Privacy Policy

1. Our commitment

Kakei Inc. ("we", "us") recognises the importance of the personal information we handle through the KAKEI AI bookkeeping service and the website trykakei.com (together, the "Service"). We comply with Japan's Act on the Protection of Personal Information ("APPI"), other applicable laws and guidelines, and this Privacy Policy.

2. Who we are

3. Scope and our role

This policy applies to all personal information we obtain in connection with the Service. We handle two different kinds of information:

• Account information about our customers and their staff. We are responsible for this information as a business handling personal information under the APPI (a "controller" under the GDPR).
• Customer Data: invoices, receipts, bank and card statements, ledgers and other content you upload, forward or connect. Customer Data may contain personal information about third parties, such as your suppliers' contacts, your employees, or bank account details. We process Customer Data on your behalf and only to provide the Service (an "entrusted party" under the APPI; a "processor" under the GDPR).

Where notice to, or consent from, those third parties is required for personal information contained in Customer Data, you are responsible for providing or obtaining it.

4. Information we collect

4.1 Information you provide

• Name, company or trading name, department, title, email address, phone number
• Login ID, password (stored in a one-way hashed form we cannot read), two-factor settings
• Billing details and tax registration numbers
• Content of enquiries, surveys and support conversations

4.2 Customer Data

• Images, PDFs, email bodies and attachments of invoices, receipts and similar documents
• Data extracted from them: supplier names, dates, items, amounts, tax and registration numbers
• Historical ledgers you import, and bank and card transaction data
• Category corrections, approvals and other records generated by your use of the Service

4.3 Information collected automatically

• IP address, browser type, operating system, device identifiers, language settings
• Access times, pages viewed, activity logs and error logs
• Information collected through cookies and similar technologies (see Section 12)

4.4 Payment information

Card payments are processed by a PCI DSS-compliant payment provider. We do not store full card numbers; we receive only payment status, card brand, last four digits and expiry date.

5. How we use information

1. To provide the Service, verify identity and manage accounts
2. To run Service features: capture, line-item extraction, category suggestions, duplicate detection, reconciliation and forecasting
3. To bill, take payment and issue invoices and receipts
4. To respond to enquiries and provide support
5. To send important notices, including changes to our terms or this policy
6. To tell you about new features, events and offers (you can unsubscribe anytime)
7. To prevent and respond to unauthorised access and misuse, and to keep the Service secure
8. To analyse usage, improve quality and develop new services, within the limits of Section 6
9. To enforce our Terms and resolve disputes
10. To comply with legal obligations

If we change these purposes, we will do so only within a scope reasonably related to the original purposes, and will publish or notify you of the change.

6. AI processing and Customer Data

• Per-customer learning: history-based categorisation uses only the data inside your workspace to build categorisation patterns specific to you. These are never shared with other customers.
• Improving shared models: we will use Customer Data to improve models shared across all customers (such as document reading) only with your explicit opt-in consent, and only after removing or pseudonymising identifying information. You can withdraw consent at any time.
• Aggregated statistics: we may use statistics aggregated so that no customer or individual can be identified (for example, average processing time) to improve or describe the Service.
• Third-party AI infrastructure: we may use cloud AI infrastructure to read and categorise documents. We contractually require such providers not to use Customer Data to train their own models.
• Human access: our staff view Customer Data only when you request support, when a security investigation requires it, or when required by law. Access is restricted to authorised personnel and logged.

7. Disclosure to third parties

We do not provide personal data to third parties without prior consent, except:

1. where required by law;
2. where necessary to protect a person's life, body or property and consent is difficult to obtain;
3. where especially necessary to improve public health or promote the healthy development of children and consent is difficult to obtain;
4. where necessary to cooperate with a public authority performing duties prescribed by law, and obtaining consent would interfere with those duties;
5. in connection with a merger, company split, business transfer or similar succession (we will require equivalent protection);
6. to service providers under Section 8.

When you choose to connect the Service with external services such as accounting software or banks, those services handle the data under their own privacy policies. We do not sell personal data.

8. Service providers

We may entrust the handling of personal data to service providers as needed. We choose providers able to protect personal information properly, bind them by contract to security measures, restrictions on sub-contracting and purpose limitation, and supervise them appropriately.

