize the Game. If the necessary information is not provided, the Company may not be able to provide specific services or respond to inquiries.

5. Recipients of Personal Data

The Company may provide some or all of the user's personal data to the following recipients within the scope necessary to achieve the purpose of use:

  1. Service providing partners

    Distribution Platforms

  2. Business contractors

    IT infrastructure/cloud service providers, payment processing companies, customer management system operators, and external trustees who act on behalf of the Company's business.

  3. Public agencies

    Administrative or judicial agencies when based on legal obligations or orders from courts/administrative agencies.

6. Data Transfer

The user's personal data will be stored on servers in Japan. Japan has received an adequacy decision regarding personal data protection from the European Commission and the UK government (effective January 2019), and an appropriate level of protection is ensured for data transfers to Japan.

7. User Rights

Users residing in the EEA and the UK have the following rights regarding their personal data under Data Protection Laws. If you wish to exercise these rights, please contact the window in Article 12. In principle, exercising the rights defined in this section will be handled free of charge. However, if the user's request is unfounded, repetitive, or excessive, the Company may charge a reasonable fee.

  1. Right of access

    The right to obtain a copy of one's own personal data.

  2. Right to rectification

    The right to have inaccurate personal data held by the Company corrected.

  3. Right to erasure (Right to be forgotten)

    The right to request deletion of data under certain conditions.

  4. Right to restriction of processing

    The right to temporarily restrict the use of data.

  5. Right to data portability

    The right to receive data in a structured, machine-readable format.

  6. Right to object

    The right to object to processing based on legitimate interests or direct marketing.

  7. Right to withdraw consent

    The right to withdraw consent at any time when the handling of the user's personal data is based on consent.

8. Lodging a Complaint with a Supervisory Authority

Users have the right to lodge a complaint with a data protection supervisory authority in the EEA or the UK where they reside, work, or where the alleged violation of Data Protection Laws occurred.

Article 14 (Special Provisions for Residents of California, USA)

1. Special Provisions

If the user resides in California, this Article shall apply in priority to Chapter 1 of this Policy based on the California Consumer Privacy Act (meaning CCPA and CPRA, hereinafter collectively referred to as "Privacy Laws"). However, even in this case, Chapter 1 of this Policy shall apply to matters not provided for in this Article.

2. Categories of Personal Information Collected

The Company has collected the following categories of personal information in the past 12 months:

  1. Identifiers

    Platform account ID, IP address, terminal identifiers.

  2. Internet or other network activity information

    Gameplay data, operation data, performance logs, crash reports.

  3. Inferences of location information

    Approximate location (country/region level) based on IP address.

  4. Audio information

    Voice data during the use of voice chat.

3. Sale and Sharing of Personal Information

The Company does not sell users' personal information to third parties in exchange for monetary consideration, nor does it share it for the purpose of cross-context behavioral advertising.

4. User Rights

Users residing in California have the following rights regarding their personal information under Privacy Laws. If you wish to exercise these rights, please contact the window in Article 12 along with the submission of identity verification documents defined in Article 10. In principle, exercising the rights defined in this section will be handled free of charge. However, if the user's request is unfounded or excessive, the Company may charge a reasonable fee.

  1. Right to know (Right to request disclosure)

    The right to request disclosure of the categories and specific pieces of personal information the Company has collected.

  2. Right to request deletion

    The right to request the deletion of personal information the Company has collected.

  3. Right to request correction

    The right to request the correction of inaccurate personal information.

  4. Right to non-discrimination

    The right not to receive discriminatory treatment in the quality or price of services for exercising the above rights.

Article 15 (Matters Published Based on the Act on the Protection of Personal Information)

Based on the Act on the Protection of Personal Information, the information of the personal information handling business operator is disclosed as follows:

Item Content
Business Name CharacterBank Inc.
Location 199 Kanshaden-cho, Shimogyo-ku, Kyoto-shi, Kyoto
Representative Shuto Mikami, Representative Director

This English translation is provided for convenience only. The Japanese-language version of this Policy is the official and governing version. If there is any conflict, inconsistency, or discrepancy between this English translation and the Japanese-language version, the Japanese-language version shall prevail.

Date of Enactment: August 13, 2026

Date of Last Revision: August 13, 2026

Back to top