The Japanese version of this policy is the authoritative text. This English version is a translation; where the two differ in any respect, the Japanese version prevails.
Privacy Policy
Last revised: 5 November 2026
NAMINOL LLC (NAMINOL合同会社, “we” or “the Company”) operates FilmedSurf, a marketplace for surf footage and photos (“the Service”). We handle users’ personal information in compliance with Japan’s Act on the Protection of Personal Information (APPI) and other applicable laws.
1. Operator and contact point
- Operator: NAMINOL LLC (NAMINOL合同会社)
- Personal information manager: Masaki Hori
- Address: Miyamasuzaka Building 609, 2-19-15 Shibuya, Shibuya-ku, Tokyo 150-0002, Japan
- Complaints and enquiries: support@naminol.com (Support page)
2. Information we collect
- Video and images: clips uploaded by filmers in which identifiable people appear (including audio). A photo clip may contain the capture information recorded in the file (metadata such as the photographer’s name, copyright notice, camera and lens, date and time, and location).
- Email address: account registration details, via our authentication provider (Clerk).
- Filming request details: the date, time, spot and description of how to recognise you (free text you choose to write) sent with “Film me”, and, for a direct filming request, the Filmers you picked, their replies and any purchase requests. The description is kept so it can be filled in for your next request.
- Instagram username (optional): only if you choose to add it. It is shown as a link to your Instagram account on spots’ “Giving back to this spot” and on filmer pages (in the app and on the public web page). It stops being shown when you remove it or delete your account.
- Public social media posts (third-party information): for a spot’s “Posts about this spot”, we collect, through the official APIs of Threads, X and Instagram, public posts that contain words such as the spot’s name — specifically the post’s identifier, the URL of the original post, the poster’s name (where available), the time it was posted, its text and hashtags, and its type (text or video). We use the text and hashtags only to decide which spot a post belongs to (including an AI check, by Anthropic, of whether the post is about surfing or waves) and to filter out inappropriate posts. Posts are shown through each service’s official embed; we do not store or redistribute their photos or videos on our servers, and we stop showing a post once the original is deleted or made private. Posters can stop their posts being shown by contacting support@naminol.com (later posts will not be shown either). Because Instagram does not give us the poster’s name, for Instagram this works per post — please include the URL of the original post.
- Location and time: the GPS position and the date and time at which a clip was filmed.
- Payment information: payment data processed through Stripe (we never hold card numbers ourselves).
- Device information and push tokens: device identifiers, push notification tokens, and the like.
- Usage and analytics: access logs, interaction logs, IP addresses, and similar.
- Saving to your camera roll: when you explicitly choose to save, the file is stored on your own device (nothing additional is sent to our servers).
3. Purposes of use
- Matching people to clips using GPS position and time of filming, and presenting the results.
- Beach clean check and “Giving back”: separately from the above, and only if you use this feature, we use the coordinates and date and time of capture of the photo you take to check whether it was taken at a place facing the sea and on the day itself. Records that pass the check on or after 1 October 2026 are also counted toward “Giving back to this spot” for the nearest public spot within 1 km of where the photo was taken. A spot’s page shows the top three people by total number of accepted days so far, with their display name and number of days. Unless you set a nickname, your display name is one we generate automatically, containing no personal information. The coordinates and times themselves are never shown. The coordinates used for this check are not used to match footage. All that remains after the check is a record of the one reward and the date, time and coordinates of capture on which it was based. “Giving back to this spot” also counts, in addition to those days, the number of people who said “thanks” for clips filmed at that spot (only from recipients who paid for the clip, or whose surf session at that spot covers the time the clip was filmed), and the top three rows show their number of days and number of thanks. The names of the people who said thanks are not shown.
- Delivering clips and enabling downloads. For a photo clip, the buyer receives the original file as uploaded, without removing the metadata it contains (photographer’s name, copyright notice, camera and lens, date and time, location, and so on); a HEIC photo is converted to JPEG, carrying that metadata over. The preview and thumbnail shown before purchase are images we regenerate, and contain none of that metadata.
- AI analysis of uploaded footage, and putting surf conditions into words.
- Delivering filming requests (the date, time, spot, description, display name and Instagram username are shown to the Filmers who receive the request; for a direct filming request, only to the Filmers you picked, and — according to your setting — to other Filmers if, for example, all of them decline), telling the requester when footage from the request arrives, and telling a Filmer about a purchase request. The screen for picking Filmers for a direct filming request shows each Filmer’s display name, Instagram username, number of thanks and how recently they filmed, together with their area: the prefecture or state of the spot they set as home, or of the spot with most of their public clips. Device location is not used.
- Processing payments and paying out revenue to filmers.
- Moderating inappropriate content and responding to reports of rights infringement.
- Responding to enquiries and providing support.
- Improving the Service, preventing misuse, and meeting legal obligations.
4. Collection requiring your consent (device features)
Collection that involves access to device features — location, push notifications, saving to your camera roll — takes place only after you have granted permission through your operating system’s dialog. You can withdraw these permissions at any time from your device or app settings.
5. Provision to third parties and outsourcing
We entrust the handling of personal information to the following providers, to the extent necessary to operate the Service. We supervise those providers appropriately.
