Privacy Policy
Effective August 9, 2026
Who we are
This Privacy Policy explains how 合同会社MBKY (G.K. MBKY) (“we,” “us,” or “our”), a Japanese limited liability company (godo kaisha), collects, uses, and protects personal information when you use xbill.co and related services we operate, including product brands such as Escape Corp, Dory, surveys, newsletter and audience signups, articles, coaching contact forms, short links, and account features.
Contact for privacy requests: support@mbky.co.
Scope
This policy applies to personal information processed through our websites and related emails. It does not cover third-party sites linked from our Service (for example Google or Zoom interfaces you open separately).
Information we collect
Account and authentication
When you create or use an account we may process: name, email address, optional nickname and profile image, email verification status, newsletter preference, and authentication metadata. Sign-in may use Google OAuth and/or email magic links or one-time codes delivered via our email provider.
Escape Corp bookings and event interest
When you book a session, join a session waitlist, or join an Escape Corp interest list we may process: name, email, timezone, answers to session or signup questions, transactional session consent, optional marketing opt-in (only when you explicitly opt in), booking status, reconfirmation or assumed-attendance status, waitlist and claim metadata, cancellation metadata, and related delivery status. Cancel, reconfirm, and waitlist-claim links use a secure token; we store a hash of that token, not the raw token in ordinary booking or waitlist records.
Surveys and feedback
Survey responses may include answers you submit, optional contact fields (such as name, email, phone, website, or other fields enabled for that survey), UTM or referrer metadata, and either your signed-in user id or a hashed anonymous ownership cookie used to limit duplicate responses.
Dory (questions and votes)
We may process question and comment text, upvote records, and either your user id (if signed in) or a hashed anonymous cookie token used for ownership and anti-abuse. Comments require a signed-in account.
Newsletter, audiences, and waitlists
We may process email address, optional name or signup answers, verification and unsubscribe tokens, approval status where an audience requires it, source information, and subscription status. Dedicated newsletter or waitlist forms treat submission as marketing opt-in for that list.
Articles
Signed-in comments may include your comment text and account identifiers (including nickname display).
Coaching and contact
Contact forms may collect name, email, optional organization, and message content. Messages may be emailed to us and, when configured, forwarded to an internal intake system.
Analytics and short links
We operate first-party, cookieless server-side analytics. We may process page paths, titles, referrers, approximate device/browser information, language, coarse geo (country/region), performance timing, UTM parameters, a temporary session id stored in browser sessionStorage (not a cookie), and a hashed IP address. If you are signed in, analytics events may also store your user id so we can understand authenticated usage. Short-link clicks may store user agent, referrer, and a hashed IP.
Email engagement
For certain first-party tracked links in emails we send, we may log recipient email, draft/audience identifiers, destination URL, user agent, and a hashed IP address.
Bot protection
Public write actions (for example booking, Dory submissions, or surveys when not signed in) may use Cloudflare Turnstile. Cloudflare may process technical data as needed to provide that check.
Cookies and similar technologies
See our Cookie Policy for details. In short: essential authentication/session cookies; optional functional anonymous ownership cookies for Dory and surveys; cookieless analytics; Google may set cookies during Google sign-in.
How we use information
We use personal information to:
- Provide and operate the Service (accounts, bookings, surveys, Dory, articles, short links)
- Authenticate users and keep the Service secure (including bot checks and abuse prevention)
- Send transactional messages (for example booking confirmations, reminders, reconfirm and cancel links, waitlist offers, email verification, magic links/OTP, session updates)
- Receive delivery and bounce events from our email provider (Resend) for transactional and campaign sends; when an Escape Corp booking confirmation permanently bounces, we may release that seat so someone else can book
- Send marketing or newsletter messages only where you have opted in or submitted a dedicated signup form
- Sync confirmed Escape Corp guests to a host Google Calendar event as attendees when Calendar integration is enabled, and create Zoom meetings for hosts when Zoom integration is enabled
- Improve the Service using analytics and operational logs
- Respond to contact and support requests
- Comply with law and enforce our Terms
Legal bases and purpose (overview)
Depending on your location, we rely on:
- Contract / necessary for the service — accounts, bookings, transactional email, cancel flows
- Consent — marketing/newsletter opt-in; certain optional fields
- Legitimate interests (or equivalent under applicable law) — security, analytics improvement, preventing spam/abuse, operating anonymous ownership cookies
- Legal obligation — where retention or disclosure is required by law
For visitors in Japan, we process personal information for the purposes described above in accordance with the Act on the Protection of Personal Information (APPI) and related guidelines.
