Privacy Policy

1. Introduction

Sanagi (“we”, “us”, “our”) is operated by Shuhei Yamamoto, sole proprietor, based in Japan, under the service name “Sanagi”. This Privacy Policy describes how we collect, use, and protect your personal information when you visit our website at https://sanagi.app or join our alpha waitlist.

This policy currently covers our waitlist phase only. When Sanagi launches its alpha AI companion service, this policy will be updated to cover additional data processing activities.

2. Information We Collect

We collect the following information when you join our waitlist:

• Email address (required) — to contact you when alpha access opens.
• Optional free-text response— your answer to “Why are you interested?” if you choose to provide one.
• A/B test assignment metadata — the variant you were shown (variant_assigned) and the month of the test (test_month), used to correlate signup context with LP variants.
• Referrer and UTM parameters — the referrer URL and utm_source / utm_medium / utm_campaign query parameters (if present), to understand how you found Sanagi.
• User agent string and submission timestamp — captured server-side for basic troubleshooting.

Note on IP addresses: IP addresses and network-layer metadata are processed by our hosting provider (Vercel) at the CDN/edge level to deliver the site. They are not stored in Sanagi’s own database at the waitlist stage.

We do not collect names, payment information, government identifiers, or any AI conversation data at the waitlist stage.

3. How We Use Your Information

We use your information solely for the following purposes:

• Alpha invitation delivery — to email you when alpha access becomes available.
• Development feedback collection — to understand interest, themes, and concerns expressed in free-text responses; this informs product design decisions.
• Operational metrics — aggregate, non-identifying analytics on signup volume and trends.

We do not sell, rent, or share your information with advertisers or unrelated third parties.

4. Legal Basis for Processing

We process your personal information based on your explicit consent (GDPR Article 6(1)(a)), given when you submit the waitlist form. You may withdraw your consent at any time by contacting us (see Section 13). Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

For California residents, we process your information based on the consent and contractual necessity bases under CCPA/CPRA.

For Japanese residents, we comply with the Act on the Protection of Personal Information (APPI).

5. Data Sharing & Sub-processors

We use the following third-party services to operate Sanagi. These sub-processors process your data on our behalf, under their respective data processing agreements:

All sub-processors are bound by their own privacy policies and data protection agreements. We will update this list and notify waitlist subscribers when sub-processors change.

6. Data Retention

We retain your waitlist data for 180 days after alpha invitation has been delivered to you, unless:

• You request earlier deletion (see Section 7), or
• We are required by law to retain data longer.

After the retention period, your data is deleted from our active systems. Backups containing your data are overwritten on a rolling basis within 30 days.

If you do not receive an alpha invitation (e.g., you join the waitlist but alpha access is not extended to you), your data is retained until alpha launch is concluded, then deleted within 180 days following the conclusion announcement.

7. Your Rights

Depending on your jurisdiction, you have the following rights regarding your personal information:

• Right to access — request a copy of the data we hold about you.
• Right to rectification — correct inaccurate or incomplete data.
• Right to erasure(“right to be forgotten”) — request deletion of your data.
• Right to data portability — receive your data in a machine-readable format.
• Right to object / restrict processing — limit how we use your data.
• Right to withdraw consent — at any time, without affecting prior lawful processing.

To exercise any of these rights, contact us at sanagiapp.team@gmail.com. We will respond within 30 days (GDPR Article 12). At the waitlist stage, these requests are handled manually by the operator.

8. International Data Transfers

Our sub-processors are primarily located in the United States. If you are accessing Sanagi from the European Economic Area (EEA), the United Kingdom, or Switzerland, your data will be transferred to the United States.

We rely on the following transfer mechanisms (GDPR Articles 44–49):

• Standard Contractual Clauses (SCCs) with our US-based sub-processors.
• Adequacy decisions, where applicable.

By submitting your information, you consent to this international transfer.

9. Children's Privacy

Sanagi is not directed to individuals under the age of 13. We do not knowingly collect personal information from children under 13. If you become aware that a child has provided us with personal information, please contact us, and we will delete such information promptly.

For users in the European Union, the minimum age for consent is 16 (GDPR Article 8), or as locally set by member state law (between 13 and 16). Users below this threshold require parental consent.

10. AI Companion Services Notice

Sanagi is currently in pre-launch / waitlist phase. No AI companion service is active yet.

When Sanagi launches its alpha AI companion features, this Privacy Policy will be expanded to cover:

• AI disclosure requirements under California SB 243, New York AI Companion Models Law, and EU AI Act Article 50.
• Conversation data handling — once alpha launches, Sanagi will use a BYOK (Bring Your Own Key) architecture: your Anthropic API key will remain with you, and we will not retain or process conversation content on our servers. Not applicable during the current waitlist phase — no AI conversations occur.
• Crisis resource referral procedures for safety-related disclosures.
• Age verification requirements as required by applicable jurisdictions.

We will notify all waitlist subscribers of the updated policy at least 30 days before alpha launch.

11. Security

We implement reasonable technical and organizational measures to protect your information:

• HTTPS encryption for all data in transit.
• Sub-processors with industry-standard security — Vercel and Supabase are SOC 2 Type II certified.
• BYOK architecture (when AI features launch) — your Anthropic API key will be held by you, not by us. We will be structurally unable to access your AI conversation content. This is Privacy by Design (GDPR Article 25). Not applicable during the current waitlist phase — no AI conversations occur.
• Access controls — only the operator (Shuhei Yamamoto) has access to waitlist data via authenticated dashboards.

In the event of a personal data breach likely to result in risk to your rights and freedoms, we will notify affected users without undue delay, and in any case within 72 hours of becoming aware (GDPR Article 33), via the email address you provided.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will:

• Update the “Last Updated” date at the top of this policy.
• Notify waitlist subscribers via email at least 30 days before the change takes effect.
• Post a notice on our website at https://sanagi.app.

Your continued participation in Sanagi after the change takes effect indicates your acceptance of the updated policy. If you do not agree, you may request deletion of your data (see Section 7).

13. Contact Us

For any questions, concerns, or requests regarding this Privacy Policy or your personal data:

• Email: sanagiapp.team@gmail.com
• Operator: Shuhei Yamamoto, sole proprietor, operating under the name “Sanagi”
• Jurisdiction: Japan