Privacy Policy

Effective date: January 1, 2026  ·  Sanko Inc.

This Privacy Policy describes how Sanko Inc. ("Sanko," "we," "us," or "our") collects, uses, discloses, and otherwise processes personal data in connection with MatchaGraph™ (the "Service"). We are the data controller in respect of personal data processed under this Policy.

If you are located in the European Economic Area (EEA), the United Kingdom, or Switzerland, additional rights and protections apply to you under applicable data protection law, including the General Data Protection Regulation (GDPR). These are described throughout this Policy and summarised in Section 9.

1. Information We Collect

We collect information you provide directly, information generated through your use of the Service, and, where applicable, information from third-party sources.

Account Information. When you register, we collect your name or display name, email address, and password (stored in hashed form). We also collect demographic information, including decade of birth, gender, and ethnic identity or countries of origin, as part of the registration process. This information is used to contextualise Evaluation Data for research and analytical purposes as described in Section 2.

Tasting and Evaluation Data. We collect all content you submit through the Service, including tasting notes, natural language descriptions, flavor attribute ratings, preparation details, product information, preference scores, and any other data entered during an evaluation session ("Evaluation Data").

Usage and Technical Data. We automatically collect certain technical information when you interact with the Service, including IP address, browser type and version, device type, operating system, pages visited, session duration, and general interaction patterns. We use session cookies that are strictly necessary to operate the Service, including to maintain your login session. We do not use third-party analytics or advertising cookies.

2. How We Use Your Information

We use the information we collect for the following purposes. Where GDPR applies, we identify the lawful basis for each category of processing.

Providing and Improving the Service. We use your data to operate, maintain, personalise, and improve the Service, and to communicate with you about your account or changes to the Service. Lawful basis: performance of a contract (Article 6(1)(b) GDPR); where applicable, legitimate interests (Article 6(1)(f) GDPR).

Research, Analysis, and Business Development. We use data derived from your use of the Service, including Evaluation Data and demographic information, to conduct internal research, statistical analysis, product development, and to support and develop our broader business. This may include creating aggregated or de-identified datasets for internal use or disclosure to third parties. Lawful basis: legitimate interests (Article 6(1)(f) GDPR). We have assessed that these interests are not overridden by your rights and freedoms, given the measures we take to protect individual privacy.

Safety, Fraud Prevention, and Legal Compliance. We process your data to detect and prevent fraud or unauthorised activity, to comply with applicable legal obligations, and to enforce our Terms of Service. Lawful basis: legal obligation (Article 6(1)(c) GDPR); legitimate interests (Article 6(1)(f) GDPR).

3. Sharing of Information

We do not sell your name, email address, or account credentials to third parties. We may share information in the following circumstances:

• Service Providers. We share information with trusted vendors and service providers who perform functions on our behalf, such as cloud hosting, analytics, and customer support, subject to confidentiality obligations and, where required, data processing agreements.
• AI Processing. Tasting descriptions and evaluation data entered into the chat interface are transmitted to OpenRouter Inc., which routes them to third-party AI model providers for processing. This data is used solely to generate responses within the Service and is subject to OpenRouter's privacy policy and terms.
• Derived and Aggregated Data. We may use, share, or license data derived from your use of the Service, including aggregated, anonymised, or de-identified datasets, for a range of business, research, and operational purposes. We take reasonable steps to ensure that such datasets cannot be used to identify you individually.
• Business Transfers. In connection with a merger, acquisition, financing, or sale of all or a portion of our business or assets, your information may be transferred as part of that transaction. We will notify you of any such transfer and any material changes to how your data is handled.
• Legal Requirements. We may disclose your information if required to do so by law, court order, or governmental authority, or if we believe in good faith that such disclosure is necessary to protect the rights, property, or safety of Sanko, our users, or others.
• With Your Consent. We may share your information for other purposes with your prior explicit consent.

4. Community and Public Sharing

If you elect to share an evaluation publicly via a share link or the community feed, that evaluation, including its flavor profile, tasting notes, and product details, will be visible to other users and, depending on your settings, to the general public. You may revoke public sharing at any time through your account settings, though we cannot guarantee that content previously accessed by others has not been retained.

5. International Data Transfers

Sanko operates primarily from the United States. Your personal data may be transferred to, stored in, or processed in countries outside the EEA, including the United States. Where such transfers occur, we take reasonable steps to ensure your data receives an adequate level of protection consistent with applicable law. You may request further information about our transfer mechanisms by contacting us at hello@sanko-cha.com.

6. Data Retention

We retain your account information and Evaluation Data for as long as your account is active and for a reasonable period thereafter for backup, archival, legal, and business continuity purposes. On account deletion, we will remove or anonymise your personal account data, subject to legal retention obligations.

Aggregated or de-identified datasets derived from your Evaluation Data are not personal data and are not subject to deletion on account closure.

7. Security

We implement reasonable administrative, technical, and physical safeguards designed to protect your information from unauthorised access, disclosure, alteration, or destruction. No method of transmission over the internet is completely secure, and we cannot guarantee absolute security. We will notify you and, where required, relevant authorities, in the event of a data breach affecting your personal data.

8. Your Choices

You may update your account information at any time through the account settings within the Service. You may request deletion of your account by contacting us at hello@sanko-cha.com. Upon deletion, we will remove or anonymise your personal account data, subject to the retention obligations described in Section 6.

9. Your Rights (EEA, UK, and Switzerland)

Depending on your location, you may have the following rights in respect of your personal data. To exercise any of these rights, please contact us at hello@sanko-cha.com. We will respond within 30 days.

• Right of access. You may request a copy of the personal data we hold about you.
• Right to rectification. You may ask us to correct inaccurate or incomplete data.
• Right to erasure. You may request deletion of your personal data, subject to our legal retention obligations.
• Right to data portability. You may request your personal data in a structured, machine-readable format.
• Right to restrict processing. You may ask us to pause processing of your data in certain circumstances.
• Right to object. You may object to processing carried out on the basis of legitimate interests.
• Right to withdraw consent. Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

You also have the right to lodge a complaint with your local data protection authority. In the EU, complaints may be directed to the supervisory authority in the Member State of your habitual residence or place of work.

10. Children's Privacy

The Service is not directed to individuals under the age of 18. We do not knowingly collect personal information from minors. If you believe we have inadvertently collected such information, please contact us and we will take steps to delete it promptly.

11. Changes to This Policy

We reserve the right to update this Privacy Policy at any time. When we do, we will revise the effective date at the top of this page and, where changes are material, notify you by email or through the Service. Continued use of the Service following notification of an update constitutes your acceptance of the revised Policy.

12. Contact

If you have questions or concerns about this Privacy Policy or our data practices, or to exercise any of your rights, please contact us at:
Sanko Inc.
Email: hello@sanko-cha.com