- Fly.io (application hosting)
- Neon (database)
- Upstash (job queue infrastructure)
- Clerk (authentication and account management)
- Amazon Web Services (AWS S3 / CloudFront: storage and delivery of video and images)
- Stripe, Inc. (payments and revenue distribution, including Stripe Connect)
- Expo, Apple (APNs) and Google (FCM) (push notification delivery)
- Shopify (operation of our online store and its checkout) and Gelato ASA (production and shipping of prints and goods): only if you ordered prints or goods from our store (shop.filmed.surf, which stopped selling in November 2026),the recipient name, address, phone number and email address you enter there, and the image you upload (people may appear in it), are provided to Gelato through Shopify. For single-frame prints ordered inside the app before then, the same kinds of information (including the image to be printed) are sent by us directly to Gelato. Production and shipping take place at partner facilities outside Japan, near the delivery address, so this information is transferred outside Japan.
Some features of the Service also send data to the AI providers below, to the extent required for that processing. What we send includes still frames extracted from footage you uploaded, and photos that were bought, in which people may appear.
- Anthropic (Claude): for content analysis and describing surf conditions — we send a small number of still frames extracted from the footage, together with the clip’s accompanying details.
- Anthropic (Claude): only if you use the beach clean feature, we send the photos of your litter pick-up that you took (which carry the location where they were taken), to check whether the photo shows a litter pick-up. After the check, we do not keep the photo. All we keep is the fact that it passed the check, and the date, time and coordinates of capture needed to investigate misuse and to count “Giving back”.
- Google (Gemini): only when you use the feature that renders a frame chosen from footage, or a photo you bought, in a painted style, we send that still frame or photo image (people may appear in it). We do not send a photo’s metadata.
Provision to credit card companies. Separately from the outsourcing above, in connection with credit card processing we may provide a filmer’s name, representative’s name, gender, date of birth, address, contact details, business description, and other information to credit card companies, to the extent necessary to enter into and perform merchant agreements and to verify that the filmer (as seller) is not a member of anti-social forces. This is provision to a third party, not outsourcing: the receiving card companies use that information for their own purposes. The basis for this provision is your consent under Article 16(3) of the Terms of Service.
Except for the outsourcing and third-party provision described above and where necessary to operate the Service, we do not provide personal data to third parties without your prior consent, other than as required by law.
6. External transmission (Telecommunications Business Act)
Our app and website transmit information recorded on your device, and information about your actions and access, to the external providers below, in order to understand usage, improve quality, and detect faults (Article 27-12 of Japan’s Telecommunications Business Act).
- Mixpanel (United States): information sent = user identifiers and usage events such as screen transitions and interactions; purpose = usage analysis and service improvement.
- Sentry (United States): information sent = device and runtime environment information at the time of an error; purpose = detecting and fixing faults.
- X Corp. (United States) and Meta Platforms, Inc. (United States; Threads and Instagram): when you open a spot’s “Posts about this spot”, each service’s official embed sends information such as your IP address, device and browser details, and the page you are viewing to that company; purpose = showing the posts. That information is handled under each company’s own privacy policy.
If you would like these transmissions stopped, please contact support@naminol.com.
7. Provision to third parties abroad (cross-border transfer)
Most of the providers and recipients above host their servers primarily in the United States, or are located in the United States or other countries (Stripe, AWS, Clerk, Anthropic, Mixpanel, Sentry, and others). Under Article 28 of the APPI, we transfer data to these third parties abroad only after putting in place, and continuing to maintain, the measures necessary to protect your rights and interests — that is, arrangements such as appropriate contractual terms that meet standards equivalent to Japan’s APPI — and we verify that those measures are being implemented. We will provide, on request, the names of the countries concerned and information about their personal data protection regimes (support@naminol.com).
8. Retention periods and retention of poster information
We retain personal data for as long as necessary to achieve the purposes of use, or for the period required by law, and thereafter delete or anonymise it appropriately. We may retain a poster’s registration details, IP address, access logs, and similar for a certain period in order to respond to reports of rights infringement and to other legal requirements (such as disclosure of sender information under Japan’s Information Distribution Platform Countermeasures Act).
9. Your rights
Under Articles 33 to 35 of the APPI you may request the disclosure, correction, addition, deletion, suspension of use, or suspension of provision to third parties of your retained personal data. Requests are accepted at support@naminol.com or through the Support page. We will verify your identity and respond without delay in accordance with the law.
10. Account deletion
You may request deletion of your account from within the app or through our support channel. On deletion, the personal information linked to your account is deleted or anonymised, other than information we are legally required to retain (accounting records, payment records, logs needed to handle rights-infringement matters, and the like). We will tell you what is deleted and what is retained when you make the request.
11. If we introduce face matching (FaceMatch)
If we introduce face matching in future to improve how accurately we match people to clips, we will collect and use the biometric-related information involved — such as facial feature data — only with your voluntary, explicit consent, and you will be able to withdraw that consent at any time. On withdrawal, we will promptly delete the biometric-related information concerned. (This section is advance notice about a possible future feature; it does not apply while that feature is not offered.)
12. Cookies and similar (web)
Our website may use cookies and similar technologies to provide the Service, improve convenience, and analyse usage. You can disable cookies in your browser settings, though some features may then be unavailable.
13. Changes to this policy
We may revise this policy in response to changes in the law or to the Service. We will announce significant changes on the Service.
14. Contact
For enquiries about this policy, please contact support@naminol.com or use the Support page.