Privacy Policy

Last updated: 27 October 2026

Daikou (daikou.online) is a tool for daigou sellers. Today it does one thing: a seller shares a survey by link and respondents answer it online. Daikou is run by an individual based in New Zealand ("we"), who is responsible for your personal information. This policy explains what we collect, why, where it is kept and your rights. Questions go to support@daikou.online.

1. What we collect

If you answer a survey

Your answers. What you choose or type in the survey, when you submitted and last changed it, and which version of the survey you answered.
Name and email (optional). Only if you fill them in.
One cookie, guest_id. A random number whose only purpose is to let the same browser come back to see and change its answers. It is used only on survey pages (under /s/), lasts one year, and page scripts cannot read it (HttpOnly). Our server keeps only a one-way hash of it, never the value itself, and does not use it to follow you across sites.
A draft in your browser. While you type, a draft of your answers is kept in your own browser's local storage (localStorage) so nothing is lost if you close the page. The draft is not sent to us; it is deleted when you submit or discard it, and you can remove it by clearing your browser data.
IP address (in memory only). To stop mass submissions from one network, the server holds the submitter's IP address in memory for up to 24 hours to count submissions. It is never written to the database or to logs.
Technical logs. Our server logs record which page was requested, the result and how long it took. If a request fails, the error log may also record your IP address and the address requested. Logs never contain your answers, name or email.

If you sign in to create surveys

Account details. When you sign in with Google or Apple we receive your name, email address, account identifier and (Google) profile picture link. Once you are signed in, your browser loads that picture directly from Google's servers (lh3.googleusercontent.com), so Google receives that request. If you use Apple's Hide My Email, we receive Apple's relay address. We do not get your Google or Apple password or access to your other Google or Apple data. We also record which seller's invitation you used, and the invitations you create.
Sign-in state. A cookie named session keeps you signed in for up to 30 days. The server keeps only its hash and when it was created, expires and was last used.
What you create. Every version of your survey text, its share link and the responses it receives.
Name shown on a survey (optional). If you turn it on for a survey, we store the nickname and contact you type and show them on that survey's page to anyone with the link. We do not check them. If you also choose to show your Google profile picture, we fetch it from Google and show it on that survey's page.

Everyone

Sign-in cookies, oauth_state_<provider> and invite_<provider>. Set only while you sign in, for 10 minutes: one protects the sign-in from being started by another site, the other carries your invite link.
Language cookie, daikou_lang (only if you choose a language). It remembers the language you chose on the page for one year and holds only the language code.

What we do not do

We use no analytics, advertising or third-party scripts and no tracking cookies. We do not sell or rent your information or build profiles from it. We do not ask for, and please do not enter, sensitive personal information in a survey (such as ID numbers, bank card numbers or health information).

2. Why we use it

Respondents' answers: the research purpose the survey owner states in the survey. For surveys we create, product research to understand how daigou sellers work and design Daikou's features.
Respondents' email: only so the survey owner can follow up about this research; never for marketing unless you agree separately.
The guest_id cookie and draft: only to let you return to and change your answers.
Owners' account details: to sign you in and keep the account secure.
Technical logs: to run the service, fix problems and prevent abuse.

We handle your personal information under New Zealand's Privacy Act 2020 and, where they apply, Japan's Act on the Protection of Personal Information and China's Personal Information Protection Law.

3. Who sees it and who processes it

The survey owner: only the owner who created a survey can see its responses (including name and email) and export them as a CSV file. Sellers who joined by invitation can create surveys. For a survey created by another seller, that seller decides what to ask and how to use the answers, and is responsible for them; we store and process the answers on their behalf. To have your answers deleted, ask the seller who sent you the link, or email us. When a survey shows its owner's nickname, that name was entered by the owner and is not verified by us.
Amazon Web Services (AWS) provides the server and database that run Daikou, in its Osaka region in Japan.
Supabase keeps backups of the database, in its Sydney region in Australia.
Google and Apple process what is needed for sign-in, only when an owner chooses to sign in with them. Respondents are not involved.

We do not give your personal information to anyone else except as above or where the law requires it.

4. Where your data is kept, and cross-border transfer

Your answers and account details are stored in Japan (AWS Osaka region), and database backups are kept in Australia (Supabase Sydney region). We run Daikou from New Zealand and may access the data from there. If you answer from mainland China, your personal information is transferred out of China. The overseas recipient is Daikou's operator, an individual based in New Zealand, contact support@daikou.online; the purposes and methods are in sections 1 and 2; the information is your answers and, if given, your name and email; you can use your rights as described in section 6.

Google and Apple sign-in may process data in the United States or other countries (owners only).

5. How long we keep it

Survey responses: until the owner deletes the response or the whole survey.
Owner accounts: until the account is deleted. Sign-in sessions stop working when they expire (30 days).
Backups: deleted data can remain in backups for up to 14 more days before it is deleted.
Cookie and draft in your browser: guest_id expires after one year; the draft is deleted when you submit or discard it. You can clear both in your browser at any time.

6. Your rights

You can ask to see, copy, correct or delete your personal information, withdraw your consent, or ask us to stop using it. While a survey is open, respondents can return to the link in the same browser and change their answers. To have your answers deleted, ask the survey owner who sent you the link, or email support@daikou.online; we will act within 20 working days. Withdrawing consent does not affect processing done before.

If you are unhappy with how we handle your information, you can complain to a regulator: in New Zealand, the Office of the Privacy Commissioner; in Japan, the Personal Information Protection Commission; in China, the Cyberspace Administration.

7. Security

All connections are encrypted (HTTPS). Only hashes of cookie values are stored, the database is not reachable from the internet and accepts only password-authenticated connections from the same server, and each survey's responses are visible only to its owner. Backups are stored encrypted at rest by Supabase. No system is perfectly secure; if an incident affects you, we will tell you and the regulator as the law requires.

8. Children

Daikou is for adult sellers and is not meant for anyone under 18. If you believe a minor has submitted information, contact us and we will delete it.

9. Changes

If we change this policy in a meaningful way, we will update the date above and, where appropriate, tell you in the service. This policy is available in Chinese and English; if the two differ, the English version prevails.

10. Contact

support@daikou.online