Privacy Policy
Privacy Policy
Who we are
Zaiketz (“we”) provides customer-service and process automation for small and medium businesses. This policy explains how we handle the personal data collected on this website, in line with Brazil’s LGPD (Law 13.709/2018) and Japan’s Act on the Protection of Personal Information (APPI).
What we collect
From the diagnostic form, what you type: your name, a contact (WhatsApp or email), and optionally your business name and a message describing what you want to automate.
Sent along with it, without you typing it: which page of the site you were on and the language it was shown in — that is what tells us what your request is about. And at the moment you submit,your IP address is used to limit how many submissions arrive from one place in a short window, which is how a public form defends itself against bots; it is used for that check and is not stored alongside your message.
If you write to us by email, at the address we publish ([email protected]), we receive your email address, what you write and the date and time you sent it, including anything attached. That is how email works; we say so here because the address is public and you can write to us without ever using the form. We use it to reply, and for nothing else. The mailbox is hosted by Zoho, which operates email for our domain.
If you message us on WhatsApp, at the number we publish on our legal pages (+81 70-6951-9201), we receive your number, what you write and the time you sent it. That is simply how a message works; we say it here because the number is public and you can write to it without ever going near the form. We use it to reply, and for nothing else. The conversation itself sits in WhatsApp, operated by Meta, under Meta’s terms.
We don’t ask for sensitive data, and we don’t use tracking cookies.
Why we process it
To respond to your diagnostic request, schedule the call, and contact you. The legal basis is your consent and pre-contractual steps taken at your request.
Where the data lives
Form submissions are processed by a serverless function (Cloudflare Workers) and stored in our database. This is business contact data — separate from the operational data of clients who hire our automation, which runs on infrastructure controlled by you or the provider you choose, in the region you choose (Brazil, Japan, or Europe).
Visitor analytics
We use two analytics tools:Cloudflare Web Analytics and Umami, which we host ourselves at analytics.zaiketz.com, on our own server in the United States.
What we see are added-up counts — how many visits, on which page, from which country, arriving from which site. We do not use those numbers to identify you, and neither tool writes a cookie in your browser. We picked these two tools precisely because they are built to measure without cookies and without following you from site to site; that part is a property of their products, not a check we can run inside your browser on your behalf.
The only cookies you may receive from this site are security ones, and they are not ours. Cloudflare, which protects this site, may write a cookie (cf_clearance) when a visit looks automated, so it does not have to challenge you again. It does not say who you are and it does not follow you off this site. If you open the payment window, that window is Paddle's and writes Paddle's cookies, on Paddle's domain, in order to process the purchase. Your theme (light/dark) and the currency you picked are kept in your own browser only, and never reach us.
Sharing
We don’t sell your data, we don’t hand it to advertisers, and we don’t build profiles. Who is involved, and why:
- Cloudflare — serves this site and runs the code that receives the form.
- Our database provider — where your message is stored.
- Google Fonts — this page’s typefaces load from Google’s servers, which means your IP reaches Google whenever you open any page of ours. That is true even if you never submit the form, so it is stated here rather than left out.
- Our email provider — if you write to the address below instead of using the form, your message passes through it.
One more case, which does not happen yet and is declared before it does: we intend to forward form submissions into our own support tooling so we can reply faster — and if that path uses WhatsApp, the message would pass through Meta. That forwarding is switched off today. When it is switched on, this page will say so, with the same “last updated” date at the top.
Providers may change over time; when they do, this page is updated.
Retention
We keep your data for as long as needed to handle your request and meet legal obligations. You can request deletion at any time.
Product emails
At checkout, Paddle shows an optional box for Zaiketz product news and offers by email. It arrives unticked: leave it alone and you never get marketing email from us — only the emails your subscription requires (receipt, billing, service notices), which do not depend on that box and cannot be switched off while the subscription exists.
If you tick it, we keep your address and the fact that you agreed. You can change your mind at any time, by either of two routes that count equally: the unsubscribe link in the footer of any of those emails, or one line to[email protected]. Withdrawing consent affects neither your subscription nor anything you have already received.
