Cotojikara — Privacy Policy
Version: 2026-08-21
1. Who is responsible for your data
CAZGA global (the "Operator", "we", "us"), a trade name used by a sole proprietorship based in Japan, decides how and why your data is handled in connection with Cotojikara (the "Service"). In data-protection law we are the controller for that data.
Write to info@cazga.com about anything on this page — a question, a request, or a complaint.
Your purchase is separate. The subscription is sold by Link, LLC ("Link"), a Stripe company, as merchant of record. Link decides how it handles the data it collects to sell and bill you, under its own privacy policy. We never see your card number.
2. What we hold, and where it comes from
| What | Where it comes from | What it is used for |
|---|---|---|
| Your name and email address | You, when you create an account (through Clerk) | Signing you in, and writing to you about the Service |
| What you write in a consultation, and the replies | You, as you use the Service | Producing the replies; keeping your consultations readable to you; detecting abuse of the Service |
| Subscription status — a customer reference, a subscription reference, whether it is active, and the country of your billing address | Link / Stripe, when you subscribe or your subscription changes | Letting you in, pausing access when a payment fails, and applying Section 2.1 of the terms (the Service is not offered to people resident in Japan) |
| Usage counts — how many consultations you have started this month, how many exchanges are in each, when each was last active | Generated as you use the Service | Applying the monthly and per-consultation limits, and keeping the Service available to everyone |
| Technical records — sign-in events and device information held by our authentication provider, server logs held by our hosting provider | Generated automatically | Security, and finding faults |
We do not run advertising or analytics trackers, and we do not buy data about you from anyone.
2.1 What is not in our database
The text of your consultations is not stored in the Operator's own database. It is held by the AI platform that runs the Service, and in the encrypted monthly backups described in Section 4. What our database holds about a consultation is a reference to it, a count of exchanges, and timestamps.
3. Why we are allowed to hold it
Where the law of your country asks us to name a legal basis (as the GDPR does), these are ours:
- To perform our contract with you — running the Service, keeping your consultations available, applying the limits you bought, and taking payment through Link.
- Our legitimate interests — keeping the Service secure and free of abuse, and understanding what people need from it so it gets better. We use conversation records for this in the ordinary course; we do not sell them, and we do not use them to train AI models.
- Legal obligations — where record-keeping or tax law requires us to keep something.
Where we rely on legitimate interests, you can object: write to us, and we will stop unless we have grounds that override your objection.
4. Who else handles it
We use other companies to run the Service. Each acts on our instructions, under its own terms, and each holds only what it needs:
| Provider | What it handles |
|---|---|
| Clerk — authentication | Your name, email address, sign-in events, device information |
| Dify — the AI platform running the Service | The text of your consultations. It holds international security certifications (SOC 2 Type II, ISO 27001) and is encrypted at rest |
| Anthropic — the provider of the AI model | Your messages and the replies, as they are generated, under its own terms |
| Supabase — database and file storage | Your account references, subscription status, usage counts, and the encrypted monthly backups of your consultations |
| Upstash — short-lived counters | Rate-limiting and one-session-at-a-time counters, keyed to your account |
| Vercel — hosting | Server logs |
| Link, LLC / Stripe — the sale | Payment and billing data, as merchant of record under its own privacy policy |
5. Your data leaves your country
The Operator is in Japan, and the providers above are in the United States and elsewhere. Your data is processed outside the country you live in.
- The European Commission has decided that Japan provides an adequate level of protection for personal data, so transfers from the EEA to us do not need separate safeguards.
- The providers in Section 4 handle data under their own data-protection terms and transfer mechanisms.
6. How long we keep it
- Consultation records — the ones on the AI platform and the encrypted backups we hold — are deleted one year after your subscription ends. This is a limit we place on ourselves, not a promise that a conversation stays readable for a year: the terms do not guarantee that a conversation can be restored or supplied again, and the Service lets you export and keep your own consultations at any time.
- Account data stays while your account exists. Ask us to delete it and we will.
- What we delete is what we hold. It does not reach internal backups kept by the AI platform, or the inputs and outputs retained by the provider of the AI model under its own terms.
- Where tax or accounting law requires a record to be kept, we keep that record for as long as the law says.
7. What you can ask us to do
Wherever you live, you may ask us to:
- Show you what we hold about you.
- Correct what is wrong.
- Delete it.
- Give you a copy you can take elsewhere — for consultations, the Service does this for you at any time, as a printable page or a file.
- Stop a particular use, or restrict it while a question is being settled.
Write to info@cazga.com. We will answer within one month. If we cannot do what you asked, we will tell you why.
If you are in the EEA or the UK, you may also complain to your national data-protection authority. If you are in Japan, you may contact the Personal Information Protection Commission.
8. Cookies
The Service sets the cookies needed to keep you signed in and to protect the sign-in process. These come from our authentication provider and cannot be turned off while you use the Service. There are no advertising or analytics cookies.
9. Children
The Service is for people old enough to enter a binding contract where they live. It is not intended for children, and we do not knowingly hold their data.
10. Security
Consultations are encrypted at rest on the AI platform. The backups we hold are encrypted by us before they are stored, with a key held outside that storage. Access to the Operator's systems is limited to the Operator.
No system is beyond reach. If a breach affects your data and the law requires it, we will tell you and the relevant authority.
11. Changes to this policy
We may change this policy. If we do, we will show you the new version and ask you to agree to it, together with the terms. Until you agree, we may stop providing the Service.
12. How to reach us
info@cazga.com — questions, requests under Section 7, and complaints.