Privacy Policy

This English translation is provided for reference only. If it differs from the Japanese version, the Japanese version prevails.

Effective　18 October 2026

1. Our approach

2Blue Inc. (株式会社２Ｂｌｕｅ; “we” or “us”) handles personal information in “Invoi” (the “Service”), its service for creating invoices and other business documents, in compliance with the Act on the Protection of Personal Information (the “APPI”) and other laws, and in accordance with this Privacy Policy (this “Policy”).

This Policy applies to the personal information of users of the Service, of people who receive documents that users issue with the Service, and of people who contact us. Unless otherwise defined, terms in this Policy have the meanings given in the APPI and in the Service's Terms of Service.

2. Who we are

Name: 2Blue Inc. (株式会社２Ｂｌｕｅ)
Corporate number: 3010001223505
Address: Kawasaki, Kanagawa, Japan (we will give the full address without delay on request)
Representative: We will give the representative's name without delay on request.
Contact: info@blueblue.jp

3. Information we collect

In providing the Service, we collect the following information.

Account information: Name and e-mail address. If you sign in with a Google account, your Google account identifier, the URL of your profile image and other information Google provides for signing in. If you sign in with your e-mail address, the confirmation code is stored in hashed form. We do not collect passwords.
Business information: Full name or company name, trade name (屋号), corporate number, registration number, address, phone number, e-mail address, contact person, logo image, seal (created from text or uploaded as an image), and bank accounts (bank name, branch name, account type, account number and account holder)
Member information: Role in each business, the e-mail address and role of people invited to a business, and the user who sent the invitation
Client and document information: Clients' names, departments, contact persons, addresses, e-mail addresses, phone numbers, corporate numbers, payment terms and notes; items; document contents (addressee, line items, amounts, dates and so on); and payment records
AI input information: Text pasted for AI input (sent to Anthropic, listed in section 8, to be read, and not stored by us; the results of the reading are stored as the client and document information above only where a member enters them in a document or saves them as a client or item); and records of AI input use (time of each reading, the member who used it, the name of the model used and the number of tokens)
Issue information: The content of each issued version (frozen together with a hash value) and its PDF; issue records (for each PDF download, print and share-link copy: its type, the version concerned, the member who did it and the time); and the time a share link was first opened
Usage records: Sign-in records (IP address, browser information (user agent) and time); records of actions in a business (type of action, the member who took it and time); and information recorded when the Service is accessed (IP address, time of access, URL accessed and so on)
Plan and payment information: The plan each business uses and its billing cycle (monthly or yearly), the status of Paid Plan contracts and payments, and similar information. Credit card numbers and other card information are handled by our payment processor (Stripe) and are not kept by us.
Inquiry information: Your name, e-mail address and the content of your inquiry
Cookies: The cookies described in section 10

4. How we collect it

When users enter or upload it in the Service.
From Google, with the user's permission, when the user signs in with a Google account.
Automatically, through sign-in, action and access records and cookies, as the Service is used.
From our payment processor, for information on Paid Plan payments.
From people who contact us, when they make an inquiry.

5. Purposes of use

We use the personal information we collect for the following purposes:

to provide the Service (registering accounts, authenticating sign-ins, managing businesses and members, creating, issuing and storing documents, managing payments and sales, exporting data and so on);
to let clients view documents through share links on users' instructions;
to read the contents of a document from text a user pastes (AI input), and to apply AI input's monthly limit and keep track of its cost;
to bill and collect Paid Plan fees;
to send notices about the Service (changes to the Terms of Service and other rules, new and changed features, maintenance, outages and so on);
to respond to inquiries and requests;
to prevent and investigate misuse, keep the Service secure, and investigate and deal with failures;
to deal with breaches of the Terms of Service;
to improve the Service and plan new features (using information aggregated so that individuals cannot be identified); and
to comply with laws.

Personal information about clients and others that users entrust to us is handled only for the purpose of providing the Service to that user, as set out in section 12.

6. Provision to third parties

We do not provide personal data to third parties without the prior consent of the person concerned, except in the following cases:

where required by law;
where necessary to protect a person's life, body or property and it is difficult to obtain the person's consent;
where especially necessary to improve public health or promote the healthy development of children and it is difficult to obtain the person's consent;
where necessary to cooperate with a national or local government body, or a party entrusted by one, in carrying out duties prescribed by law, and obtaining the person's consent would likely interfere with those duties; or
any other case permitted by the APPI.

