Kakera Art Privacy Policy
- Version: Draft 0.1
- Effective date: 2026-09-01
1. Controller
The controller is AWAWAWAWA Inc., trading as Kakera Art, at 2F-C, SibuyaDogenzakaToukyu Bld., Dogenzaka, Shibuya Ku, Tokyo, 150-0043, Japan.
Contact: privacy@kakera.art.
2. Scope and data we collect
We may collect:
- launch waitlist data, collected before the service opens: email address, country or region, the consents given, and the time they were given. An optional survey may add the plans a person is interested in and the artists they would like to see. The waitlist requires no purchase, and the email address is used only to send launch and artist announcements until the person unsubscribes or the waitlist is closed. Unsubscribing removes the address from further sending; deleted within 30 days, apart from a minimal suppression record (a hash of the address) kept so that the unsubscribe is honoured;
- request data: name, email, country, Artist/plan, brief, reference files, budget, desired timing, referral source, and the private-artwork option where selected. The order form asks the Customer to confirm they are 18 or over; we record only that the confirmation was given as part of accepting the Terms, and do not collect a date of birth or age;
- contact form data: the name, contact address, enquiry category, and message a person submits, together with anything they later send by replying to our acknowledgement — for a shipping incident this typically includes photographs of the artwork, its packaging, and the shipping label, which shows the recipient's name and address. The form itself accepts no file uploads;
- order data: Order Summary, communications, approvals, revision history, payments, refunds, and support records;
- delivery data collected only when needed: recipient name, address, telephone, carrier instructions, and a legally required customs identifier (for example, a Korean personal customs clearance code);
- technical data: IP address, request time, browser/device information, security logs, and essential cookie or session data;
- payment status and transaction identifiers from Stripe. Stripe receives card information directly; we do not store the full card number.
Do not submit unnecessary sensitive information. Reference images and briefs may reveal health, ethnicity, religion, sexuality, biometric characteristics, or other sensitive information. Submit such information only where necessary and lawful and where you have authority to do so.
3. Purposes and legal bases
| Purpose | Typical legal basis |
|---|---|
| Review a request and provide a quotation | Steps requested before entering a contract |
| Answer a contact form enquiry and investigate a shipping incident | Steps requested before entering a contract; performance of a contract; legal obligation for insurance and customs records |
| Accept, produce, approve, charge, deliver, and support a Commission | Performance of a contract |
| Payment security, fraud prevention, service security, and legal claims | Legitimate interests; legal obligation where applicable |
| Customs, tax, accounting, and export records | Legal obligation |
| Publish the artwork, unless the Customer selected the private option | Contractual permission/legitimate interests for non-personal artwork; consent where identifiable personal data requires consent |
| Send launch and artist announcements to the waitlist | Consent given when joining the waitlist |
| Send marketing messages | Consent or another basis permitted by applicable law |
We do not use solely automated decision-making that produces legal or similarly significant effects.
4. Recipients and service providers
We disclose only data reasonably necessary for the stated purpose to:
- the selected Artist and authorised Kakera Art operations personnel;
- Stripe, for payment processing and fraud prevention;
- Resend, for transactional email;
- DHL or the carrier identified for the order, and customs authorities/brokers, for delivery and customs clearance;
- Neon / Databricks, for managed database hosting;
- Vercel, for application hosting;
- Cloudflare, for DNS, network delivery, and security;
- professional advisers, insurers, banks, payment networks, regulators, courts, or law-enforcement bodies where lawfully necessary.
These providers may act as processors, independent controllers, or both depending on the activity. Their own privacy notices may also apply.
5. International transfers
Kakera Art is operated from Japan, so data submitted from another country is transferred to Japan. The European Commission adopted Decision (EU) 2019/419 recognising Japan as adequate for covered transfers to qualifying Japanese private-sector recipients. UK transfers rely on the applicable UK adequacy framework where its scope covers the transfer.
Some providers process data in the United States or other countries. Japan’s adequacy status does not by itself remove the requirements for those onward transfers. Where required, we use the provider’s data-processing terms and an applicable transfer mechanism, such as the EU Standard Contractual Clauses, UK Addendum/IDTA, or a valid adequacy or Data Privacy Framework mechanism, together with supplementary measures where appropriate.
6. Retention
We keep data only for as long as necessary, for the following periods:
| Data | Retention period |
|---|---|
| Launch waitlist registration and optional survey answers | Until unsubscribe or closure of the list, then deleted within 30 days, apart from a minimal suppression record kept to honour the unsubscribe |
| Contact form enquiries and the email thread that follows | 2 years after the enquiry is closed, or with the order record where it concerns an order |
| Rejected, withdrawn, or expired request with no contract | 6 months after closure |
| Active Commission files and communications | During production and for 2 years after delivery, unless needed longer for a dispute |
| Tax, accounting, payment, contract, customs, and export-evidence records | 7 years from the legally relevant date, or longer only where law requires |
| Reference files not required as legal records | Delete within 90 days after delivery or cancellation |
| Security and access logs | 90 days, unless needed to investigate an incident |
| Publication permission record | While the artwork is published and for a reasonable period needed to document the permission |
A deletion request does not require us to erase data that we must retain to comply with law, establish or defend legal claims, or exercise another applicable exemption. We restrict such retained data to the permitted purpose and delete or anonymise it when the basis ends.
7. Rights
Depending on applicable law, a person may request access, correction, deletion, restriction, objection, or portability; withdraw consent prospectively; and complain to a data-protection authority. Email privacy@kakera.art. We may verify identity and may refuse or limit a request where law permits. For EU/UK requests, we generally respond within one month, subject to lawful extensions.
EU/EEA individuals may complain to the supervisory authority in their country. UK individuals may complain to the Information Commissioner’s Office. Individuals in Japan may contact Japan’s Personal Information Protection Commission. The right to complain is not affected by contacting us first.
8. Publication choice
The publication choice concerns the finished artwork, not publication of the Customer’s identity — the Customer's real name and contact details are never published. Publication is the default, and the order form offers a private option that excludes the artwork from publication. A Customer can select that option, or withdraw a previous consent to publication, before first publication by contacting us. Where a published work is personal data and consent is the legal basis, consent may be withdrawn for future processing. Removal cannot guarantee deletion of copies independently reshared by third parties.
9. Security
We use reasonable technical and organisational safeguards appropriate to the nature and risk of the data. No internet system is completely secure. If a breach creates a notification obligation, we will notify affected individuals and authorities as required by applicable law.
10. Children
The service is not offered to persons under 18, and we do not knowingly accept their orders or intentionally collect their data. Contact us if data was submitted by a minor.
11. Cookies and analytics
The site uses only cookies or local storage strictly necessary for security, language, forms, and checkout. If optional analytics, advertising, or cross-site tracking is added, this section and the consent interface must be updated before activation.
12. Changes
We may update this Policy and will post the new version, effective date, and a summary of material changes. Where required, we will give additional notice or seek consent.
13. Language
The English version is controlling. The Japanese translation is provided for review and convenience, except where mandatory law requires otherwise.