Privacy Policy

Last revised: November 10, 2026

FTZ handles information needed to provide its services in accordance with Japan’s Act on the Protection of Personal Information and other applicable laws.

01 Operator and scope

FTZ is individually operated. For privacy enquiries, contact info@ftz.jp.

This policy covers FTZ’s website and editorial media, label and FTZ Distribution services, Signals, podcasts, the FTZ app, newsletters and related enquiries. External providers also apply their own policies to information they independently collect. Where a contract or service notice supplements this policy, we explain its scope.

02 Information we handle

Depending on the features you use, we handle:

• Enquiries and business relationships: names, professional identities, email addresses, messages and necessary contractual and correspondence records.
• Distribution applications and submissions: artist names, contact details, locations, profiles, application reasons, official and music links, requested dates, release metadata, audio, artwork, credits and rights declarations.
• Accounts and podcasts: email addresses, account IDs, team names, authentication information, membership permissions, show and episode content, and submission, review and publication records.
• The FTZ app: account IDs, saved song, album and episode IDs and display information, and update times. Device-only saves are distinguished from information synced through an account.
• Newsletters and LINE: email addresses, subscription, confirmation and unsubscribe status, delivery results, opens and clicks depending on settings, and messages you send through LINE.
• Browsing and security: viewed pages, interactions, times, IP addresses, device and browser information, cookies and similar identifiers, and security checks and access records. Section 06 explains purposes and recipients.
• Editorial and publicity work: supplied press materials, editorial contacts and professional media contact information officially made public.

03 Purposes

We use information to respond to enquiries; review and contact distribution applicants; manage releases and materials; perform contractual, distribution and publicity work; authenticate accounts and manage permissions; produce, review and publish podcasts; sync app saves; provide and stop requested communications; analyse usage and improve services; prevent abuse; protect rights; and meet legal obligations.

An enquiry or distribution application does not enrol you in the newsletter. Changes to purposes are notified or published, with consent obtained where required by law.

04 Third-party disclosure and service providers

We do not disclose personal data to third parties except with consent or where permitted by applicable law. Responding to an enquiry does not authorise unrestricted disclosure to unrelated parties.

We engage providers for necessary storage, authentication, forms, email and related processing. We manage this through provider selection, review of contracts and service terms, and access restrictions. Outsourcing and business succession are distinguished from disclosures requiring consent under applicable law. Section 07 addresses providers outside Japan.

For approved releases and podcasts, we provide the identities, biographies, credits, works and programme content submitted and confirmed for publication or distribution. Private application contents and staff contact details are not automatically published.

05 Service-specific handling

Contact enquiries

Names, email addresses, subjects and messages entered in the contact form are delivered to FTZ through Web3Forms. hCaptcha and Web3Forms spam protection help prevent abuse. Web3Forms submission data and emails received by FTZ are stored and managed separately.

FTZ Distribution and Signals

Distribution applications containing artist names, email addresses, telephone numbers, locations, profiles and application reasons, links and requested release dates follow this route: Cloudflare → Signals (hosted on Vercel) → Supabase. They are stored privately in Supabase for staff review and contact. Cloudflare Turnstile helps prevent abuse. Receiving an application does not send an automatic email.

After acceptance, FTZ invites the applicant to Signals to manage assigned release information, audio and artwork submissions, corrections, rights checks and distribution registration. Application input is not saved in public website files or GitHub. Publication and distribution are reviewed separately from receiving an application.

Newsletters and LINE

Only email addresses whose owners request registration and open the confirmation link are added to the newsletter list. Brevo manages confirmation, delivery and unsubscribing. Each newsletter contains an unsubscribe link. Unsubscribing and deleting retained information are separate requests; contact us for deletion.

Brevo processes email addresses, subscription, confirmation and unsubscribe status, delivery results and, depending on settings, opens and clicks. FTZ’s registration intake processes hashes derived from email and IP addresses, request times and single-use request IDs to limit abuse. This intake database does not store raw email or IP addresses. Subscriber records are not saved in public site files or GitHub.

LINE communications use the FTZ official account. You can control notifications and blocking in LINE. We do not automatically combine LINE friends with the email subscriber list.

Podcasts

Account registration and login use email addresses, team names, password hashes and session information for authentication and permissions. Show and episode drafts, audio, images, rights declarations, submitted versions, corrections, reviews and publication records support production, review and distribution.

FTZ-managed data and media use Cloudflare services including D1 and R2. Access to drafts and submitted materials is restricted to authorised users and staff. Approved published content becomes accessible through programme pages, RSS and distribution destinations. RSS uses contact information confirmed for public use. Existing programmes referenced from an external host are also subject to that host’s handling.

