Privacy Policy

FIX Inc. ("we," "us," or "our"), operating under the trade name Scratch Lab, is committed to protecting your personal information. This Privacy Policy explains how we collect, use, and safeguard information you provide when using our website or contacting us regarding our data recovery services.

This Policy covers two distinct categories of data: (a) the contact and case information you provide to us, for which we act as the data controller; and (b) the content stored on media you send us for recovery, for which we act as a data processor on your behalf. Section 5 explains how we handle recovery data.

We collect the following information only when you voluntarily submit it through our inquiry or case submission forms.

All submissions

• Company name and branch / store name
• Contact person's name
• Email address
• Phone number (optional)
• Country / region
• Preferred language
• Your internal case or reference number (optional)
• Type of data stored, recovery priorities, and symptoms or details of the request

Case submissions (shipping media) only

• Shipping address (postal code, address lines)
• Items included in the package
• Affected media type, OS, source device, model number, and serial number
• Permission to open the media (HDD)
• Encryption method and device password (only if the device is locked and you choose to provide them)
• Shipping carrier and tracking number (optional)

We do not automatically collect personally identifiable information beyond standard web analytics (see Section 7).

We use the information collected solely for the following purposes.

• Responding to inquiries about our data recovery services
• Providing quotations and case assessments
• Coordinating device shipping and return logistics
• Communicating with business partners and resellers

We will not use your information for any purpose beyond those stated above without your prior consent.

Where the GDPR applies, our legal bases for processing are: performance of a contract or pre-contractual steps taken at your request (responding to inquiries, preparing quotations, and carrying out recovery work); your consent (for example, where you provide a device password or opt in to analytics cookies); and our legitimate interests in operating and improving our services, except where overridden by your rights. The legal basis for processing recovery data is the contract between you and us, under which you act as the controller and we act as your processor.

We do not sell, trade, or rent your personal information to third parties. We do not transfer your personal information to third parties except as described in this Policy.

We may use a limited number of service providers (subprocessors) to operate our business — for example, web analytics (see Section 7) and shipping carriers you authorize. These providers process data only on our instructions and under appropriate contractual safeguards. We do not otherwise outsource the handling of your personal data. We may disclose information where required by applicable law or regulation.

Your contact and case information is stored and managed within Japan. We implement appropriate technical and organizational measures to protect personal information against unauthorized access, loss, destruction, or alteration.

Handling of recovery data. Media you send us, and the data recovered from it, may contain personal information about you or third parties. We process this data solely to perform the requested recovery and return it to you. We do not access, use, or disclose recovery data for any other purpose. Recovered data and any working copies are securely erased within a defined period after the case is closed and the data has been returned to you, unless you instruct us otherwise in writing or we are required to retain it by law. Device passwords and encryption details you provide are used only to perform the recovery and are deleted once the case is closed.

If you are located in the European Economic Area (EEA), the United Kingdom, or Switzerland, please note that your personal data will be transferred to and processed in Japan. Japan has been recognized by the European Commission as providing an adequate level of data protection, so transfers from the EEA to Japan do not require additional safeguards. For transfers from the UK or other regions, we rely on appropriate safeguards such as Standard Contractual Clauses where required.

As an EEA, UK, or Swiss resident, you have the right to

• Access the personal data we hold about you
• Request correction or deletion of your data
• Object to or restrict our processing of your data
• Receive your data in a portable format and have it transmitted to another controller (data portability)
• Withdraw consent at any time, where processing is based on consent
• Lodge a complaint with your local data protection authority

To exercise any of these rights, please contact us using the details in Section 9. We do not currently maintain an establishment within the EEA; if an EU representative under Article 27 GDPR is required, their details will be published in this Section.

Our website uses Google Analytics to understand site usage patterns. Google Analytics sets cookies and collects usage data, which may include online identifiers such as your IP address. We treat this as personal data.

We also use Microsoft Clarity to understand how visitors interact with our website through heatmaps and session recordings. Microsoft Clarity sets cookies and collects behavioral data such as mouse movements, clicks, and scrolling, which may include online identifiers such as your IP address. We treat this as personal data.

Where required by law, we load analytics cookies only after you give consent through our cookie banner, and you can change or withdraw your choice at any time. Strictly necessary cookies, which are needed for the site to function, do not require consent.

• Google Analytics Terms of Service:https://marketingplatform.google.com/about/analytics/terms/us/
• Google's Privacy Policy:https://policies.google.com/privacy
• Microsoft Clarity:https://clarity.microsoft.com/
• Microsoft Privacy Statement:https://www.microsoft.com/en-us/privacy/privacystatement

You may also opt out via the Google Analytics Opt-out Browser Add-on.

Inquiry and case records are retained only as long as necessary to fulfill the purposes described in this Policy. As a general guide, inquiry records are retained for up to 12 months after the last contact, and case records for up to 24 months after a case is closed, unless a longer period is required by law or agreed with a business customer. Recovery data is erased as described in Section 5. Records are deleted promptly once the applicable period has elapsed.

For questions, data access requests, or deletion requests, please contact us. If we act as a processor for a business customer, we may direct certain requests to that customer as the controller.

FIX Inc. — Scratch Lab
Akihabara ST Building 6F,
4-13-6 Sotokanda, Chiyoda-ku, Tokyo 101-0021, Japan

Email: support@media-sos.com
Phone: +81 50-5577-5734
Hours: Monday–Friday, 10:00–19:00 JST

We may update this Privacy Policy from time to time. The most current version will always be available on this page with the updated date noted below.

Update History

• Established: June 1, 2026
• Last updated: June 1, 2026