Privacy Policy

1. Who I am

Hi, I am Anna. I run Kanni in Japan, the self-guided Japan itinerary you found at www.kanniinjapan.com. It is a one-person project, so when this policy says "I", it really is just me.

The legal side belongs to my company. For data protection law, Vibe Labs s.r.o. is the data controller for everything described here: it decides what gets collected and why, and it is who you complain to if you are not happy about it.

Company

Vibe Labs s.r.o.

Registered office

Čs. armády 369/7, Bubeneč, 160 00 Praha 6, Czechia

Business ID (IČO)

23452617

Privacy questions

hi@kanniinjapan.com

2. What I collect

What you hand me

• •Your email address. The only field on the signup form, and the only thing I need to buy the guide, because that is where I send it. Nothing else is asked for.
• •Anything you email me. If you write to me, I keep the thread so I can reply and remember the conversation.

What gets collected automatically

• •Usage data. Which pages you look at, how you got here, roughly where you are (city level, worked out from your IP address), your device and browser, and when you visited.
• •Campaign tags. If you arrive from an ad or a link I shared, the link carries tags such as utm_source, fbclid or gclid. I store those in your browser for up to 30 days so that if you sign up later, I can tell which link brought you.
• •Your IP address and browser identifier at signup. Sent along with the signup so the ad platforms can match the conversion, and so I can spot bot signups.

What I do not collect

No card numbers, no passport details, no passwords, no precise GPS location, and nothing about your health, beliefs, or anything else the law treats as sensitive. Please do not send me any of that.

3. Why I use it, and my legal basis

If you are in the UK or the EEA, the law says I need a legal basis for every use. Here they are, in a table, because that is genuinely the clearest way to put it.

I will not use your data for something new and unrelated without telling you first, and asking again where the law needs me to.

4. Payments and Stripe

When the guide goes on sale, payments run through Stripe, a payment processor used by millions of businesses and certified to the highest card industry security standard (PCI DSS Level 1).

Your card details never touch my site or my servers. You type them into Stripe's own secure checkout, Stripe processes the payment, and I never see the full number.

What Stripe passes back to me is:

• •Your name and email address
• •Your billing country, and postcode where Stripe collects one
• •The amount, the currency, and the date
• •The card brand and the last four digits, so we can both identify the payment if something goes wrong
• •Whether the payment succeeded, failed, or was refunded

I use that to deliver the guide, send your receipt, handle refunds and support, and keep the tax records I am required to keep.

Stripe also uses your data for its own purposes, mainly fraud prevention and meeting its own legal duties, which makes Stripe an independent controller for that part. Their privacy policy covers what they do, and it is worth a read. Stripe sets its own cookies during checkout to spot fraudulent payments.

If you buy the guide, I will add your email to the buyer list so I can send you your copy, any corrections, and updated editions. That is part of the product, not marketing. If you would rather not hear from me beyond the delivery email, say so and I will note it.

5. Cookies and tracking

Cookies are small files a site stores in your browser. Here is what this site uses, honestly and in full.

• •Attribution cookie (kij_attr). Mine, first-party, lasts 30 days. Remembers which link or ad you arrived through so a later signup gets credited correctly.
• •Google Analytics 4 (_ga and friends). Loaded through Google Tag Manager. Tells me how many people visit and which pages they read. Typically lasts up to 2 years.
• •Meta Pixel (_fbp, _fbc). Tells me whether an Instagram or Facebook ad actually led to a signup, and lets Meta show my ads to people like you. Typically lasts up to 90 days.
• •Server-side measurement. When you sign up, my server also sends the same conversion event to my tag container at ssst.kanniinjapan.com, which passes it to Google and Meta. Your email is scrambled with a one-way hash before it leaves my server, so those platforms can match it without ever reading it.
• •Stripe. Sets its own cookies on the checkout page to detect fraud.
• •Vercel Web Analytics. Counts page views without cookies and without following you between sites.

Turning them off

Everybody gets asked. The banner has "No thanks" sitting right next to "That's fine", the same size and the same colour, because a refusal should be no harder than an agreement, and you can open it up and pick the two categories separately.

What differs is what happens while you decide. If you are visiting from the UK, the EEA or Switzerland, nothing loads until you say yes, and the banner stays until you answer. Everywhere else the analytics and advertising cookies start on arrival, which the law there allows, and you can close the banner to leave things as they are. Either way the off switch is always available:

• •Use the cookie settings link, here or in the footer of any page. Your choice is remembered in your browser, and refusing also deletes whatever those tools already set.
• •Turn on Global Privacy Control in your browser or extension. If your browser sends that signal, I treat it as a refusal automatically and never ask you again.
• •Block or delete cookies in your browser settings. Nothing on this site breaks if you do.
• •Install Google's Analytics opt-out add-on.
• •Adjust your Meta ad preferences, or opt out at Your Online Choices.
• •Email me and I will delete everything I hold on you and take you out of any advertising audience.

