1. Introduction
KyotoTech LLC (合同会社KyotoTech) ("Company," "we," "us," or "our") is committed to protecting your privacy and handling your personal information responsibly.
This Privacy Policy explains how we collect, use, disclose, and protect personal information in connection with our website (kyototech.co.jp), software products (including SaQura and KisoStats), and services.
KisoStats — No Data Collection
KisoStats is a macOS menu bar system monitor and disk cleanup utility. KisoStats does not collect, transmit, store, or process any personal data whatsoever. The application runs locally on your Mac. It contains no analytics or telemetry and requires no user account. The only connection it makes is the update check to kyototech.co.jp, which transmits no personal data beyond what any web request carries (IP address, app version). System metrics (CPU, RAM, SSD, network speed) are read from macOS system APIs, displayed in real-time, and are not stored or logged.
Legal Framework
As a Japanese company serving international customers, we comply with:
- APPI - Japan's Act on the Protection of Personal Information (個人情報保護法)
- GDPR - EU General Data Protection Regulation (for EU/EEA residents)
- Other applicable data protection laws in your jurisdiction
In case of conflict between this Policy and applicable law, the applicable law shall prevail.
2. Data Controller Information
Data Controller
KyotoTech LLC (合同会社KyotoTech)
〒612-8083 京都市伏見区京町2丁目237-202
Kyoto, Japan
Email: support@kyototech.co.jp
EU Representative (Article 27 GDPR)
KyotoTech LLC is established outside the European Union. Where we offer services to, or monitor the behaviour of, individuals located in the European Union, we have designated a representative in the Union pursuant to Article 27 GDPR. Data subjects in the EU/EEA may contact our representative on all matters relating to the processing of their personal data and the exercise of their rights under the GDPR — in addition to, or instead of, contacting us directly:
DataRep (Data Protection Representative Limited, trading as DataRep)
Altmarkt 10 B/D, 3rd & 4th floor, 01067 Dresden, Germany
Email: datarequest@datarep.com (please mark the subject with “KyotoTech; SaQura”)
Online form: www.datarep.com/data-request
DataRep maintains contact points across the EU/EEA; please always address postal inquiries to “DataRep” so they reach us.
Data Protection Inquiries
For questions about this Privacy Policy or our data practices, please contact:
3. Personal Information We Collect
Information You Provide Directly
| Data Category |
Data Elements |
Purpose |
Legal Basis (GDPR) |
| Contact Information |
Name, Email, Phone (optional), Message |
Respond to inquiries |
Legitimate interest / Consent |
| License Information |
Email address |
License delivery |
Contract performance |
| Account Information |
Email, License Key |
License management |
Contract performance |
| Expert interviews (by invitation only) |
Your answers, name, role and organization as you choose to state them, your email address, optional photo, consent choices, record of your approval of the final text |
Prepare and publish the interview you approved; send you the confirmation of your approval and the link once the interview is online |
Consent (Art. 6(1)(a)); approval record and its confirmation by email: legitimate interest (Art. 6(1)(f)) |
Information Collected Automatically
| Data Category |
Data Elements |
Purpose |
Legal Basis (GDPR) |
| License Activation Data |
License Key, Hardware ID (hashed), Machine Name (encrypted), OS/Platform, Timestamp, IP address, Browser type (User-Agent) |
License validation, prevent abuse |
Contract performance |
| Administrative Audit Trail |
Action performed, Timestamp, IP address, Browser type (User-Agent), affected record |
Security audit trail for administrative actions, dispute resolution |
Legitimate interest |
| Web Server Logs |
IP address, Browser type (User-Agent), Requested address, Access times |
Security — automatic detection and blocking of abusive requests — and troubleshooting |
Legitimate interest — deleted after 14 days |
Information We Do NOT Collect
We explicitly DO NOT collect:
- Your encryption keys or passwords created with our Software
- Content of files you encrypt
- Usage patterns or telemetry from the Software
- Precise geolocation data
- Biometric data
- Data from children under 16
- Sensitive personal data (racial/ethnic origin, political opinions, religious beliefs, health data, sexual orientation)
4. How We Use Your Information
Purposes of Processing
| Purpose |
Categories of Data |
Legal Basis (GDPR) |
APPI Basis |
| Respond to inquiries |
Contact information |
Legitimate interest |
Specified purpose |
| Deliver licenses |
Email, License Key |
Contract performance |
Contract fulfillment |
| Validate licenses |
Activation data |
Contract performance |
Service provision |
| Prevent license abuse |
Hardware ID (hashed) |
Legitimate interest |
Fraud prevention |
| Provide technical support |
Contact info, License data |
Contract performance |
Customer service |
| Improve services |
Aggregated analytics |
Legitimate interest |
Service improvement |
| Legal compliance |
Various |
Legal obligation |
Legal requirement |
| Prepare and publish expert interviews |
Interview answers, details you provide, email address, optional photo, approval record |
Consent; for the approval record legitimate interest in documenting what was approved |
Consent |
What We Do NOT Do
- No Selling: We DO NOT sell, rent, or trade your personal information to third parties for marketing purposes.
