Privacy Policy

1. Who operates the service

The service is provided by CHIIIT ARCHIVE, operated by Hanako Ie. Our address, contact details, and other public business information are available on the Legal Information page.

2. Information we collect

• Your name, email address, telephone number, country or region, and shipping address
• Order number, items, amount, currency, payment status, refunds, and other transaction information
• Inquiry type and message, preferred language, related item or order information, and support history
• Technical information such as IP address, browser and device information, request data, security assessments, errors, and delivery logs
• Browser language and publicly displayed product data read by the Buyee Connect tag, including category ID, product code (SKU), description, image URL, price, product name, product-page URL, size or colour options, quantity limits, and stock availability
• Browser-stored information needed for the cart, checkout continuity, and order confirmation
• If you register for first access: your email address, country or region group, language, signup source, consent and confirmation timestamps, and email-delivery status

3. How we use information

• To process orders, payments, refunds, production, delivery, and after-sales support
• To respond to inquiries and assist with translation and reply preparation
• To verify identity, prevent fraud, bots, spam, and misuse, handle incidents, and operate the service securely
• To maintain transaction, accounting, and tax records, comply with law, handle disputes, and protect legal rights
• To maintain and improve the quality, usability, and reliability of the service
• To send opening and first-drop updates to customers who have expressly consented

4. Orders and payments

We use Stripe Checkout to process direct purchases of Vintage items for domestic delivery and Photography works. Stripe handles contact, shipping, payment-method, and transaction information for payment processing, payment-method or identity checks, fraud prevention, and transaction operations.

Our application database does not store full payment card numbers or card security codes. We retain the Stripe session and payment identifiers, payment status, amount, currency, contact details, and shipping information needed to administer an order.

For international purchases of Vintage items, Buyee acts as an external proxy purchasing service and the point of contact for purchase, payment, and international delivery. We load the Buyee Connect tag on every public storefront page to display its purchase interface for visitors outside Japan. The tag receives the visitor's IP address, browser language, and product information displayed on the current page. Membership, payment, and delivery information entered on Buyee is handled under Buyee's policy. We do not automatically send the text of your inquiry to Buyee.

5. Shipping and fulfillment

We use the name, contact details, shipping address, and item information needed to ship Vintage items.

Photography works are made to order. We provide Gelato, our production and delivery provider, with the recipient's name, email address, telephone number where needed, shipping address, order reference, and work specifications. We do not use this Photography production flow to produce Vintage items.

6. Inquiries and customer support

Our inquiry form collects your name, email address, optional country and order number, preferred language, inquiry type, message, and optional related item information. We use this information to receive and answer your inquiry, manage its status, and prevent misuse.

We use Resend for inquiry acknowledgements, administrative notifications, and staff replies. Resend processes recipient email addresses, transactional email content, and delivery information such as message identifiers and delivery status to provide email delivery.

7. AI-assisted support

We use the OpenAI API to translate inquiry text and assist with translating or preparing replies. Before sending content, we take steps to minimize it and replace some identifiers, including email addresses, order identifiers, telephone numbers, and tracking numbers.

AI output is used only to assist support work. We do not use AI alone to make decisions that produce legal or similarly significant effects on you.

8. Security and bot protection

We use Cloudflare Turnstile to protect the inquiry form, first-access registration, and administrator login from bots and abuse. Turnstile processes technical security signals relating to the browser, device, and network, together with a verification token.

We do not send the inquiry form's name, email address, order number, or message to Cloudflare as part of Turnstile verification.

9. Service providers

We use the following external services where necessary to provide the service. Each provider handles information under our agreement and instructions or under its own applicable terms and privacy policy, depending on its role.

Stripe

payments, transaction processing, fraud prevention, and refunds

Gelato

production and delivery of Photography works

Buyee

display of the Buyee Connect Cart, proxy purchase, payment, and international delivery of Vintage items

Neon

application database infrastructure

Vercel

site hosting, delivery, and runtime logging

Resend

transactional and inquiry-related email delivery

OpenAI

inquiry translation and reply-preparation assistance

Cloudflare Turnstile

bot and abuse detection and security verification

10. International processing

Use of external services may result in personal information being processed in a country or region other than where you live. Processing locations and safeguards vary according to the service, agreement, and configuration used.