Providing personal data as part of the outsourcing described in section 7, or because our business is succeeded to through a merger or otherwise, is not a provision to a third party.

When a user gives a client a document's PDF or a printed document, or gives a client a share link, the information on the document (the issuer's name, address, registration number, bank account and so on) is disclosed to the client by the user. Members of a business can also see the names, e-mail addresses, roles and activity records of the other members of the same business.

7. Outsourcing

We may outsource all or part of the handling of personal data to external providers to the extent necessary to achieve the purposes of use. In that case, we choose providers that we consider will handle personal data properly, set out security measures, confidentiality, conditions for sub-outsourcing and other necessary matters in contracts or similar arrangements, and supervise the providers as necessary and appropriate.

8. External services and third parties in foreign countries

We use the following external services to provide the Service.

Cloudflare, Inc. (United States): Delivering and running the website and application, storing files (logo and seal images and document PDFs), creating document PDFs, relaying connections to the database, and analytics for the pages that can be viewed without signing in (Cloudflare Web Analytics; section 10)
PlanetScale, Inc. (United States): Running the database. Data is stored in Japan (AWS Tokyo region).
Plus Five Five, Inc. (United States; service name “Resend”): Sending e-mails with sign-in confirmation codes. We do not use its features for tracking opens or link clicks.
Google LLC (United States): Signing in with a Google account
Anthropic, PBC (United States; service name “Claude”): Reading text pasted for AI input. We send the pasted text, the business's name (its trade name, if it has one), the document type and the current date. Under Anthropic's terms, content it receives through its API is not used to train its models.
Stripe (contracting party in Japan: Stripe Japan, Inc.): Processing Paid Plan payments
AIBISU Corp. (株式会社アイビス; Japan; service name “zipcloud”): Looking up addresses for postal codes. Only the postal code is sent; no personal information is sent.
Frankfurter (a public API for exchange rates): Getting exchange rates. Only currency codes are sent; no personal information is sent.

The main countries and regions where personal data is stored or processed are as follows.

Database: Japan (AWS Tokyo region; backups are stored in the same region).
Logo and seal images and document PDFs: the country cannot be identified, because Cloudflare does not publish the country where data is stored and its choice of storage region is not guaranteed. We have chosen the Asia-Pacific region as the storage region.
Contents and sending records of e-mails with sign-in confirmation codes: United States (stored by Resend; e-mails are sent from facilities in Japan (AWS Tokyo region)).
Text sent for AI input: United States (processed by Anthropic, which keeps it for the period set by Anthropic and then deletes it).
Running the website and application and creating PDFs: the country cannot be identified, because processing takes place in data centers that Cloudflare operates around the world and the location depends on how the Service is accessed.
Payment information: the United States and other countries, as determined by Stripe.

When we entrust the handling of personal data to any of the providers above that are located outside Japan, we confirm, through their data processing terms and similar arrangements, that they have established the systems needed to take, on a continuing basis, measures consistent with the purpose of the provisions of Chapter 4, Section 2 of the APPI, and we check the implementation of those measures periodically. On request, we will tell you how those systems are established, give an outline of the measures the provider takes, and provide the other information required by law.

For information on the personal information protection system of the United States, please see the information published by the Personal Information Protection Commission (https://www.ppc.go.jp/enforcement/infoprovision/laws/offshore_report_america/).

9. Security measures

We take the following measures to prevent leaks, loss or damage of personal data and otherwise keep it secure.

Basic policies: we have adopted this Policy and an Information Security Policy for the proper handling of personal data.
Organizational measures: access to production systems is limited to our staff who need it for their work.
Personnel measures: staff who handle personal data are made aware of their duty of confidentiality and of the proper handling of personal data.
Physical measures: personal data is stored in data centers operated by the external providers listed in section 8.
Technical measures: all traffic is encrypted with HTTPS. We use sign-in methods that do not rely on passwords, restrict access to data by business and by role, and record actions taken in each business.
Understanding the external environment: we take security measures based on an understanding of the personal information protection systems of the countries listed in section 8.

Our specific measures are described in the Information Security Policy.

