6-2. Information Handling When Using AI and SaaS
We use AI and SaaS (cloud services) for production, research, operational support, and related work. Before first processing information entrusted to us by a client through these services, we explain and agree in writing or by email on the purpose, the services and their actual information-handling conditions, and the scope of information that may be entered. Use within the agreed scope proceeds without seeking consent for each individual processing step, except where separate consent is required by law or an individual agreement.
We limit inputs to information necessary for the purpose. We remove or mask unnecessary personal information and handle personal information, unpublished materials, and similar information only within the scope for which the necessary authority and permissions have been confirmed. Masking alone does not establish permission to use information.
Clients are asked to identify in advance any prohibited inputs and restrictions imposed by their customers, rights holders, or other relevant parties. Before use, both parties confirm NDAs, service agreements, the restrictions provided, and necessary permissions. Providing materials, the absence of stated prohibitions, or compliance with service terms alone does not constitute permission to enter information. If use would exceed the agreed scope or material service conditions change, we pause the affected processing and reconfirm before proceeding.
Use for training, retention periods, sharing and access, storage locations, deletion methods, and logs or backups that may remain after deletion vary by service, plan, feature, and setting. We confirm and explain what we can control and what depends on the provider, and carry out necessary reasonable safeguards, return, and deletion in accordance with law, contract, and the agreed scope. Data not being used for training does not mean that it is not stored.
We implement measures such as limiting access, managing accounts, and checking recipients. If a mistaken transmission or data breach is suspected, we stop the affected processing, investigate and contain its impact, and take necessary action, including reports and communications required by law or contract.
This Policy does not replace individual NDAs or service agreements, or any necessary consent or permission from the individuals concerned, rights holders, or other third parties. Agreement to use AI or SaaS does not waive legal or contractual obligations or third-party rights.
