Privacy Policy
Last updated: October 30, 2026
Max Miyazaki ("we", "us") handles the personal information entrusted to us in "Shopwise" (the "Service") as follows, in accordance with Japan's Act on the Protection of Personal Information ("APPI") and other laws.
1. Who we are
- Operator: Max Miyazaki (sole proprietor, Japan)
- Address: We will disclose it without delay upon request.
- Contact: support@getshopwise.com
2. What we hold
- Account information: your email address, when the account was created and when you last logged in, your language setting, and when you consented to the transfers outside Japan (section 6) with the version of the page shown before it, when you agreed to the Terms of Service and which version, when a change to the Terms was shown to you and which version, and when you agreed on the subscription page. There is no password.
- Login records: what keeps you logged in (a random string in a browser cookie; our database stores only a value calculated from it). When you request a login, your IP address is used briefly, only in our server's memory and never stored, to stop repeated requests. Login emails are sent and confirmed by an outside login service (WorkOS), which receives your email address, IP address, browser information and the time.
- What you enter or import: store names and settings, monthly figures (sales, costs, customer counts and so on), optional data (cash at month end, sales by time of day and by item, item and time-slot names), change history, and the reports made. Files you upload for an import are deleted after 7 days. If you include a person's name in a store name or similar, we treat it as personal information too.
- Payment information (only if you choose to pay): the name on receipts (your name or shop name), your billing country and address (as the payment service Stripe gives them to us), the card's issuing country, the date, amount, currency and invoice number of each payment, and the state of your subscription. Card numbers and other card details are handled by Stripe; we never receive them.
- Your messages: emails you send to support@getshopwise.com and our replies. They reach our mailbox (Google's Gmail) through Cloudflare and are kept there.
- Requests for the legal disclosure under the Act on Specified Commercial Transactions (when, and the record of sending): when the request was made and when it was sent, the language, and the number the email service gave that email. The email address you enter is used only to send the disclosure and is not stored (it is held only in our server's memory, for up to 24 hours, so that one address gets it at most once a day). To stop repeated requests, your IP address is used briefly, only in memory, and never stored.
We use no analytics, advertising or tracking (no analytics tools, ad tags, tracking scripts, external fonts or CDN).
3. Why we use it
- To provide the Service (login, storing data, making reports, exporting data).
- To charge for the Service, issue receipts, and keep payment records for accounting and tax.
- To record your billing country as the basis for how Japanese consumption tax applies.
- To keep the Service safe (preventing misuse, investigating failures).
- To answer your questions and send important notices about the Service (prices, changes to the terms and so on).
- To maintain and improve the Service (only through totals that identify no one).
- To answer requests for the legal disclosure under the Act on Specified Commercial Transactions.
We do not sell your information or use it for advertising.
4. Sharing with others
We do not provide personal information to others without your consent, except:
- where the law requires it;
- where needed to protect someone's life, body or property and consent is hard to obtain;
- when we entrust its handling to the outside services in section 5, as far as needed to run the Service.
5. Outside services we use
Each receives only what it needs for the Service to work.
| Service | What it receives | Why | Country / where stored |
|---|---|---|---|
| Fly.io (US company) | Everything the Service stores (section 2, items 1–4) | Runs the Service and stores its data. Under its data processing agreement, Fly.io handles the information only on our instructions, unless the law requires otherwise | Database and uploaded files: Japan (Tokyo). Their daily copies (kept 7 days): United States. Company in the US |
| Cloudflare (US company) | The Service's whole database (without uploaded files), copied continuously every 15 seconds; emails sent to support@getshopwise.com | Backups; forwarding emails sent to support@getshopwise.com to our mailbox (Email Routing) | Backups: Asia-Pacific location requested (not guaranteed; we do not use Cloudflare's guaranteed-location setting). Forwarding: the emails pass through Cloudflare's facilities (its privacy policy says it primarily stores information in the US and the European Economic Area). Company in the US. It also answers DNS for our domain; the Service's pages do not pass through it |
| WorkOS (US company) | Email address; the login request (IP address, browser information, time) | Sends and confirms the login code | United States |
| Anthropic (US company) | Only the figures the Service calculated for a report and the Service's fixed wording. Never any text you typed or imported (store names, notes, item and time-slot names, the headings and cells of an imported file) or your email address | Writes the report's explanation | Processed in the US (set to refuse processing anywhere else). Stored in the US (the location of its sub-processors' cloud infrastructure is given as "Worldwide"). Inputs and outputs deleted within 30 days (up to 2 years if flagged as a possible breach of its usage policy) |
| Stripe (contracting party: Stripe Japan, Inc.) | Email address, the name on receipts, billing country and address, the card details you type into Stripe's page, subscription, invoice and payment records | Processes payments and renewals, keeps your card details, provides the page where you change your card, keeps the subscription, invoice and payment records, and sends the email telling you your card is about to expire | The United States (Stripe, LLC) and India (Stripe's affiliates); Stripe Payments Europe, Limited in Ireland also handles it. Only if you choose to pay |
| Sentry (US company) | Only the type of an error, where in the program it happened, and the kind of page (e.g. /app/stores/{store_id}). No figures, names or email addresses | Tells us something failed | United States |
| Better Stack | Only the answer of the Service's health-check address and a regular signal from the server. No customer information | Tells us the Service is down | A US company that processes data mainly in the EU. Receives no customer information |
| Google (US company) | Emails sent to support@getshopwise.com and our replies | Receiving, keeping and answering your messages (Gmail for individual users; we have no business data processing agreement with Google) | Google's privacy policy says its servers are around the world and information may be processed outside the country where you live |
| Resend (US company) | Email address; the email's text (plan, price, dates, how to cancel; in the reminder before the first payment, the notice that a payment was received and the notice of a refund, the card brand and its last four digits) | Sends the confirmation emails for subscribing, cancelling and changing the plan, the notice that a payment was received (with a link to the receipt), the notice of a refund, the reminders before the first payment and before a yearly renewal, and the notice when a payment has not gone through; sends the legal disclosure under the Act on Specified Commercial Transactions to the email address that requested it | United States (records are stored in the US; sending is set to Tokyo, but it is not guaranteed that every email is sent from Tokyo) |
6. Transfers to companies outside Japan
We provide personal data to third parties in the United States and India through the companies in section 5 (except Sentry and Better Stack) with your consent (APPI Art. 28(1); India is Stripe's affiliates). We ask for it before you log in, and record when you gave it and the version of the page shown before it. The countries, their systems for protecting personal information and the measures each company takes are on Transfers of personal data outside Japan. Without your consent, the Service cannot be used.
