Balance — Japan Country Annex

Effective date: 19 July 2026 Last updated: 19 July 2026

Owner: , Director, BabaYaga Program, TOO — Privacy Officer and Designated Child Safety Officer for every Japanese resident covered by this Annex; the person discharging the business-operator contact duties under the Act on the Protection of Personal Information (個人情報の保護に関する法律, Act No. 57 of 2003 as amended, the "APPI"), with business contact ; the designated contact point for the Personal Information Protection Commission (個人情報保護委員会, the "PPC"), the Consumer Affairs Agency ("CAA"), the National Police Agency ("NPA"), and the Internet Hotline Center Japan ("IHC"), under their respective intake protocols. Reviewed: at least once a year, by 9 June. Re-opened immediately on (a) any amendment to the APPI — including the entry into force of the 2026 amendment bill (statutory guardian-consent threshold for data subjects under 16, a best-interests-of-the-child duty, and strengthened enforcement; expected in force 2027 — this Annex is drafted future-proof: Balance already obtains guardian consent for all minors, so the amendment's commencement changes nothing operationally); (b) any amendment to the APPI Enforcement Rules or Cabinet Order, or any PPC Guideline or Q&A revision — in particular the children's-data practice (guardian consent where the minor cannot reasonably judge the consequences, in PPC practice around 15 years old and under) and the Art 28 cross-border information-provision items; (c) any change in the PPC's designation of countries with equivalent standards under Art 28 (currently the EEA and the United Kingdom — not the United States or Kazakhstan); (d) any amendment to the Civil Code Art 4 (age of majority — 18, since 1 April 2022) or Art 5 (a minor's juristic act requires the legal representative's consent); (e) any amendment to the Act on Punishment of Activities Relating to Child Prostitution and Child Pornography (Act No. 52 of 1999, as amended 2014 — simple possession criminalised); (f) any amendment to the Consumer Contract Act, the Act on Specified Commercial Transactions (特定商取引法, the "Tokushōhō"), or the Premiums and Representations Act insofar as they bear on the subscription flow; (g) any decision of the Supreme Court of Japan materially bearing on the APPI or the privacy right (Constitution Art 13); (h) any change in Japan's adequacy postures (the EU-Japan mutual adequacy of 23 January 2019 covers EEA↔Japan flows; it does not govern Japan→US/Kazakhstan flows); (i) any change to a sub-processor's Japan data-handling posture under our sub-processor register; (j) the bringing into force of any post-Effective-date Japanese regulation governing automated processing or related techniques (covered by the deliberate-silence carve-out in § 2); (k) Japan is a party to the Budapest Convention (in force for Japan 1 November 2012) and an APEC CBPR participating economy — any change to either posture. Classification: Public legal annex. This document is published at Privacy Policy alongside the global Privacy Policy (H1) and at Children's Privacy Notice alongside the Children's Privacy Notice (H2), and is incorporated by reference into both. It is one of the country annexes that travel with the global documents under the "global policy + per-country annex" architecture documented in our internal compliance plan § 6.3.

This Annex discharges the country-annex obligations referenced in:

• Privacy Policy § 18 (Country annexes — Japan row).
• Children's Privacy Notice § 14 (Country annexes — Japan row).
• Child Safety Standards § 13 (Country annexes — Japan row).
• Terms of Service § 17 (Japan consumer-protection carve-out — Consumer Contract Act voiding of full liability exemptions; Tokushōhō disclosures).
• Subscription Terms § 18 (Japan consumer-rights overlay — no statutory cooling-off for digital subscriptions; the Tokushōhō disclosure regime applies instead).
• Data Retention & Deletion Policy § 13 (Japan — PPC complaint route).
• our breach-notification runbook § 9 (Japan breach-notification route under APPI Art 26 — prompt initial report + final report to the PPC, data-subject notification).
• our international-transfer pack § 6 (APPI Art 28 consent-after-information cross-border mechanism).