Where required by applicable law, we assess and use appropriate safeguards, including contractual measures where relevant. Please review each external provider's current privacy information for details of its handling practices.

11. Legal bases for EU and UK users

Where EU or UK data protection law applies, we rely primarily on the following legal bases, depending on the purpose and circumstances of the processing:

Contract or steps before entering a contract

orders, payments, production, delivery, refunds, and support directly related to a prospective or completed purchase

Legitimate interests

service operation, general customer support, fraud and bot prevention, security, incident response, and business administration, balanced against your rights and interests

Legal obligation

accounting, tax, legally required records, and responses to authorities

Consent

where applicable law requires consent or where we expressly request consent for a specific optional activity

12. Data retention

Inquiry information becomes eligible for deletion or anonymization 12 months after the inquiry is marked completed. We review eligible inquiries periodically and process them sequentially, one record at a time. This does not mean that an inquiry is deleted automatically at the exact moment the boundary is reached.

We may place a legal or operational hold and retain information for longer when needed for legal compliance, disputes, security investigations, or legitimate operational needs. If hold information is inconsistent, we do not proceed with deletion or anonymization as a safety measure.

After deletion or anonymization, we may retain limited operational and audit fields that do not identify you, together with the time the retention action was completed.

Order, payment, delivery, refund, and accounting records are retained for periods appropriate to applicable law, tax and accounting duties, dispute handling, and legitimate business needs. The 12-month inquiry period does not automatically apply to those transaction records.

Security, incident, and delivery logs are retained for as long as needed for their purpose, under applicable provider terms and law.

First-access registration information is retained until you withdraw consent or the update purpose ends, after which it is deleted except for the minimum record required by law or to prevent misuse.

13. Backups

Information that has been deleted or anonymized may remain for a limited period in backups, point-in-time recovery history, or disaster-recovery copies. These copies are not used for ordinary business operations and are removed in accordance with the applicable retention period or backup rotation.

14. Cookies and essential browser storage

We store cart item identifiers and update times in your browser's localStorage. An email address entered in the cart may also be stored in localStorage for checkout convenience. You can remove this information through your browser settings.

We use short-lived essential cookies or browser storage for checkout cancellation or continuity and order confirmation. Stripe and Cloudflare Turnstile may also use cookies or similar technologies necessary for payment and security functions.

The Buyee Connect tag sends information needed to display its international-purchase cart and process a purchase request to Buyee, and may use cookies or similar browser technologies. The information sent includes the visitor's IP address, browser language, and the product information described above.

We do not currently use cookies for behavioral advertising or third-party audience analytics.

15. Security measures

We use safeguards appropriate to the nature and risk of the information, including access controls, authentication, input validation, protected communications, least-privilege access, logs designed not to contain sensitive content, data minimization, and retention controls.

No transmission or storage system on the internet can be guaranteed absolutely secure. If we suspect an incident, we assess its impact and respond in accordance with applicable law.

16. Your rights

Subject to applicable law, you may have the right to make the following requests or objections concerning your personal information:

• Information about our handling, and access to or disclosure of personal information we hold
• Correction, completion, or updating of inaccurate information
• Deletion or erasure, suspension of use, or restriction of processing
• Objection to processing based on legitimate interests
• Withdrawal of consent for future processing where processing is based on consent
• A complaint to an applicable data protection authority

Submit a request through our Contact page. To protect information, prevent fraudulent requests, and comply with law, we may ask you to verify that you are the person concerned or an authorized representative. Legal exceptions may prevent us from fulfilling all or part of a request.

17. Children's information

The service is not designed for children. If you are below the age at which consent from a legal representative is required, please use the service together with a parent, guardian, or other legal representative.

If you believe a child's personal information was provided without required authorization, please contact us through the Contact page.

18. Changes to this Policy

We may update this Policy when our services, external providers, or applicable laws change. If a change is material, we will provide notice on this site or by another appropriate method, depending on the nature of the change.

The updated text and last-updated date will be posted on this page.

19. Contact

For questions about our handling of personal information, this Policy, or a privacy-rights request, please use our Contact page.

Our address, telephone number, and email address are also published on the Legal Information page.