6. Who else sees your data

I run this on other people's tools, so those tools handle your data on my behalf. Each one is contractually bound to use it only for what I ask.

I may also share data with an accountant or a lawyer if I need professional advice, or with the authorities if the law genuinely requires it. If I ever sell or hand over the business, your data would move with it, and I would tell you before that happened.

I have never sold personal data and I never will. No list rentals, no data brokers, no swapping addresses with anyone.

7. Where your data goes

Vibe Labs s.r.o. is based in the Czech Republic, so your data starts inside the EU. Most of the companies above are based in the United States, though, so it will also be processed there. Where data leaves the UK or the EEA, I rely on the safeguards built into those providers' terms, normally the European Commission's Standard Contractual Clauses with the UK Addendum, or the provider's certification under the EU-US Data Privacy Framework. You can ask me for details of the safeguard covering a specific provider.

8. How long I keep it

• •Your email address: until you unsubscribe or ask me to delete them. After that I remove you from the list, though Beehiiv keeps a minimal suppression record so you are not accidentally added back.
• •Purchase and tax records: as long as tax law requires, which is normally six to seven years from the sale. I cannot delete these early, even if you ask.
• •Analytics data: Google Analytics deletes user-level data after 14 months. Meta and Stripe run their own retention schedules, set out in their policies.
• •Emails you send me: up to three years, so I can pick up an old conversation where we left it.

9. Your rights

Wherever you live, you can email me and ask for any of the following. If you are in the UK or the EEA these are legal rights under the GDPR, and I will honour them for everyone anyway.

• •See it. Ask for a copy of everything I hold about you.
• •Fix it. Tell me to correct anything wrong.
• •Delete it. Ask me to erase it, apart from records I am legally required to keep.
• •Take it with you. Get your data in a portable file, or have me send it to someone else.
• •Object, or ask me to pause. Tell me to stop using it for a given purpose, or to restrict how I use it while we sort something out.
• •Withdraw consent. Unsubscribe from any email, or email me. Doing so does not undo anything I did lawfully before you asked.

Email hi@kanniinjapan.com and I will reply within one month, which is the deadline the GDPR sets. If your request is complicated I can extend that by up to two further months, and I will tell you if that happens. It is free, and I will not make you jump through hoops. I may ask you to confirm you are really you, because handing your data to the wrong person would be worse.

There is no automated decision-making or profiling here that has any legal effect on you. The only sorting that happens is which travel emails I think you will find useful.

If you think I have handled your data badly, please tell me first so I can fix it. You also have the right to complain to a data protection authority without going through me at all.

Mine is the Czech Office for Personal Data Protection, Úřad pro ochranu osobních údajů: uoou.gov.cz, postmaster@uoou.cz. You can equally go to the authority where you live: the ICO in the UK, or your national authority anywhere in the EEA.

10. If you are in California

Under the CCPA and CPRA you can ask me what personal information I have collected about you, where it came from, why I collected it and who I disclosed it to. You can ask me to delete it or correct it, and you can opt out of the "sharing" of personal information for cross-context behavioural advertising.

I do not sell your personal information and I never have. Using the Meta and Google advertising tags described above may count as "sharing" under California law, so there are three ways to stop it: open cookie settings and switch advertising off, turn on Global Privacy Control in your browser, which I honour automatically, or email me and I will remove you from any advertising audience by hand. I will not treat you any differently for exercising these rights, because there is nothing to treat differently about.

You can make a request through an authorised agent, and you can make one twice in any twelve month period at no cost. Same address: hi@kanniinjapan.com.

11. How I protect it

The site runs over HTTPS, so everything between your browser and my server is encrypted. API keys live in my host's encrypted environment settings and never in the site's code. Your email goes through my own server rather than straight to the email provider, so no keys are ever exposed to your browser. The accounts holding your data are protected with strong, unique passwords and two-factor authentication.

No system is perfect, and I will not pretend otherwise. If there is ever a breach that puts you at risk, I will tell you and the relevant regulator without delay, as the law requires.

12. Children

This site and the guide are for adults. I do not knowingly collect data from anyone under 16. If you are a parent and think your child has signed up, email me and I will delete it.

13. Changes to this policy

The guide is still being built, so this policy will change as things do. The date at the top always shows the current version. If a change actually matters to you, such as a new purpose or a new company handling your data, I will email the list rather than quietly editing this page.

14. How to reach me

Privacy questions, data requests, or a note telling me this page is too long, all go to the same place:

I read every one of these myself, usually within a day or two.