Version 2.0 · Effective 14 August 2026 · Replaces the version of 27 July 2026
This Privacy Policy explains how Banto Inc. (株式会社万燈), a company registered in Japan with its office at Central Park Tower La Tour Shinjuku 5F, 6-15-1 Nishi-Shinjuku, Shinjuku-ku, Tokyo 160-0023, Japan (“we”, “us”), handles information in connection with MyPostiz (“the Application”), the social media scheduling application we operate at https://postiz.banto-works.com, and this documentation website.
Banto Inc. is the controller of the information described here. Our contact point for privacy matters is takechi@jusetz.jp.
The Application is an internal tool. It is not offered to the public, it has no sign-up, and the social media accounts it publishes to are accounts we own and operate. In practice, the personal information it handles is that of our own staff and of our own social media accounts.
| Category | What it is, and where it comes from |
|---|---|
| Connected account information | The open ID or account ID, display name, username or handle, avatar image, and — where the platform provides them — the follower, like and post counts of a social media account that a member of our staff has connected. Received from the platform's API after that person authorises the connection. |
| Access tokens | The authorisation credentials issued by each platform (access token, refresh token, expiry, granted scopes) that allow the Application to publish to the connected account. Received from the platform; we never receive or store platform passwords. |
| Content we create | The post text, images and video files written and uploaded by our staff, the channels selected, the scheduled publish time, the platform-specific post settings, and the outcome of publishing, including any error message returned by the platform. |
| Confirmation data | The list of posts on the connected account, read back from the platform after publishing so that we can confirm a post exists before marking it as published. |
| Dashboard account data | The email address and hashed password of each staff member permitted to use the dashboard. |
| Technical logs | Standard server logs generated when the dashboard is used: IP address, timestamp, requested path, browser user agent, and the result of the request. Generated automatically by our server. |
The Application does not collect follower or friend lists, direct messages, comment threads, other people's posts, location data, contact lists, payment information, or any special category of personal data.
| Purpose | Basis |
|---|---|
| To let a staff member connect an account they own, and to display which account is connected so posts are not sent to the wrong place. | Necessary to provide the Application to our staff; our legitimate interest in operating our own accounts correctly. |
| To upload and publish the posts our staff have written and scheduled, at the time they chose. | Same as above. |
| To confirm that a scheduled post was really published, and to report the reason when it was not. | Same as above. |
| To keep the dashboard secure and to investigate faults or abuse. | Our legitimate interest in the security and reliability of our systems. |
| To comply with legal obligations that apply to us. | Legal obligation. |
We do not use any of this information for advertising, for building profiles of individuals, for automated decision-making that produces legal or similarly significant effects, or as training data for machine-learning models.
When a TikTok account is connected, the Application requests the scopes listed on our TikTok integration page and uses the resulting data only as follows:
user.info.basic, user.info.profile) —
displayed in the channel list so the operator can confirm the destination of a post.user.info.stats) — displayed on the channel screen
so the operator can confirm the correct account is connected and see the result of publishing.video.upload, video.publish) — used to send
and publish the media and caption our staff prepared, to that same account.video.list) — used to read back that account's
own posts so a scheduled item can be marked published or failed.TikTok data is used only for these purposes. It is not sold, rented or shared with any third party, is not used for advertising or profiling, is not used to train machine-learning models, and is not combined with data from other sources to build a profile of any individual. Data obtained from TikTok is deleted when the account is disconnected, as described in section 6.
We do not sell, rent, trade or otherwise share this information. It is disclosed only:
| Information | Retention |
|---|---|
| Access tokens and connected account information | Until the account is disconnected in the dashboard or access is revoked on the platform, at which point they are deleted. Deletion happens immediately on disconnection; residual copies in encrypted backups are removed within 30 days. |
| Posts, media and publish results | Kept while operationally useful and deleted no later than 24 months after the scheduled publish time. Media files are deleted within 30 days of publishing. |
| Dashboard account data | For as long as the person is authorised to use the Application, and deleted within 30 days of that authorisation ending. |
| Technical logs | 90 days, then deleted. |
Where we are required by law to keep something longer, we keep only what the law requires, for as long as it requires.
No system is perfectly secure. If a breach affecting personal information occurs, we will act to contain it, notify the people affected and the relevant authority where the law requires, and describe what happened.
Subject to the law that applies to you, you may ask us to confirm what information we hold about you, to provide a copy, to correct it, to delete it, to restrict or object to our use of it, or to withdraw a consent you previously gave. Exercising these rights is free of charge.
