Skip to content
Shopwise

Transfers of personal data outside Japan

Last updated: October 30, 2026

To provide Shopwise (the "Service"), Max Miyazaki ("we") provides your personal data to the third parties outside Japan listed below. Under Article 28 of Japan's Act on the Protection of Personal Information (APPI), we ask for your consent before doing so. This page sets out what you need to know before consenting: the countries, each country's system for protecting personal information, and the measures each company takes.

1. Countries: the United States and India

The countries in this section are where the companies that receive your personal data are. Where each company's facilities for storing and processing the data are is a separate matter, set out company by company in section 3.

  • Fly.io, Cloudflare, WorkOS, Anthropic, Plus Five Five (Resend), Google: US companies.
  • Stripe (only if you choose to pay): our contracting party is Stripe Japan, Inc. (ストライプジャパン株式会社), a Japanese company. The companies that receive and handle your personal data are Stripe, LLC in the United States and Stripe's affiliates in India (section 3).

In addition, under Stripe's contract, Stripe Payments Europe, Limited in Ireland handles personal data (section 3). The EU, which includes Ireland, is a country the Personal Information Protection Commission has designated under Article 15 of the APPI Enforcement Rules as having a system for protecting personal information at a level equivalent to Japan's. It is therefore not a "third party in a foreign country" under Article 28(1) of the APPI.

2. Each country's system for protecting personal information

The United States

From the Personal Information Protection Commission's survey of foreign systems for the protection of personal information (the United States):

  1. The United States participates in the APEC Cross-Border Privacy Rules (CBPR) system (since 25 July 2012).
  2. The United States has no comprehensive federal privacy law; there are federal laws that apply to specific sectors, and state laws.

Added on our own judgement (not in the Commission's survey):

  1. The United States has systems, such as Section 702 of the Foreign Intelligence Surveillance Act (FISA), that oblige companies to cooperate with government information-gathering. The Commission's survey shows "–" for systems that oblige companies to cooperate with government information-gathering in a way that may seriously affect individuals' rights; we tell you about this one anyway.

India

From the Personal Information Protection Commission's survey of foreign systems (India, updated 25 January 2022):

  1. India has no comprehensive law on the protection of personal information. Laws for specific areas include the Information Technology Act, 2000 and the rules made under it on reasonable security practices and sensitive personal data or information (2011).
  2. India has no EU adequacy decision and does not participate in the APEC Cross-Border Privacy Rules (CBPR) system.
  3. Of the eight principles of the OECD Privacy Guidelines, no provision was found for the accountability principle; the other seven are partly provided for.
  4. Under the Information Technology Act, the central government and others may require information for India's sovereignty and integrity, defence, the security of the state, friendly relations with foreign states, public order, and the prevention or investigation of related offences. The Commission's survey finds no provisions on limits and procedures for such access, approval by an independent body, limits on handling the information obtained, transparency, oversight, or remedies for people whose rights are infringed by unlawful access.

What has changed since the Commission's survey (checked by us in the notifications published in India's official gazette):

  1. In 2023 India enacted a comprehensive law on the protection of personal data, the Digital Personal Data Protection Act, 2023 (Act No. 22 of 2023). However, most of its provisions setting out businesses' obligations and individuals' rights apply from 13 May 2027, under a notification of 13 November 2025 (G.S.R. 843(E)). Until then, the laws in point 1 apply.

3. The companies, and the measures each takes

Fly.io, Inc. (United States)

  • Personal data provided: everything the Service stores (Privacy Policy section 2, items 1–4)
  • Purpose: running the Service and storing its data
  • Where it is stored:
    • The Service's database, and files uploaded for an import, are stored on Fly.io's servers in Japan (Tokyo).
    • Every day, Fly.io makes a full copy of that storage and keeps it in the United States for 7 days. Each copy holds the whole database and any uploaded files still kept at the time (up to 7 days' worth). Fly.io stores these copies with its own provider, Amazon Web Services (United States).
  • The company's measures:
    • Under its data processing agreement (DPA), Fly.io handles personal data only on our documented instructions, unless the law requires otherwise.
    • This agreement takes priority over Fly.io's terms of service (including the terms that let it use data to improve its services).
    • Fly.io deletes the data within 30 days after its service to us ends (encrypted backups may keep it for up to 90 days).
    • When Fly.io adds or changes a provider of its own, it announces this 30 days in advance.
    • Stored data, the copies and connections are all encrypted.
    • Fly.io states that it has a SOC 2 Type 2 report.