The FTZ app and Apple Music

FTZ accounts use email addresses, account IDs, saved song, album and podcast IDs and display information, and update times for authentication and sync across devices. Authentication and storage use Supabase. Saves made without signing in remain on the device.

FTZ accounts and Apple Music authorisation are separate. Playback and optional authorised additions to your Apple Music library take place through Apple on the device, subject to eligibility, subscription and connectivity. FTZ does not use a Music User Token as your FTZ identity and does not store audio or a copy of your entire personal Apple Music library on FTZ servers.

Listener-only accounts created in the app can request deletion from the account settings in Library. After verifying a valid signed-in session, FTZ deletes that listener account and its synced FTZ saves. Accounts shared with FTZ business services require support assistance to check related business data. Removing FTZ saves or deleting an FTZ account does not automatically remove items from your Apple Music library. Device-only saves can be removed separately from deleting a sync account.

06 Cookies and external data transmission

Cookies and similar technologies support signed-in sessions, security and analytics. You can restrict or remove them using browser and provider settings, although some features may become unavailable. The principal recipients and purposes are listed below; linked policies also explain provider processing and subcontractors.

GA4 is configured not to send form input, site search terms or URL queries and fragments as measurement data. Google Signals and advertising personalisation are disabled. The editor, draft previews and individual deployment URLs are excluded. In addition to browser cookie controls, supported browsers can use the Google Analytics Opt-out Browser Add-on.

Embedded players may connect to their providers when the page is displayed. If you are signed into an external service, that provider may associate the activity with your account. External links lead to services governed by their own policies.

07 Processing outside Japan

The providers above and their subcontractors may store or process information outside Japan. Locations depend on the feature, contract, configuration and subcontractors; processing is not confined to Japan.

When engaging a provider outside Japan to handle personal data, we follow applicable legal requirements concerning the destination’s system, provider safeguards, contracts, supervision, information and consent. Where a consent-based transfer or other circumstance requires additional disclosures, we explain the relevant country, framework and safeguards separately. Enquiries are accepted through section 10.

08 Security measures

FTZ uses authentication, role-based access, encrypted communications, server-side secret management, separation of private applications and materials from public content, input validation and abuse prevention to help protect information. We review data handling and provider use and restrict unnecessary access.

If a breach occurs, we investigate and limit harm and make reports and notify affected people as required by law. You may request further information about safeguards insofar as disclosure does not compromise security.

09 Retention and deletion

We retain information for periods necessary for its purpose, enquiries, contractual and rights management and legal obligations, and delete information when it is no longer needed. Provider records and FTZ’s email and business records are managed separately.

• Enquiries: FTZ retains received emails as needed for responses and business. Web3Forms submission data follows its policy, contract and settings. Its official policy states a maximum of three years, with shorter periods depending on the plan or earlier deletion. Provider deletion does not also delete FTZ’s received email.
• Newsletters: Necessary subscription and confirmation records are managed for delivery. Records may remain after unsubscribing to prevent further sends and establish consent or delivery history. Contact us if you request deletion as well as unsubscribing. Provider logs and backups follow provider contracts, settings and policies.
• Registration abuse prevention: Checks cover the preceding 24 hours. Older intake records are deleted at the next registration request.
• Applications, releases, podcasts and accounts: Records remain as needed for applications, active features, contracts, rights and submission or publication history. Requests following service closure or deletion are reviewed against retention duties and others’ rights.
• Analytics: Google Analytics data follows that service’s retention settings and policies. User- and event-level data and aggregated reports do not share identical retention rules.

Legal duties, disputes or backups can prevent deletion or immediate erasure. We explain applicable reasons and handling and restrict processing as necessary. Deleting information in FTZ does not necessarily remove published releases or RSS from every external destination; those destinations may require separate procedures.

10 Your requests and contact

Contact info@ftz.jp for requests about purposes, access to retained personal data or disclosure records, correction, additions, deletion, stopping use or disclosure, account deletion, or complaints. You may also contact this address to request operator details such as the operator’s name and address.

Identify the service, relevant registration email or other identifying information, and the action requested. We may ask for information necessary to verify you or your representative. Do not email passwords or authentication codes.

After verification, we respond without undue delay in accordance with applicable law and notify you of the outcome. If the requested action is unavailable, we explain why. Any procedure involving a charge is explained in advance.

11 Providing information is optional

Providing information is voluntary. Features requiring authentication or contact information may be unavailable without the necessary data. An account or newsletter subscription is not required for ordinary article browsing.

12 Changes

We review this policy as laws, services and provider use change. Updated text and revision dates appear on this page, with important changes announced through appropriate service channels where needed. Consent is obtained where required by law.