Privacy Policy

壱Data controller

The data controller for Kotoba Dojo is:

Please direct all privacy questions, rights requests and complaints to privacy@letiziainc.com.

弐Data we collect

参How your prompts are processed

When you submit a round, your text is sent to third-party AI providers — an image generation API (OpenAI) and the Anthropic Claude API — solely in order to generate the resulting image and produce your score and coaching.

These providers process your prompts solely in order to provide the Service to you — that is, to generate your image and return your score and coaching. They act as our processors under their API terms and handle the data only on our instructions.

We do not use your prompts to train AI models, our own or anyone else's.

What you must not put in a prompt. Prompts are free text, and we cannot inspect them before they are sent. You therefore must not include:

• Special category (sensitive) personal data — data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic or biometric data, data concerning health, or data concerning a person's sex life or sexual orientation.
• Personal data about other people — including names, contact details, images, or descriptions of identifiable third parties — unless you have a lawful basis for providing it to us.
• Confidential or security-sensitive information — government identifiers, financial account details, passwords, API keys, or anything else you are not free to disclose.

肆Legal bases for processing

Where the EU or UK GDPR applies to you, we rely on the following legal bases:

Balancing note. For fraud prevention and security we have weighed our interest in keeping the Service usable and affordable against your interests and rights. We use the minimum data needed (account identifiers, request metadata, rate-limit counters), we do not profile you for advertising, and the processing is what a user would reasonably expect from a paid service. You may object to this processing at any time by writing to privacy@letiziainc.com; we will stop unless we can show compelling legitimate grounds that override your interests.

伍Third-party processors

We share data with the following service providers, each only to the extent needed to operate the Service:

Each of these providers except Product Hunt acts as our processor, handling data only on our instructions and only for the purpose shown. The safeguards applied to transfers outside your country are set out in section 捌.

Product Hunt is an independent controller, not our processor. We embed their badge image in the footer of our landing page; the request your browser makes for that image goes to Product Hunt directly and carries your IP address and the page you were on. They decide what to do with it under their own privacy policy, not on our instructions. Nothing about your account, your rounds or your prompts is sent to them.

We do not sell or share your personal data.

陸Why we use your data

• Service delivery — running rounds, generating images, scoring, and tracking your progress.
• Billing — managing subscriptions, credits, and top-up purchases.
• Fraud prevention — detecting duplicate accounts, credit abuse, and automated play.
• Improvement — understanding how the Service is used so we can make it better (analytics only, and only with your consent).

漆Retention

We keep personal data only as long as we need it for the purpose it was collected for:

Where a longer period is required by law — principally the payment records above — we retain only the records the law requires and delete the rest on the schedule shown.

Deleting your account yourself. You can delete your account at any time from the in-app menu, under Account → Delete account. Doing so removes your profile, your play history, the images generated for your rounds and any credits still on your balance — credits are not refunded — from the live service straight away. It cannot be undone: we are not able to restore an account once it has been deleted. Backups and any records the law requires us to keep are then cleared on the schedule in the table above. If you need help deleting your account, or cannot reach the menu for any reason, write to privacy@letiziainc.com and we will do it for you.

Two things are worth knowing before you delete. An active paid subscription is not cancelled by deleting your account — Stripe is a separate system and is not told of the deletion — so you must cancel it first under Plan management in the same menu. We block deletion while a subscription is running rather than leave you billed for an account you can no longer reach. And if you choose to answer the optional question about why you are leaving, that answer is stored anonymously: it carries no user identifier, no email address and no nickname, and cannot be connected back to you or to the account it came from. Answering is optional, and skipping it changes nothing about the deletion.

捌International transfers

We operate from Japan and use the processors listed in section 伍. Your data may therefore be processed outside the country in which you live, in the locations named in that table.

For transfers of personal data from the European Economic Area and the United Kingdom, we rely on:

• The EU–Japan mutual adequacy decision, which recognises Japan as providing an equivalent level of protection, for data processed by us and by Supabase in the Japan region.
• The processors' Standard Contractual Clauses (and the UK International Data Transfer Addendum where applicable) for transfers to Netlify, Stripe, Google (both OAuth sign-in and Analytics), Cloudflare, Anthropic and OpenAI in the United States.

You may request details of the safeguards applied to any specific transfer by writing to privacy@letiziainc.com.

玖Your rights

Subject to applicable law, you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete data.
• Delete your data (right to erasure).
• Restrict our processing of your data in certain circumstances.
• Object to processing based on our legitimate interests, including fraud prevention as described in section 肆.
• Port your data — receive it in a structured, commonly used, machine-readable format.
• Withdraw consent at any time where we rely on consent, such as analytics cookies. Withdrawal does not affect processing carried out before you withdrew.
• Complain to a supervisory authority — see below.

