Privacy Notice

Effective September 15, 2026

This Privacy Notice explains how Keisho LLC (“Keisho”, “we”, “us”) handles personal information in operating Keisho Scout, a service that connects owners of businesses in Japan who are planning a succession or sale with people and companies who want to acquire a business (the “Service”).

We handle personal information in accordance with Japan’s Act on the Protection of Personal Information (the “APPI”) and the guidelines issued under it.

This notice is published in Japanese and English. The Japanese version is the official version, and if the two differ, the Japanese version prevails.

1. Who is responsible for your information

Item	Details
Business operator	Keisho LLC
Address	[to be added]
Representative	[to be added]
Contact for personal information	scout@keisho.biz

Keisho Scout is a joint venture between Keisho and Acquire Scout. Keisho is responsible for the personal information handled in the Service. Acquire Scout builds and operates the Service’s technology on Keisho’s behalf, as a service provider described in section 7.

2. What this notice covers

This notice applies to personal information we handle through the Keisho Scout website, the accounts people create on it, and our email and telephone contact with you about the Service. It does not cover Keisho’s other services or websites operated by others. When you verify your identity, the screens you use are operated by Stripe, and Stripe’s own privacy policy also applies to them (see section 3.3).

3. The information we collect

3.1 Owners who list a business

Your name, telephone number and email address.
Your relationship to the business, and information that shows you own it or are authorised to sell it, including the document you provide for that purpose.
Information about the business: its name, address, industry and location; financial information such as revenue, profit and asking price; the number of employees; the reason for the sale; and your other answers to our questions.
Documents and photographs you upload, such as financial statements.
The agreement you enter into with us and the date you signed it.
Messages you exchange with us through the Service, and records of our calls and meetings with you.

3.2 Buyers

Your full legal name, email address and country of residence.
Whether you are acquiring as an individual or through a company, and the type of buyer you are.
The plan you have chosen.
Listings you save, the requests you make about listings, and the messages you write to owners with those requests.
Records of agreements you enter into through the Service, such as non-disclosure agreements, including the text you agreed to, the name you signed with and the time you signed.
The result of your identity verification (section 3.3).

3.3 Identity verification by passport

Buyers verify their identity with their passport through Stripe Identity, a service provided by Stripe, Inc. and its affiliates (“Stripe”). The verification takes place on screens operated by Stripe. During it, Stripe collects:

Images of your passport.
Images of your face, which Stripe compares with the photograph in your passport using biometric technology.
The details printed in your passport, such as your name, date of birth, passport number, issuing country and expiry date.
Information about the device and connection you use.

Keisho Scout receives from Stripe only whether you were verified, the reason if verification did not succeed (for example, that a photograph could not be read), a reference number for the verification and the time. We also record which version of the consent wording you agreed to and when. We do not copy your passport images, your face images or the details read from your passport into Keisho Scout’s own systems.

Stripe keeps the images and details it collects in Keisho’s Stripe account, where they can be viewed by the people who have access to that account: Keisho’s staff and those operating the Service on Keisho’s behalf. Stripe also uses verification information for its own purposes, including preventing fraud, keeping its services secure and improving them, in accordance with its privacy policy at https://stripe.com/privacy. How long this information is kept is described in section 10, and where it is processed in section 8.

We ask for your consent before your verification begins. If you would prefer not to verify through Stripe, contact us at scout@keisho.biz and we will arrange another way to verify your identity.

3.4 Information collected automatically

Cookies that keep you signed in and remember choices you make, described in section 9.
The country your connection appears to come from, which our hosting provider determines from your IP address. We use it to choose the language and currency to show you. We do not store it against your account.
Technical records kept by our hosting provider when you use the Service, such as your IP address, the pages you request, the time and your browser type.
Reports of errors in the Service, with names, email addresses and telephone numbers removed before they are sent.

Some illustrative photographs on our pages are loaded from Unsplash. To display them, your browser connects to Unsplash, which receives your IP address.

3.5 When you contact us

When you email or telephone us, we keep the content of the correspondence and your contact details so that we can respond and keep a record of what was agreed.

3.6 Information we do not ask for

We do not ask for special care-required personal information as defined in the APPI, such as information about race, creed, medical history or criminal record. Please do not include it in listings, documents or messages.

4. How we use your information

We use personal information for the following purposes:

To create and manage accounts and to let you sign in.
To prepare, review and publish listings, including confirming that the person listing a business owns it or is authorised to sell it, and reviewing listings for information that could identify the business before they are published.
To show anonymous listings to the public and more detailed listings to registered buyers, within the limits set out in section 5.
To pass a buyer’s request and profile to the owner of the business concerned, and to disclose a business’s identity to a buyer whom the owner has approved and who has signed a non-disclosure agreement.
To verify the identity of buyers.
To provide our business succession and M&A advisory and intermediary services to owners who have entered into an agreement with us, including calls, preparing documents and arranging meetings.
To prepare Japanese and English versions of listings, including by automated translation that the owner and our staff review.
To send you notices about your account, your listings and your requests.
To respond to your enquiries and requests.
To keep the Service secure, prevent and investigate fraud and misuse, and diagnose and fix problems.
To improve the Service.
To comply with laws and regulations, and to establish, exercise or defend legal claims.

