Privacy Policy

Last Updated March 12, 2026

We at Kotoba Technologies, Inc. (“Kotoba,” “we,” “us,” or “our”) have created this privacy policy (this “Privacy Policy”) because we understand that you care about how your information is collected, used, and shared. This Privacy Policy describes how we collect and use personal information in connection with our website located at https://www.kotoba.tech, our mobile application, and the related voice translation services, features, and functionality made available through them (collectively, the "Services"), and when you otherwise interact with us.

This Privacy Policy is incorporated by reference into our Terms of Service, available at Terms of Service. By accessing or using the Services, you acknowledge that you have read and understand this Privacy Policy.

If you are a resident of California, you may have additional rights described in Sections V and VI below.

We collect the following information about you, either because you provide it to us, it is necessary to provide our services, or because it helps us improve and secure the Website. We do not use audio data to identify individuals or authenticate users. However, we may process and store voice-derived data associated with your account solely to generate translated speech in your voice.




We disclose your personal information with the following categories of third parties for the purposes described below. If you are a California resident, please visit Appendix I for a more detailed breakdown of how we disclose and share your information. We do not sell personal information for monetary compensation.


Personal information collected through the Services may be transferred to, stored, and processed in Japan, where our cloud infrastructure is located, and may be accessed by our Japanese affiliate for purposes of service delivery, customer support, and, for individual paid and free users, model training. By using the Services, you consent to such transfers.



This section summarizes certain privacy rights that may apply to residents of California and other U.S. states that have enacted comprehensive privacy laws. Additional disclosures specific to California residents, as required by the California Consumer Privacy Act (“CCPA”), as amended by the California Privacy Rights Act (“CPRA”), are provided in Section VI below.

Depending on your state of residence and subject to applicable law, you may have certain rights regarding our collection, use, disclosure, and sharing of your personal information. To request to exercise such rights, contact us as set forth in Section IX. Please be aware that these rights may be subject to limitations and exceptions and may vary based on your jurisdiction. 

Subject to applicable law, these rights may include:

Appeals Process. If we deny your privacy rights request in whole or in part, we will inform you of the reasons for our decision. You may appeal that decision by contacting us as set forth in Section IX with "Appeal" in the subject line. Please include a description of the request that was denied and the basis for your appeal. We will respond to your appeal within the timeframe required by applicable law (generally 45 to 60 days, depending on your jurisdiction). If your appeal is denied, we will provide information on how to contact your state Attorney General or other applicable regulatory authority, where required by law.

Response Timeframes. We will respond to verifiable consumer requests within the timeframes required by applicable law. For California residents, we will confirm receipt of your request within 10 business days and provide a substantive response within 45 calendar days of receipt. If we require additional time, we will notify you of the extension and the reasons for it. In no event will we take longer than 90 calendar days to respond to a request. Response timeframes may vary for residents of other states in accordance with applicable law.


We do not knowingly collect personal information from children under 13. If you are under 13, do not provide us with personal information. Parents and guardians should monitor their children’s online activity and instruct them not to share personal information without permission. If you believe a child under 13 has provided us with personal information, please contact us as described in Section IX so we can delete it. We do not have actual knowledge of selling or sharing personal information of consumers under 16. If we become aware that we have collected or shared such information, we will promptly delete it.


Data Category

Retention Period

Additional Notes

Account & Contact Information

Duration of account + 6 months after deletion

Longer if required for tax, accounting, legal, or dispute-resolution obligations

Commercial Information (subscription status, purchase history)

Duration of account + 6 months after deletion

Longer if required for tax, accounting, legal, or dispute-resolution obligations

Communications Data

Duration of account + 6 months after deletion

Longer if required for tax, accounting, legal, or dispute-resolution obligations

Internet/Network Activity (log data, IP addresses)

Up to 24 months from collection

Shorter if required by law; longer if reasonably necessary for security, fraud prevention, or legal compliance

Audio Data (Enterprise Users)

Limited period as reasonably necessary to provide Services

Not used for model training; retained only for service delivery, security, troubleshooting, or legal compliance

Audio Data (Non-Enterprise Users)

Up to 12 months from last interaction with Services

If you have not opted out of model training: Used for model training to improve translation accuracy; [prior to use for model training, we de-identify the data by removing or transforming personal identifiers, including user ID, device ID, precise geolocation, and timestamps;] data remains linked to your account during retention to honor deletion requests and apply quality controls; identifiable data deleted after retention period.

If you have opted out of model training: Data collected after opt-out is not used for model training and is retained only as reasonably necessary to provide Services (same as enterprise users).

De-Identified/

Aggregated Data

Indefinitely

Not reasonably capable of being linked to you. We publicly commit to maintain and use   de-identified Data in de-identified form and not to attempt to reidentify such data, except to test and improve our de-identification processes. We require recipients of de-identified data to agree by contract to the same restrictions.




If you have questions or comments about this Privacy Policy, or would like to request to exercise any applicable rights described herein, please contact us:


Verification and Authorized Agents. Kotoba will verify requests by asking you to provide information sufficient to confirm your identity and match our records. To designate an authorized agent to submit a request on your behalf, you must provide written permission, verify your identity directly with us, or provide the authorized agent with a valid power of attorney, as permitted by applicable law.


Appendix I – Additional Information for California Residents

The table below reflects the categories of personal information collected and processed in the past 12 months and whether the information is disclosed for business purposes or “shared” for cross-context behavioral advertising under the CCPA/CPRA. 

Category of Personal Information

Examples 

Disclosed for Business Purpose?

Shared for Cross-Context Behavioral Advertising?

A. Identifiers

Name, email address, account ID/username, IP address, device ID, RevenueCat ID, AppsFlyer ID, third-party login identifiers (Google/Apple)

Yes — service providers for hosting, infrastructure, analytics (Apple Analytics, AppsFlyer, RevenueCat), authentication, subscription management, customer support, security monitoring, and payment processors

Yes — with advertising partners such as Google Ads, Apple Search Ads and Meta Platforms, Inc., and others  via cookies and similar technologies; opt-out available as described in Sections IV and V

B. Commercial Information

Subscription status, purchase history, transaction confirmations from third-party payment processors (no direct payment card processing)

Yes — payment processors and service providers supporting subscriptions, analytics, customer support, financial administration

No

C. Internet or Network Activity

Log and usage data, IP address, browser/device type, referring URLs, timestamps, interaction data, cookies and similar technologies

Yes — hosting providers, analytics providers (Firebase, Apple Analytics, AppsFlyer, RevenueCat), security and fraud prevention vendors

Yes — with advertising partners such as Google Ads, Apple Search Ads and Meta Platforms, and others via cookies and similar technologies; opt-out available as described in Sections IV and V 

D. Audio, Electronic, or Similar Information

Audio recordings, raw audio input, transcripts, translated outputs

Yes — cloud infrastructure and service providers processing audio solely to provide the Services

No

E. Sensitive Personal Information

Sensitive information incidentally included in voluntarily submitted audio recording

Yes — cloud infrastructure and service providers processing audio solely to provide the Services

No

F. Communications Data

Customer support inquiries, service requests, correspondence

Yes — service providers supporting communications, ticketing, operational support

No