Privacy Policy
This English text is a reference translation. The Japanese version is the official version. If the two differ, the Japanese version prevails.
MICHISE ("we") sets out below how the MICHISE browser extension ("the Extension") handles information.
This policy describes what the Extension actually does. In particular, it states explicitly which information read from a business screen is not sent to our server.
1. Scope
This policy applies to:
- the MICHISE browser extension distributed through the Chrome Web Store and Microsoft Edge Add-ons;
- the MICHISE server that the Extension connects to.
The Extension is intended to be deployed by a company to its employees. In this policy, "user" means a person operating the business system, and "administrator" means a person who creates and publishes guidance in the Extension's admin screen.
2. Information the Extension handles
2-1. Information entered by an administrator
- Email address (entered when an administrator signs in)
- Password (same)
- Authentication token (received from our server on successful sign-in)
- The guidance content an administrator creates (text, button labels, the element to attach guidance to, display conditions, selection navi questions and choices, data stock rules, images inserted in popups, and so on)
- The email address of an invitee (entered when an administrator invites someone else as an administrator)
2-2. Information used to connect and to stop the Extension
- A one-time enrollment token. A company administrator places this on each device using the MICHISE installer, and the Extension reads it. It is used once only, to determine which company's settings the device should receive.
- A company access code. Issued by an administrator in the admin screen and entered by a user under "Connect to company" in the Extension's popup. Like the enrollment token, it is used once only, to determine which company's settings the device should receive. It cannot be used on devices where the company has deployed a managed configuration.
- A disable password. Entered in the Extension's popup to stop the Extension from working in that browser profile.
2-3. Information processed on the business screen
To place guidance correctly, and to evaluate display conditions and judge whether a step has been completed, the Extension processes the following on the business screen. None of it is sent to our server.
- Page elements and their text (to locate where guidance should appear)
- Values in input fields. Read only when an administrator has configured a step that fills one field by referring to another, or has configured a data stock (see below). Password fields, file inputs and hidden fields are never read.
- Data stock values. On the pages an administrator specified, the value of an input field (text, number or date) the administrator specified is kept temporarily. It is used only to evaluate display conditions the administrator configured and to fill input fields in guide steps.
- Selection navi answers. The Extension shows the questions and choices an administrator created, and presents guidance that matches the answer the user picks. The answers are neither stored nor sent.
- The address (URL) of the page currently displayed, to evaluate the display conditions an administrator configured
- Clicks, key presses, focus changes and scrolling, used solely to judge whether the current step of the guidance has been completed
- A screenshot of the business screen. Taken once, immediately after an administrator uses "select on screen" in the admin screen to designate where guidance should appear, so that the administrator can later confirm which location was chosen.
About screenshots. A screenshot is taken only when an administrator performs the location-selection action in the admin screen. It is never taken during ordinary use, when a user is simply viewing guidance. The image is stored only in that device's browser (IndexedDB) and is not sent to our server.
About data stock. What an administrator saves and publishes to our server is only the rule stating which field on which pages to keep. Values kept on a user's screen are sent neither to our server nor to the administrator. They are stored per tab in session storage that is cleared when the browser closes (chrome.storage.session). Each data stock has a retention time set by the administrator: 10 minutes by default, or 30 minutes, 1 hour, or any value from 1 to 1440 minutes (up to 24 hours). The retention time counts from when the value was last kept, and a value past its retention time is not used. Such a value is not removed at the exact moment its retention time passes; it is removed the next time the Extension checks the value. A kept value is also removed in any of these cases: when the tab is closed, when the browser is closed, when the source field becomes empty, when a page outside the range the administrator specified is opened, when a page on a different site is opened, when the connected company changes or can no longer be confirmed, or when the rule is no longer published. If the administrator shortens the retention time, values that are already kept are also given the shorter time.
