Privacy policy

1. Information we collect

• Newsletter sign-up: your email address, edition language, sign-up and confirmation times, and a record of your consent (the consent text shown and its version, the page you signed up on, a hash of your IP address and your browser type). The newsletter is intended for readers aged 16 and over.
• Inquiries: your name, email address and message.
• Product submissions and advertising orders: company name, contact name, email address, product details and order details. Payments are processed by Stripe; we do not store card numbers.
• Automatically: IP address, browser and device type, referrer, pages viewed, cookie identifiers and access times.

2. How we use it

• To provide, run and improve the Service and show articles and product information.
• To send the newsletter until you unsubscribe, and to keep a record of your consent (to demonstrate it and answer questions about it).
• To answer inquiries, handle submissions and advertising orders, invoice and process payments, and contact you about them.
• To measure usage, prevent abuse and keep the Service secure.
• To comply with legal obligations.

3. Legal bases (visitors in the EEA and the UK)

• Newsletter: your consent (GDPR and UK GDPR Art. 6(1)(a)). You can withdraw it at any time with the unsubscribe link in each email; this does not affect sending before you withdrew.
• Consent and unsubscribe records: our legal obligations and our legitimate interest in demonstrating consent and honouring opt-outs (Art. 6(1)(c) and (f)).
• Analytics and advertising cookies: your consent, given in the consent tool (Art. 6(1)(a)).
• Inquiries, product submissions and advertising orders: steps you ask us to take and the performance of a contract (Art. 6(1)(b)).
• Security and abuse prevention, such as limits on repeated sign-ups: our legitimate interest in protecting the Service (Art. 6(1)(f)).

4. Cookies, analytics and advertising

We use Google Analytics 4 (Google LLC), which uses cookies to measure how the Service is used. For visitors from the EEA, the UK and Switzerland, analytics cookies are not used until you consent; until then Google Analytics receives only cookieless signals (such as that a page was viewed and the consent state), without cookies or advertising identifiers.

You can opt out with Google's browser add-on (https://tools.google.com/dlpage/gaoptout) or block cookies in your browser; some features may then not work.

Some pages (Japanese articles and product pages) show ads from Google AdSense (Google LLC), labelled 「広告」 (advertisement). Third-party vendors, including Google, may use cookies to serve ads based on your previous visits to the Service or other websites. See how Google uses information from sites that use its services: https://policies.google.com/technologies/partner-sites.

You can turn off personalised ads in Google's Ad Settings (https://adssettings.google.com) and opt out of third-party vendor cookies at www.aboutads.info.

Visitors from the EEA, the UK and Switzerland see no ads: the Google AdSense script is not loaded for them, so no advertising cookies or identifiers are used.

Our newsletter emails do not track opens or link clicks.

5. Affiliate links

The Service contains affiliate links (Amazon Associates, Kickbooster). As an Amazon Associate, Modern-G earns from qualifying purchases. The linked sites may set their own cookies and process information under their own privacy policies.

6. Service providers and international transfers

We are based in Japan. We share personal information with the providers below only as needed to run the Service, and they handle it on our instructions. Newsletter sign-up details (email address, edition language and consent record) go to Intuit Mailchimp, Resend, Vercel and Neon.

• Vercel Inc. (USA): hosting
• Neon (Databricks, Inc., USA; data stored in Singapore): database
• Intuit Mailchimp (USA): newsletter delivery and unsubscribe handling, including the confirmation email when someone who unsubscribed signs up again
• Resend (Plus Five Five, Inc., USA): transactional email and, only where a sign-up needs confirming, the newsletter confirmation email
• Stripe, Inc. (USA): payment processing
• Google LLC (USA): analytics, advertising (Google AdSense) and consent management

6.1 Safeguards for transfers

Where the GDPR or the UK GDPR applies to a transfer: Japan is covered by an EU adequacy decision and by the UK's adequacy regulations (both cover businesses subject to Japan's APPI, such as Gloture). For providers in the United States we rely on the EU-US Data Privacy Framework and its UK Extension where the provider is certified (Intuit, Vercel, Databricks for Neon, and Google are), and on the Standard Contractual Clauses with the UK Addendum in each provider's data processing terms (Mailchimp, Resend, Vercel, Neon). You can ask us for a copy of these safeguards.

