Privacy Policy

Meta-Werbemessung

Die optionale Meta-Messung sendet Produktansichten, Warenkorb, Checkout und bestätigte bezahlte Käufe sowie IP-Adresse und Browserinformationen an Meta, das Cookies verwenden kann. Namen, E-Mails, Adressen und Beleglinks werden nicht gesendet. Beide anderen Einwilligungen sind erforderlich. Frühere Einwilligungen aktivieren dies nicht.

Meta Platforms: Privacy policy. Cookie policy.

1. Information collected

• At checkout: name, address, email, phone, shipping details.
• At payment: card details (received directly by Stripe; never reach our servers).
• At contact: name, email, message body.
• Access logs: IP address, browser type, timestamps.
• With ad measurement consent: campaign and creative labels from an Instagram ad link.

2. Purpose of use

• Shipping orders and contacting customers about orders.
• Replying to enquiries.
• Operating, improving, and protecting the Site from misuse.
• With consent, comparing Instagram ad spend with paid orders to measure ad performance.
• Complying with legal obligations.

3. Third-party processors

• Stripe, Inc. (payment): name, address, email, card details, order amount. With ad measurement consent, short campaign and creative labels are also stored on the Checkout Session. With analytics consent and valid ad labels as well, random flow and page identifiers are stored to reconcile actions in the same tab with payment status.
• Printful, Inc. (manufacturing, shipping): product SKU, quantity, order id, and — because each garment ships from Printful's partner facility directly to the customer — the recipient's name, shipping address, and phone number.
• Resend (email): name, email address, order ID, ordered products and amounts, delivery and tracking information, subscription status, and contact messages.
• Google LLC (analytics): with consent only, pages viewed, scroll depth, time product-description sections are visible in the foreground tab, selection and cart actions, referrer, approximate location, device and browser type, cookie-based pseudonymous identifiers, products, sleeve style, colour, size, quantities, currency, amounts, checkout progress and errors, action sequence, elapsed time, viewport dimensions, random flow and page identifiers, and an analytics transaction identifier. Names, addresses, email addresses, card details, operational order references and payment session IDs are not sent to analytics. Never used for advertising.

Each processor handles data under its own privacy policy.

4. Letters (optional subscription)

"Letters" is an optional email subscription. Notices are limited to new words, essays, and events.

• Data collected: email address only.
• Processor: the address is stored with Resend for delivery.
• Unsubscribing: every email carries an unsubscribe link; writing to studio@hosen.tokyo also works. After unsubscribing, the address is removed from the delivery list.

5. Cookies and analytics

The Site uses essential storage for basic operation (cart state, language preference). These need no consent.

Analytics uses Google Analytics 4. The Google analytics script is not loaded before consent. Allowing analytics enables the browsing and purchase measurement described in section 3. The analytics transaction identifier is a one-way transformation of the payment session ID; it is pseudonymous, not guaranteed anonymous. Earlier consent for browsing only is not carried forward. Consent can be changed or withdrawn at any time from "Cookie settings" in the footer.

Instagram ad measurement is a separate choice. With consent, short campaign and creative labels from an ad link are held in the current tab and attached to a Stripe Checkout Session started within 24 hours. We compare paid orders with ad spend internally. If both analytics and ad measurement are allowed, validated campaign, creative, source and medium labels are also sent to Google Analytics to distinguish ad traffic. Names and email addresses are not stored as campaign labels. Campaign-label measurement alone does not send data to Meta. Meta transmission requires the separate new Meta measurement opt-in described above. Declining or withdrawing consent clears the labels held in the tab. Earlier consent to site analytics does not authorize ad measurement.

6. Retention

Order data is retained for the period required by Japanese tax and commercial law (seven years). Contact messages are deleted three years after the conversation closes. Subscriber email addresses are retained until unsubscribed. Analytics cookies expire after 60 days. A random flow identifier is created after consent and kept in the same tab for at most 24 hours, until the tab closes or consent is withdrawn. Identifiers attached to an order follow the order-record retention period. The consent choice remains in browser storage until changed or cleared. A tab stores the analytics transaction identifier to limit duplicate purchase reporting; this storage is deleted when the tab closes. Information already sent to Google follows its privacy policy and the analytics property's retention settings. Meta consent can be changed or withdrawn in the footer Cookie settings. Withdrawal stops new sends but cannot recall data already sent. A one-way pseudonymous payment identifier is retained on our server to prevent duplicate Meta purchases. Meta's retention of received data and cookies follows its policies.

Campaign labels remain in the tab until it is closed or consent is withdrawn, but are not attached to orders after 24 hours. If attached to an order, they follow the retention period for order data.

7. Access, correction, and erasure

To request access, correction, or erasure of personal data, write to studio@hosen.tokyo. After identity verification, the request is processed within a reasonable period.

8. For consumers in the EU and the UK (GDPR / UK GDPR)

Data controller: hosen. Contact studio@hosen.tokyo; the operator's legal name and address are listed on the Act on Specified Commercial Transactions page.

Legal basis: performing an order is contract performance (GDPR Art. 6(1)(b)); tax and commercial-law retention and other legal compliance is a legal obligation (Art. 6(1)(c)); the "Letters" subscription and analytics (Google Analytics) rely on consent (Art. 6(1)(a)); ad measurement relies on separate consent (Art. 6(1)(a)); operating the Site, preventing misuse, and access logs rely on legitimate interests (Art. 6(1)(f)).

Your rights: access, rectification, erasure ("right to be forgotten"), restriction, portability, objection, and withdrawal of consent. Send requests to studio@hosen.tokyo.

Supervisory authority: residents of the EU/EEA may lodge a complaint with the data protection authority in their country. UK residents may contact the Information Commissioner's Office (ICO, ico.org.uk).

Transfers: hosen is established in Japan. Transfers from the EU to Japan rely on the European Commission's adequacy decision. Transfers from the UK to Japan rely on the UK government's adequacy regulations. Transfers to Stripe, Printful, and similar processors (including the United States) rely on each provider's Standard Contractual Clauses or the Data Privacy Framework.

EU representative (GDPR Art. 27): where one is required, the contact details will be published on this page.

9. California (CCPA)

Personal information is not sold to third parties. California residents wishing to exercise rights under the California Consumer Privacy Act may write to studio@hosen.tokyo.

10. Contact

Questions about this Policy: studio@hosen.tokyo.