7. How long we keep it
| Information | How long |
|---|---|
| Account, stores, monthly figures, reports, change history | Until you delete your account (or the store or report). We never delete them automatically |
| Backups of deleted data | Up to 30 days after deletion (encrypted backups; then erased). Fly.io's daily copies go after 7 days, and Cloudflare's backup after about 25 days as a rule, or about 27 if our deletion stops (Transfers of personal data outside Japan). 30 days is the outer bound, allowing for Cloudflare's automatic deletion, which it says happens "typically" within 24 hours |
| Files uploaded for an import | 7 days |
| Support emails (including our replies) | We handle them not one email at a time but by conversation (the run of emails that follow one another under the same subject). Once a month, we delete every conversation that holds an email more than a year old, our replies included (so the oldest email stays up to about 1 year and 1 month, and newer emails in the same conversation can be deleted before they are a year old). Conversations about payments, refunds, receipts or invoices are kept for the same period as the payment and refund records below. Deleting your account does not delete these emails |
| Records of requests for the legal disclosure under the Act on Specified Commercial Transactions (when, and the record of sending; no email address) | 1 year |
| Server logs (built not to contain customer information) | 7 days |
| Error reports | 30 days |
| Payment and refund records (what the receipts and refund statements show — the name on them, the plan, the period, the date, amount and currency of each payment and refund, the invoice and refund statement numbers — and the time zone their dates are shown in, billing country and address, the card's issuing country, why we made a refund, the numbers Stripe gives you, your invoices and your refunds, and your account number in our records) | The period the law sets for keeping accounting records (7 years from the day after the tax-return deadline for the year of the transaction). After you delete your account, only these are kept, for accounting and tax |
| Records of transfers to third parties outside Japan (your email address and the version of the page you agreed to) | 3 years after the account is deleted (kept under APPI Art. 29; then erased) |
| Records Stripe keeps | According to Stripe's privacy policy |
8. How we keep it safe
- Organisation: only the operator handles personal information. Written rules say what may be sent to outside services and what is never logged.
- People: the operator keeps up with the laws and rules on personal information.
- Physical: data is stored in outside providers' data centres with physical security. But once a month, to make sure the backup can be restored, the operator restores it temporarily on the operator's own computer and deletes it as soon as the check is done.
- Technical: all connections to the Service are encrypted (HTTPS). Stored data and backups are encrypted. Each customer's data is kept separate and reachable only from that customer's account. Logs and error reports are designed not to record customers' figures, names or email addresses. This is checked continuously by automated tests. There are no passwords. The Service's administrator pages show only totals such as counts, and the administrator's account cannot see other customers' data either; this is how it is built, and automated tests check it continuously. The operator, however, as the person responsible for running and restoring the Service, has access to the server and the backups, and can see the customers' data there.
- Foreign environment: we use US companies and, through Stripe, provide personal data to the United States and India, as in section 6. Both countries' systems for protecting personal information are on Transfers of personal data outside Japan.
9. Your rights
- You can ask us to tell you how we use your personal information, to disclose it, correct, add to or delete it, stop using or erase it, or stop providing it to others. You can also ask us to disclose the records of transfers to third parties outside Japan (section 6).
- Much of this you can do yourself in the Service (export your data, delete data and your account).
- For anything else, email support@getshopwise.com. After confirming it is you, we respond without delay, free of charge.
- We disclose in electronic form, or in another way if you ask for one.
- If we cannot do all or part of what you ask, we tell you so and why.
- You can also ask us to delete your support emails (section 7). Emails about payments, refunds, receipts or invoices, however, tax law requires us to keep, so we cannot delete them until that period ends.
10. Cookies
The Service uses only the cookies it needs to work; none for advertising or tracking.
| Name | Purpose | Duration |
|---|---|---|
| sw_session | Keeps you logged in | The login ends 30 days after you last used it (the cookie itself lasts up to the browser limit of 400 days) |
| sw_csrf | Stops forged form submissions | Until the browser is closed |
| sw_lang | Remembers your language before you log in | 1 year |
| sw_login | Checks the login while it is in progress | 10 minutes |
11. Customers in the United States
We do not sell your personal information or share it for targeted advertising. To use a right under a US state law, contact us as in section 9.
12. Changes to this policy
We announce the changed text and its effective date in the Service. Important changes are also sent to your registered email address.
13. Contact
support@getshopwise.com
14. Language
The Japanese version of this policy governs. This English version is a translation for reference; where they differ, the Japanese version prevails.