10. Cookies and advertising

The Service uses only the following cookies, which are needed to provide it:

a cookie that keeps you signed in (including cookies used temporarily during sign-in); and
a cookie that stores your display setting (light, dark or matching your device).

We do not use cookies for advertising or for tracking behavior.

On the pages of the Service's website that can be viewed without signing in (such as the top page and the pricing page of https://invoi.jp), we use the analytics program Cloudflare Web Analytics of Cloudflare, Inc. (United States) to understand how the pages are viewed and to improve them. The program makes your browser send that company the address of the page viewed, the address of the referring page, the type of browser and device, the screen size and the time the page took to display. According to that company, it does not use cookies or any other way of storing information in your browser, nor any way of identifying individuals from IP addresses or device information. It is not used on the screens after signing in, on documents, or on the screens opened from shared links.

If you disable cookies in your browser settings, you cannot use features that require signing in.

The screens of businesses on the Free Plan show one advertising space marked “PR” (it is not shown on documents, their PDFs, printed documents or the page opened from a share link). The space shows our own notices or introductions to services of partners such as accounting software providers and banks, and an introduction to a partner's service leads to a page of ours on the Service's website (https://invoi.jp). No third-party tags or scripts are used to show advertising, and we do not provide account information, User Data or document contents to advertisers or partners.

That page of ours may carry affiliate links to partners. When you click such a link, the affiliate service provider (ASP) or the partner may set a cookie in your browser to record the referral. How these providers handle information is governed by their own privacy policies.

If we introduce advertising delivered by third parties into the Service, we will first change this Policy and list in this section the tags used, where information is sent, what information is sent and the purposes for which it is used.

11. Requests for disclosure and other actions

You may ask us to notify you of the purposes of use of retained personal data about you that we hold, to disclose it (including records of provision to third parties), to correct, add to or delete its contents, to stop using or erase it, or to stop providing it to third parties.

Please send your request by e-mail to info@blueblue.jp, describing what you are asking for. After confirming your identity (or, for a request by an agent, the agent's authority), we will respond without delay in accordance with the law. To confirm identity, we may ask you to write from the e-mail address registered in the Service or to submit the necessary documents.

As a rule, we disclose information by providing electronic records by e-mail. We do not charge a fee for requests.

If we cannot meet a request for a reason set out in law, we will tell you so and give the reason.

You can check and change business information, client information and the like on the Service's screens. At present, requests to delete an account (leave the Service) are accepted at the e-mail address above.

12. Personal information about your clients

Personal information that users enter into the Service, such as the names and contact details of their clients' contact persons (including any contained in text pasted for AI input), is handled by us on the users' behalf, as outsourced handling. We handle it only to provide the Service to that user and do not use it for our own purposes.

Users are responsible for obtaining such information lawfully and for having the authority needed to enter it into the Service and give it to clients.

Requests for disclosure and other actions concerning such information should be made to the business that entered it. If we receive such a request, we will work with that business to respond, for example by contacting it.

When a client opens a share link, we record the time it was first opened and show it to the business that issued the document. Viewing a share link does not require signing in or entering a name or other details.

Please do not enter Individual Numbers (My Numbers) into the Service.

13. Retention and deletion

We keep personal data for as long as needed to achieve the purposes of use. Account and business information is kept for as long as the account or business exists.

When we receive a request to leave the Service, we delete the user's account information within 90 days of the request; when we receive a request to delete a business, we delete that business's data within 90 days of the request. However, we may keep information that must be kept by law, and records needed to deal with misuse and similar matters, for as long as necessary.

Data in backups, sending records kept by our e-mail provider, text sent to Anthropic for AI input and the like are deleted after their respective set periods.

Records of actions a departed user took in a business remain as that business's records, but the user's name and other details are no longer shown.

Users should keep documents and data that the law requires them to retain (such as electronic transaction data that must be kept under the Electronic Books Maintenance Act) themselves, for example with the Service's export features (PDF and CSV).

14. Changes to this Policy

We may change this Policy in response to changes in laws, changes to the Service and the like. When we do, we will announce the changed content and its effective date on the Service's website or in the Service. If a change requires the consent of the persons concerned under the law, we will obtain their consent in advance.

15. Contact

Inquiries, comments and complaints about this Policy and our handling of personal information are accepted at:

Contact point: 2Blue Inc., Invoi Personal Information Inquiries
E-mail: info@blueblue.jp