We do not use personal information beyond these purposes without your consent, except where the APPI permits it.

5. What other users of the Service can see

Anyone, without an account, can see a listing’s description of the business, its industry, its prefecture and headline figures such as asking price and revenue. Public listings never contain the business’s name, its address, or the owner’s name or contact details.
Registered buyers can see further details of a listing, according to their plan. These details still never include the business’s name, its address, or the owner’s name or contact details.
When a buyer asks about a listing, the owner of that business can see the buyer’s full legal name, whether the buyer is an individual or a company, the type of buyer, the buyer’s country of residence, whether the buyer’s identity has been verified, and the message the buyer wrote.
When the owner approves a buyer and the buyer signs a non-disclosure agreement, that buyer can see the business’s name and address and any means of contacting the business that the owner has chosen to share, and can open the documents the owner has released to them.
The owner’s own name, email address and telephone number are never shown to any buyer, at any stage.
Keisho’s staff can see the information they need to review listings, confirm ownership, verify buyers and provide our services.

6. Sharing with third parties

We do not sell personal information.

We provide personal data to third parties only with your consent or where the APPI permits. The sharing between owners and buyers described in section 5 happens when you take the step that causes it: a buyer’s profile is shared with an owner when the buyer asks about that owner’s listing, and a business’s details are shared with a buyer when the owner approves that buyer. By taking that step, you consent to that sharing.

We may also provide personal data without consent where the APPI permits, including where it is required by law, where it is necessary to protect a person’s life, body or property and it is difficult to obtain consent, or where we need to cooperate with a public authority performing duties prescribed by law. Personal data may also pass to a successor if our business is transferred through a merger or other transaction; this is not a provision to a third party under the APPI.

We keep the records of provision to third parties that the APPI requires.

7. Service providers

We entrust the handling of personal information to the following service providers, to the extent needed for them to perform their services for us. We select providers that protect personal information appropriately, bind them by agreement to do so, and supervise them.

Provider	What they do for us	Information they handle	Where it is processed
Supabase, Inc.	Database, file storage and sign-in	Account, listing and buyer information; uploaded documents and photographs	Japan (Tokyo)
Vercel Inc.	Hosting the website and running the Service	Information passing through the website; technical records	The Service runs in Japan (Tokyo); pages are delivered from Vercel’s network location nearest you
Amazon Web Services	Sending service emails; automated translation of listings	Email addresses and email content; listing text	Japan (Tokyo)
Resend, Inc.	Sending account emails, such as password resets	Email addresses and email content	United States
Functional Software, Inc. (Sentry)	Error reporting	Technical details of errors, with names, email addresses and telephone numbers removed	European Union (Germany)
Stripe, Inc. and its affiliates	Identity verification of buyers	The information described in section 3.3	United States, India and other countries where Stripe operates
Acquire Scout	Developing and operating the Service	Information in the Service, to the extent needed for development and operation	United States

8. Information processed outside Japan

Some personal information is handled outside Japan. For each case, we set out below the country concerned, information about that country’s system for protecting personal information, and the measures the recipient takes to protect it.

8.1 Identity verification by Stripe

Country: the United States, and other countries where Stripe and its service providers operate, including India. Stripe lists its service providers at https://stripe.com/service-providers/legal.
The United States’ system: the United States has no comprehensive federal law on the protection of personal information. The Federal Trade Commission Act prohibits unfair and deceptive practices, including in the handling of personal information, and federal laws apply to particular sectors such as finance and health. A number of states, including California, have comprehensive laws. The United States participates in the APEC Cross-Border Privacy Rules System. United States law also allows government authorities to require companies to provide information they hold, for law enforcement and national security purposes. The Personal Information Protection Commission publishes information on the systems of foreign countries at https://www.ppc.go.jp/personalinfo/legal/kaiseihogohou/.
Measures taken by Stripe: Stripe processes the information on our behalf under a data processing agreement that forms part of our agreement with Stripe. Stripe states that, when it transfers personal data of people in Japan to countries the Personal Information Protection Commission has not recognised as having equivalent protection, it enters into written agreements with the recipients that provide rights and obligations equivalent to those under the APPI. Stripe also states that its privacy practices comply with the APEC Cross-Border Privacy Rules (CBPR) and Privacy Rules for Processors (PRP) systems.

We provide this information on the consent screen before your verification begins, and ask for your consent there.

