Account privacy notice
Account owners control the people and records they add. KurodaLab processes them to provide Approval Link.
Data processed and service providers
Approval Link processes the account email, business profile, invited people's names and addresses, approval requests and customer contact details, revisions, decisions, files, delivery and security audit records, and subscription identifiers and status. It uses this data to provide the requested workflow, authenticate users, send requested notices, prevent abuse, provide support and reconcile payment. Some security records use a hash of an IP address rather than the plain IP address.
Cloudflare Workers, D1, R2, KV and email services host and process the application. Stripe processes subscription payments and refunds. Email recipients' providers handle delivered messages; support mail is routed to a Google-hosted mailbox. Optional connected hosts and notification receivers process data that the account owner chooses to share with them. These providers may process data outside Japan. Approval Link does not sell customer data.
Optional AI draft suggestions
AI drafting is currently disabled pending provider configuration and verification. If it is enabled, a Pro or Studio owner must turn the feature on and explicitly request a draft after checking that the selected images and notes contain no unnecessary personal information. The app sends those selected inputs to Cloudflare Workers AI when configured, removes image-container metadata, and does not add stored customer names, email addresses or linked order, booking or contact references. Personal details visible inside an image or note must be removed by the owner before sending it. The response is a suggestion for the local editor: it is not automatically saved, sent or approved.
Cloudflare's Workers AI data controls state that Customer Content is not used for model training or service improvement without explicit consent and is not made available to other Cloudflare customers. Drafting requests are configured to disable AI Gateway log collection and response caching. Provider processing is governed by Cloudflare's agreements and the applicable model terms. The app also supports OpenAI only as an explicitly configured alternative: it sends inputs to one provider, without automatic fallback or sending them to both. OpenAI requests use store: false; its data controls state that API data is not used for training unless the account opts in, and default abuse-monitoring logs may retain content for up to 30 days with stated exceptions. That period applies to OpenAI only. Provider data handling is separate from deleting records in Approval Link.
Shared monthly cost-reservation and detected usage-overage totals, without draft content, survive record or account deletion so the product limit cannot be reset. Anonymous accounting records contain a random accounting ID, month, state, reserved amount and any detected usage cost, without site, request or customer IDs, input content or credentials. They are kept only as needed for monthly cost reconciliation. Per-request AI attempt history is removed with its approval, removing its link to the anonymous accounting record.
Export, retention and deletion
Direct customer requests become eligible for automatic removal after they are declined, expired or cancelled, or after approved work is marked completed. Answered or expired internal decisions are also removed on a schedule. The current account plan determines the period: Free 7 days, Starter 90 days, Pro 365 days and Studio 730 days. A downgrade can shorten the period for existing closed records. Export records and needed files before they become eligible for removal or before changing plans.
The owner can prepare a private TAR archive containing account settings, approval records, internal decisions, referenced files and billing identifiers. A completed archive is available for up to 24 hours. Save it before closing the account. The archive download requires the owner's authenticated session.
When immediate closure starts, new approval and Checkout activity is blocked. After Stripe confirms the refund, Approval Link removes the Stripe Customer, revokes OAuth grants, deletes active workspace rows from D1 and removes files under the workspace's R2 prefix. A short-lived status cookie allows the owner to check completion after the login account is removed. The minimal closure receipt, without the login email, is removed after 30 days.
Deleted D1 rows may remain in Cloudflare's recovery history for up to 30 days on the paid plan. An incomplete R2 multipart upload whose ID was lost before checkpointing is automatically aborted by R2 after seven days by default. Already delivered email, downloaded copies and records held by Stripe or an external recipient are outside the application's active-data deletion. Stripe can retain historical transaction records even after its Customer object is deleted.
Contact contact@kurodalab.com for access, correction or deletion questions, subject to identity checks and applicable law. See billing and refunds for the separate subscription actions.