Privacy Notice
Last updated: July 16, 2026
BBDF Consulting LTD ("we", "us") operates LevelKana (the "Service"). This notice explains what personal data we collect, how we use it, and your rights. We act as the data controller for personal data processed through the Service.
Data Controller
The data controller responsible for your personal data is:
- Name: BBDF Consulting LTD
- Contact: [email protected]
Data Protection Officer
For any question, request, or complaint regarding the processing of your personal data, you can contact our Data Protection Officer:
- Name: Federico Blancato
- Email: [email protected]
Data we collect
- Account data: email address, password hash, display name, and account preferences.
- Learning data: lessons started, items reviewed, scores, streaks, and other progress signals required to deliver the Service.
- Billing data: plan, subscription status, and transaction identifiers. Payment card details are handled directly by our payment processor (Stripe); we do not store full card numbers.
- Technical data: IP address, browser/device type, and basic event logs needed for security and reliability.
- Consent-based measurement data: when you grant analytics or advertising measurement consent, Google may process the page location and title, campaign and ad-click identifiers, cookie or online identifiers, browser/device information, and registration events. LevelKana filters page query parameters before explicitly sending events and does not intentionally include email addresses or form contents in these events.
- Marketing preferences: if you opt in, we record your consent to receive marketing emails so we can honour and audit it.
- Browser-local WaniKani integration data: if you use the public WaniKani readiness checker, your API token and a local cache of your WaniKani user ID, username, level, and passed subjects’ spellings, accepted readings, and meanings are stored in your browser. The token and item-level progress are sent directly from your browser to WaniKani and are not received or stored by LevelKana.
Purposes and legal bases
We process your personal data for the following purposes:
- Service delivery: to provide the Service, create and maintain your account, and personalise your learning path (legal basis: contract).
- Contact and support: to respond to your enquiries, support requests, and feedback sent to us by email or via in-app forms (legal basis: contract / legitimate interests).
- Service communications: to send essential transactional emails such as registration confirmation, password resets, billing receipts, and security alerts (legal basis: contract).
- Newsletter and marketing: to send the LevelKana newsletter and promotional messages about new content, features, and offers, only if you have explicitly opted in (legal basis: consent). You can withdraw consent at any time via the unsubscribe link in every message or by contacting the DPO.
- Billing and fraud prevention: to process payments through Stripe and detect fraudulent transactions (legal basis: contract / legitimate interests).
- Security and reliability: to keep the Service secure, prevent abuse, and diagnose technical issues (legal basis: legitimate interests).
- Analytics and advertising measurement: to understand how the Service is used and whether ads lead to visits and registrations, only when you grant the corresponding cookie consent. We do not use this consent to personalize ads (legal basis: consent).
- Legal compliance: to comply with applicable laws (e.g. tax, accounting) and to establish, exercise, or defend legal claims (legal basis: legal obligation / legitimate interests).
Sharing
We share data only with service providers who help us run LevelKana, including:
- Stripe — payment processing and tax calculation (Stripe Tax);
- Email provider — transactional and (if opted in) marketing email delivery;
- Cloud hosting providers — infrastructure and reliability.
- Google Analytics and Google Ads — analytics and advertising measurement when you grant the corresponding consent.
When you choose to use the WaniKani readiness checker, your browser connects directly to WaniKani using the token you provide. That request is governed by WaniKani's own terms and privacy practices; the token does not pass through LevelKana's servers.
We do not sell your personal data. Some of these providers may process data outside your country, including under standard contractual clauses or equivalent safeguards.
Cookies
We use a small number of cookies for authentication and preferences. With your consent, we also use separate analytics and advertising measurement cookies. Advertising measurement is used to understand whether ads lead to visits and registrations, not to personalize ads. You can manage each optional purpose through the cookie banner and through your browser settings.
The WaniKani readiness checker uses browser local storage, at your request, to remember the API token and cached comparison data. You can remove both at any time with the checker's “Forget data” button or through your browser settings.
Retention
We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including legal, accounting, or reporting requirements. Specific retention periods are:
| Data category | Retention period |
|---|---|
| Account and learning data | For the lifetime of your account; deleted or anonymised within 90 days of account closure. |
| Contact and support correspondence | Up to 24 months from the last interaction. |
| Newsletter subscription data | Until you withdraw consent or unsubscribe; consent records kept for 24 months thereafter for auditing. |
| Billing and tax records | 10 years from the date of the transaction, as required by applicable tax law. |
| Technical and security logs | Up to 12 months, unless needed longer to investigate an incident. |
| Google Analytics event-level measurement data | 2 months under our current Google Analytics retention setting; aggregated reports and conversion records may be retained longer under Google's service settings and policies. |
| Cookie preferences | Up to 12 months from your last choice, after which we ask again. |
| Browser-local WaniKani integration data | Until you choose “Forget data” or clear the site's local storage in your browser. |
Your rights
Subject to applicable law, you have the right to:
- access a copy of your personal data;
- correct inaccurate data;
- delete your data ("right to erasure");
- object to or restrict certain processing;
- port your data to another service;
- withdraw optional cookie or marketing consent at any time;
- lodge a complaint with your local data protection authority (in the UK, the ICO).
To exercise these rights, email [email protected].
Children
The Service is not directed to children under 13 (or the minimum age of digital consent in your jurisdiction). We do not knowingly collect personal data from children below that age.
Changes
We may update this notice from time to time. Material changes will be communicated via email or in-app notice.
Contact
Data Controller: BBDF Consulting LTD · [email protected]
Data Protection Officer: Federico Blancato · [email protected]