Voice BouquetBack to Home

Privacy Policy

Privacy Policy

Last updated: October 11, 2026

ACK Craft K.K. ("we," "us," or "our") operates Voice Bouquet ("the Service"). This Privacy Policy explains how we collect, use, store, and protect your personal information — including voice recordings and biometric data — when you use the Service.

01Information We Collect

We collect the following information:

  • ●
    Organizer's email address
    Provided when creating a bouquet. Used to send the recording link, management URL, and video-ready notification, as well as notices about your bouquet (such as anniversary notices) and information about the Service. You can stop notices and information with the unsubscribe link in each email.
  • ●
    Participant's email address (optional)
    If you register it on a bouquet's page, used to send notices about the bouquet (such as when it is complete, when a thank-you voice arrives, or anniversary notices) and information about the Service. While we offer perks such as coupons, it is also used to send the bouquet link and the perk. You can stop these with the unsubscribe link in each email.
  • ●
    Recipient's name
    Used as the addressee of the bouquet.
  • ●
    Recorder's name
    Displayed alongside the voice message.
  • ●
    Voice recordings (audio data)
    Your recorded voice messages are stored to deliver the bouquet. Voice recordings may constitute biometric data under certain laws (see Section 09 below).
  • ●
    Photos
    Optionally attached to voice messages.
  • ●
    Thank-you messages
    We may store the audio thank-you message the recipient sends back to the organizer and participants, along with a photo if one is added.
  • ●
    When the recipient page was first opened
    We save the time the recipient first opened the recipient page, once per bouquet, and show it to the organizer on the management page so they can see the bouquet was delivered. It does not include IP addresses or device information.
  • ●
    Feedback
    Optional comments or suggestions you submit for service improvement.
  • ●
    Payment information
    Processed through Stripe. We never store credit card numbers or payment credentials on our servers.
  • ●
    Access logs
    IP addresses and basic access data collected for security and abuse prevention.
  • ●
    Bouquets created from ChatGPT
    If you create a bouquet with the Voice Bouquet plugin in ChatGPT, we receive only what the plugin needs: the recipient's name, the occasion, the language, your email address, and optionally how the bouquet is signed and up to three conversation starters. We do not receive your ChatGPT conversation. The recording link and the number of voices we return appear in your ChatGPT conversation and are handled by OpenAI under its own terms. To prevent abuse, we keep a count of plugin requests without names, email addresses, or links.

The Service does not require account registration. We do not collect passwords.

02How We Use Your Information

We use the collected information only for the following purposes:

  • ●Creating, managing, sharing, and generating videos (including audio and photos)
  • ●Facilitating thank-you messages from the recipient to the organizer
  • ●Showing the organizer whether the bouquet was delivered (whether the recipient page was opened)
  • ●Sending notification emails to the organizer (e.g., recording completion)
  • ●Sending organizers and participants who registered their email address notices about their bouquet (such as anniversary notices) and information about the Service
  • ●Operating, maintaining, and improving the Service
  • ●Automatically analyzing recordings to understand the occasions the Service is used for and to improve it, including detecting technical problems such as silent or failed recordings
  • ●Preventing fraud and unauthorized use
  • ●Responding to inquiries and support requests

Automated analysis of recordings

We analyze recordings automatically on computers we manage. Recordings and the transcripts created for this analysis are not sent to external AI services, and are not used to train any AI model.

We keep only categories for each bouquet (such as the occasion or situation, for example a birthday, a retirement or a get-well wish for someone who is ill or in hospital) and aggregate statistics. Transcripts are deleted within 24 hours of processing. Per-bouquet categories are kept for as long as the bouquet exists and are deleted when the bouquet is deleted. Categories are never stored together with the recipient's name.

We do not use these categories for advertising or to personalize emails, and only a limited number of our staff can access them.

For people in the UK and the EEA, we carry out this analysis on the basis of our legitimate interests in understanding how the Service is used and keeping it working properly.

You can object to this analysis at any time, even if you only recorded a message and do not have an account, by emailing voice-bouquet@ackcraft.com. We will exclude the relevant recordings from analysis and delete any categories already created for them.

