LEGAL / Global Privacy Policy
SkyPeople.online Global Privacy Policy
GDPR / UK GDPR / CCPA-CPRA / APPI Harmonized Framework
This English translation of the SkyPeople.online Global Privacy Policy is provided solely for the convenience of our international users and global regulatory review. The official and legally binding master version of this Policy is the Japanese language version (). In the event of any conflict, inconsistency, discrepancy, or divergence in interpretation between this English translation and the Japanese original, the Japanese version shall strictly control and govern in all respects.
- Data Controller
- Media System Co., Ltd. (Japan)
- Effective / Last Revised
- October 26, 2026 (English translation v1.0 of the Japanese master v1.2)
- Global Privacy Contact / DPO
- contact@media-system.org
Section 1 (Fundamental Principles, Global Compliance Statement, and Data Controller Information)
Media System Co., Ltd. (メディアシステム有限会社 / a corporation organized under the laws of Japan; hereinafter referred to as the "Company") recognizes that respecting user privacy and ensuring the lawful and transparent processing of personal data is a paramount corporate governance responsibility in the global operation of our aviation and skydiving telemetry analysis platform, "SkyPeople.online" (hereinafter referred to as the "Service").
The Company complies with comprehensive privacy and data protection legislation across major worldwide jurisdictions, including:
Japan: The Act on the Protection of Personal Information (APPI) and related administrative guidelines;
European Union (EU/EEA): The General Data Protection Regulation (Regulation (EU) 2016/679 — EU GDPR) and Member State implementing laws;
United Kingdom (UK): The UK GDPR and the Data Protection Act 2018 (DPA 2018);
United States of America (US): The California Consumer Privacy Act of 2018 as amended by the California Privacy Rights Act of 2020 (CCPA/CPRA), state comprehensive privacy laws (Virginia VCDPA, Colorado CPA, Connecticut CTDPA, Texas TDPSA, etc.), and the Children's Online Privacy Protection Act (COPPA).
Data Controller Information:
Entity Name: Media System Co., Ltd. (メディアシステム有限会社)
Registered Head Office: Tenma-cho, Chuo-ku (formerly Naka-ku), Hamamatsu-shi, Shizuoka, Japan
Global Privacy Organization: Data Protection Officer (DPO) / Legal Compliance Department
Official Legal Contact Email: contact@media-system.org
Corporate Website: https://media-system.org
Section 2 (Categories of Personal Information Collected and Collection Methods)
The Company adheres to the principle of Data Minimization. We collect only personal data that is strictly necessary for the performance and security of the Service, classified into the following tiers and aligned with California statutory categories (CCPA/CPRA Cal. Civ. Code § 1798.140):
Level 0: Anonymous Cryptographic Identifiers (Secure Hardware Keystore Linked):
Identifiers (CCPA Category A):
Cryptographically generated anonymous user UUIDs completely divorced from real-world identities. Stored in and synchronized across Apple devices via Apple iCloud Keychain, or within Android hardware security modules via Android Keystore / EncryptedSharedPreferences. Handled in a state that cannot identify an individual unless the user voluntarily registers an email address or credentials.
Internet and Electronic Network Activity (CCPA Category F):
Operating system versions (iOS, Android, watchOS, Garmin OS, Wear OS), hardware models (iPhone, Apple Watch Ultra, Android devices, Garmin smartwatches), application release versions, connectivity metrics, and display resolutions.
Level 1: Authentication and Profile Information (Voluntarily Registered by User):
Identifiers and Customer Records (CCPA Category A & B):
Email address and cryptographically salted password hashes.
Sign in with Apple Identifier: Opaque Apple user ID and Apple private relay email address.
Google Account Identifier: Opaque unique user identifier obtained via Google OAuth.
Public nickname and avatar image voluntarily configured by the User.