- No Profiling: We DO NOT use your personal information for automated decision-making or profiling that produces legal effects.
- No Marketing: We DO NOT send unsolicited marketing emails unless you have explicitly opted in.
5. Data Sharing & Disclosure
Service Providers
We share personal information with the following categories of service providers:
| Provider Category |
Purpose |
Data Shared |
Location |
Safeguards |
| Payment Processor (Stripe) |
Payment processing |
Email (for receipts) |
USA |
Standard Contractual Clauses |
| Email Delivery (Google Workspace) |
Sending transactional emails |
Email address, message content |
USA |
Standard Contractual Clauses |
| Hosting Provider |
Website/API hosting |
All data processed |
Japan |
APPI compliance |
WhatsApp Link
Our contact section links to WhatsApp (WhatsApp Ireland Limited, Ireland). The link does not load any content from WhatsApp. Only when you click it and message or call us there does WhatsApp process your data (including phone number, profile details and connection data) under its own responsibility; data may also be transferred to the USA. We process your message to handle your request (Art. 6(1)(b)/(f) GDPR). The WhatsApp Privacy Policy applies.
Legal Disclosures
We may disclose personal information when required by law, including:
- Court orders or legal process
- Requests from law enforcement agencies
- Protection of our legal rights
- Investigation of fraud or security incidents
- Protection of the rights, property, or safety of our users or the public
Business Transfers
In the event of a merger, acquisition, or sale of assets, personal information may be transferred to the acquiring entity. We will notify you of any such change.
No Other Sharing
We do not share personal information with third parties except as described in this Policy.
6. International Data Transfers
Primary Storage
Personal information is primarily stored on servers located in Japan.
Cross-Border Transfers
When we transfer personal information outside Japan, we ensure adequate protection through the following mechanisms:
| Destination |
Mechanism |
Safeguards |
| EU/EEA and United Kingdom |
Designation by Japan's Personal Information Protection Commission (APPI Article 28) |
The Commission has designated the EU/EEA and the United Kingdom as having a personal information protection system equivalent to Japan's |
| USA (Stripe) |
Standard Contractual Clauses (SCCs) |
Contractual data protection obligations |
| Other countries |
Case-by-case assessment |
Appropriate safeguards per APPI |
Data Coming to Us from the EU/EEA and the United Kingdom
When personal data from the EU/EEA reaches our servers in Japan, the transfer relies on the European Commission's adequacy decision for Japan (Article 45 GDPR, Implementing Decision (EU) 2019/419). For the United Kingdom, the corresponding UK adequacy regulations for Japan apply.
Your Consent
For transfers to countries without adequate data protection, we will obtain your explicit consent where required by APPI or GDPR.
7. Data Retention
Retention Periods
| Data Category |
Retention Period |
Basis |
| Contact form submissions |
2 years after last contact |
Business necessity |
| License activation data |
Duration of license + 1 year |
Contract fulfillment |
| Payment records |
7 years |
Japanese tax law requirements |
| Support tickets |
2 years after resolution |
Customer service |
| Web server logs (incl. IP address) |
14 days |
Security / troubleshooting |
| System and security logs (login attempts, blocked requests, incl. IP address) |
4 weeks |
Security / abuse prevention |
| Administrative and licensing audit trail (incl. IP address) |
12 months |
Security audit trail / dispute resolution |
| Expert interviews |
Until you withdraw consent. Material that is not or no longer published is deleted 12 months after the last activity, including after the interview has been taken offline. After any withdrawal or deletion we keep only a record without any content (date, reference number and checksums of the approved text and of your details) |
Consent; for the remaining record legitimate interest in documenting approvals (Art. 6(1)(f)) |
Deletion
After the retention period expires, personal information is securely deleted or anonymized.
8. Data Security
Technical Measures
We implement appropriate technical security measures, including:
- Encryption of data in transit (TLS 1.3)
- Encryption of sensitive data at rest
- Secure password hashing for authentication
- Regular security updates and patches
- Access controls and authentication requirements
- Network security measures (firewalls, intrusion detection)
Organizational Measures
- Limited access to personal information on a need-to-know basis
- Employee training on data protection
- Incident response procedures
- Regular security assessments
No Guarantee
While we implement reasonable security measures, no method of transmission or storage is 100% secure. We cannot guarantee absolute security of your data.