6.2 Provision to recipients abroad (Japan's APPI, Article 28)

Japanese law requires us to tell you, before you consent, where your newsletter sign-up details go and how they are protected. By subscribing you consent to this provision; we keep a record of that consent (the text shown, its version and the time).

Recipient country: the United States. Neon stores data on servers in Singapore.

The United States has no comprehensive federal privacy law covering businesses in general; there are sector-specific federal laws (such as the Electronic Communications Privacy Act, the Gramm-Leach-Bliley Act and HIPAA) and state laws, including California's Consumer Privacy Act. The United States takes part in the APEC Cross-Border Privacy Rules (CBPR) system. Since July 2023 the EU has recognised an adequate level of protection for transfers to US companies certified under the EU-US Data Privacy Framework. US law also lets government agencies require companies to provide information for national-security purposes (for example, Section 702 of the Foreign Intelligence Surveillance Act).

Singapore (Neon's storage location) has a comprehensive data protection law for the private sector (the Personal Data Protection Act 2012) and takes part in the APEC CBPR system; it has no EU adequacy decision. Its Criminal Procedure Code lets the police order information to be produced.

Source: Personal Information Protection Commission, Japan, surveys of foreign personal-information systems (https://www.ppc.go.jp/enforcement/infoprovision/laws/), based on its fiscal-2021 survey; later changes may not be reflected.

Providers' safeguards: in data processing terms that form part of their customer agreements, each provider commits to handle the data only on our instructions, keep it secure, bind its staff to confidentiality, control its sub-processors, notify us of breaches and delete or return the data when the service ends. Intuit (Mailchimp), Vercel and Databricks (Neon) are certified under the EU-US Data Privacy Framework; Resend's re-certification is under review.

7. Disclosure to third parties

We do not sell personal information or disclose it to third parties without consent, except as required by law. Use of the providers above is not a disclosure to third parties.

8. How long we keep information

• Newsletter subscriptions: until you unsubscribe.
• Sign-ups that are never confirmed: deleted 60 days after the last request.
• After you unsubscribe: your email address, edition, dates, the consent text shown (and its version) and the unsubscribe record, kept for 3 years after you unsubscribe to demonstrate consent and answer questions, then deleted. Mailchimp keeps your address marked as unsubscribed so that you are not emailed again.
• Other information: for as long as needed for the purposes in section 2, or as long as the law requires (for example, accounting records).

9. Security

• Access to personal information is limited to the people who need it, with role-based permissions.
• Connections are encrypted (HTTPS), administrative access is restricted, and credentials are protected.
• We select and supervise our service providers.

10. Your rights

You may ask us to disclose, correct, delete or stop using your personal information, or to stop disclosing it, subject to applicable law. We will verify your identity and respond without undue delay. You can unsubscribe from the newsletter at any time with the link in each email.

If you are in the EEA or the UK, you also have the right to access your personal information, have it corrected or erased, restrict or object to its use, receive it in a portable format, and withdraw your consent at any time (without affecting processing before you withdrew). You can complain to the data protection authority where you live or work; in the UK, that is the Information Commissioner's Office (ico.org.uk). Please contact us first so we can help. We do not make decisions about you based solely on automated processing.

11. Contact and operator

• Operator: Gloture Co., Ltd.
• Address: Aoyama Marutake Bldg. 6F, 3-1-36 Minami-Aoyama, Minato-ku, Tokyo 107-0062, Japan
• Representative: 希咲 君一
• Contact: info@gloture.co.jp

12. Changes

We may update this policy when the law or the Service changes. We will announce significant changes on the Service.