Apart from this automated analysis, our staff listen to a recording only when needed to respond to a support request or to investigate a technical problem or misuse.

03Third-Party Sharing

We do not sell, rent, or trade your personal information. We share personal information only in the following circumstances:

  • ●When required by law, regulation, or legal process
  • ●To protect the life, safety, or property of any person
  • ●With your explicit consent

We use the following third-party service providers to operate the Service. These providers process data on our behalf under contractual obligations:

  • ●Google Firebase (data storage, audio & photo file hosting)
  • ●Google Cloud — Cloud Run / Cloud Storage (video generation & storage)
  • ●Stripe (payment processing)
  • ●Resend (email delivery)
  • ●Vercel (web hosting)
  • ●Sentry (error monitoring & performance tracking)
  • ●ElevenLabs (text-to-speech for video narration)

04Data Retention & Deletion

Completed bouquet data (audio, photos, and associated information) is retained indefinitely until the organizer requests deletion.

Incomplete bouquets are automatically deleted approximately 30 days after creation.

Video download links have an expiration period. Please download your video promptly. After download, file management is your responsibility.

To request deletion of your data, please contact us by email. We will process deletion requests within 30 days.

05Security

We implement the following measures to protect your data:

  • ●All communications are encrypted via HTTPS (SSL/TLS)
  • ●Access tokens are hashed to prevent unauthorized URL-based access
  • ●Direct access to audio and photo files is restricted; files are served only through our servers
  • ●Database and storage access is limited to server-side processes only

06Analytics & Advertising

We use the following tools for service improvement and advertising measurement. These tools may use cookies and browser identifiers to measure visits and activity. We use the results in aggregate to improve the service.

  • ●
    Google Analytics (Google LLC)
    Used to analyze website usage. See Google's Privacy Policy for details.
  • ●
    Meta Pixel (Meta Platforms, Inc.)
    Used for advertising measurement and optimization. See Meta's Data Policy for details.
  • ●
    ChatGPT Ads Pixel (OpenAI, L.L.C.)
    Used to measure and optimize ads shown in ChatGPT. See OpenAI's Privacy Policy for details.
  • ●
    Vercel Analytics / Speed Insights (Vercel Inc.)
    Used to measure page performance. See Vercel's Privacy Policy for details.

You can disable data collection by adjusting your browser's cookie settings. Some features may not function properly with cookies disabled.

To measure progress without loading analytics SDKs on private gift pages, we retain the organizer's existing Google Analytics browser identifier for up to 30 days. We send recording-received, completion and purchase events, plus progress actions such as screen visits, recording, sharing, opening, playback, setup, download requests, thank-you recording and sending, email registration and create-new-gift clicks, from our server, including payment amount and currency. We do not send names, email addresses, recordings or private links in these events. The participant browser, recording and upload-attempt identifiers stay in our database; they are not sent to Google Analytics. Fixed screen and access-role categories describe bouquet progress attributed to the organizer, not identified recipients. If you disable analytics cookies, reopen your gift management page so we can stop future server events associated with that gift. Previously sent events are not removed by this browser setting.

To improve the service and troubleshoot problems, we record visits to management, recording and recipient screens, sharing, whether the name field was filled, the recording button being shown, arrivals from anniversary email links, recording, playback start/end, showing and playing the thank-you, download requests, setup, registration actions, send failures and save results in our database, using random identifiers scoped to a bouquet and browser, plus recording and upload-attempt identifiers. Diagnostic records exclude audio, names, email addresses and access tokens, but link to internal bouquet and saved-message IDs. We do not use them to identify the same person across devices. Browser identifiers and pending events expire after 30 days and are cleared on a subsequent visit. Server diagnostic records older than 30 days are removed by scheduled cleanup. For each bouquet, however, we keep only the first time each of these stages was reached — the recipient screen being shown, opened and played, the thank-you being recorded and sent, and the thank-you being shown and played — with the bouquet’s record until the bouquet is deleted. Removing a recording or a thank-you also clears these times, together with the diagnostic history above. These times do not include participant or browser identifiers. Removing a recording also clears that bouquet’s diagnostic history up to the deletion request. We do not record in browsers that send DNT or GPC, have cookies disabled, or have an existing analytics opt-out. However, the time the recipient page was first opened (listed under information we collect) is recorded as part of the service, regardless of these settings, so the organizer can see the bouquet was delivered. Browsers that previously turned off action recording stay opted out. These settings do not erase records already sent. Clearing browser storage resets identifiers and saved preferences. Errors sent to Sentry may include the upload-attempt ID only; Sentry’s operational retention settings apply separately.

