Privacy policy

The calculators and the back office run entirely in your browser. Figures you type — your rent, your wage bill, your prices — are saved to your own device using your browser's local storage and are never transmitted to us. We have no copy, no account for you, and no way to read them.

That is a consequence of how they are built rather than a promise we ask you to take on faith: there is no server to send anything to. Clearing your browser data deletes them, which is also why the back office offers an export file.

Two different relationships run through this product, and they carry different duties.

For your own account and the figures you enter, we are the controller — we decide what is held and why, and the rest of this policy describes it.

For the customer details you collect — the phone numbers on your stamp card, the people who use your kiosk — you are the controller and we are only a processor. They are your customers, gathered under your promise to them. We act on your instructions, do not use those records for our own purposes, and never sell them. In practice this means a data-protection obligation toward those people is yours, and we help you meet it rather than assume it for you.

The stamp card stores the phone numbers your customers give you, on your device, in the same browser storage as everything else. We never receive them and have no way to read them.

That does not make them yours to do as you like with. Those numbers belong to the people who gave them to you, which makes you the one responsible for them — under PIPEDA in Canada, the CCPA in California and their equivalents elsewhere. In practice: ask before you type a number, use it for the stamp card and nothing else unless they agreed to more, and remove anyone who asks. The list has a delete control on every row for exactly that reason.

Because a shared counter tablet is a shared counter tablet, the card holds the phone number and nothing else — no names, no birthdays, no notes.

The review-reply writer uses a Google Gemini API key that you supply. It is stored in your browser alongside your other settings and is sent directly from your browser to Google when you generate a reply. It never passes through us.

What you send that way is handled under Google's Privacy Policy. You can remove the key from your browser at any time in Settings.

The free tools genuinely hold nothing. The paid platform is a hosted service, so it necessarily does — and the honest version of that matters more than a reassuring one.

If you switch the platform on, the customer details you collect are stored on our servers, not only on your device. That is what makes them work across your tills, survive a lost tablet and reach people by message at all. It is a real difference from the free back office and not a technicality.

If you create an account on the KANJIN platform, we hold:

• Your email address and the details you enter about your business, so you can sign in and so your emails can carry your name.
• Details of your customers, taken at the kiosk or the counter: their phone number, and where they give it, a first name, birthday or email. Stamp balances, visit counts and total spend sit alongside them.

We do not sell any of it, and we do not use your customer list for anything except showing it back to you.

Creator discovery uses the YouTube Data API. In using those features you are also bound by the YouTube Terms of Service, and Google's handling of your information is governed by the Google Privacy Policy.

We store search results — public channel names, subscriber counts, thumbnails and published contact details — only as a cache, so the same search does not have to be run twice. That cache is discarded and refreshed at least every 30 days, in line with the YouTube API Services caching requirements. We do not build profiles of creators beyond what their public channel already shows.

Wherever you are, you can ask us what we hold about you, correct it, take a copy, or have it deleted. If you are in the European Economic Area or the United Kingdom, those are formal rights under the GDPR and UK GDPR and we treat them as such: access, rectification, erasure, restriction, portability, and objection to processing. Comparable rights under PIPEDA in Canada, the CCPA and CPRA in California, and Taiwan's Personal Data Protection Act are honoured the same way, including the California right not to be discriminated against for exercising them.

Where we rely on your consent — the AI key, marketing email — you can withdraw it at any time, and withdrawing it does not undo anything lawfully done beforehand.

If you are a customer of a shop that uses KANJIN, you do not have to write to anybody. Your own stamp card page carries two links: one stops that shop emailing you, and one deletes your card and everything attached to it. The shop can also export or delete you from its own customer list, from the same screen it uses to see you.

Our legal bases, plainly:

• Performance of a contract — running the account you signed up for, and taking payment for it.
• Legitimate interests — keeping the service secure, preventing abuse, and understanding which pages are worth keeping. We do not use this basis for anything intrusive.
• Consent — where you have given it, such as storing an AI key or agreeing to hear from us.
• Legal obligation — retaining payment records where tax or accounting law requires it.

If you think we have handled something badly, tell us first and we will try to fix it. You also have the right to complain to your data protection authority — the ICO in the UK, your national supervisory authority in the EEA, or the Office of the Privacy Commissioner in Canada.

Every company that receives data from KANJIN is named on the subprocessors page, with what each one gets and where it runs. The agreement a shop holds with us about its own customers is the data processing agreement.

• Free tools and the stamp card: for as long as you keep them on your device. There is no copy anywhere else and no clock running on our side.
• Platform account records: for as long as the account is open, then deleted within 30 days of you closing it or asking us to.
• A shop’s customers: until the shop’s own retention setting is reached, three years by default, counted from their last visit. The shop is told 30 days before anybody is deleted.
• Cached public YouTube data: refreshed or discarded within 30 days, as the YouTube API Services terms require.
• Payment and invoice records: kept for as long as tax and accounting law requires, typically seven years, and used for nothing else.

The calculators store nothing outside your own device, so nothing crosses a border at all. The free back office is nearly the same: your figures, your costs and your customer list stay in your browser and are never uploaded.

One exception, and it is worth being exact about. If you switch on emailed stamp receipts, the customer’s email address and their stamp count are sent to our email provider, Resend, in the United States, so the message can be delivered. Nothing else goes with it — no phone number, no visit history, no list — and we keep no copy. Leave receipts switched off and nothing at all leaves your device.

For the paid platform there are two places to know about. KANJIN is operated from Taiwan, and the servers holding the data are in Singapore — so information moves between both.

If you are in the UK or EEA, that matters: neither Taiwan nor Singapore has a general adequacy decision, so those transfers are made under the standard contractual clauses our providers publish together with the safeguards their terms require. If you would rather your data never left your own device, the free back office is exactly that and always will be available to you.

KANJIN is a tool for running a business and is not directed at children. We do not knowingly collect information from anyone under 16, and you should not enter a child's details into the stamp card or the customer list. If you believe a child's information has reached us, tell us and we will delete it.

• Free tools: clear your browser data, or use the "Clear all figures" control in Settings. That is the only copy there has ever been.
• Your AI key: remove it in Settings, or clear your browser data.
• Platform account: ask us and we will delete your account and its records. Cached public YouTube data expires on its own within 30 days.

To request deletion, or to ask what we hold, email hello@kanjin.app. You can also revoke our access to your Google account at any time through Google security settings.

This site sets no cookies. The public pages (the homepage, the tools, the blog, the sign-in pages) use Vercel Web Analytics, which counts page views and four named events (a calculator used, its link to the back office pressed, a sign-up started, a sign-up finished) without cookies and without identifying you or following you to other sites. It is not loaded on the kiosk, on a customer’s card, inside an embedded calculator or in the back office.

We never attach analytics to the figures you type into a calculator: knowing that somebody used the break-even page is reasonable; transmitting their rent is not. The back office asks you once whether it may send us usage counts (five event names, a count each: first stamp, poster printed, a day’s sales logged, kiosk opened, first email sent). It is off unless you say yes, it never sends a figure, a name, a phone number or an email, and the server refuses anything else. You can change your answer in Settings.

Everything travels over an encrypted connection, and platform access needs your password. But the free tools trade some safety for privacy, and you should know which: data in your browser is not encrypted at rest. Anyone who can use that device can read what is in it.

On a shared counter tablet holding a customer list, that matters. Use a device lock, and do not leave the back office open on a screen the public can reach.

If this policy changes in a way that affects what we hold, the date at the top changes and material changes are noted here. Questions go to hello@kanjin.app. See also our terms of service.