We do not sell, rent or swap your details with anyone, and we do not use open pixels or link rewriting to track clicks in these emails.
Your rights
You may request access, correction, portability, anonymization, or deletion of your data, and withdraw consent. To exercise these rights, email [email protected] — it is the channel we read first. Our contact form and WhatsApp (+81 70-6951-9201) work too. We reply within 2 business days.
Changes
We may update this policy. The “last updated” date above reflects the current version.
Zaiketz — appointment reminders and confirmations
Zaiketz is the service Zaiketz operates so that salons, clinics and independent professionals can send appointment reminders and review requests to their own customers.
Who is responsible for what
The business that hires Zaiketz decides to send the messages and is the controller of its customers' data. Zaiketz acts as the processor: we handle that data only to carry out what the business asked for, never for purposes of our own. Messages are sent from the business's own WhatsApp Business account.
What we process
Only what is needed to remind someone of an appointment: the name as it appears in the business's calendar, the phone number in international format, the date, time and service of the appointment, the delivery state of each message (sent, delivered, read, failed) and, if the person replies, the rating from 1 to 5 they gave.
When the business publishes a commitment policy (how much notice they ask for to cancel), we also keep the record that the policy was shownto the person — the exact version they saw, and the date and time they confirmed the appointment. It is what makes it possible to say afterwards what was on the screen that day. We keep nothing else about the confirmation.
What we do not keep
Message content is not stored. We keep a cryptographic digest (SHA-256) used to avoid processing the same notification twice, and the text cannot be recovered from it. We do not ask for or store payment details, identity documents, addresses or any sensitive data. We do not use the business's customer data to train artificial-intelligence systems.
Where the data lives
Today, on servers in Japan. That is where we intend to keep it. If we ever need to change region or provider, our aim is to give the business reasonable advance notice and to preserve an equivalent level of protection. Delivering the message itself necessarily passes through the providers named above.
Isolation between businesses
Each business sees only its own data. The system is built so that an access that does not identify the business fails rather than returning someone else's.
Who we share with
With whoever must deliver the message: Meta (WhatsApp Cloud API), through the business's own account, and — when the business chooses that channel — the SMS carrier.
And with the business itself, in a way worth stating: when someone reschedules or cancels through the link, the alert the business gets on their phone carries that person's name — that is how they know which slot reopened. It is the same name already in their own diary, and nobody outside receives that alert.
We do not sell data, do not release it for advertising, and do not build profiles. Providers may change over time; when they do, this page is updated.
Confirmation links
A reminder may carry a link for the person to confirm, reschedule, cancel or rate, with no account and no password. That link is a random code, stored by us only as a digest, valid for that one appointment and time-limited. It reveals nothing beyond the business's name and the appointment time the message already carried.
How long we keep it
Delivery records are routinely retained for an estimated period of up to 400 days, so a business can compare a month against the same month a year earlier. Expired confirmation codes are purged periodically. If a business ends its contract, its customers' data is deleted following a reasonable grace period and the operational cleanup schedule.
How to stop receiving messages
Simply reply to the message asking to stop. The system processes the opt-out for subsequent messages to that number.
Deletion and data-subject requests
Anyone may request deletion of their own data, through the business or directly from us — through our contact form or on WhatsApp at +81 70-6951-9201. Requests handled directly by us are processed within a reasonable operational timeframe. The request is recorded so that the erasure preference is reapplied following any backup-restoration procedure.
Changes to this policy
We may update this policy — for example, when adding a delivery channel or changing provider. The “last updated” date at the top marks the current version, and material changes are ordinarily communicated to the business, so it can inform its own customers.
Governing law and jurisdiction
This policy is governed by Japan's Act on the Protection of Personal Information (APPI) and, where applicable to data subjects in Brazil, by the LGPD (Law 13.709/2018). The parties choose the Kyoto District Court (京都地方裁判所), Japan, as the venue for disputes between Zaiketz and the contracting business arising from this service. This does not affect any right the applicable law gives the business's own customer, as a data subject, to sue where they reside over the handling of their own data.