Sharing and processors
We do not sell personal information. We share information with service providers who process it on our behalf, including:
| Provider | Role |
|---|---|
| Resend | Transactional and marketing email delivery; auth email; delivery/bounce webhooks |
| MongoDB | Database hosting |
| OAuth sign-in; Google Calendar sync for Escape Corp hosts (guest emails may appear as calendar attendees) | |
| Zoom | Meeting creation for Escape Corp hosts when enabled |
| Cloudflare | Turnstile bot protection; object storage (R2) for files/images we host |
| Vercel | Website hosting and related infrastructure |
When configured, coaching contact submissions may also be sent to an internal hub/intake endpoint we control.
We may disclose information if required by law, to protect rights and safety, or in connection with a corporate reorganization involving G.K. MBKY.
International transfers
We are based in Japan. Some processors operate in other countries (including the United States and the EU/EEA). Where we transfer personal information internationally, we do so as needed to provide the Service and with appropriate contractual and organizational safeguards.
Retention
- Accounts: retained while your account is active; deleted when you delete your account or we complete an erasure request (see Your rights)
- Bookings and related operational records: retained as needed to run sessions, prevent abuse, and meet legal/accounting needs; email us for residual erasure requests
- Audience / newsletter memberships: until you unsubscribe or we delete upon request, subject to suppression records needed to honor opt-outs
- Survey, Dory, and comment content: while needed for the product purpose, or until deleted via account deletion / moderation / request
- Analytics and hashed logs: retained for a reasonable period for reporting and security
- Contact messages: typically retained for support and follow-up (on the order of years unless you ask us to delete sooner where feasible)
Your rights
Subject to applicable law, you may:
- Access and correct personal information we hold about you
- Delete your account via Profile → Delete account (self-serve). This removes your user account and account-owned content described in the product (for example profile data, comments, signed-in Dory activity, survey responses linked to your account) and unsubscribes you from the newsletter list association we maintain for your account
- Request residual erasure by emailing support@mbky.co (for example Escape Corp bookings keyed by email, other audience memberships, or copies in email inboxes). Self-serve account deletion does not automatically cancel Escape Corp seats
- Unsubscribe from marketing/newsletter emails via the link in those emails or related unsubscribe pages
- Cancel an Escape Corp booking using the cancel link in your confirmation email
- Object to or restrict certain processing, and withdraw consent where processing is consent-based
- Data portability for account information we can reasonably provide
We may need to verify your request. Some analytics and security logs cannot be fully individualized after hashing or aggregation.
EU/EEA and similar regimes may also provide rights to lodge a complaint with a supervisory authority. California residents may have additional rights under the CCPA/CPRA; we do not sell personal information.
Children
The Service is not directed to children under 16. We do not knowingly collect personal information from anyone under 16. If you believe we have, contact support@mbky.co and we will take appropriate steps to delete it.
Security
We use industry-standard measures appropriate to our size and risk profile, including encrypted transit (HTTPS), access controls, hashed identifiers where noted, and least-privilege admin access. No method of transmission or storage is completely secure.
Changes
We may update this Privacy Policy from time to time. We will post the updated policy on this page and revise the effective date. Material changes may also be communicated by additional reasonable means (for example email or a site notice).
Contact
合同会社MBKY (G.K. MBKY)
Japan
Privacy and data requests: support@mbky.co
Last updated August 9, 2026.