How to make a request. There are two ways:

• Email privacy@letiziainc.com from the address registered to your account.
• Delete your account and its associated data yourself, at any time, from the in-app menu under Account → Delete account. See section 漆 for what this removes and for the subscription you need to cancel first.

Identity verification. We verify requests by confirming that they come from the email address registered to the account. If we cannot verify your identity we may ask for further information before acting.

Response time and cost. We respond within one month of receiving a verified request, extendable by two further months for complex requests (we will tell you if that happens). Reasonable requests are free of charge.

Complaints. You may lodge a complaint with your local data protection authority — in the EEA, the supervisory authority of your country of residence, work or the alleged infringement; in the UK, the Information Commissioner's Office (ICO). In Japan, you may contact the Personal Information Protection Commission (個人情報保護委員会, PPC). We would appreciate the chance to address your concern first at privacy@letiziainc.com.

拾Cookies & consent

We use two categories of cookies and similar storage:

• Essential — required for authentication, login sessions, security, and core functionality, including remembering your cookie choice and your language. These cannot be switched off and are not used for tracking.
• Analytics — set by Google Analytics 4 to help us understand how the Service is used, such as page views and feature usage. IP anonymization is handled by GA4 by default.
• Advertising — set by Google AdSense to serve and measure advertising, and to limit how often you see the same ad. Google may use these cookies to personalise ads based on your prior visits to this and other sites.

Declining does not restrict any part of the Service. You can also control cookies through your browser settings, though disabling essential cookies will prevent the Service from working.

You can additionally opt out of Google Analytics by installing the Google Analytics Opt-out Browser Add-on, and manage how Google personalises ads to you in your Google My Ad Center settings.

拾壱Children

The Service requires users to be at least 13 years old. We do not knowingly collect personal information from children under 13.

If we learn that we have collected personal information from a child under 13, we delete it promptly. If you believe a child under 13 has provided us with personal information, please contact privacy@letiziainc.com and we will act on it.

拾弐California privacy notice

This section applies to California residents under the CCPA as amended by the CPRA.

Disclosure for the preceding 12 months. The table below sets out, for each category of personal information, whether we collected it, whether we disclosed it for a business purpose, the categories of recipients, and whether we sold or shared it.

We have not sold or shared personal information in the preceding 12 months, as the table records, and we do not sell or share it now. We have not sold or shared the personal information of consumers we know to be under 16.

Sensitive personal information. We collect one category of sensitive personal information: account log-in credentials — your email address in combination with authentication tokens, or your Google sign-in identifier. We use it only to authenticate you, keep your account secure, and provide the Service you asked for. Those are purposes for which the CPRA does not provide a right to limit, and we do not use or disclose sensitive personal information for any purpose that would trigger that right — in particular, we do not use it to infer characteristics about you. We do not collect government identifiers, precise geolocation, health, biometric or genetic data, racial or ethnic origin, religious beliefs, or data concerning sex life or sexual orientation.

California residents have the right to know, to delete, to correct, and to opt out of sale or sharing (not applicable, as we do neither). To exercise a right, use either method in section 玖 — email privacy@letiziainc.com, or the in-account deletion option. We will not discriminate against you for exercising any of these rights — no denial of service, no different prices, no reduced quality.

拾参Japan (APPI) procedures

We handle personal information in accordance with Japan's Act on the Protection of Personal Information (個人情報保護法, APPI).

Under the APPI you may request disclosure, correction, addition, deletion, suspension of use, or suspension of provision to third parties of your retained personal data. The procedure is:

• How to request — email privacy@letiziainc.com stating which request you are making.
• Identity verification — send the request from the email address registered to your account. We may ask for additional confirmation if there is doubt.
• How we respond — by email to the registered address, unless you ask for another reasonable method.
• Fee — no charge for reasonable requests.

Security management measures (安全管理措置). We take the following measures to manage personal data securely:

• Organizational — access to personal data is granted on a need-to-know basis, limited to those who require it for their role, and access rights are reviewed when roles change.
• Personnel — everyone with access to personal data is bound by confidentiality obligations and is instructed in the proper handling of that data.
• Technical — encryption in transit (TLS) for all connections; server-side storage of API keys and secrets, so that they are never exposed to the browser; and row-level security in the database, so that each account can reach only its own records.
• Physical — personal data is held on the cloud infrastructure of major providers (listed in section 伍), in data centres subject to the physical access controls those providers maintain. We operate no personal-data servers on our own premises.

Further detail on any of these measures is available on request — write to privacy@letiziainc.com.

Complaint desk. Complaints about our handling of personal information may be sent to privacy@letiziainc.com. If a complaint is not resolved to your satisfaction, you may contact the Personal Information Protection Commission (個人情報保護委員会).

Foreign transfers. Details of the third parties in foreign countries to whom we provide personal data, the countries concerned, and the safeguards in place are set out in section 捌.

拾肆Governing language & changes

We may update this policy from time to time. We will post notice of material changes on the site and, where the change materially affects your rights, notify you by email.