法律 · hōritsu
What data of yours is stored, what for, and how to ask for it to be deleted.
| Item | Value |
|---|---|
| Owner | Jordi Salord Font |
| Tax ID (NIF) | 41744039M |
| Address | Terrassa 08221 (Barcelona), Spain |
| Contact email | konnichiwa@hanasuka.com |
| Activity | Web platform for learning Japanese |
No data protection officer has been appointed, because the processing does not fall under any of the cases in Article 37 of Regulation (EU) 2016/679 (GDPR).
| Item | Where it comes from | What for |
|---|---|---|
| Name and email address | From your Google account, if you sign in with it | Greeting you by name and being able to contact you |
| Google identifier (sub) | Recognising your account even if you change your email. It is the real identifier: the email can change, this cannot | |
| Name, email address and Apple identifier (sub) | From your Apple account, if you sign in with it. You can choose not to share your email: Apple then provides an address that forwards messages to you | Greeting you, being able to contact you and recognising your account |
| An access code Apple provides at sign-in | Apple | Asking Apple to withdraw Hanasuka's access to your Apple account when you delete yours |
| Username | You choose it, if you sign in with a password | Identifying you |
| Password | You choose it, if you sign in with a password | Checking that it's you. It is stored as a cryptographic hash and can be neither read nor recovered |
| Study progress | Generated as you use the application: units completed, right and wrong answers per character and per sentence, streak and pending reviews | Saving where you are and what you struggle with |
| Preferences | You: voice, text size and whether you want to see romaji | So that the application behaves the same on all your devices |
| Date and version of the terms accepted | Recorded automatically when the account is created | Being able to prove which text you accepted and when. Without this, "you accepted" could not be demonstrated |
| IP address | Your connection | The server logs and the rate limit on failed sign-in attempts. The rate limit does not store the IP, but a cryptographic hash of it |
| Log of the emails sent to you | Recorded automatically when one is sent to you, such as the sign-up code | Being able to check whether it went out and resend it if needed. The address, the time and whether it went out are stored; never the content of the email nor the code it carried |
| Email address of an unfinished sign-up | You, when you request the code to create an account that doesn't exist yet | So that a mistyped address isn't lost: whoever runs the server can see it, and can correct it and resend you the code, give you one by another channel or delete it. It is deleted when the account is created |
| What you write in the contact form | You: the reason, your name, your email and the message | Reading your enquiry and replying. It arrives as an email in the owner's mailbox and is stored nowhere else; you don't need an account to write |
| IP address from which you write through the contact form | Your connection, when you send the form | Seeing which country and which provider a message was written from, to spot spam and abuse. It goes inside the email that arrives in the owner's mailbox, with a link to look it up in MaxMind's geolocation service, and is deleted along with it |
| Browser data collected by reCAPTCHA | Google, when you use the contact form: your IP address and signals about how you interact with the page. Google collects and processes them, not Hanasuka, which only receives back a score from 0 to 1 | Telling a person from an automated program and preventing the form from being used to send spam |
| Browsing data collected by Google Analytics | Google, only if you accept it in the public website's cookie notice: the website pages you visit, where you arrive from, the type of device and browser, the language, the approximate city and a random identifier stored in a cookie. The IP address is used to work out that city and Google does not store it. Nothing is collected in the application | Finding out how many people visit Hanasuka's website and which pages are read, to decide what to improve. It is looked at as aggregate figures: it is not linked to your account, your name or your email |
| A mark that you are using the application | Recorded automatically while you use it | Showing how many people are studying right now. Only the time and a short reference to your account are stored; neither what you were doing nor from where |
| Notification subscription | Your browser, only if you turn them on: an address of its notification service and two keys to encrypt what is sent to you, together with the application's language and your time zone | Sending you the notifications you've chosen, in your language and at a reasonable hour. One is kept per device, separately from your progress |
No special-category data, precise location or card data is collected; if there were payments, the payment provider would process them. No profiles are built for advertising purposes and no automated decisions with legal effects on you are made.
The speaking exercises use the speech recognition built into your own browser. It's worth knowing how it works: in most browsers (Chrome, Edge and others based on the same engine) that recognition does not happen on your device; instead, the browser sends the audio to its maker's servers and returns the recognised text.
Hanasuka never receives, listens to or stores that audio. It only compares the text the browser returns with the sentence in the exercise, and that comparison happens inside your browser. The processing of the audio is the responsibility of the browser's maker and is governed by its own privacy policy.
The microphone permission is requested and managed by the browser: you can withdraw it whenever you want from its settings. The voice that reads the Japanese sentences is your system's speech synthesis and sends nothing to Hanasuka.
