Project Shield for Agency
Effective date: September 15, 2026
This Privacy Policy explains what information Project Shield for Agency (the “Service”), provided by WapiCRM (Seijo 2, Setagaya, Tokyo, Japan) (“we,” “us”), collects when a Customer agency and its staff use the Service, and how that information is used, shared, and protected. This Policy is written for the Customer organization and the individual staff who use the Service on its behalf; where the Service is used to process data about a Customer’s own consultants and clients (“End Individuals”), the Customer — not us — is generally responsible as the data controller for that data, and we act as a data processor / service provider on the Customer’s behalf.
Account and billing information: name, work email, and hashed password for staff accounts; subscription plan, billing status, and Stripe customer/subscription identifiers for the Customer’s organization. We never see or store full payment card numbers — card details are entered directly into Stripe’s hosted checkout.
Ticket and inbox content: when a Customer connects a shared email inbox (via IMAP), the Service reads inbound messages in that inbox to classify them, extract relevant details (such as consultant name, client name, rate, or requirement ID), generate a suggested reply, and store the result as a “ticket.” This may include compensation (“rate”) information and, depending on the content of a given email, immigration or visa-status information about End Individuals.
Master data: consultant/talent and internal staff records that Customer chooses to import (e.g., via CSV), which may include name, email, skill, rate, and availability.
Usage and log data: standard web server logs (IP address, timestamps, requested URLs) for security and troubleshooting.
We do not sell personal information, and we do not use Customer Data to train our own general-purpose models.
We share limited data with the following categories of service providers, solely to operate the Service:
We do not share Customer Data with other Customers of the Service, or with any third party for their own independent marketing purposes.
Because the Service is built for staffing agencies, tickets and master data may include consultant compensation (“rate”) and, where present in an inbound email, immigration or visa-status information about End Individuals. This is treated as sensitive information. Customer is responsible for having a lawful basis to collect and process this data about its End Individuals (including any required notices or consents to those individuals) before submitting it to the Service. We process it only as instructed by Customer, to provide the Service.
Where the Service is used to process personal information of individuals in Japan, we handle that information consistent with Japan’s Act on the Protection of Personal Information (APPI), including limiting use to the stated purposes above and treating compensation and immigration/visa-status details as requiring the Customer’s own appropriate basis (including opt-in consent where APPI requires it for sensitive categories) before submission to the Service. Where the Service is used to process personal data of individuals located in the EU/UK or California, we act as a processor / service provider on the Customer’s instructions, and the Customer remains responsible for having a valid legal basis under GDPR/UK GDPR or the applicable notice and opt-out rights under the CCPA; individuals seeking to exercise a data-subject or consumer right should follow Section 7 below.
We retain Customer Data for as long as the Customer’s subscription is active, plus a reasonable period after cancellation in case Customer wants to export or reactivate. Customer may request deletion of its data at any time by contacting us; we will delete or anonymize it within a reasonable period, except where retention is required by law. Absent a different arrangement with Customer, we retain Customer Data for up to 90 days after subscription cancellation and then delete it, except where a shorter period is requested by Customer or a longer period is required by law.
We use industry-standard measures to protect Customer Data, including encrypted connections (HTTPS) to the Service, salted/hashed password storage, and per-Customer data isolation within the application. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.
Customer may access, correct, export, or delete data it has entered into the Service at any time through the Service itself, or by contacting us. Where an End Individual (e.g., a consultant) wishes to exercise a data protection right (such as access, correction, or deletion) with respect to information about them, they should contact the Customer agency directly, as the Customer is the data controller for that information; we will assist Customer in fulfilling such requests as needed.
Our hosting provider and AI classification subprocessor may store or process data on servers located outside Customer’s own country, including in the United States. By using the Service, Customer acknowledges that Customer Data (including End Individual data submitted to the Service) may be transferred to and processed in such locations. We require our subprocessors to protect Customer Data with safeguards consistent with this Policy, and we take reasonable steps to use providers that maintain appropriate technical and organizational security measures.
The Service is intended for business use by staffing agency staff and is not directed to children. We do not knowingly collect personal information from children.
We may update this Privacy Policy from time to time. For material changes, we will provide reasonable notice (e.g., by email or an in-app notice) before the changes take effect.
Questions about this Privacy Policy, or requests regarding Customer Data, can be sent to: projectshiedexam@gmail.com