Breach Notification
In the event of a data breach that affects your personal information, we will notify you and the relevant authorities as required by applicable law (APPI, GDPR).
9. Your Rights
Rights Under APPI (Japan)
Under Japan's Act on the Protection of Personal Information, you have the following rights:
| Right |
Description |
| Access (開示請求) |
Request disclosure of your personal information |
| Correction (訂正請求) |
Request correction of inaccurate information |
| Deletion (削除請求) |
Request deletion of your personal information |
| Suspension of Use (利用停止請求) |
Request cessation of use of your information |
| Third-Party Disclosure |
Request information about third-party disclosures |
Additional Rights Under GDPR (EU/EEA Residents)
If you are located in the EU/EEA, you additionally have the right to:
| Right |
Description |
| Data Portability |
Receive your data in a structured, machine-readable format |
| Restriction of Processing |
Request limitation of processing in certain circumstances |
| Object to Processing |
Object to processing based on legitimate interests |
| Withdraw Consent |
Withdraw consent at any time (where processing is based on consent) |
| Lodge a Complaint |
File a complaint with a supervisory authority |
How to Exercise Your Rights
To exercise any of these rights, please contact us at:
Response Time
- APPI: Without delay, and in any case within 2 weeks
- GDPR: Within 1 month (extendable by 2 months for complex requests)
Verification
We may require verification of your identity before processing requests.
No Fee
We will not charge a fee for reasonable requests, except as permitted by law for manifestly unfounded or excessive requests.
10. Cookies & Tracking
Cookies We Use
This website sets no cookies. Your language and display theme are remembered in your browser's local storage. They stay on your device and are not sent to us.
What We Do NOT Use
- Third-party advertising cookies
- Cross-site tracking
- Social media tracking pixels
- Fingerprinting technologies
Analytics
We measure reach with two systems. Both run on infrastructure we operate ourselves; neither involves an external analytics provider.
- Umami — a self-hosted, cookieless analytics tool on our server in Germany, active across this website. It records aggregated, non-identifying information only: page visited, hostname, referrer, approximate country derived from the IP address, browser, operating system, device class, screen size and language. No cookies are set and IP addresses are not stored persistently.
- In-house page measurement — a small script on selected pages that sends the page path, referrer, screen size, browser language and time zone offset to our own API at
main.kyototech.co.jp. Your IP address is truncated on our server before it is stored: the last block is removed, so only a coarse network range such as 203.0.113.xxx is kept, never the full address. From that truncated range we derive a pseudonym that changes every day, which lets us count repeat page views within one day without recognising you on a later day. No cookies, no user account.
Download counter: when you download a file from a product page, the page sends the product name and the file name to our own API so that we can count downloads. It uses no cookies and no user account.
Neither system:
- Uses cookies
- Tracks individual users across websites
- Collects data that identifies you personally, or builds a profile of you
- Shares data with third parties
Legal basis: Art. 6(1)(f) GDPR — legitimate interest in understanding how our website is used, balanced against the minimal, non-identifying data collected.
11. Newsletter (Discontinued)
We discontinued our newsletter on September 29, 2026. Subscription is no longer offered on this website, and no further newsletters will be sent.
The newsletter data has been removed from our live systems: the email addresses of all subscribers, the associated confirmation and consent records, the delivery log, and the anonymous open and click statistics. Remaining backup copies are being deleted. We no longer use any of this data.
If you have questions about this, please contact support@kyototech.co.jp.
12. Third-Party Services
Payment Processing (Stripe)
We use Stripe for payment processing. When you make a purchase:
- Your payment information is processed directly by Stripe
- We do not receive or store your credit card information
- Stripe is PCI DSS compliant
- Stripe's privacy policy applies: stripe.com/privacy
Email Delivery (Google Workspace / Gmail SMTP)
Transactional emails are delivered via Google Workspace (Gmail SMTP), operated by Google LLC (United States):
- Recipient email address and message content are processed by Google for delivery
- International transfer is covered by the EU Standard Contractual Clauses
- Google's privacy policy applies: policies.google.com/privacy
NuGet Package Distribution
Our Software is distributed via NuGet (nuget.org):
- NuGet's privacy policy applies to package downloads
- We do not receive personal information from NuGet downloads
Links to External Sites
Our website may contain links to external sites. We are not responsible for the privacy practices of other sites. We encourage you to read their privacy policies.
13. Children's Privacy
Age Restriction
Our services are not directed to individuals under 16 years of age. We do not knowingly collect personal information from children under 16.
Parental Notice
If we become aware that we have collected personal information from a child under 16, we will take steps to delete such information promptly.
