Privacy Policy

Last updated 27 September 2026

SORAH Inc. (we, us) sets out below how we handle personal information across the websites, applications and online store we operate, and the program we run to publish our own work to our own social media accounts (together, the Services).

This policy applies to sorah.io, shop.sorah.io, the SORAH app, and our publishing program.

1. Who we are

Company: SORAH Inc.
Head office: 3-9-8 Shimoochiai, Shinjuku-ku, Tokyo, Japan
Representative: Shunsuke Kamata
Contact: info@sorah.io

2. Information we collect

Server logs — when you visit the Services, our hosting provider records the IP address, browser type, referring URL and time of access.
Language preference — your choice of display language is stored in NEXT_LOCALE and scape-language-preference cookies. They are not used to track browsing behaviour.
Newsletter — when you subscribe we collect your email address and chosen language.
Online store — when you place an order we collect your name, delivery address, email address and order details. Payment details are handled directly by the payment provider and are not retained by us.
Enquiries — when you contact us by form or email, we collect your organisation, contact name, email, message, artworks of interest, requested quantity and timing, and consent to submit the enquiry.

On the Japanese and English corporate pages of sorah.io, we load Google Analytics 4 through Google Tag Manager only with your consent. Page views, referrers, visit times, device and browser information, and usage such as scrolling are sent to Google to help us improve the site. Names, email addresses and enquiry messages entered into our forms are not sent as analytics data. Advertising measurement and Google signals are not enabled.

3. Use of social media APIs

We use the APIs provided by social media platforms (Pinterest, Instagram, Threads, YouTube, Bluesky and similar) for one purpose only: to publish content we have created to social media accounts that we ourselves own and operate.

What we obtain — the access token issued when we authorise our own account via OAuth, and the identifiers of our own account, boards and channels needed to address a post.
What we do not obtain — no other user profiles, posts, followers, messages or other personal data. Our application never asks any person other than us to authorise it.
What we do not store — we do not accumulate information obtained from these APIs in our own database. We call the API each time the information is needed.
Token storage — access and refresh tokens are held as encrypted GitHub Actions secrets and managed only by our own staff. They are never disclosed, shared or sold to third parties.
Human selection — every item published is reviewed and selected individually by our staff before it goes out. We do not publish indiscriminately.
Revoking access — authorisation of our application can be revoked at any time from the account settings of each platform. Once revoked, we can no longer publish to that account.

4. Why we use this information

To provide, maintain and improve the Services
To sell and ship products
To send the newsletter and announcements
To respond to enquiries
To publish to our own social media accounts
To meet legal obligations

5. Sharing and processors

We do not disclose personal information to third parties without consent, except where required by law. The following providers process data on our behalf in order to run the Services.

Vercel Inc. (USA): Website hosting and server logs
Google LLC (USA): Consent-based website analytics (Google Analytics 4) and tag management. Google Privacy Policy: https://policies.google.com/privacy
Klaviyo, Inc. (USA): Newsletter delivery and wholesale enquiry management. Enquiries do not subscribe you to the newsletter.
Shopify Inc. (Canada): Online store and order processing
Cloudflare, Inc. (USA): Delivery of images and data files
Neon Inc. (USA): Storage of site data
GitHub, Inc. (USA): Storage of source code and credentials
Social media platforms: Publishing to our own accounts

6. International transfers

The providers listed above are located outside Japan. We transfer personal information under the contracts we hold with them and the safeguards each provider offers.

7. Retention

Newsletter subscriptions — until you unsubscribe
Order records — for the period required by law
Server logs — for the retention period of our hosting provider
Enquiries — for a reasonable period after the matter is resolved

8. Your rights

You may ask us to disclose, correct, add to, delete or suspend the use of the personal information we hold about you, and to stop providing it to third parties.

If you are in the European Economic Area or the United Kingdom, the General Data Protection Regulation gives you the right to access, rectification, erasure, restriction of processing, data portability and objection, and the right to lodge a complaint with a supervisory authority.

To make a request, write to info@sorah.io.

9. Cookies

sorah.io uses NEXT_LOCALE and scape-language-preference cookies to remember your display language. Your analytics choice is saved for 180 days in browser local storage (sorah.analytics-consent.v1).

Google Analytics cookies (_ga and _ga_*) are used only after you allow analytics. Google measurement tags are not loaded before consent or when you decline. You can change your choice at any time using Cookie settings in the footer. Withdrawing consent stops further measurement and clears this site's analytics cookies. You can browse and submit forms without allowing analytics. This preference is independent of the separately operated Data Scape and online store cookie settings.

On the online store at shop.sorah.io, Shopify uses cookies for the shopping cart and session management.

10. Children

The Services are not directed at people under 16. If we learn that we have collected personal information from someone under 16, we will delete it promptly.

11. Security

We encrypt data in transit, store credentials in encrypted form and limit access rights, in order to protect personal information against unauthorised access, loss, destruction, alteration and disclosure.

12. Changes to this policy

We revise this policy when needed. Where a change is material, we will state the change and its date on this page.

13. Contact

For questions about this policy or about how we handle personal information, please contact us.

Company: SORAH Inc.
Head office: 3-9-8 Shimoochiai, Shinjuku-ku, Tokyo, Japan
Email: info@sorah.io