Privacy Policy

Last updated 6 September 2026

SORAH Inc. (we, us) sets out below how we handle personal information across the websites, applications and online store we operate, and the program we run to publish our own work to our own social media accounts (together, the Services).

This policy applies to sorah.io, shop.sorah.io, the SORAH app, and our publishing program.

1. Who we are

Company: SORAH Inc.
Head office: 3-9-8 Shimoochiai, Shinjuku-ku, Tokyo, Japan
Representative: Shunsuke Kamata
Contact: info@sorah.io

2. Information we collect

Server logs — when you visit the Services, our hosting provider records the IP address, browser type, referring URL and time of access.
Language preference — your choice of display language is stored in a cookie named NEXT_LOCALE. It is not used to track browsing behaviour.
Newsletter — when you subscribe we collect your email address and chosen language.
Online store — when you place an order we collect your name, delivery address, email address and order details. Payment details are handled directly by the payment provider and are not retained by us.
Enquiries — if you write to us, the content of your message and your contact details.

We do not run analytics tools, advertising trackers or behavioural targeting cookies on sorah.io.

3. Use of social media APIs

We use the APIs provided by social media platforms (Pinterest, Instagram, Threads, YouTube, Bluesky and similar) for one purpose only: to publish content we have created to social media accounts that we ourselves own and operate.

What we obtain — the access token issued when we authorise our own account via OAuth, and the identifiers of our own account, boards and channels needed to address a post.
What we do not obtain — no other user profiles, posts, followers, messages or other personal data. Our application never asks any person other than us to authorise it.
What we do not store — we do not accumulate information obtained from these APIs in our own database. We call the API each time the information is needed.
Token storage — access and refresh tokens are held as encrypted GitHub Actions secrets and managed only by our own staff. They are never disclosed, shared or sold to third parties.
Human selection — every item published is reviewed and selected individually by our staff before it goes out. We do not publish indiscriminately.
Revoking access — authorisation of our application can be revoked at any time from the account settings of each platform. Once revoked, we can no longer publish to that account.

4. Why we use this information

To provide, maintain and improve the Services
To sell and ship products
To send the newsletter and announcements
To respond to enquiries
To publish to our own social media accounts
To meet legal obligations

5. Sharing and processors

We do not disclose personal information to third parties without consent, except where required by law. The following providers process data on our behalf in order to run the Services.

Vercel Inc. (USA): Website hosting and server logs
Klaviyo, Inc. (USA): Newsletter delivery
Shopify Inc. (Canada): Online store and order processing
Cloudflare, Inc. (USA): Delivery of images and data files
Neon Inc. (USA): Storage of site data
GitHub, Inc. (USA): Storage of source code and credentials
Social media platforms: Publishing to our own accounts

6. International transfers

The providers listed above are located outside Japan. We transfer personal information under the contracts we hold with them and the safeguards each provider offers.

7. Retention

Newsletter subscriptions — until you unsubscribe
Order records — for the period required by law
Server logs — for the retention period of our hosting provider
Enquiries — for a reasonable period after the matter is resolved

8. Your rights

You may ask us to disclose, correct, add to, delete or suspend the use of the personal information we hold about you, and to stop providing it to third parties.

If you are in the European Economic Area or the United Kingdom, the General Data Protection Regulation gives you the right to access, rectification, erasure, restriction of processing, data portability and objection, and the right to lodge a complaint with a supervisory authority.

To make a request, write to info@sorah.io.

9. Cookies

sorah.io uses one cookie, NEXT_LOCALE, to remember your display language. You can disable cookies in your browser, in which case your language choice will not be remembered.

On the online store at shop.sorah.io, Shopify uses cookies for the shopping cart and session management.

10. Children

The Services are not directed at people under 16. If we learn that we have collected personal information from someone under 16, we will delete it promptly.

11. Security

We encrypt data in transit, store credentials in encrypted form and limit access rights, in order to protect personal information against unauthorised access, loss, destruction, alteration and disclosure.

12. Changes to this policy

We revise this policy when needed. Where a change is material, we will state the change and its date on this page.

13. Contact

For questions about this policy or about how we handle personal information, please contact us.

Company: SORAH Inc.
Head office: 3-9-8 Shimoochiai, Shinjuku-ku, Tokyo, Japan
Email: info@sorah.io