Soroban Portal Privacy Policy

This is an English reference translation. Only the Japanese version is legally binding. If the two versions differ, the Japanese version prevails.

SIC Co., Ltd. ("we", "us" or "our") handles personal information in "Soroban Portal" (the "Service") as follows, in accordance with the Act on the Protection of Personal Information and other laws and regulations.

1. Business operator

Name: SIC Co., Ltd.
Address: #1-1-1 Osaka Ekimae No.3 Bldg 29F, 1-1-3 Umeda, Kita-ku, Osaka-shi, Osaka-fu 530-0001, Japan
Representative: Hiroki Inoue, Representative Director

2. Scope of this policy

This policy covers the personal information of Subscribers to the Service (schools and organizations) and their administrators, and of the students and teachers that Subscribers add to the roster.
Information generated when the Soroban app is used with an issued account (such as learning records) is handled under the Soroban app privacy policy.
This policy also covers the personal information of people who send a consultation or question through the form on the Soroban Portal introduction page (portal.abacus.sicorp.jp).

3. Information we collect

Administrator information: the email address used to sign in to Soroban Portal, and identifiers assigned by the authentication system (including the identifier of the Google Account when signing in with a Google Account)
School information: school name, country of the school (Japan or outside Japan), and subscription status
Student information: the display name entered by the Subscriber, role, whether the student is enrolled or withdrawn, the features added, and the login ID and status of issued accounts (including students whose add-on has been removed and students who have been withdrawn). Passwords are kept only in a form converted by the authentication system for verifying sign-ins; we never store or view the passwords themselves
Payment information: school name, administrator's email address, and the status of the subscription, invoices and payments. Payment details such as credit card numbers are collected directly by the payment service (Stripe), and we do not keep them
Operation records: for operations performed in Soroban Portal, the administrator who performed them, the date and time, and what was done (including, for example, a display name before and after a change; passwords are not included)
Content entered for processing by a feature: some information, such as the title of a worksheet, is handled temporarily for processing and is not stored
Records needed to check limits, such as the number of times a feature has been used
Access records: information such as IP address, date and time, and browser type that comes with access to the Service
Records of errors on screens: for errors that occur on Soroban Portal screens, the type, details, when and where they occurred, the screen version and the browser type. Names, email addresses and IP addresses are not recorded
Records of sending sign-in links: the recipient email address and the source of the connection, converted into values that cannot be restored to the original, and the number of sends
Consultation information: your name, school name, email address, country or region, the content of your consultation, which page or link you came from (referral source), a value converted from the IP address of the sender that cannot be restored to the original, and the type of browser
On the introduction page, we use Google Analytics (Google LLC) to understand how the page is viewed.
The Service's screens and the introduction page obtain fonts from Google Fonts (a service operated by Google LLC). When they do, the IP address of the connection is sent to Google and is handled under Google's privacy policy.

4. Purposes of use

To provide and manage the Service
To bill and collect fees and to issue receipts and invoices
To send notices about the Service and to respond to inquiries
To prevent unauthorized use, investigate failures and operate the Service safely
To improve the Service

5. Provision to third parties

We do not provide personal information to third parties without the consent of the individual, except where required by law or otherwise permitted by law.

6. Entrustment and handling outside Japan

To the extent necessary to achieve the purposes of use, we entrust the handling of personal information to the following businesses.
Google LLC (United States): authentication (Firebase Authentication), data storage (Google Cloud Firestore, stored in the Tokyo region), server operation and access records
Stripe, Inc. (United States) and its group companies: payment of fees and issuing invoices and receipts. The handling of payment information is also subject to Stripe's privacy policy
Amazon Web Services Japan G.K. (Japan) and its affiliates (sending is done in the Tokyo region): sending emails with sign-in links and acknowledgment emails for consultations
Cloudflare, Inc. (United States): detecting fraudulent automated access on the sign-in page
Functional Software, Inc. (United States; service name Sentry): storing records of errors that occur on Soroban Portal screens and notifying us
Discord Inc. (United States): notifying our staff that a consultation has been received
The system for the protection of personal information in the United States is as described in the survey of systems for the protection of personal information in foreign countries published by the Personal Information Protection Commission, Japan (Japanese only). Based on an understanding of that system, we take measures to select and supervise the businesses we entrust and other measures for safe management.

7. Retention period

Operation records are deleted automatically 3 years after the date they were recorded.
Access records are, as a rule, deleted after 30 days.
Records of errors on screens are, as a rule, deleted after 30 days.
Records of sending sign-in links are, as a rule, deleted automatically within 3 days.
When a Subscriber deletes a student, we delete that student's roster information, learning records and sign-in information, including their name in operation records.
Deleted information remains for up to 14 days in the backups we take automatically in case of failures, and is then deleted automatically.
Other information is kept during the subscription and, after it ends, for the period required by law or necessary to operate the Service, and is deleted when no longer needed.

8. Security measures

Sign-in to Soroban Portal is limited to Google Accounts or a sign-in link in an email received by the person themselves, and each administrator can handle only the information of the schools they manage.
Two-step verification is set up on the accounts of our staff who manage the whole Service.
Communication is encrypted (HTTPS), and operation records are kept.
When we entrust businesses outside Japan, we take measures based on an understanding of that country's system, as described in Section 6.

9. Information about students

Display names are entered by the Subscriber. A display name does not have to be a full name; the Service can be used with a nickname or similar.
The Subscriber shall explain to students and their guardians the use of the Service and the handling set out in this policy.

10. Requests for disclosure and inquiries

We accept requests for notification of the purposes of use, disclosure, correction, addition or deletion, suspension of use or erasure, suspension of provision to third parties, and disclosure of records of provision to third parties concerning retained personal data, as well as inquiries and complaints about the handling of personal information, at the contact below. After confirming the identity of the individual, we will respond without delay in accordance with the law.
Contact: Personal Information Inquiries, SIC Co., Ltd. Email: support@sicorp.jp

11. Revisions

We may revise this policy in response to changes in laws or to the Service. The revised policy takes effect when it is posted on this page.

SIC Co., Ltd.
support@sicorp.jp
Established: October 25, 2026
Updated: November 2, 2026