Privacy Policy

Effective as of 14 July 2025

Kioku LLC (“we”, “our” or “us”) respects your privacy. This Privacy Policy explains how we collect, use, disclose and protect personal information when you use our multilingual AI translation software‑as‑a‑service available at nani.now and any related applications or websites (collectively, the "Service").

It applies to all users worldwide. By using the Service, you acknowledge that you have read and understood this Policy.

1. Introduction and Scope

Data Controller – Kioku LLC, Central Nagoya 1101, Meieki‑2‑34‑17, Nishi‑ku, Nagoya, Aichi 451‑0045, Japan. (Email: hello@kiok.jp).
We comply with applicable privacy laws, including the EU General Data Protection Regulation ("GDPR"), the UK GDPR, and the California Consumer Privacy Act/California Privacy Rights Act ("CCPA/CPRA").
This Policy covers personal information we process about individual users. It does not apply to information that cannot be linked to an identified or identifiable person ("anonymous data").

2. Information We Collect

Category	Examples	Source
Account Data	Name, email address, OAuth identifier, organisation name	Provided by you during sign‑up
Usage Data	IP address, browser type, device identifiers, timestamps, pages visited, language settings, character counts translated	Collected automatically via server logs and cookies
Cookies & Similar Tech	Session ID; Cloudflare Turnstile cookie – note that Cloudflare Web Analytics sets no cookies	Your browser when you visit our site
Billing Data	Billing name, address, card type, last 4 digits, subscription tier, transaction IDs	Provided by you; stored and tokenised by Stripe
Support Data	Information you provide in email or chat with us	Provided by you

Translation Input

The text or documents you submit for translation are processed transiently and are not stored on our servers. They are forwarded to our NLP providers (currently OpenAI and Google) for real‑time processing and policy‑compliance checks, then discarded by us.

Our providers may retain short‑term logs for abuse detection and safety purposes. See Google Gemini API Terms and OpenAI Enterprise Privacy for details.

3. How We Use Your Information & Legal Bases

Purpose	Legal Basis (GDPR)
Provide, operate and maintain the Service (e.g. authenticate you, process translations, deliver results)	Contract – Article 6 (1)(b)
Process payments and manage subscriptions	Contract; Legal obligation for financial records
Respond to enquiries and provide customer support	Contract; Legitimate interests (service quality)
Monitor, analyse and improve the Service, including model quality, performance, and security	Legitimate interests (grow and secure our business)
Send important administrative messages (e.g. policy updates, security alerts)	Contract; Legal obligation
Send optional product news or marketing emails (if you opt in)	Consent – Article 6 (1)(a); you may withdraw at any time
Detect, investigate and prevent fraud, abuse or violations of our Terms of Service	Legitimate interests; Legal obligation

4. Cookies and Similar Technologies

We use:

Essential cookies – required to operate the Service, keep you logged in and protect against bots (Cloudflare Turnstile).
Cookie‑free analytics – Cloudflare Web Analytics collects aggregated, anonymous usage metrics without using cookies, localStorage or fingerprinting.

Most browsers let you delete or block cookies; however, the Service may not function properly without essential cookies.

5. Data Security

We implement appropriate technical and organisational measures, including:

Industry‑standard encryption in transit (e.g., TLS) and at rest (e.g., strong symmetric encryption).
Role‑based access controls; least‑privilege principle for staff.
Regular security audits, vulnerability scanning and third‑party penetration testing.
Incident response plan aligned with ISO / IEC 27001.

No method of transmission or storage is completely secure; we therefore cannot guarantee absolute security.

6. International Data Transfers

We are located in Japan, which benefits from an EU adequacy decision. We may transfer personal data to the United States and other countries where our subprocessors operate. When we do, we rely on:

European Commission Standard Contractual Clauses (Art. 46 GDPR);
Adequacy decisions (Japan);
For transfers originating from the United Kingdom, we implement the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU SCCs, as applicable;
Where our U.S. subprocessors are self‑certified under the EU–US Data Privacy Framework, we rely on that certification;
Additional technical safeguards such as encryption in transit.

By using the Service, you understand that your information may be processed abroad as described.

7. Data Retention

Data Type	Retention Period
Account & Billing data	While account is active plus 1 year after cancellation to resolve disputes & meet legal obligations
Translation input	Not stored – deleted immediately after processing
Usage & log data	Up to 12 months, then deleted or anonymised
Marketing consent records	Until you withdraw consent plus 3 years (audit trail)

We may keep anonymised or aggregated data indefinitely.

8. Your Rights

Depending on your location, you have the right to:

Access – request a copy of personal data we hold about you;
Rectify – correct inaccurate or incomplete data;
Delete – request erasure of your data (subject to legal retention);
Restrict / Object – limit or object to certain processing;
Data Portability – receive data you provided in a structured, machine‑readable format;
Withdraw consent at any time for processing based on consent;
Lodge a complaint with a supervisory authority (e.g. your local Data Protection Authority in the EEA).

To exercise any rights, email hello@kiok.jp. We may verify your identity before responding and will reply within one month (extendable by two months for complex requests, per GDPR). Requests are free unless manifestly unfounded or excessive.

California residents may also:

Request disclosure of the categories and specific pieces of personal information collected, sources, purposes and third parties;
Request deletion of personal information;
Opt out of "sale" or "sharing" (we do not sell or share personal information for cross‑context behavioural advertising);
Exercise these rights without discrimination. To submit a verifiable request, email hello@kiok.jp or have an authorised agent do so on your behalf.

9. Children’s Privacy

The Service is not directed to children under 13 years of age and we do not knowingly collect personal data from anyone under 13.

If you are between 13 and 16 years old (or a lower age if permitted by the laws of your country), you may only use the Service with the verifiable consent of your parent or legal guardian, unless applicable law allows you to provide your own consent (for example, if you are 16 or older in the European Economic Area or United Kingdom).

Where we rely on consent to process your personal data and you are below the applicable digital age of consent, we will seek parental or guardian authorisation. If we become aware that we have collected personal data from a child without the required consent, we will delete that information promptly.

Parents or guardians who believe we hold personal data about a child should contact us.

10. Changes to This Privacy Policy

We may revise this Policy from time to time. If we make material changes, we will post the updated Policy on our website and update the Effective Date above. We will provide reasonable advance notice (e.g. by email) when required by applicable law. Continued use of the Service after the effective date constitutes acceptance of the revised Policy.

11. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or your personal information, please contact:

Kioku LLC Central Nagoya 1101, Meieki‑2‑34‑17, Nishi‑ku Nagoya, Aichi 451‑0045, Japan Email: hello@kiok.jp Phone: +81‑80‑5733‑6139

If you are located in the European Economic Area or United Kingdom and believe your privacy concern has not been resolved, you have the right to lodge a complaint with your local supervisory authority.

Nani Terms & Privacy