Privacy
What personal data this service holds, why, how long, who else sees it, and how to have it removed. The short answer is account records and almost nothing else.
FID Ltd. is the controller of the personal data described here. This page covers the public website and the Kansoku platform.
The short version
We hold your account and billing records, and a log of your use of the service. We do not collect personal data from the sites the service reads. That is a product decision enforced in code, not a promise in prose — see the collection policy.
What we hold, and why
| Data | Why we hold it | How long |
|---|---|---|
| Name, email, company | To operate your account and contact you about it | While the account is open, then 30 days |
| Usage records — which key made which request, when, and how much data it moved | This is what your invoice is derived from, and you can read it in the console | While the account is open, then 30 days |
| Billing records | Because tax law requires us to keep them | As Japanese tax law requires, currently seven years |
| Support correspondence | To answer you, and to see the history if you write again | Three years |
| Card details | We do not hold them | — |
Payment details are collected by Stripe directly. They do not pass through our servers and we do not store them.
What the service collects from other sites
Prices, titles, availability and the identity of the seller who published a listing — from public commercial pages, the same pages a shopper sees without signing in.
Where a seller is a named business we record the business. Where a listing carries an individual's details we do not retain them. We do not build profiles of individuals, and we do not sell what we collect.
Legal bases
Where the GDPR applies: we process account and usage data to perform our contract with you; billing records to meet a legal obligation; and security and abuse-prevention logs in our legitimate interest in keeping the platform working for every customer.
Who else sees it
The third parties involved are listed, with what reaches each of them, on the subprocessors page. We do not sell personal data and we do not share it for advertising.
Where it is held
Observations and account records are stored in the region chosen when the workspace is created. Tell us if you have a residency requirement before you sign up, so we can say plainly whether we can meet it.
Where data moves out of the EEA or the UK, we rely on the European Commission's adequacy decision for Japan, and on standard contractual clauses where a transfer falls outside it.
Cookies
The console uses a session cookie, required to keep you signed in. There is no way to opt out of it while using the console, because without it there is no session.
The public site loads analytics only where configured, with consent denied by default until a choice is made. No advertising cookies are set.
Your rights
You can export or delete your account data from the console at any time.
Depending on where you live you may also have the right to access, correct, delete, restrict or object to our processing, to portability, and to withdraw consent where we relied on it. California residents have the rights to know, delete, correct and to opt out of sale or sharing — we do not sell or share personal data, so there is nothing to opt out of.
Write to us and we will do it and confirm when it is done. We do not require you to justify the request, and exercising a right never degrades your service.
If you are not satisfied, you may complain to your supervisory authority; in Japan, the Personal Information Protection Commission.
Breach notification
If a breach affects your personal data we will notify you and the relevant authority without undue delay, with what we know, what we do not yet know, and what we are doing about it. We would rather send an incomplete notice promptly than a complete one late.
Children
The service is sold to businesses and is not directed at children. We do not knowingly collect data from anyone under 16.
Changes
Material changes are announced 30 days ahead by email to account owners. The current version and its date are always at the foot of this page.
Contact
Write to the address on the legal notice page. Mark data protection enquiries clearly and they will be routed accordingly.
Last updated