Effective Date: 2026-07-14
Version: 1.1
See also: Cookie Preferences — the full list of every cookie we set, what it does, and how long it lasts.
PuchiDen (プチ電) is a browser-based international calling service. It is operated by Mirakuru Europa OÜ, a private limited company registered in Estonia. Mirakuru Europa OÜ is the data controller for the personal data described in this policy.
Development and user support are provided to Mirakuru Europa by 株式会社Kafkai Giken (Kafkai Giken, Inc., Japan), which acts as a sub-processor under a written Data Processing Agreement with the controller.
If you only read one thing, read this:
The table below lists every category of personal data we hold about you, the purpose behind each, the lawful basis under Article 6 of the GDPR, and how long we keep it.
| Category | Examples | Purpose | Lawful basis (Art. 6 GDPR) | Retention |
|---|---|---|---|---|
| Account | Email address, account identifier, email verification timestamp, timestamps of Terms of Service and Privacy Policy acceptance | Identify your account, prove consent | Contract (6(1)(b)); consent for marketing opt-in (6(1)(a)) | Until you delete your account |
| Profile preferences | Language, timezone, optional display name | Localise the interface | Contract (6(1)(b)) | Until you delete your account |
| Verified caller IDs | Phone numbers you have verified for use as outbound caller ID, associated nicknames | Let you choose which number appears to the person you call | Contract (6(1)(b)) | Until you delete the entry or your account |
| Phone directory | Numbers and nicknames you save for yourself | Your convenience when dialling | Contract (6(1)(b)) | Until you delete the entry or your account |
| Call records | Destination number, caller ID used, start time, duration, per-minute rate, cost | Calculate and verify charges for each call | Contract (6(1)(b)) | 60 days, then automatically deleted |
| Credit balance | Amount in EUR | Operate a prepaid calling service | Contract (6(1)(b)) | Until you delete your account |
| Top-up transactions | Amount, date, payment method, provider reference, invoice identifier, VAT amount and the billing country it was based on; for crypto top-ups also the coin used, the amounts, the payment status, and the NOWPayments deposit address (never your own wallet address) | Estonian tax compliance | Legal obligation (6(1)(c)) | 7 years (Estonian tax law) |
| Billing profile | Name, company name, street address, city, postal code, country, VAT identifier | Issue compliant invoices | Contract (6(1)(b)); legal obligation (6(1)(c)) | Linked to top-up transaction retention |
| Session | Login code hash, session identifier, language and timezone state | Keep you logged in securely | Legitimate interest (6(1)(f)) | 24 hours maximum per session; 30-minute inactivity timeout |
| Server logs | IP address, request path, timestamp, error context | Security, debugging, abuse prevention | Legitimate interest (6(1)(f)) | 7 days on rotation |
| Public-page analytics | Truncated IP (last 2 bytes masked), URL visited, referrer, UTM parameters, country derived from IP, user-agent string, and — on the landing page only — a pricing-calculator interaction event (queried destination country and mobile/landline toggle; no identifier) | Aggregate marketing insight on public pages only (blog, pricing, FAQ, landing). Never fires inside the account area or on the dialer. | Legitimate interest (6(1)(f)) | Raw hit rows 90 days; aggregate dashboards indefinitely |
Beyond country-level geolocation on public marketing pages (see the "Public-page analytics" row above), we do not collect your location. We do not build cross-site or behavioural profiles. We do not collect your phone number — registration requires only an email address.
Delivering the service requires a small set of third parties. Each only receives the data it needs to perform its role. No third party receives your call audio in storage: audio is only processed in transit by the telecommunications infrastructure provider for the duration of a live call.
puchiden.app and receives your IP address, your request headers, and the URL you visit. It does not receive your call audio or call records.[email protected] and [email protected]. Any email you send to us is stored in Google Workspace and read by our support team. Please avoid including sensitive information in these emails unless it is necessary for your request.analytics.kafkai.com that receives the public-page analytics and conversion data described in this policy.For the full list of sub-processors, including any we do not name in public text for supplier-confidentiality reasons, contact us at [email protected] and we will provide it.
PuchiDen is designed around the data we choose not to collect:
We set a small number of strictly-necessary cookies that are required for the site to work. These cannot be disabled without breaking core functionality:
sessionid — keeps you logged in between requests. HttpOnly, Secure, SameSite=Lax. Expires after 24 hours, or after 30 minutes of inactivity.csrftoken — protects the forms on the site against cross-site request forgery. Expires after 1 year.django_language — remembers whether you chose English or Japanese. Expires after 1 year.cookie_consent — records your cookie preference so we do not ask again on every page. HttpOnly, Secure, SameSite=Lax. Expires after 1 year.A full disclosure of every cookie we set is always available at puchiden.app/legal/cookies-preference/.
We do not use advertising identifiers, cross-site trackers, session-replay tools, Google Analytics, or Facebook Pixel. We do not set any cookie that links your identity to external advertising networks.
If we ever introduce a non-essential cookie in the future, we will show you a clear consent choice and will not store any such cookie until you explicitly agree. There is no pre-ticked box — consent is always opt-in.
Some of our sub-processors are established outside the European Economic Area. Transfers are made under the following legal bases:
As a data subject in the European Union or European Economic Area, you have the following rights in respect of personal data we hold about you:
Contact [email protected] from the email address associated with your account. We may ask you to confirm control of that address before we act, to protect your data against unauthorised requests.
We respond within one month of receiving your request, in line with Article 12(3). If your request is complex we may extend this period by up to two additional months and will tell you so within the first month. Requests are free of charge, except where they are manifestly unfounded or excessive (Article 12(5)).
Today, data export and account deletion are carried out by our support team rather than through a self-service interface. We want to verify requests carefully, and the volumes are small enough to handle individually. We plan to add a self-service option in a future release.
We take a defence-in-depth approach:
If a personal-data breach occurs we comply with Article 33 of the GDPR: we will notify the Estonian Data Protection Inspectorate within 72 hours of becoming aware of the breach, unless the breach is unlikely to result in a risk to your rights and freedoms.
If the breach is likely to result in a high risk to your rights and freedoms, we will also notify you directly and without undue delay, as required by Article 34.
If you believe you have observed a security incident involving PuchiDen, please contact us at [email protected].
There are privacy limits inherent to any service that bridges the web to the public phone network. We publish a separate Data Transparency document that describes these limits in detail — including why call audio cannot be end-to-end encrypted once it reaches the public phone network, why certain call metadata is unavoidable, and why the recipient of a call will always have some record of receiving it. Please read our Data Transparency document for more details.
Changes. We will notify you by email of any material change to this policy before it takes effect. The effective date and version number at the top of this page always reflect the current version.
Contact.