プライバシーポリシー

[Company legal name] ("we", "us") takes your privacy seriously. This policy explains how Kaji (the "Service") collects, processes, uses and protects your personal data, as required by Taiwan's Personal Data Protection Act.

1. Who we are

• Operator: [Company legal name]
• Address: [Registered address, Hong Kong]
• Contact: [support@your-domain]

2. What we collect

3. Why we use it

• To create and manage your account, verify your email and keep sign-in secure;
• To provide pulls, balances, top-ups, buybacks and shipping, and to handle refunds and disputes;
• To prevent fraud, abuse and breaches of the Terms, and to keep our systems secure;
• To answer your questions and send notices about your account and transactions;
• To keep transaction records as the law requires and to respond to lawful requests from authorities;
• With your consent, to tell you about new packs and campaigns.

4. What is shown publicly

The home page's "Recent pulls" shows rare prizes recently won by players. Each entry shows only the first character of your display name, followed by three asterisks (for example "S***"), the card and pack, and when it was pulled; without a display name it shows "A player". We never show your email, your full display name or your account id. You can change your display name in Settings at any time.

5. Who we share it with

Only as needed for the purposes above, with:

• Our payment provider: Stripe (top-up payments, refunds and disputes);
• Couriers: the recipient's name, phone and address when shipping your items;
• Service providers: hosting, database and email providers that process data for us under contract and only on our instructions;
• Authorities: when the law requires it.

We do not sell your personal data.

6. Where it is processed

Our and our providers' servers may be outside Taiwan (for example in Hong Kong, Japan or the United States). We require our providers to protect your data to a standard equivalent to this policy.

7. How long we keep it

• Account data: while your account exists; after deletion, as long as the law or resolving a dispute requires.
• Transaction, top-up and shipping records: as tax, accounting and other laws require (generally at least five years).
• Technical logs: as long as needed for security and troubleshooting, usually no more than a year.

After that we delete the data or make it impossible to link to you.

8. Security

We encrypt data in transit (HTTPS), store passwords as hashes, limit and log staff access, and review our security regularly. No transmission over the internet is completely secure, so please keep your password safe.

9. Your rights

Under the Personal Data Protection Act you may ask us to:

1. tell you what we hold or let you see it;
2. give you a copy;
3. complete or correct it;
4. stop collecting, processing or using it;
5. delete it.

Email [support@your-domain] from your registered address; we will act on your request once we have confirmed it is you. Data we must keep by law, or need to resolve a dispute, may not be deleted at once. If you do not provide data we need, we may be unable to provide some or all of the Service.

10. Cookies

We use essential cookies to keep you signed in and remember your language, and browser storage to remember interface preferences. We do not use third-party advertising cookies. You can block cookies in your browser, but you may then be unable to sign in.

11. Minors

The Service is only for people aged 18 or over. If we find that an account belongs to someone under 18, we will close it and handle their data as the law requires.

12. Changes to this policy

We may change this policy by posting the changes and their effective date on this page; we will tell you of material changes by email or on the site.