Level 2: Aviation Activities and Telemetry Data:
Precise Geolocation Data (CCPA Category G):
High-frequency time-series GNSS coordinates (latitude, longitude, ellipsoidal altitude), barometric altitude, vertical speed, ground speed, glide ratio, 3-axis acceleration (G-forces), angular velocity, and heading vectors collected via Supported Devices (Apple Watch, Garmin, Wear OS, mobile sensors, or GNSS loggers).
Jump Log Attributes:
Jump dates, jump numbers, dropzone designations, aircraft type, canopy models, rig attributes, and debriefing notes.
Sensitive Personal Information / Special Category Data (GDPR Art. 9 / CCPA § 1798.140(ae)):
Biometric / Health Data: Real-time heart rate measurements captured during jumps via compatible smartwatches (Apple Watch, Garmin, Wear OS), and optional body weight/equipment weight entered solely for aerodynamic wing-loading calculations.
Commercial and Billing Information (CCPA Category D):
Opaque customer tokens, plan status, expiration timestamps, and transaction status codes received from Stripe, Apple App Store (StoreKit), or Google Play (Google Play Billing).
*Note: The Company's servers NEVER store, process, or transmit full credit card numbers (PAN) or security codes (CVV); all payment transactions are handled directly by PCI DSS Level 1 certified payment processors (Stripe, Apple, Google).*
System Audit and Forensic Security Logs (CCPA Category F):
IP addresses, request timestamps, requested URLs, HTTP response codes, and security anomaly detection logs (admin_audit_logs).
Section 3 (Purposes of Processing and Legal Bases under GDPR and UK GDPR)
The Company processes personal data exclusively for the following purposes:
Providing and maintaining fundamental functions of the Service (jump logging, 3D trajectory reconstruction SkyStage™, multi-device synchronization, and telemetry analysis);
Administering, renewing, and authenticating PRO subscriptions and billing;
Generating statistical aerodynamic debriefings via AI-assisted coaching algorithms;
Identity verification, password recovery, and customer support;
Detecting, investigating, and mitigating cyberattacks, telemetry tampering, unauthorized access, and violations of our Terms of Service (forensic audit trail preservation);
Complying with applicable legal, fiscal, and regulatory obligations, and defending legal claims.
Legal Bases for Processing under EU GDPR and UK GDPR (Articles 6 and 9):
Performance of Contract (Art. 6(1)(b)): Processing required to deliver the Service and process transactions pursuant to our Terms of Service.
Legitimate Interests (Art. 6(1)(f)): Processing necessary to secure cloud infrastructure, protect against ban evasion, ensure data integrity, and defend the Company against legal liability.
Explicit Consent (Art. 6(1)(a) & Art. 9(2)(a)): Processing sensitive personal data (heart rate and biometric telemetry) and optional marketing communications. Users may withdraw consent at any time.
Legal Obligation (Art. 6(1)(c)): Retaining commercial transaction records to satisfy commercial, tax, and consumer protection laws.
Section 4 (Privacy by Design, Anonymity-First Architecture, and Precision Location Protection)
Anonymity-First Architecture:
The Service implements Privacy by Design by enabling Users to log jumps and render 3D flight debriefs using only anonymous hardware UUIDs via Apple iCloud Keychain or Android Keystore, without requiring a real name or email address.
Private by Default:
All jump logs, trajectory records, and biometric measurements are STORED AS COMPLETELY PRIVATE BY DEFAULT. They are never displayed to third parties or shared in multiplayer modes unless the User affirmatively toggles the visibility setting to "Public" or "Multiplayer Shared".
Protection of Precise Runway and Landing Coordinates:
To preserve airport security, dropzone operational boundaries, and private property rights, high-precision raw ground coordinates at take-off runways and landing zones are masked or blurred in public community displays according to user settings.
Section 5 (No Sale and No Sharing of Personal Information, Disclosures, and Service Providers)
NO SALE AND NO SHARING DECLARATION (CCPA/CPRA):
The Company DOES NOT SELL personal information for monetary or other valuable consideration.
