Privacy Policy — Kaji Studio

Kaji Studio operates this website. For everything described here we are the data controller, meaning we decide what is collected and why. Our full identification and contact address are at the bottom of this page.

This policy covers the kaji.studio website and nothing else. The Kaji Meals app has a policy of its own, because an app that holds an account and your content has almost nothing in common with a website that holds neither, and a single document covering both made everyone read the half that did not apply to them.

If you want to exercise any of the rights described below, or you simply want to know what we hold about you, use the privacy contact address at the bottom of this page. It goes to a separate inbox from general mail so that a request cannot get lost behind a pile of feature suggestions. We answer within one month, which is the deadline the GDPR sets us.

This website is a set of static pages. There is nothing to sign into, no database behind it, and nothing to fill in but a contact form that hands your message to your own mail client.

• We do not sell or rent personal data, and we never have.
• The site sets no cookies. There is no consent banner because there is nothing to ask you about.
• We do not use advertising networks, and nothing here follows you to another website.
• The site is hosted in the European Union.

The site sets no cookies and keeps nothing on your device. The only measurement is Vercel Web Analytics, which counts visits without cookies by deriving a daily-rotating value from your IP address, browser user agent and the page path. We never receive your raw IP address, we cannot recognise you on a return visit, and we cannot follow you elsewhere. The basis is our legitimate interest in knowing whether the site works (Article 6(1)(f) GDPR).

Our hosting provider, Vercel, also keeps short-lived server logs that necessarily include IP addresses, as any web server does. These exist to keep the site up and to investigate abuse, and they are deleted on Vercel's own schedule.

The Cookie Policy covers this in more detail, including what would have to change before the site needed a consent banner.

The contact form on this site has no server behind it. What you type stays in your browser: pressing send opens a draft in your own mail client, addressed to us, carrying your name, your email address and your message. If you close that draft instead of sending it, nothing ever reaches us. Writing to our address directly does the same thing without the form.

Once you do send it we have an ordinary email from you, and we use it to answer you. It goes on no mailing list and into no profile. The form asks you to agree to that before it opens the draft; beyond your agreement we have our own interest in replying to people who write to us, and, where your message is about becoming a customer, steps taken at your request before a contract (Article 6(1)(a), (f) and (b) GDPR). Either way, you can tell us to delete the correspondence at any time.

We keep the correspondence for as long as answering you and having a record of what was said requires, and delete it by hand when neither is true any more. A mailbox runs no cleanup job of its own, and we would rather say that than imply an automation that is not there.

We use as few providers as the site can run on. They act on our instructions under a data processing agreement, and none of them may use your data for their own purposes.

Mail you send us is held in our mailbox, and the provider that runs it processes that mail for us. Kaji Meals relies on several further providers — Supabase, Resend, RevenueCat and the two app stores — which are listed in the app's own policy, because nothing on this website touches them.

Server logs

Short-lived, on our hosting provider's schedule.

Analytics

Counts of visits and page paths, and nothing that could be traced back to you. There is no record of your visit to delete.

Mail you send us

Kept while answering you or keeping a record of the exchange requires it, then deleted by hand.

Under the GDPR you can ask us for a copy of what we hold about you, ask us to correct it, ask us to delete it, ask us to restrict or stop a particular use, and ask for your data in a portable form. You can also object to any processing we base on legitimate interest, and we will stop unless we have a compelling reason not to.

Write to the privacy contact address at the bottom of this page. The same address covers the Kaji Meals app — tell us which of the two your request is about, or ask about both, and we will answer for both.

If you think we have handled your data badly, we would rather hear it from you first, but you have every right to complain to a supervisory authority instead. In Portugal that is the Comissão Nacional de Proteção de Dados (CNPD); if you live elsewhere in the EU, you may complain to your own country's authority.

When we change what this website collects, we change this page in the same release, and the date at the top moves. A change that materially affects you — a new processor, a new purpose, a longer retention period — is described here rather than mentioned in passing somewhere you would have to go looking for it.