Contact Us
If you believe we have collected information from a child under 16, please contact us immediately at support@kyototech.co.jp.
14. Changes to This Policy
Right to Update
We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements.
Notification
We will notify you of material changes by:
- Posting the updated Policy on our website
- Updating the "Effective Date" at the top
- For significant changes, sending email notification to affected users
Review
We encourage you to review this Policy periodically.
15. Contact Us
Privacy Inquiries
For any questions, concerns, or requests regarding this Privacy Policy or our data practices:
Postal Address
KyotoTech LLC (合同会社KyotoTech)
〒612-8083 京都市伏見区京町2丁目237-202
Kyoto, Japan
Supervisory Authorities
Japan (APPI):
Personal Information Protection Commission (個人情報保護委員会)
www.ppc.go.jp
EU/EEA (GDPR):
You have the right to lodge a complaint with a supervisory authority in your country of residence.
Version History
| Version |
Date |
Changes |
| 4.3 | October 15, 2026 | Added expert interviews (by invitation only): data collected, purpose, consent as the legal basis, the approval record, retention of 12 months for unpublished material and the content-free record kept after withdrawal. Section 6 now names the basis for data coming to us from the EU/EEA and the United Kingdom (adequacy decision (EU) 2019/419 and UK adequacy regulations). |
| 4.1 | October 4, 2026 | KyotoTech Vault is no longer offered on this website; its sections were removed. Updated the KisoStats section (update check), added Loki Radar, and corrected the overview of browser storage and the list of recipients, and described the download counter. |
| 4.0 | September 29, 2026 | Newsletter discontinued. Subscription is no longer offered, and all newsletter data (subscriber email addresses, consent records, delivery log and anonymous open and click statistics) was removed from our live systems; remaining backup copies are being deleted. Section 11 now documents the discontinuation; the Gmail SMTP entry in section 12 now covers transactional emails only. |
| 3.9 | July 31, 2026 | Replaced the generic "Security logs — 1 year" retention entry, which did not match reality in either direction, with accurate entries: system and security logs are kept for 4 weeks, and the administrative and licensing audit trail for 12 months. Disclosed the administrative audit trail as a separate category of automatically collected data, and completed the license activation entry, which had omitted the IP address and browser type that are in fact recorded. |
| 3.8 | July 30, 2026 | Corrected and completed the description of our logs and page measurement. Web server logs are now described accurately: they contain the full IP address, are used to detect and block abusive requests, and are deleted after 14 days — the previous entry described them as anonymized, which was not correct. Added a matching retention entry. For the in-house page measurement, we now state explicitly that the IP address is truncated on our server before storage and never stored in full, and that the pseudonym derived from it changes daily. |
| 3.7 | July 28, 2026 | Named the analytics tools used on this website: Umami (self-hosted, cookieless, server in Germany), now active across the site, alongside the existing in-house page measurement on selected pages. Listed the categories of data each records and stated the legal basis (Art. 6(1)(f) GDPR). |
| 3.6 | June 18, 2026 | Published the appointed EU representative under Art. 27 GDPR: DataRep (Data Protection Representative Limited), Dresden, Germany, replacing the prior placeholder. |
| 3.5 | June 15, 2026 | Clarified the named newsletter consent regimes as EU/EEA (GDPR), Switzerland (revDSG) and Japan (APPI); the UK is no longer listed as a separately targeted regime, as we do not target or expect subscribers in the United Kingdom. Subscribers outside the named regions continue to receive the conservative double opt-in default. |
| 3.4 | April 18, 2026 | Added newsletter analytics: anonymous open-pixel and click-redirect aggregation (slug, country from GeoIP, language, device class, timestamp). No subscriber identifier, no cookies, no IP storage. Retention 24 months. Legal basis Art. 6(1)(f) legitimate interest. |
| 3.3 | April 18, 2026 | Newsletter consent process is now region-dependent: double opt-in for EU/EEA/UK/CH and German-language signups, single opt-in for Japanese IP addresses (APPI). Documented derived country, language and consent_method as audit data; clarified that the IP address itself is not stored. |
| 3.2 | April 16, 2026 | Added newsletter subscription processing: double opt-in, data collected, Google Workspace SMTP delivery, retention, withdrawal rights |
| 3.1 | March 17, 2026 | Added KisoStats: explicit no-data-collection statement for macOS system monitor utility |
| 3.0 | March 13, 2026 | Added KyotoTech Vault: file storage, collaboration spaces, guest access, audit logging, virus scanning, uploaded content liability disclaimer |
| 2.0 | December 31, 2025 | Major update: Added GDPR/APPI compliance details, international transfers, data retention, expanded rights |
| 1.0 | January 2025 | Initial release |