07Cookies

The Service uses cookies through the analytics and advertising tools described above. Our hosting provider (Vercel) may also use cookies for technical purposes.

08Children's Privacy

The Service is not directed to children under 13 years of age. We do not knowingly collect personal information from children under 13. If we learn that we have collected personal information from a child under 13, we will promptly delete it.

Users between the ages of 13 and 16 may use the Service only with parental or guardian consent.

If you believe a child under 13 has provided us with personal information, please contact us by email.

09Biometric Data Notice

Voice recordings collected through the Service may constitute biometric identifiers or biometric information under applicable state laws, including the Illinois Biometric Information Privacy Act (BIPA).

  • ●
    Purpose of collection
    Voice recordings are collected to create, store, and deliver bouquets as requested by the user, and are analyzed automatically as described in "How We Use Your Information". We do not create voiceprints or use recordings to identify individuals.
  • ●
    Storage & retention
    Voice recordings are stored until the organizer requests deletion, or until the purpose for which they were collected has been fulfilled. Incomplete recordings are deleted after 30 days.
  • ●
    No sale or profit
    We do not sell, lease, trade, or otherwise profit from your biometric data.
  • ●
    Destruction schedule
    When the purpose for collecting biometric data has been satisfied, or within 3 years of the individual's last interaction with the Service (whichever comes first), we will permanently destroy the biometric data.

By using the Service and submitting a voice recording, you acknowledge and consent to the collection, storage, and use of your voice data as described in this policy. You may withdraw consent at any time by contacting us to request deletion.

10Your Privacy Rights

Depending on your jurisdiction, you may have the following rights regarding your personal information:

  • ●
    Right to know
    You can request details about what personal information we have collected, the sources, purposes, and third parties with whom it is shared.
  • ●
    Right to delete
    You can request deletion of your personal information. We will process your request within 30 days.
  • ●
    Right to opt-out of sale
    We do not sell your personal information. There is nothing to opt out of.
  • ●
    Right to non-discrimination
    We will not discriminate against you for exercising any of your privacy rights.
  • ●
    Right to data portability
    You can request a copy of your personal information in a commonly used, machine-readable format.

California residents (CCPA/CPRA): Under the California Consumer Privacy Act, you have the rights listed above. We have not sold personal information of any consumer in the preceding 12 months. To exercise your rights, contact us by email.

We will verify your identity before processing requests. You may designate an authorized agent to make requests on your behalf.

11Do Not Track Signals

Some browsers send "Do Not Track" (DNT) signals. There is currently no industry standard for responding to DNT signals. We stop the server analytics described in Section 06 when we detect DNT or Global Privacy Control (GPC) during creation or a visit to the gift management page. This does not change the behavior of every analytics tool on public pages.

12International Data Transfers

Our company is based in Japan. Your data may be stored and processed in Japan, the United States, or other countries where our service providers operate. By using the Service, you consent to the transfer of your data to these countries. We ensure appropriate safeguards are in place for international data transfers.

13Changes to This Policy

We may update this Privacy Policy from time to time. Significant changes will be posted on this page with an updated "Last updated" date. Continued use of the Service after changes constitutes acceptance of the updated policy.

14Contact Us

For questions about this Privacy Policy, to exercise your privacy rights, or to request data deletion, please contact us:

Company
ACK Craft K.K.
Representative
Hiroshige Umino
Address
390-2 Shimomaruya-cho, Kawaramachi-dori Oike-sagaru, Nakagyo-ku, Kyoto 604-8006, Japan
Service
Voice Bouquet