8.2 Account emails by Resend

Country: the United States. Resend keeps email addresses and email content for 30 days.
The United States’ system: as described in section 8.1.
Measures taken by Resend: Resend handles the information under its Data Processing Addendum, under which it processes personal data only for the purposes of our agreement and in accordance with our documented instructions, and protects it with appropriate technical and organisational security measures. Resend states that its services are audited under SOC 2 Type II and ISO 27001.

8.3 Error reports by Sentry

Error reports are processed in Germany, in the European Union. The Personal Information Protection Commission has designated the member states of the European Economic Area as having a system for protecting personal information that is equivalent to Japan’s. Names, email addresses and telephone numbers are removed from reports before they are sent.

8.4 Providers based outside Japan that process in Japan

Supabase, Vercel and Amazon Web Services are companies based in the United States. The personal information they handle for the Service is stored and processed in their Tokyo facilities, except as stated in section 7.

8.5 Further information

On request, we will provide further information about the measures described in this section. Contact us at scout@keisho.biz.

9. Cookies

The Service uses the following cookies:

Cookie	Purpose	How long it lasts
sb-…	Keeps you signed in to your account	Until you sign out or your session ends
ks_locale	Remembers the language you chose	One year
ks_currency	Remembers the currency you chose for prices	One year
keisho-preview	Gives access to the Service before its public launch	30 days

We do not use advertising cookies, analytics cookies, tracking pixels or third-party analytics services. During identity verification, Stripe sets its own cookies on its own screens, as described in Stripe’s privacy policy.

10. How long we keep information

Documents and photographs uploaded for a listing, including the document provided to show ownership, are deleted 90 days after the listing is withdrawn, closed or declined by Keisho. If the listing returns to review or is published again before then, they are not deleted.
A listing you have not worked on for 30 days is set aside, so that your page stays tidy. What you have written is kept. The documents and photographs uploaded for it, including the document provided to show ownership, are deleted 12 months after it is set aside. Opening the listing again before then stops that.
Other account and listing information is kept while your account is open. When you ask us to close your account, we delete it or make it impossible to identify you from it, except for information we need to keep, such as signed agreements, records the law requires us to keep, and records of provision to third parties, which we keep for as long as that need lasts.
The result of your identity verification is kept with your account.
In Keisho’s Stripe account, Stripe keeps the images and details collected during verification for up to three years, unless we delete them sooner, and keeps the biometric information used to compare your face with your passport for up to one year. Information that Stripe holds for its own purposes is kept in accordance with Stripe’s privacy policy.
Resend keeps account emails for 30 days.

11. How we protect your information

We take the following measures to prevent the leakage, loss or damage of personal data and otherwise to manage it securely:

Basic policy and rules: we have set out this notice as our basic policy and have established rules for how personal data is acquired, used, stored, provided, deleted and disposed of.
Organisational measures: we have appointed a person responsible for personal data; access is limited to staff who need it for their work; staff accounts are created by invitation only and removed when no longer needed; and we have a procedure for reporting and responding to incidents.
Human measures: staff who handle personal data are bound by confidentiality obligations and receive training on its handling.
Physical measures: personal data is stored in the data centres of our service providers, which apply physical access controls.
Technical measures: access rules are enforced within the database itself, so each person can reach only the information their role permits; public listing pages are built from data that contains no identifying information about the business or its owner; data is encrypted in transit; uploaded documents are held in private storage and are never publicly accessible; the Service holds no credential that bypasses these access rules; and error reports have personal details removed before they are sent.
Understanding the external environment: we store personal data in Japan with the providers listed in section 7, and handle some personal data in the United States and the European Union as described in section 8, having confirmed the systems for protecting personal information in those countries.

12. Your rights

Under the APPI, you may ask us to:

Notify you of the purposes for which we use your retained personal data.
Disclose the retained personal data we hold about you, including in electronic form, and disclose the records of its provision to or receipt from third parties.
Correct, add to or delete retained personal data that is inaccurate.
Stop using or delete retained personal data that we are using beyond the purposes of use, that we obtained improperly, that we no longer need, or whose handling is likely to harm your rights or legitimate interests.
Stop providing retained personal data to third parties where the APPI gives you that right.

You can correct many of your details yourself on your account page. For any other request, email us at scout@keisho.biz with the request, your name and the email address of your account. We will confirm your identity, for example by replying to the email address on your account, and respond without delay. We do not charge a fee. If we cannot do what you ask, we will tell you why.

You can also ask us to delete the verification information held in Keisho’s Stripe account. For information that Stripe holds for its own purposes, including biometric information, you can contact Stripe at privacy@stripe.com.

13. Questions and complaints

Please send questions and complaints about how we handle personal information to scout@keisho.biz. You can also consult the Personal Information Protection Commission of Japan: https://www.ppc.go.jp/.

14. Changes to this notice

We may change this notice. We will publish the changed notice on this page with the date it takes effect, and where a change requires your consent under the law, we will ask for it. Previous versions are available on request.