Legal
Privacy Policy
Effective 4 September 2026 · Last updated 4 September 2026
The short version: to sign you in we store your email address and nothing else that identifies you. We do not store a password, we never see your card details, and we run no advertising or analytics trackers on this site. You can read, export or permanently delete everything we hold from your account page at any time.
1. Who is responsible for your data
| Business operator | hakuba electronics |
|---|---|
| Website | hakubaelectronics.com |
| Registered address | Japan. The full registered address is provided without delay on request — please use the contact form or the email address below. |
| Privacy contact | privacy@hakubaelectronics.com |
2. What we collect
When you sign in or hold a service contract with us, we hold the following and nothing more:
- Email address — the address you sign in with.
- Display name — the name shown in the header. Derived from your email address at first sign-in; you may change it to anything you like.
- Service contract record — your plan, status, amount, billing period and contract reference.
- Sign-in security records — the times you signed in, plus your IP address and browser identifier stored only as an irreversible keyed digest.
What we deliberately do not collect
- No password — sign-in is by one-time link and code, so there is no password for us to store or for anyone to steal.
- No payment card data — card details go directly to a regulated payment provider and never touch our servers.
- No advertising, analytics or social tracking cookies, and no third-party tracking scripts.
- No sensitive personal information as defined by APPI art. 2(3).
3. Why we use it (purpose of use)
As required by APPI art. 17, the purposes of use are limited to the following. We will not use your information for any other purpose without first obtaining your consent.
- To sign you in and keep you signed in.
- To show and administer your service contract.
- To contact you about your account or your contract.
- To detect and prevent abuse of the sign-in system, and to respond to a security incident.
- To meet our obligations under Japanese law, including tax and accounting record-keeping.
For visitors in the EU/UK: our lawful bases under GDPR art. 6 are performance of a contract, legitimate interests, and legal obligation.
4. Cookies
This site sets exactly one cookie, and only after you sign in:
| Name | __Host-he_sess |
|---|---|
| Purpose | Keeps you signed in. It holds a random value with no meaning outside our server — your email address is not in it. |
| Lifetime | 30 days from your last visit, and no more than 90 days in total. Signing out deletes it immediately. |
| Consent | Strictly necessary to provide a service you asked for, so no consent banner is required. |
Your browser also keeps your language choice and your display name in local storage on your own device.
5. How long we keep it
| Sign-in codes and links | 15 minutes, then deleted automatically. |
|---|---|
| Sessions | Up to 30 days idle, 90 days maximum. |
| Security records | 90 days, then deleted automatically. |
| Account and contract | For as long as your account exists, then only what tax and accounting law requires. |
6. Who else sees it
We do not sell your personal information. We use the following service providers, each acting only on our instructions:
| Email delivery | An email delivery provider transmits your sign-in message. |
|---|---|
| Server hosting | Our server is hosted in Japan. Your data is stored in Japan. |
| Legal disclosure | Only where Japanese law requires it. |
If an email delivery provider processes data outside Japan, that transfer is covered by standard contractual protections.
7. How we protect it
- The whole site is served over HTTPS with HSTS.
- Sign-in tokens and session identifiers are stored only as cryptographic hashes.
- The session cookie is HttpOnly, Secure, SameSite and host-locked.
- The authentication service runs as an unprivileged, sandboxed account.
- Sign-in attempts are rate-limited, and codes are invalidated after five wrong guesses.
- The database is readable only by the service account.
8. Your rights
Under APPI arts. 33–35 and GDPR arts. 15–21 you have rights over your data. Most of this you can do yourself, immediately:
- See everything we hold — your account page lists it.
- Correct it — change your display name on the account page.
- Erase it — Delete my account removes everything immediately.
- Cut off access — Sign out of all devices.
For anything else, write to privacy@hakubaelectronics.com. We respond within 30 days, free of charge.
9. Children
This is a business service and is not directed at children. We do not knowingly create accounts for anyone under 16.
10. Changes to this policy
If we change this policy we will update the date at the top of this page.
11. Contact and complaints
Questions, requests and complaints: privacy@hakubaelectronics.com.
If you are not satisfied with our response, you may complain to Japan's Personal Information Protection Commission (ppc.go.jp).