2-4. Information the Extension does not handle
- Health information
- The contents of personal communications such as email or chat
- Location (no location API is used)
- Browsing history (no list of visited pages is recorded or stored)
- Cookies (never read or written)
3. Purposes
| Information | Purpose |
|---|---|
| Email address and password | To verify the administrator's identity |
| Authentication token | To keep the administrator signed in |
| Invitee's email address | To invite that person as an administrator so they can sign in |
| Enrollment token and company access code | To determine which company the device belongs to |
| Disable password | To confirm that the Extension may be stopped in that browser profile |
| Guidance content | To display guidance on the user's business screen |
| Images inserted in popups | To show images in published popups |
| Page elements and text | To locate where guidance should appear |
| Input field values | To perform the "fill by reference" step an administrator configured, and to keep data stock values |
| Data stock values | To evaluate display conditions an administrator configured and to fill input fields in guide steps |
| Selection navi answers | To present guidance that matches the answer picked |
| Page address | To evaluate the display conditions an administrator configured |
| Clicks and similar actions | To judge whether a guidance step has been completed |
| Screenshot of the business screen | So an administrator can confirm the location they designated |
| Guidance progress | So guidance can continue after the page changes |
We do not use this information for advertising, behavioural analysis or web analytics, and we do not send it to any external analytics service.
4. Information processed and stored on the device
| Where | What | When it is removed |
|---|---|---|
| Extension storage (chrome.storage.local) |
A cached copy of the company's published settings (including guides, buttons, popups, hints, selection navi and data stock rules), synchronisation state, guidance progress, the company binding, and the list an administrator uses to preview drafts on their own device only | Guidance progress expires after 30 minutes. The rest is removed when the company settings are cleared or the Extension is uninstalled |
| Extension session storage (chrome.storage.session) |
The administrator's authentication token, the company, environment and tabs the administrator is previewing, and data stock values with per-tab state | When the browser is closed. The authentication token is also removed on sign-out or when it expires. Data stock values are removed according to the retention time and the cases listed in section 2-3 |
| Managed configuration (chrome.storage.managed) |
The one-time enrollment token (read only; the Extension cannot write to this area) | When the company administrator removes the deployed configuration |
| In-browser database (IndexedDB) |
Screenshots of the business screen, images an administrator inserted in the admin screen, and cached copies of published popup images (for display on users' devices) | When the Extension is uninstalled, or when deleted from the admin screen. Cached popup images are also removed when the published settings no longer use them |
An administrator's password is sent for authentication immediately after entry and is not stored on the device. Company access codes and disable passwords are likewise sent immediately after entry and are not stored on the device. The authentication token is stored only in an area that is cleared when the browser closes; it is never written to disk-backed storage.
Guidance progress consists only of the guide identifier, flags for completed steps, the branch taken, the starting step and a timestamp. It contains no screen content and no entered values.
5. Information sent to our server
The Extension sends information to our server only in the following cases.
- When an administrator signs in or out: on sign-in, the email address and password are sent. On sign-out, the authentication token is sent so that it can be revoked.
- When a device is bound to a company: the one-time enrollment token, or a company access code entered by the user, is sent once, and the device receives its own connection information in return. After binding, this connection information is used to confirm the connected company and to switch the publishing channel (test or production) in the popup.
- When an administrator saves settings or selects "Publish changes": the guidance content they created (guides, buttons, popups, hints, selection navi, the default button appearance, data stock rules including their retention time, and folder names and assignments) is sent. Images used in published popups are also sent. Values kept by data stock are not sent.
- When receiving published settings: the server decides which company's settings to return; the Extension never sends a company or environment identifier. Published popup images are received using the same connection information.
- When an administrator invites another administrator: the invitee's email address is sent. When the operator registers a company, the company's display name is also sent.
- When an administrator issues a company access code: the code is generated on the device, and only a non-reversible form (hash) is sent to our server. The code itself is shown once on the issuing screen and is stored neither on the device nor on the server.
- When an administrator creates an installer: the creation request is sent. The enrollment token is generated on the server and built into the installer; the server stores only its hash together with the expiry, the administrator who created it and similar details.
- When the Extension is stopped in a browser profile: the disable password entered is sent for verification. The password is not stored; only the time of the attempt and whether it succeeded are recorded.
6. Information that is not sent to our server
The following is processed on the device only and is never sent to our server.
- Screenshots of the business screen
- Text displayed on the business screen
- Values entered in input fields
- Values kept by data stock
- Selection navi answers
- The address of the page currently displayed
- Clicks, key presses and scrolling
- Guidance progress
The part of the Extension that runs inside the business screen performs no external communication at all. Communication occurs only in the cases listed in section 5.