Write to takechi@jusetz.jp. We may need to confirm that the request genuinely comes from you. We will acknowledge the request and respond within 30 days; if a request is complex we will tell you and explain the delay. If you are not satisfied with our response, you may complain to your local data protection authority — in Japan, the Personal Information Protection Commission.
We are based in Japan and the Application runs on infrastructure we operate. This documentation website is served by Vercel Inc. from its global network, which may place a copy of these public pages on servers outside Japan; those pages contain no personal information. Where personal information is transferred across borders — for example when a post is delivered to a platform whose servers are abroad — we rely on safeguards permitted by applicable law and transfer no more than is necessary.
The Application is a workplace tool for our staff and is not directed at children. We do not knowingly collect personal information from children. If you believe a child's information has reached us, contact us and we will delete it.
This documentation website uses no cookies and no tracking of any kind. The dashboard sets a single session cookie, which is strictly necessary to keep a signed-in staff member signed in. There are no advertising, analytics or third-party cookies.
We may update this policy when the Application changes or when the law requires. The version number and effective date at the top of this page always identify the current version, and the previous version's date is shown beside it. A material change will be reflected here before it takes effect.
Banto Inc. (株式会社万燈)
Central Park Tower La Tour Shinjuku 5F, 6-15-1 Nishi-Shinjuku, Shinjuku-ku, Tokyo 160-0023, Japan
Telephone: +81 3-6823-4427
Email: takechi@jusetz.jp
第2版／2026年8月14日施行（2026年7月27日版を改訂）
株式会社万燈（〒160-0023 東京都新宿区西新宿6丁目15-1 セントラルパークタワー ラ・トゥール新宿5階。以下「当社」）は、 当社が運用するSNS投稿スケジューラー「MyPostiz」（以下「本アプリ」。管理画面 postiz.banto-works.com）および 本説明サイトにおける情報の取り扱いを、本ポリシーのとおり定めます。個人情報の管理責任者への連絡先は takechi@jusetz.jp です。本アプリは社内利用のみで、一般向けの登録・販売は行っていません。
友だち・フォロワーの一覧、ダイレクトメッセージ、コメント、他人の投稿、位置情報、連絡先、決済情報、要配慮個人情報は取得しません。
広告配信、個人のプロファイリング、機械学習の学習データとしての利用は行いません。
TikTokアカウントを接続した場合、TikTok連携ページに記載した権限の範囲で、 ①接続先の確認と表示（user.info.basic / user.info.profile）②本人アカウントの数値の表示（user.info.stats） ③本人が作成した投稿の公開（video.upload / video.publish）④公開の成否確認（video.list）のためだけに使用します。 第三者への提供・販売、広告・プロファイリング・機械学習への利用は行いません。接続を解除した時点で削除します。
取得した情報を販売・貸与・共有することはありません。提供先は、①投稿先である当該SNS、②当社の指示に基づき 基盤を提供する事業者（本アプリを稼働させるサーバー事業者、および本説明サイトを配信する Vercel Inc.）、 ③法令に基づく開示請求があった場合の当該機関に限られます。
通信はすべてHTTPSで暗号化し、管理画面はログインを必須とします。データベースは公開されていない自社サーバー上で 稼働し、パスワードはハッシュ化して保管します。外部の解析・広告サービスへの送信は行いません。 万一漏えい等が発生した場合は、被害の拡大防止、本人への連絡、法令に基づく監督官庁への報告を行います。
保有する情報の開示・訂正・利用停止・消去・第三者提供の停止をご請求いただけます（無料）。 takechi@jusetz.jp までご連絡ください。ご本人であることを確認のうえ、 30日以内に対応します。対応にご不満がある場合は、個人情報保護委員会へ申し出ることができます。
管理画面でチャンネルを削除すると、その時点で認可情報と接続アカウント情報を削除します。 各SNSの設定から本アプリの許可を取り消しても、公開できない状態になります。上記メールでの削除依頼も受け付けます。
当社は日本国内で本アプリを運用します。本説明サイトは Vercel Inc. の配信網から提供されるため、 公開ページの複製が国外のサーバーに置かれることがあります（個人情報は含みません）。投稿の公開に伴い 情報が国外のSNS事業者へ渡る場合は、法令上認められる範囲で必要最小限にとどめます。
本アプリは業務用であり、子どもを対象としていません。本説明サイトはCookieを使用せず、解析も行いません。 管理画面はログイン状態の維持に必要なセッションCookieのみを使用します。本ポリシーを改定する場合は、 このページの版数と施行日を更新して公表します。
株式会社万燈／〒160-0023 東京都新宿区西新宿6丁目15-1 セントラルパークタワー ラ・トゥール新宿5階／ 電話 03-6823-4427／メール takechi@jusetz.jp