This Annex is the canonical Japanese-resident extension of the global Privacy Policy and Children's Privacy Notice. Where this Annex grants a Japanese resident a right that the global Policy does not, this Annex governs; the converse also holds. The two are read together.

This Annex is drafted in English. A Japanese translation of this Annex and of the common documents is provided via the language switcher at balance.babayagaprogram.com as part of the batch-1 locale rollout — the de-facto expectation of Japanese-language consumer disclosure (Consumer Contract Act / Tokushōhō practice) is discharged by that rendering.

1. Scope and applicability

This Annex applies to every Balance user (parent or kid) whose country of residence is Japan. The APPI is a national statute; there is no prefectural data-protection sub-layer for private-sector processing.

We determine country of residence at install/sign-up time by (a) the country the parent self-declares in onboarding, (b) the IP-geolocation read at sign-up (discarded immediately after the residence decision — our internal data-flow map § 2.1), and (c) the Play Store account locale. Reviewable at Settings → Account → Region. Where any signal identifies Japan, this Annex applies; the most-protective reading controls.

The APPI has explicit extraterritorial reach at Art 171: it applies to a foreign business operator handling personal information of persons in Japan in connection with supplying goods or services to persons in Japan. Balance supplies its service to Japanese residents through Google Play Japan; the APPI applies in full, and the PPC may exercise its report-collection and order powers against Balance directly.

2. Statutory framework — what applies

(Any prospective Japanese regulation governing automated processing, algorithmic decisions, or related techniques — including the AI Promotion Act framework and any successor instrument — is intentionally omitted from this Annex on the principle that this Annex makes no affirmative or negative statement about whether Balance does or does not process personal data using techniques within the scope of any such regulation. Balance's substantive product posture is described elsewhere in the policy bundle and is the controlling reference; this Annex's silence is deliberate.)

3. Supervisory authorities

3.1 PPC

A Japanese resident may consult the PPC's mediation line or a local consumer centre. We accept all enquiries at (named individual: — the APPI Art 40 complaint-handling contact) and respond within the § 6 timelines.

3.2 Other regulatory bodies

3.3 The contact function

The APPI does not impose a general DPO mandate; the operator must publish a complaint-handling contact (Art 40) and the items required on disclosure requests. That contact is , Director, BabaYaga Program, TOO — , published here, in the global Privacy Policy § 1, and at balance.babayagaprogram.com. No local representative is engaged (locked user decision).

4. Lawful bases — APPI purpose regime

The APPI is a purpose-limitation-plus-consent regime rather than a lawful-bases catalogue:

• Parent account data: acquired properly (Art 20) for purposes specified at sign-up (Art 17, Art 21 notice) — service delivery, security, billing.
• Kid profile + device data: acquired with the guardian's consent (PPC children's practice; the pending under-16 statutory rule already satisfied) through the parent-first onboarding (§ 5); used only within the specified supervision purposes.
• Third-party provision (Art 27): none, except the entrusted-processing (itaku) carve-out for the § 10 sub-processors, which operate under our instructions with Art 25 supervision.
• Cross-border (Art 28): the parent's consent after information provision (§ 8).
• No sensitive personal information (Art 20(2)) is processed. No advertising, profiling, or sale — monitoring/limits/tasks are performed at the parent's direction, strictly for the safety, well-being and parental supervision of the child, never for any commercial purpose.

5. Children's rights overlay

1. The parent (guardian) always consents; the kid never self-registers. PPC practice requires legal-representative consent where the minor cannot reasonably judge the consequences (around 15 and under); the 2026 amendment will fix a statutory under-16 threshold (expected in force 2027). Balance already obtains guardian consent for all minors of every age — the kid profile exists only inside the authenticated parent account and the pairing act is the parent's, so both the current practice and the future statutory rule are satisfied by design.
2. Best interests of the child: the amendment's best-interests duty is anticipated: the DPIA (our Data Protection Impact Assessment) records the analysis; the product exposes no content feed, no social surface, no contact-by-strangers surface, no advertising.
3. The guardian exercises the kid's Arts 32-35 rights in-app or by email.
4. Plain language: kid-facing screens use age-appropriate plain Japanese/plain language.
5. No commercial exploitation of children's data — ever.