Relationship to the store declarations. The Chrome Web Store requires disclosure even for information that is processed only on the device. We apply the same approach to the Microsoft Edge Add-ons data usage declaration and declare the same categories on both stores. The five categories are "Personally identifiable information", "Authentication information", "Website content", "User activity" and "Financial and payment information". Of these, the only things sent to our server are the items listed in section 5 — the administrator's email address, password and authentication token, an invitee's email address, the enrollment token and company access code, the disable password (sent only for verification and not stored), and the guidance content the administrator created (including images inserted in popups). The remaining three — "Website content", "User activity" and "Financial and payment information" — are processed on the device to the extent needed to display guidance; that does not mean we collect them, send them to our server, or use them for advertising or analytics. "Financial and payment information" is declared because a screenshot taken by an administrator may happen to capture whatever is shown on that screen, not because the Extension seeks out such information.
7. Retention
On the device
- Guidance progress: expires after 30 minutes
- Administrator authentication token: removed when the browser is closed, on sign-out, or when it expires
- Cached settings and company binding: removed when the company settings are cleared or the Extension is uninstalled
- Screenshots: removed when the Extension is uninstalled
- Data stock values: not used once the retention time set by the administrator (10 minutes by default, up to 24 hours) has passed since they were last kept. Such values are removed the next time the Extension checks the value. They are also removed in the other cases listed in section 2-3, such as when the tab or browser is closed
- Cached copies of published popup images: removed when the published settings no longer use them, or when the Extension is uninstalled
On our server
Our server stores administrator accounts and permissions, the guidance content administrators have saved or published (including images in published popups), company display names, device connection information, hashes of enrollment tokens and company access codes, operation records (such as which administrator published and when, and the results of device binding), and the time and result of disable-password attempts. Images no longer used by published popups are deleted from the server when publishing.
We retain the necessary data for as long as MICHISE is in use, and delete it within 30 days after use ends.
Installer enrollment tokens are issued with an expiry (90 days at most) and may also be limited to a maximum number of devices; they stop working once expired, exhausted or revoked. Company access codes have no expiry or device limit, but when an administrator changes the code, the previous code stops working. In either case, devices that are already bound continue to work.
8. Deleting data
- On the device: "Clear company settings" in the admin screen removes the company binding and the cached settings. Uninstalling the Extension removes all data it holds.
- Authentication token: removed on sign-out, and when the browser is closed.
- On our server: deletion requests are accepted at michise.support@gmail.com.
9. Sharing with third parties
We do not sell the information we handle, and we do not provide it to advertising platforms, data brokers or similar third parties.
The Extension communicates with a single server that we operate. No code is implemented to send information to any external analytics or advertising service.
We may disclose information to the extent required by applicable law.
10. Advertising and analytics
We do not use the information for delivering or measuring advertising, nor for analysing user behaviour. The Extension displays no advertising and contains no analytics mechanism.
11. Security
- Secrets used for connection are never held in plain text on our server; only an irreversible hash is stored.
- The administrator's authentication token is stored only in an area cleared when the browser closes, never in disk-backed storage.
- The Extension's communication destination is fixed to a single location and cannot be changed from outside.
- The Extension requests only two permissions: access to its own storage, and the ability to capture the visible screen once, immediately after an administrator designates a location.
- No remotely hosted code is executed. The Extension runs only the code included in the package distributed through the Chrome Web Store or Microsoft Edge Add-ons.
- Which company's settings are returned is decided by the server from the device's connection information; the Extension cannot specify a company.
12. Limited Use disclosure
MICHISE's use of information received from Google APIs will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements.
The same commitments in this section also apply to MICHISE as distributed through Microsoft Edge Add-ons. We also strive to handle information as required by the Developer policies for the Microsoft Edge Add-ons website.
Information handled by MICHISE is used only for MICHISE's single purpose — displaying administrator-authored guidance on the user's business screen — and for related operational purposes.
MICHISE does not:
- use, transfer or sell the information for personalized advertising;
- sell or transfer it to third parties such as advertising platforms or data brokers;
- use, transfer or sell it to determine credit-worthiness or for lending purposes.
13. Changes to this policy
When we change this policy, the updated text is published on this page. The text published here is the current version. The last updated date is shown at the top of this page.
14. Governing law
This policy is interpreted in accordance with the laws of Japan.
15. Contact
For questions about this policy, or to request deletion of data, please contact us.
Provider: MICHISE
Contact: michise.support@gmail.com