Cloudflare, Inc. (United States)

We use Cloudflare's services for the following two purposes.

Backups

  • Personal data provided: the Service's whole database (without uploaded files). Changes are sent every 15 seconds.
  • Purpose: backups (a spare copy so the Service's data is not lost)
  • Where it is stored: we ask for the Asia-Pacific region, and Cloudflare's dashboard currently shows the location as "Asia-Pacific". But Cloudflare follows this only on a best-effort basis and does not guarantee it. We do not use Cloudflare's setting that guarantees a location (a jurisdiction restriction). Cloudflare is a US company. Cloudflare also states that it uses Oracle (the United States, the EEA, the UK, Japan, Australia, Canada, Singapore) and Google (the EEA, the United States, Australia, India) for its developer services, so the data may be stored outside the Asia-Pacific region.
  • How long data stays: data you delete can remain here for about 25 days after you delete it. We make one copy of the database a day. Deleted data goes when the first copy made after the deletion (up to 1 day later) is deleted, together with everything older than it. That copy is deleted at our once-a-day check once it is more than 23 days old, so at most 24 days after it was made. Up to 1 day plus 24 days: about 25 days. In case our deletion stops for any reason, Cloudflare also deletes anything older than 26 days automatically (typically within 24 hours after that, Cloudflare says); in that case, up to about 27 days.

Forwarding support emails

  • Personal data provided: the emails you send to support@getshopwise.com (your email address, the subject, the text and any attachments)
  • Purpose: forwarding emails sent to support@getshopwise.com to our mailbox (Google's Gmail, below); Cloudflare calls this service Email Routing
  • Where: the emails pass through Cloudflare's facilities on their way to us. Cloudflare's privacy policy says it primarily stores information in the United States and the European Economic Area, and may transfer and access it from around the world.

The company's measures (the same data processing agreement applies to both purposes)

  • Under its data processing agreement (DPA), Cloudflare processes the data only to provide its services and on our written instructions, and never for marketing or advertising.
  • The same agreement requires the disks storing personal data to be encrypted. Cloudflare's public documentation says stored data is encrypted with AES-256 and connections with TLS.
  • The same agreement states that Cloudflare is certified under the Global CBPR system.

WorkOS, Inc. (United States)

  • Personal data provided: your email address; the login request (IP address, browser information, time)
  • Purpose: sending and confirming the login code
  • Where it is stored and processed: the United States (under its data processing agreement).
  • The company's measures: its DPA says it processes the data to provide the service under its contract with us and our instructions. It also says it may process the data to build or improve the quality of its services, to detect security incidents and to protect against fraud. The same agreement says it encrypts the data in transit and at rest where appropriate. It states that it is SOC 2 Type 2 certified.

Anthropic, PBC (United States)

  • Personal data provided: only the figures the Service calculated for a report and the Service's fixed wording. Never sent: any text you typed or imported (store names, notes, item and time-slot names, the headings and cells of an imported file) or your email address.
  • Purpose: writing the report's explanation
  • Where it is processed: the United States. We ask for processing in the United States, and in Anthropic's console our account is set to refuse processing anywhere else. On 21 October 2026 we confirmed from the live service that Anthropic refuses a request for processing outside the United States.
  • Where it is stored: in Anthropic's service, the place where data is stored (the workspace's storage location) is the United States. It is fixed when a workspace is created, and the United States is currently the only location offered. Anthropic's list of sub-processors, however, gives the location of its cloud infrastructure (Google Cloud, Amazon Web Services, Microsoft Azure) and of its traffic routing (Cloudflare) as "Worldwide", so it does not show that all storage and traffic stay within the United States.
  • How long it is kept: inputs and outputs are deleted within 30 days (up to 2 years if flagged as a possible breach of Anthropic's usage policy).
  • Support requests: Anthropic has contractors handle its users' support requests. We do not include your data in any request we send to Anthropic.
  • The company's measures: its DPA says it processes the data only to provide or maintain the services, on our documented instructions. Its terms say it does not train models on our data. The agreement requires encryption of stored data (at least AES-256) and of connections (TLS 1.2 or later). It states that it holds ISO 27001 certification and SOC 2 reports.