The Company DOES NOT SHARE personal information with third parties for cross-context behavioral advertising. The Company has not engaged in such sales or sharing in the preceding 12 months.
Trusted Cloud Service Providers (Data Processors):
The Company entrusts data hosting and technical processing to reputable infrastructure providers under strict Data Processing Agreements (DPAs):
Supabase, Inc. (USA): Cloud relational database (PostgreSQL/PostGIS), authentication, and encrypted Edge Functions;
Vercel, Inc. (USA): Next.js web application deployment and global Edge CDN;
Stripe, Inc. / Apple Inc. / Google LLC (USA): Subscription payment processing and application distribution;
Resend, Inc. (USA): Transactional security email dispatch.
Section 6 (International Cross-Border Data Transfers and Safeguards)
The Company's cloud server infrastructure is deployed primarily in data centers located in the United States and Japan.
Transfers from the European Economic Area (EEA) and the United Kingdom (UK):
Transfers of personal data from the EEA to Japan are executed in reliance on the European Commission Adequacy Decision for Japan.
Transfers from the EEA or the UK to the United States or other non-adequate jurisdictions are conducted pursuant to the European Commission's Standard Contractual Clauses (SCCs — Implementing Decision (EU) 2021/914) and the UK International Data Transfer Addendum (IDTA), ensuring a level of protection equivalent to that guaranteed under European law.
Section 7 (Security Measures and Technical Safeguards)
The Company enforces multi-layered technical and organizational security measures conforming to APPI, GDPR Article 32, and CCPA standards:
End-to-End Transport Encryption: Mandatory TLS 1.3 across all public web, mobile, wearable, and API communications;
Row Level Security (RLS): Enforcing database-level cryptographic policies ensuring that users can only read or write their own records;
Privileged Access Control: Production databases and administrative dashboards require HMAC cryptographic signatures and multi-factor authentication, with all administrative actions immutably logged in admin_audit_logs;
Client-Boundary Data Sanitization: Root layout and React Server Component (RSC) flight data payloads strictly filter out internal keys and patent application numbers to prevent data leakage (#PD-075 compliance).
Section 8 (Data Retention Periods and Forensic Preservation for Banned Accounts)
Personal data is retained only for as long as necessary to fulfill the purposes of processing or as mandated by statutory retention periods.
When a user requests self-service account deletion (user-purge), all personal information and jump logs are permanently erased or anonymized, subject to a natural backup purge window (not exceeding 30 days).
Forensic Preservation for Banned Accounts (#PD-089 Harmonization / GDPR Art. 17(3)(e) & CCPA § 1798.105(d)):
Where an account is suspended or banned for terms violations, telemetry spoofing, or malicious intrusion, the self-service deletion API is automatically blocked to prevent evidence tampering (anti-audit tampering) and ban evasion.
Under Article 17(3)(e) of the EU GDPR (establishment, exercise, or defense of legal claims) and Section 1798.105(d) of the California CCPA, the Company retains cryptographic identifiers, IP audit records, and security telemetry in secure isolation until the conclusion of investigations or the expiration of legal statutes of limitation (generally 3 to 5 years).
Section 9 (Data Subject Rights and International DSAR Submission Protocol)
Users have the following legal rights regarding their personal data under applicable domestic and international laws:
Rights under the EU GDPR and UK GDPR:
Right of Access (Art. 15): The right to obtain confirmation and copies of personal data processed;
Right to Rectification (Art. 16): The right to correct inaccurate or incomplete data;
Right to Erasure ("Right to be Forgotten" / Art. 17): The right to request data erasure (subject to Section 8(3) legal defense exceptions);
Right to Restriction of Processing (Art. 18);
Right to Data Portability (Art. 20): The right to receive personal data in a structured, commonly used, and machine-readable format;
Right to Object (Art. 21);
Right not to be subject to Automated Decision-Making / Profiling (Art. 22).