6. APPI rights catalogue — Arts 32-35

Honoured at and in-app (the guardian exercises the kid's rights):

• Art 32 — disclosure of purposes and items: this bundle + the sign-up notice.
• Art 33 — disclosure of retained personal data: in-app JSON export at Settings → Family → [kid name] → "Export this kid's data" (electronic delivery as the requested method) + plain-language summary; without delay, and in any event within 2 weeks, Balance's self-imposed ceiling.
• Art 34 — correction, addition, deletion: Settings → Account → Edit; result notified without delay.
• Art 35 — cessation of use / erasure / cessation of third-party provision: Settings → "Delete my account" / "Delete this kid"; Delete-account page; cascade per Data Retention & Deletion Policy § 7.
• Art 28(3) reference information on cross-border recipients: § 8 + § 10 below.
• Complaint handling (Art 40): , then the PPC mediation line.

Requests may be in Japanese or English, free of charge (a cost-based fee is permitted for Art 33 disclosure; Balance charges none). Identity verification uses the parent's existing authentication credential.

7. Children's data — consent mechanics and minimisation

• Parent creates the account with a verified email (+ Google Play payment instrument where subscribed), then affirmatively creates the kid profile and pairs the kid's device — the guardian consent, evidenced and logged, via a Japanese-language consent screen itemising items, purposes (safety and parental supervision only), recipients, retention, and rights.
• Data minimisation: only what the supervision service needs; proof media is E2EE to the parent's devices — Balance holds ciphertext only (§ 13).
• Kid data is never used for advertising, never profiled, never sold.

8. International data transfers from Japan — APPI Art 28

Japan→US (hosting) and controller access from Kazakhstan run on Art 28 consent after information provision: at sign-up the parent is provided, before consenting, with (i) the destination countries (United States; Kazakhstan), (ii) an outline of each destination's personal-information protection system (per the PPC's published country summaries), and (iii) the protective measures the recipients take (DPAs, security controls, the E2EE proof-media measure). The sign-up transfer consent is that Art 28 consent. Neither the US nor Kazakhstan is a PPC equivalent-standards country (only the EEA and the UK are). The sub-processors also operate as entrusted processors under Art 25 supervision; the paperwork is in our international-transfer pack § 6. § 18 covers any equivalence or CBPR development.

9. Data residency for Japanese residents

Japan imposes no data-localisation mandate on parental-control services.

10. Sub-processors touching Japanese-resident data

Full list: our sub-processor register.

11. Breach notification — APPI Art 26

Internal SLA: our breach-notification runbook § 5.4 + § 9.

12. Cookies, spam, and electronic direct marketing

The APPI (Art 27(5) read with the 2022 "personally referable information" rules) and the Telecommunications Business Act external-transmission rules (2023) govern tracking identifiers. The Balance app deploys strictly-necessary storage only (authentication tokens; device-pairing key wrap; earned-time cache) and transmits user information externally only to the § 10 processors for service delivery — no advertising or analytics transmission. The public site uses no analytics, advertising cookies, trackers, or fingerprinting. Balance sends no electronic direct marketing to Japanese residents (the Act on Regulation of Transmission of Specified Electronic Mail opt-in rule would apply if it ever did) — only transactional email. Advertising directed at children: never.

13. Lawful-access requests and the encryption posture

Japanese authorities may seek data via Criminal Procedure Code warrants (Art 218) and records-production orders, PPC report-collection powers, and international channels (Budapest Convention; Japan-US MLAT in force 2006). Posture:

• Proof media is end-to-end encrypted (fresh per-file key, XChaCha20-Poly1305, wrapped to parent-device X25519 keys; ciphertext-only upload). No master key, no backdoor.
• Response protocol: (1) acknowledge within one business day; (2) engage Japanese counsel to assess validity; (3) preserve relevant ciphertext; (4) inform the authority that plaintext is not available from us; (5) cooperate in identifying the lawful route to the key-holding parent.
• No bulk plaintext interception assistance; no server-side content scanning. CSAE cooperation runs via § 14 regardless.