Stripe (only if you choose to pay)

  • Contracting party: Stripe Japan, Inc. (ストライプジャパン株式会社, corporate number 8010601046367)
  • Personal data provided: your email address, the name on receipts, billing country and address, the card details you type into Stripe's page, subscription, invoice and payment records. If you do not choose to pay, none of your data goes to Stripe.
  • Purpose: processing payments and renewals; keeping your card details; the page where you change your card; keeping the subscription, invoice and payment records; sending the email telling you your card is about to expire
  • Where it goes:
    • Stripe, LLC in the United States, and its affiliates and sub-processors (under Stripe's data processing agreement).
    • Stripe's affiliates in India. Stripe's privacy policy says it may transfer personal data to "the United States and India". Stripe's list of service providers says Stripe Technology India Private Limited (India) provides user support and internal operational support to other Stripe affiliates.
    • Stripe Payments Europe, Limited in Ireland, which Stripe's contract with Japanese businesses (such as us) makes an additional party solely to process personal data (for Ireland, see section 1).
  • The company's measures: its DPA says it processes the data on our behalf and on our instructions. It also says it uses the data for its own purposes to monitor and prevent fraud and to analyse, improve and develop its products and services. PCI DSS Level 1; SOC 1 and SOC 2 audits. It states that its privacy practices comply with the CBPR system.

Plus Five Five, Inc. (the Resend service, United States)

  • Personal data provided: your email address; the email's text (plan, price, dates, how to cancel; in the reminder before the first payment, the notice that a payment was received and the notice of a refund, the card brand and its last four digits)
  • Purpose: sending the Service's emails
  • Where it is stored and processed: the United States (under its data processing agreement). As for sending: in Resend's dashboard we set our domain's region to Tokyo, and the source of an email that actually arrived showed it was sent from ap-northeast-1 (Tokyo) (checked on 23 October 2026, under the current settings). But the list of sending addresses Resend publishes for our domain (its SPF record) also includes IP addresses in the United States (Amazon Web Services' US East region), so it is not guaranteed that every email is sent from Tokyo.
  • The company's measures: its DPA says it does not process the data beyond the purposes in the contract and our instructions. Usage data (including data that identifies the source and destination of an email, and activity logs) it handles as an independent controller, and may process to provide, optimise and maintain its services. Stored data is encrypted (AES-256) and connections are encrypted (TLS). It states that it is SOC 2 Type II compliant.

Google LLC (United States)

  • Personal data provided: the emails you send to support@getshopwise.com (your email address, the subject, the text and any attachments) and our replies
  • Purpose: receiving, keeping and answering your messages (we receive and answer support emails in Gmail, Google's service for individual users)
  • Where it is stored and processed: Google's privacy policy says: "We maintain servers around the world and your information may be processed on servers located outside of the country where you live."
  • How long it is kept: as in section 7 of the Privacy Policy.
  • The company's measures: we have no business data processing agreement with Google. We use Gmail as an individual user, under Google's terms of service and privacy policy. Google's privacy policy says it uses encryption to keep data private while in transit, and reviews its information collection, storage and processing practices, including physical security measures, to prevent unauthorised access to its systems.

4. Outside services that receive no personal data

Sentry (error reports, United States) and Better Stack (downtime alerts; a US company that processes data mainly in the EU) are set up so that they receive no personal data (Privacy Policy section 5).

5. About your consent

  1. We ask for your consent before you log in (before the login moves to WorkOS). We record when you gave it and the version of this page. As the law requires (APPI Article 29), we keep your email address and the version of this page you agreed to for 3 years after you delete your account.
  2. Without your consent, the Service cannot be used: WorkOS handles the login itself, and Fly.io stores the data.
  3. If this page changes, we ask for your consent again the next time you open the Service.
  4. We accept requests to stop these transfers as described in section 9 of the Privacy Policy. The Service cannot be provided without them (paragraph 2), so we cannot stop the transfers while you continue to use it. If you ask, we tell you so and, if you wish, you stop using the Service and we delete your account and data. Nothing more is provided to these companies after that (what we must keep by law after deletion is in section 7 of the Privacy Policy).

Back to the home page