Rights under the California Consumer Privacy Act (CCPA/CPRA) and U.S. State Laws:
Right to Know and Access: The right to request disclosure of categories and specific pieces of personal information collected;
Right to Delete: The right to request deletion of personal information (subject to statutory security exceptions);
Right to Correct: The right to rectify inaccurate personal information;
Right to Limit the Use of Sensitive Personal Information: The right to limit the use of sensitive personal information (such as heart rate telemetry) to that necessary to perform the services;
Right to Opt-Out of Sale / Sharing: (The Company does not sell or share personal information);
Right to Non-Discrimination: The right not to receive discriminatory treatment for exercising privacy rights.
Rights under the Japanese Act on the Protection of Personal Information (APPI):
The right to demand notification of purpose, disclosure, correction, addition, deletion, or cessation of use of Retained Personal Data.
Data Subject Access Request (DSAR) Protocol:
To exercise any of the above rights, Users may submit a verified written request to:
Email: contact@media-system.org (Subject: "Data Subject Access Request (DSAR)")
Response Timeline: The Company will verify identity and respond within statutory deadlines (within 30 calendar days for GDPR/APPI requests, and within 45 calendar days for CCPA requests).
Section 10 (U.S. State-Specific Consumer Privacy Disclosures)
California "Shine the Light" Law (Cal. Civ. Code § 1798.83):
The Company does not disclose personal information to third parties for their direct marketing purposes.
Global Privacy Control (GPC) Signals:
The Service recognizes and honors browser-based opt-out preference signals (such as Global Privacy Control — GPC) transmitted from applicable legal jurisdictions.
Section 11 (Cookies, Local Storage, and Tracking Technologies)
The Service uses essential HTTP cookies and browser Local Storage strictly for session maintenance, security authentication (HMAC tokens), and language selection.
The Company DOES NOT USE third-party tracking cookies or behavioral advertising pixels.
Users may disable cookies via browser settings, but doing so may cause certain secure functions (such as authenticated dashboards) to become unavailable.
Section 12 (Protection of Children and Minors)
In accordance with the U.S. Children's Online Privacy Protection Act (COPPA), the Service is not directed to children under 13 years of age, and the Company does not knowingly collect personal information from children under 13.
In the European Union and the United Kingdom, the Company does not knowingly collect personal data from minors below the age of digital consent (13 to 16, depending on the Member State) without verified parental consent.
If the Company discovers that it has inadvertently collected personal information from a child below the statutory age, the Company will promptly delete such information.
Section 13 (Modifications to this Policy)
The Company may update this Global Privacy Policy from time to time. When amendments are made, the Company will post the revised policy on the Platform and update the effective date. Continued use of the Service following such updates constitutes acceptance of the revised policy.
Section 14 (Global Legal Inquiries, DPO Contact, and Regulatory Authorities)
Official Legal and DPO Inquiries:
For inquiries, comments, or complaints concerning personal data handling, contact:
Operating Company: Media System Co., Ltd. (メディアシステム有限会社)
Department: Global Data Protection & Legal Compliance Department
Email: contact@media-system.org
Website: https://media-system.org
Right to Lodge a Complaint with Supervisory Authorities:
Users have the right to lodge a complaint with a competent supervisory authority:
EEA Data Protection Authorities (DPAs): The supervisory authority in the Member State of your habitual residence or place of work;
United Kingdom: Information Commissioner's Office (ICO: https://ico.org.uk);
Japan: Personal Information Protection Commission (PPC: https://www.ppc.go.jp).
GOVERNING LANGUAGE:
This Privacy Policy is executed in the Japanese language (GLOBAL_PRIVACY_POLICY_v1.2.md), which shall be the sole official, authentic, and controlling text. In the event of any discrepancy between this English translation and the Japanese original, the Japanese version shall strictly govern and control.
*This document is the official English translation specification (v1.0) established by 00-1 Legal Advisory and locked with chmod 444.*