PRIVACY POLICYプライバシーポリシー

Draft of 1 November 2026

This policy explains what personal data kaitotoba.com collects, why, who receives it and what your rights are. It follows Japan's Act on the Protection of Personal Information (APPI) and, for visitors and buyers in the EU and the UK, the GDPR and UK GDPR.

1. Who is responsible

Kaito Racing LLC, Fukuoka, Japan, represented by Kaito Toba (representative member) (the "controller"). The full address is disclosed without delay upon request. Privacy questions: hello@kaitotoba.com. [[EU representative under GDPR Art. 27, if needed: name + address. See open questions.]]

2. The short version

The site has no user accounts and no advertising. We collect what is needed to deliver your order, answer your messages and run the Lights Out ranking, and, only if you accept analytics cookies, usage statistics through Google Analytics. We never sell your data.

3. What we collect and why

Shop orders. Name, email, delivery address, phone number if the carrier needs it, the items ordered and the order total. Used to take payment, prepare and ship your order, send the confirmation and tracking, handle misprints or returns and keep the accounting records required by law. Card details go straight to the payment provider; we receive only the payment result (and e.g. the card brand and last four digits). Legal basis (GDPR): performance of the contract; legal obligation for tax and accounting records.

Messages. If you email us (order support is by email only, at hello@kaitotoba.com), your name, contact details and message, used only to reply and help. If you message Kaito's Moto Crew account on LINE, LINE's own privacy policy also applies; orders are not handled there. Basis: our legitimate interest in answering you, or the contract if it is about an order.

Lights Out game. The nickname you choose and your best time, shown publicly in the ranking (do not use your real name if you prefer not to). To keep the ranking fair, a random device cookie (kt_dev) links a nickname to the device that first used it, and a scrambled (keyed hash) form of your IP address is used for a few minutes to stop automated flooding; it is deleted within one hour and never linked to your nickname. Basis: providing the game you choose to play, and our legitimate interest in a fair ranking.

Server logs. Like every website, our hosting provider records technical access logs (IP address, time, page, browser) for security and to fix errors. They are kept for a short time by the host and not used to profile you. Basis: legitimate interest in a secure site.

Website statistics (Google Analytics). Only if you press Accept in the cookie banner, we use Google Analytics 4, a service of Google LLC (for visitors in the EEA and the UK: Google Ireland Limited). It tells us which pages are visited, how visitors found the site (referring site, campaign), device type, browser, screen size, language and approximate location (country or city, derived from the IP address, which Google Analytics 4 does not store), and what happens on the site: products viewed or added to the cart, checkouts started and orders completed (order reference, items and amount; never your name, address, email or card), Lights Out games started and finished, and taps on the LINE, Japan store and language buttons. Google sets cookies (_ga, _ga_*) holding a random ID, kept up to 13 months. Google signals, advertising features and ad personalisation are switched off, and the data is not used for advertising. Until you accept, your browser sends nothing to Google (we host the fonts ourselves). Basis: your consent (GDPR Art. 6(1)(a)), which you can withdraw at any time (section 4).

4. Cookies and storage in your browser

Strictly necessary (no consent needed). The kt_dev cookie, only when you play Lights Out: a random code, no personal data, kept up to 2 years, needed for the ranking to work. Your browser's own storage (localStorage) keeps your language, your cart and currency, your Lights Out best time and nickname, and your cookie choice (kt-consent, 12 months); this stays on your device and is not sent to us until you submit a score or an order. On the payment page, Stripe may set its own cookies for security and fraud prevention.

Analytics (only with your consent). Google Analytics cookies (_ga, _ga_*), up to 13 months. See section 3.

Changing your mind. Use Cookie settings at the bottom of every page to accept or withdraw your consent at any time; withdrawing is as easy as accepting. If you reject or withdraw, Google Analytics stops and we delete its cookies on this site; this does not affect what was collected before. We ask again after 12 months. Deleting your browser data also removes all of the above.

5. Who receives your data

Only service providers that work for us under contract and use it for no other purpose: the payment provider (Stripe), our order fulfilment partners and the carriers that deliver your parcel, our web hosting and email provider, and Google (website statistics, only if you accepted analytics cookies). We may also give data to authorities when the law requires it. We do not sell or rent personal data, and we do not share it for advertising.

6. Data outside your country

We are a Japanese company, so your data is handled in Japan. Our providers process it in the following places: website and email hosting in Italy (EU); order fulfilment and shipping in the EU, the United States and other countries depending on your address; payments in the United States, Ireland and Japan; website statistics (Google) in the United States and other countries, under the EU-US Data Privacy Framework and standard contractual clauses. The EU and Japan recognise each other's data protection as adequate. For other transfers our providers use safeguards such as the European Commission's standard contractual clauses, and under the APPI they maintain systems that meet the standards set by Japan's Personal Information Protection Commission. You can ask us for details of these safeguards and of the data protection laws of those countries.

7. How long we keep it

Order and accounting records: 7 years, as required by Japanese tax law. Messages: up to 2 years after the last contact. Game ranking: as long as the ranking runs, or until you ask us to remove your nickname. Rate-limit data: under one hour. Google Analytics data: 14 months, then deleted automatically; analytics cookies in your browser: up to 13 months, or until you withdraw consent.

8. Security

The site uses HTTPS. Order files and the ranking are stored in a folder on the server that cannot be reached from the web; access is limited to the people who run the shop, with individual sign-in. Keys for the payment and order services are stored only on the server, never in the website pages. Our staff and providers are bound to confidentiality. [[Name the person in charge of data security (APPI 安全管理措置) if you want it shown.]]

9. Your rights

You can ask to see the data we hold about you, to correct it, to delete it (for example a nickname), to stop or restrict its use, or to receive it in a portable format. Under the APPI you can also ask us to disclose records of data provided to third parties. If you are in the EU or the UK you may also object to processing based on legitimate interest and complain to your data protection authority; in Japan, to the Personal Information Protection Commission. Email hello@kaitotoba.com; we may need to check that the request comes from you and answer within one month. There is no charge.

10. Children

The shop is for adults or with a parent's permission. If you are under 16, ask a parent before entering a nickname in the game; parents can ask us to remove one at any time.

11. Changes

If we change how we use personal data, we update this page and the date at the top.