Privacy Policy

Sanban processes the group information you enter (member names, expense amounts, payment details), an anonymous identifier automatically assigned at first visit, access logs (IP address, user agent, etc.), and user settings stored in your browser's cookies and localStorage (language, cookie-consent state, recently opened groups, and the master copy of your own payment details).

We use this information solely to (1) provide the service, (2) respond to incidents and protect security, and (3) improve the service through statistical analysis.

Sanban does not sell user data to third parties.

We rely on a cloud infrastructure provider based in Japan, together with analytics and error-tracking providers based in the United States. For personal data originating in the EU/UK, transfers are covered by Standard Contractual Clauses (SCCs) or equivalent safeguards entered into by each provider.

Data sent to these providers is treated as processing entrusted to a service provider (processor) and is not a "sale" of data within the meaning of Section 2 above.

In addition to the above, cookies and localStorage used for analytics and error tracking fire only after you select "Accept" in the cookie consent banner. You can change your choice at any time from the in-site settings.

Each group has a retention period chosen by the user; once that period elapses, the group is no longer accessible. Payment details (transfer URLs, account information, etc.) are published as short-lived snapshots and become unreadable after expiry.

You may request access, correction, or deletion through the contact address below.

The data controller (within the meaning of GDPR Art. 4(7) and UK GDPR) is the individual developer who operates the Service. Contact: [email protected].

We process personal data on the following legal bases: (a) performance of the contract for providing the Service and the features described in this policy (GDPR Art. 6(1)(b)); (b) our legitimate interests in handling incidents, ensuring security, and improving the Service through statistical analysis (GDPR Art. 6(1)(f)); (c) your consent for analytics and error-tracking cookies / localStorage (GDPR Art. 6(1)(a) and ePrivacy Directive Art. 5(3)).

Depending on your jurisdiction, you have the following rights: (1) access to the personal data we process about you; (2) rectification of inaccurate data; (3) erasure ("right to be forgotten"); (4) restriction of processing; (5) data portability in a machine-readable format; (6) objection to processing based on legitimate interests. We do not engage in automated decision-making, including profiling, that produces legal effects on you.

You may withdraw cookie consent at any time from the in-site settings; withdrawal does not affect the lawfulness of processing carried out before withdrawal.

For California residents (CCPA / CPRA): we do not sell or share your personal information (Right to Opt-Out of Sale/Sharing). You may also exercise your Right to Know, Right to Delete, and Right to Correct by contacting [email protected].

To exercise these rights, or for any complaint regarding our processing, please contact [email protected] first. You also have the right to lodge a complaint with the supervisory authority in your jurisdiction (for example, your national EU data protection authority, the UK Information Commissioner's Office, the California Attorney General, or the Personal Information Protection Commission of Japan).

For privacy inquiries, please contact [email protected].

This policy may be amended without prior notice. The "Last updated" date at the top of this page will be revised, and material changes will be announced on the site.