| Purpose | Legal basis |
|---|---|
| Creating your account, giving you access and saving your progress | Performance of the contract of use you accept when signing up (Art. 6(1)(b) GDPR) |
| Handling your enquiries and the exercise of your rights | Performance of the contract and compliance with a legal obligation (Arts. 6(1)(b) and 6(1)(c) GDPR) |
| Keeping the service secure: rate limiting of failed sign-in attempts and server logs | The owner's legitimate interest in protecting accounts against unauthorised access (Art. 6(1)(f) GDPR) |
| Filtering spam from the contact form with reCAPTCHA | The owner's legitimate interest in the only form open to anyone not becoming a channel for bulk sending (Art. 6(1)(f) GDPR) |
| Seeing which country and which provider a contact form message was written from, based on the IP address | The owner's legitimate interest in the only form open to anyone not becoming a channel for bulk sending (Art. 6(1)(f) GDPR) |
| Measuring visits to the public website with Google Analytics | Your consent, which you give in the cookie notice and withdraw whenever you like from «Cookie preferences», at the bottom of every page of the public website (Art. 6(1)(a) GDPR) |
| Checking that the service's emails go out and resending them if they didn't | The owner's legitimate interest in sign-up and notifications working: an email that doesn't go out leaves someone unable to create their account (Art. 6(1)(f) GDPR) |
| Showing how many people are using the application right now | The owner's legitimate interest in showing that the service is alive (Art. 6(1)(f) GDPR) |
| Sending you the notifications you turn on | Your consent, which you give by turning them on in your browser and withdraw whenever you like by turning them off, signing out on that device or removing the browser's permission (Art. 6(1)(a) GDPR) |
| Invoicing and accounting and tax obligations, if you purchase a paid plan | Compliance with a legal obligation (Art. 6(1)(c) GDPR) |
Providing the data requested is necessary to use the service: without an account there is nowhere to save progress, and therefore no service.
| Recipient | Why | Where |
|---|---|---|
| Google Ireland Ltd. / Google LLC | Three different services, none of them mandatory. If you sign in with Google, it is the one that verifies your identity and confirms your name and email. If you write through the contact form, its reCAPTCHA anti-spam receives your IP and how your browser behaves on that page. And if you accept visit measurement on the public website, Google Analytics receives, as a data processor, the website pages you visit and the browser data described above. Outside those three cases —and Chrome's notification service, if you turn them on in that browser, which has its own row—, your browser does not communicate with Google on Hanasuka's behalf | European Union and United States |
| Apple Distribution International Ltd. / Apple Inc. | Only if you sign in with Apple: it verifies your identity and confirms your name and your email, or the forwarding address. If you delete your account, it is asked to withdraw the access | European Union and United States |
| MaxMind, Inc. | Only if you write through the contact form and the owner looks up which country and which provider your message comes from: it receives the IP address and nothing else, not your name, your email or what you write | The United States |
| Your browser's notification service: Google for Chrome and Android, Mozilla for Firefox, Apple for Safari, Microsoft for Edge | Only if you turn on notifications: it is what delivers them to your device. What they say is encrypted with keys that only your browser holds, so that service knows that a notification reaches you and when, but not what it says | Depending on your browser's maker; it may be outside the European Economic Area |
| Hosting provider | Hosts the server where the application and the file with your progress live | European Union / European Economic Area |
| Payment provider | Only if you purchase a plan: it charges and invoices. It processes the card details, never Hanasuka | According to its own policy |
Beyond this, your data is not sold, transferred or shared with anyone, except where legally required. There is no advertising and no cross-site tracking: visit measurement, if you accept it, is not used for ads, and Google signals for advertising are turned off.
The selection translator works entirely inside your browser, with the dictionary built into the application. The text you select is not sent anywhere: if an expression is not in the dictionary, the application tells you it can't translate it rather than asking a third party.
The server where accounts and progress are stored is in the European Economic Area, so there is no international transfer there.
If you sign in with Google, if you write through the contact form —whose anti-spam is Google's— or if you accept visit measurement with Google Analytics, data may be communicated to Google LLC in the United States. That transfer is covered by the European Commission's adequacy decision on the EU-US Data Privacy Framework of 10 July 2023 and, in the alternative, by the standard contractual clauses approved by the Commission.
If you sign in with Apple, data may be disclosed to Apple Inc. in the United States, covered by the same adequacy decision and, alternatively, by the standard contractual clauses approved by the Commission.
If you write through the contact form, the owner may look up your IP address with MaxMind, Inc., in the United States, to see which country and which provider the message comes from. That transfer is covered by the same adequacy decision: MaxMind is certified under the EU-US Data Privacy Framework.
If your browser sends the microphone audio to its maker for recognition, that transfer is made by the browser and is governed by that maker's policy, not by this one.
If you turn on notifications, what is sent to you goes through the notification service of your browser's maker, which may be outside the European Economic Area. It travels end-to-end encrypted and that service cannot read it; what it does see —that a notification reaches your device, and when— it handles under its own policy.
You can exercise at any time the rights granted to you by Articles 15 to 22 of the GDPR:
Two of them need no request: in "Your account", within your avatar menu, you can download all your data in a file (portability) and delete your account and your progress yourself, on the spot and without intermediaries (erasure). What is deleted there cannot be recovered. The only exception is accounts that administer the server: those cannot delete themselves, as they would leave the platform with no one to run it, and the same screen lets them request closure, which is handled by hand within one month.
For the others, or if you prefer to ask in writing, write to konnichiwa@hanasuka.com from your account's email or proving your identity some other way, or use the contact form on the public website choosing the reason "My personal data". It is free and answered within one month, extendable to two if the request is complex, notifying you before the first one expires.
Write through the contact form
If you believe your data is not being processed correctly you can lodge a complaint with the Spanish Data Protection Agency (C/ Jorge Juan 6, 28001 Madrid — www.aepd.es), although we would appreciate you writing to the owner first to try to resolve it.
To open an account you must be at least fourteen years old, in accordance with Article 7 of Spanish Organic Law 3/2018 on the Protection of Personal Data and guarantee of digital rights. Below that age, the consent of the holder of parental authority or guardianship is required. If an account belonging to a child under fourteen is detected without that consent, it will be cancelled and its data deleted.
Technical and organisational measures appropriate to the risk of the processing are applied:
This policy may be updated to reflect changes in the law or in the service itself. The version in force is the one published on this page, with its date at the bottom; substantial changes will be announced within the application.
Last updated: 17 October 2026.