A current list of sub-processors is available on request from privacy@trykakei.com.

9. International transfers

Some of our providers operate servers outside Japan (for example, in the United States or the European Union). In accordance with Article 28 of the APPI, we transfer personal data only where:

• the recipient has established a system that meets the standards set by Japan's Personal Information Protection Commission, ensured by contract; or
• the recipient is located in a country recognised by the Commission as having an equivalent level of protection (EU and UK); or
• otherwise, with your prior consent.

On request, we will promptly provide the name of the destination country, an overview of its data protection system, and the measures taken by the recipient. As a rule, Customer Data is primarily stored in Japan.

10. Security measures

• Policies: a basic policy and internal rules for handling personal data.
• Organisational: a designated person responsible for personal data, regular reviews, and an incident response process.
• Personnel: confidentiality undertakings and regular training for staff.
• Physical: access-controlled data centres and measures against loss or theft of devices.
• Technical: TLS 1.2+ encryption in transit, AES-256 at rest, access control and least privilege, multi-factor authentication, logging and vulnerability testing.
• Foreign environments: where data is handled abroad, we take the local legal framework into account.

If a data breach occurs that is likely to harm individuals' rights and interests, we will report it to the Personal Information Protection Commission and notify affected individuals as required by law.

11. Retention and deletion

• Account information is kept while your account is active and deleted within 120 days of cancellation, except where the law requires us to keep records (such as billing and accounting records) for longer.
• Customer Data is kept according to your plan's retention period. After cancellation it remains available for export for 30 days, then is deleted, including from backups, within 90 days.
• Access logs are kept for up to one year for security purposes.

You may have legal obligations to retain books and records. Please export what you need before cancelling.

12. Cookies

• Essential cookies keep you signed in, protect the Service and remember settings such as language.
• Analytics cookies help us understand and improve how our website is used.

We do not provide your information to third parties for behavioural advertising. You can disable cookies in your browser, though some features may not work. Disclosures required under Japan's Telecommunications Business Act regarding external transmission are set out in this section and in a list available on request.

13. Your rights and requests

Under the APPI, you may request notification of purposes of use, disclosure (including records of third-party provision), correction, addition or deletion, suspension of use or erasure, and suspension of provision to third parties, for retained personal data we hold about you.

1. Email the contact in Section 18 and we'll send you a request form.
2. We will verify your identity (or your agent's authority).
3. We will respond without delay. If we cannot comply for a reason allowed by law, we will tell you why.
4. A fee of JPY 1,000 (incl. tax) per request may apply to requests for notification of purpose or disclosure.

Requests concerning third-party personal information inside Customer Data (such as your suppliers' contacts) are generally handled through the customer who controls that data. If we receive such a request directly, we will contact and assist that customer.

14. EEA and UK residents

14.1 Legal bases

• Performance of a contract (providing the Service and billing)
• Legitimate interests (security, fraud prevention, improving the Service, updates to existing customers)
• Consent (optional analytics cookies, shared model improvement, marketing)
• Legal obligation (such as retaining accounting and tax records)

14.2 Your rights

You have the right to access, rectify, erase, restrict, port and object to processing of your personal data, and to withdraw consent. You may also lodge a complaint with your local supervisory authority.

14.3 Transfers

Japan benefits from an adequacy decision of the European Commission. For transfers to other countries, we use appropriate safeguards such as the Standard Contractual Clauses.

14.4 Data processing agreement

A Data Processing Agreement covering our processing of Customer Data is available on request.

15. California residents

Under the California Consumer Privacy Act as amended by the CPRA, California residents have the right to know what personal information we collect and why, and to access, delete and correct it, without discrimination for exercising these rights. We do not sell personal information or share it for cross-context behavioural advertising. We collect the categories described in Section 4 for the purposes in Section 5. Submit requests via Section 18.

16. Children

The Service is intended for businesses and is not directed at anyone under 16. We do not knowingly collect personal information from children under 16.

17. Changes to this policy

We may update this policy to reflect changes in law or the Service. For material changes, we will notify you on the Service or by email a reasonable period before they take effect, and will obtain consent where the law requires it.

18. Contact

This English version is provided for reference. If there is any inconsistency between it and the Japanese version, the Japanese version prevails.