SUIKEI / LEGAL
Privacy Policy
Last updated: 28 August 2026
Verdo Lab ("we", "us") sets out below how we handle personal data in the iOS and Android app "SUIKEI" and its related website (together, the "Service"). 日本語
1. Who we are
- Trading name: Verdo Lab
- Address: Wind Ebisu Bldg. 8F, 2-4-8 Ebisu-nishi, Shibuya-ku, Tokyo 150-0021, Japan
- Contact: contact@verdolab.com (English and Japanese)
We are the controller of personal data processed through the Service for the purposes of the EU General Data Protection Regulation (GDPR) and the UK GDPR. The name of the individual operating Verdo Lab will be provided on request without undue delay.
2. What we collect
- Account data: an anonymous user identifier issued automatically per device. The app does not ask you to create an account and does not collect your email address or any other registration details.
- Content you create: tanks, livestock, equipment, water parameters, care logs, photos, notes, reminders and in-app settings.
- Purchase data: plan type, purchase state and expiry date. We never receive card numbers or other payment credentials.
- Billing identifier: an anonymous app user ID used to manage your subscription state.
- Data requiring device permission: photo library and camera (when you choose or take a photo), notifications (if you enable reminders).
- Usage data: a record of actions such as opening the app, viewing each onboarding screen, starting, completing or abandoning tank setup, opening the subscription screen and completing a purchase, together with your device model, OS version, app version, language setting and time zone. We do not send the names of your tanks or livestock, your notes, your photos or anything else you type in.
The Service does not collect location data, contacts or advertising identifiers. We do not collect crash reports, and we never use your data for advertising or for tracking you across other companies’ apps and websites.
3. Why we process it, and our legal bases
If you are in the European Economic Area (EEA) or the United Kingdom, the legal basis for each purpose is set out below.
| Purpose | Legal basis |
|---|---|
| Anonymous authentication, so your records stay tied to you | Performance of a contract (GDPR Art. 6(1)(b)) |
| Storing, syncing and backing up your records, and sending reminders | Performance of a contract (Art. 6(1)(b)) |
| Checking and managing your subscription | Performance of a contract (Art. 6(1)(b)) |
| Using your photo library, camera and notifications | Consent (Art. 6(1)(a)). You can withdraw it at any time in your device settings |
| Responding to enquiries and sending important service notices | Performance of a contract (Art. 6(1)(b)) and legitimate interests (Art. 6(1)(f)) |
| Investigating faults you report, improving quality and developing features | Legitimate interests (Art. 6(1)(f)) — to provide a service that works reliably |
| Analysing how the app is used, so we can improve it | Legitimate interests (Art. 6(1)(f)) — to find out where people get stuck and fix it |
| Acting on breaches of our terms | Legitimate interests (Art. 6(1)(f)) — to protect the Service and its users |
| Meeting statutory record-keeping obligations | Legal obligation (Art. 6(1)(c)) |
We do not use your data for advertising or for tracking across other companies' apps and websites, and we do not sell or rent it.
4. Processors we use
| Company / service | Purpose and data sent |
|---|---|
| Google LLC Firebase | Authentication, database, photo storage and cloud processing. Account data, your content and photos |
| RevenueCat, Inc. | Subscription management. Purchase data and the anonymous app user ID |
| PostHog, Inc. | Usage analytics. The anonymous user identifier, the record of actions above, and device and app information |
| Cloudflare, Inc. | Website delivery and protection. IP address and similar data incidental to your visit |
We do not disclose personal data to any other third party without your consent, except where required by law.
5. Where your data is held, and international transfers
Content you create is held primarily in Google data centres in the Tokyo region (asia-northeast1). Data may also be processed in the United States and other countries in the course of our processors' operations.
Transfers from the EEA or the UK to Japan rely on the adequacy decisions adopted by the European Commission and by the UK Government in respect of Japan. Transfers to the United States and elsewhere are protected by the European Commission's Standard Contractual Clauses contained in our data processing agreements with Google LLC and RevenueCat, Inc., or by other appropriate safeguards under Art. 46 GDPR. You can request details of these safeguards using the contact address above.
6. Security
We use encryption in transit (TLS), access controls, proper handling of credentials and other technical and organisational measures appropriate to the risk.
7. How long we keep it
- Content you create is kept until you delete it or stop using the Service.
- You can delete individual records, photos and your whole account from within the app.
- When you delete your account, the associated content and photos are removed promptly.
- Deleted data is erased from our servers and backups within 90 days of deletion.
- Purchase records may be retained for as long as statutory record-keeping obligations require.
8. Your rights in the EEA and the UK
If you are in the EEA or the UK you have the following rights under the GDPR and UK GDPR.
- Access (Art. 15) — to obtain a copy of the personal data we hold about you
- Rectification (Art. 16) — to have inaccurate data corrected
- Erasure (Art. 17) — to have your data deleted in certain circumstances
- Restriction (Art. 18) — to have processing restricted in certain circumstances
- Portability (Art. 20) — to receive the data you provided in a structured, machine-readable format and have it transmitted to another controller. You can also export it yourself from within the app
- Objection (Art. 21) — to object to processing based on our legitimate interests
- Withdrawing consent (Art. 7(3)) — to withdraw consent at any time, as easily as it was given. This does not affect the lawfulness of processing carried out beforehand
To exercise any of these, write to contact@verdolab.com. We will normally respond within one month, free of charge.
Complaints to a supervisory authority (Art. 77). If you are not satisfied with how we have handled your request, you have the right to lodge a complaint with the supervisory authority in your country of residence or where the alleged infringement occurred. A list of EEA authorities is available from the European Data Protection Board; in the UK the authority is the Information Commissioner's Office (ICO).
9. Automated decision-making
We do not carry out automated decision-making or profiling that produces legal effects concerning you or similarly significantly affects you.
10. Children
The Service is intended for people aged 18 and over and is not directed at children. We do not knowingly collect personal data from children. If you believe a child's data has been collected, please contact us and we will delete it promptly.
11. Cookies
We use only the cookies and similar technologies necessary to deliver and protect the website. We do not use advertising or behavioural analytics cookies.
12. Changes and contact
We may revise this policy to reflect changes in the law or in the Service. We will announce material changes in the app or on the website. For questions or complaints, write to contact@verdolab.com.