Privacy policy

This policy explains what personal information 相原　司 (“we”), operating tempurachan.yura from Tokyo, Japan, collects when you visit the shop or place an order, why, and what your rights are. It is written to meet the Japanese Act on the Protection of Personal Information (APPI) and, for customers in the European Economic Area and the United Kingdom, the GDPR.

What we collect

• Order details: your name, email address, shipping address, country, optional phone number and Instagram handle, the items you order and any notes you add.
• Payment: card payments are processed by Stripe. We never see or store your card number. For PayPal or Wise payments we receive the payment confirmation from those services.
• Technical data: your IP address and browser type, used briefly to protect the shop against abuse (for example limiting repeated attempts).
• Where you came from: during your visit we note in your browser's session storage how you reached the shop (for example our Instagram bio, a Google search or a link with a campaign tag). It holds no personal data, disappears when you close the tab, and is saved with an order only so we know which channels bring customers.
• Drop emails: if you sign up (in the footer, after confirming the link we email you, or by ticking the box at checkout) we store your email address to tell you about new sets and boxes. Every email has a one-click unsubscribe link; we then stop immediately, and on request we delete your address completely.
• Analytics: only if you agree in the cookie banner, Google Analytics and Google Merchant Center set cookies to record how the site is used (pages viewed, device type, approximate location) and which Google listings lead to an order. Until you agree, the Google tag runs in Consent Mode without cookies: it only sends anonymous signals that cannot identify you, which Google uses for aggregated estimates. If you agree, the Meta Pixel also lets Meta (Instagram, Facebook) measure which of our posts and ads lead to a visit or an order, and when you then pay by card we send that order to Meta from our server too (your email, phone, name, city and postcode only as one-way hashes). Without your consent the Meta Pixel is not loaded and nothing is sent to Meta. You can say no and the shop works exactly the same. We also count page views with Vercel Web Analytics, which uses no cookies, does not track you across sites and only gives us totals (pages, country, device type). In the same cookieless way we count shop steps (a product viewed, added to the cart, checkout started, a card payment that failed and the reason the bank gave) as totals per day, country, referring site and product, without any identifier, IP address or card details.
• Reservations: if you ask to reserve an upcoming release, we store your email, the quantity and anything optional you add (name, Instagram, country) to contact you about that release, and add you to its release alert.
• Instagram messages: when you message us on Instagram, Meta passes your message to our server so we can send an instant reply with the right link; we keep your Instagram name and when you last wrote, to reply at most once every 12 hours.
• In your browser: your cart, chosen currency and cookie choice are stored in your own browser (local storage), not on our servers.

Why we use it

• To process, ship and support your order, including customs paperwork (contract).
• To send order confirmations, payment details, shipping and tracking emails (contract).
• To send a restock email when you ask for one (consent; you can unsubscribe at any time).
• When you start an order but don't finish paying, to send at most two reminders about that order (our legitimate interest in completing a sale you started). Every reminder has a one-click link to stop them for good.
• About 10 days after your order ships, to ask once for a review (our legitimate interest in showing honest feedback from real customers). If you write one, we publish your score, text, the name you choose and your country; never your email or address. The same one-click link stops these emails.
• To follow up once on a question you asked us, for example about a price or a release (legitimate interest). Tell us and we stop.
• If you have bought from us, to show our ads less to existing customers and to find people with similar interests on Instagram and Facebook (Meta Custom Audiences, legitimate interest). We only send Meta one-way hashes of your contact details, which Meta uses for matching and then deletes. You can object at any time by emailing us.
• To prevent fraud and keep the shop secure (legitimate interest).
• To keep accounting records required by Japanese tax law (legal obligation).
• To understand and improve the shop through analytics, only with your consent.

We do not sell your personal information and do not use it for advertising.

Who we share it with

We share only what each service needs to do its job:

• Stripe (card payments; USA and Ireland)
• PayPal and Wise (only when you choose them)
• DHL Express and FedEx (delivery and customs clearance; Japan, your country and transit countries)
• Resend (sending our emails; USA)
• Vercel (website hosting; USA and global network) and Neon (database; Germany)
• Meta Platforms (Meta Pixel and Conversions API, only with your consent; Ireland and USA)
• Google (Analytics and Merchant Center measurement: cookies only with your consent, cookieless anonymous signals otherwise; Customer Reviews, only if you opt in after an order, which shares your email, country, order number and expected delivery date so Google can send you a short survey; USA)
• LINE (order alerts to our staff with your name, country and order; Japan)
• Authorities, when the law requires it (for example customs or tax)

Some of these providers are outside Japan and the EEA. Where personal information is transferred abroad, we rely on providers that commit to protection measures comparable to the APPI and the GDPR (such as standard contractual clauses). You can ask us for more detail about the countries involved and their privacy rules.

How long we keep it

Order records are kept for as long as Japanese tax and accounting law requires (up to 7 years), then deleted. Restock requests are deleted once the email is sent or when you unsubscribe. Security logs are kept for a short period only.

Your rights

You can ask to see the personal information we hold about you, have it corrected or deleted, stop its use, receive a copy, or withdraw consent for analytics at any time. EEA and UK residents can also complain to their local data protection authority. To use any of these rights, contact us at tempurachanyura@gmail.com or by Instagram DM. We reply within 30 days.

Security

The shop runs entirely over encrypted connections. Card data is handled only by Stripe. Access to orders is limited to our staff and protected with two-step verification.

Changes and contact

If this policy changes, we update it on this page with a new date. Questions? Contact 相原　司 at tempurachanyura@gmail.com.