Full encryption posture: our encryption-posture record.

14. CSAE reporting routes — Japan

• Balance Designated Child Safety Officer: (named individual: ). Acknowledgement within one business day, in Japanese for Japanese reporters.
• Police: emergency 110; non-emergency consultations #9110; prefectural-police cybercrime consultation desks.
• Internet Hotline Center Japan (IHC): https://www.internethotline.jp/ — INHOPE-member illegal-content hotline (CSAM category).
• Child-abuse consultation dial 189 (いちはやく) — routes to the local child consultation centre (児童相談所).
• Childline Japan: https://childline.or.jp/ — 0120-99-7777 (for children).
• NCMEC CyberTipline (https://report.cybertip.org/) — provider-side discoveries route to NCMEC, which relays to Japanese law enforcement.

Full routing table: Child Safety Standards § 8.5.

15. Complaint routes (summary)

A Japanese resident may always first raise the matter at (APPI Art 40); prior contact is not a precondition to any authority route.

16. Consumer rights — the Consumer Contract Act + Tokushōhō overlay

• Consumer Contract Act: clauses that fully exempt our liability, or that unilaterally prejudice the consumer contrary to good faith (Art 10), are void — the Terms of Service contain no such clause (Terms of Service § 17).
• Tokushōhō online-sales disclosures: the final-confirmation screen shows the subscription quantity/term, price, payment timing, supply timing, and cancellation method — including the 2022 subscription-trap rules — implemented in the Google Play purchase flow + Subscription Terms § 5.
• No statutory cooling-off applies to online mail-order digital subscriptions; the disclosed cancellation policy governs — Balance discloses its cancellation terms plainly and honours the Google Play refund policy as the operational floor plus its voluntary refund posture (Subscription Terms § 8).
• Premiums and Representations Act: no misleading representations; pricing shown tax-inclusive in the store flow.
• Contracting capacity: age of majority 18 (Civil Code Art 4, since 1 April 2022); a minor's contract without legal-representative consent is voidable (Art 5) — the subscribing parent must be an adult; the kid never contracts with Balance.

17. Cross-references

• Global Privacy Policy: Privacy Policy (H1).
• Children's Privacy Notice: Children's Privacy Notice (H2).
• Terms of Service: Terms of Service (H3).
• Subscription Terms: Subscription Terms (H4).
• Child Safety Standards: Child Safety Standards (H5).
• Retention Policy: Data Retention & Deletion Policy (H6).
• Records of Processing: our Records of Processing Activities (Article 30) (H7).
• DPIA + LIA: our Data Protection Impact Assessment (H8).
• Breach Runbook: our breach-notification runbook (M1).
• Transfer Pack: our international-transfer pack (M2) — APPI Art 28 information-provision items on file.
• JIT Permission Disclosures: the just-in-time permission disclosures (M3).
• App Classification: our country classification table.
• Sub-processor list: our sub-processor register.
• Encryption Posture: our encryption-posture record.
• Data Flow / Inventory Map: our internal data-flow map.
• Compliance Plan: our internal compliance plan.

18. Versioning and review

• Every change to a substantive row in §§ 2-16 bumps the frontmatter and triggers re-publication.
• The commencement of the 2026 APPI amendment (expected 2027) triggers a confirmation review of §§ 2, 5, 7 (operationally already satisfied — guardian consent for all minors).
• Any PPC Guideline/Q&A revision on children's data, Art 28 information items, or equivalence designations triggers an off-cycle rewrite of §§ 5, 8.
• A material Consumer Contract Act / Tokushōhō change triggers an off-cycle update to § 16 + Subscription Terms.
• A material change to a sub-processor's posture triggers an off-cycle update to §§ 8, 10.
• The annual review is by 9 June. The Privacy Officer signs off; the Designated Child Safety Officer co-signs any change to §§ 5, 7, 11, 13, 14.

End of Japan Country Annex.