Privacy Policy

1. Who we are

Inari Stationery Strategy ("Inari", "we", "us") operates stationerystrategy.com and the member tools available from it. We are the business responsible for deciding how your personal information is handled (the "controller" under GDPR-style rules, and the "personal information handling business operator" under Japan's APPI).

Questions, requests or complaints: inaristationery@gmail.com.

2. Information we collect

We only collect what the service needs to work.

• Information you give us: name, email address, preferred email language, quiz answers, pathway notes, product and cost data you enter into the Cost & Price Studio, course progress, and any message you send us.
• Account information: email address and a hashed password (we never see or store your password in readable form). If you sign in with Google, we receive your name, email address and profile image.
• Purchase information: order ID, product purchased, amount, currency, country and tax status. Card numbers are handled entirely by our payment provider — we never receive or store them.
• Usage information: pages visited inside the member area, feature usage, approximate location derived from IP address, browser and device type, and timestamps.

3. Why we use it (purposes of use)

Under APPI Article 17 we must specify our purpose of use. We use personal information only for the purposes listed below, and we will notify you before using it for any new purpose.

• To create and operate your account and deliver the products you purchased
• To generate and store your GO Global Quiz results and personal pathway
• To send transactional email (receipts, password resets, account notices)
• To send the weekly newsletter and educational email in the language you chose — only with your consent, and you can withdraw it at any time
• To provide customer support and answer your messages
• To detect fraud and abuse, and to keep the service secure
• To meet tax, accounting and legal record-keeping obligations

4. Legal bases (U.S., Japan, EU/UK visitors)

In Japan, we rely on your consent and on the specified purposes of use above. In the EU/UK, we rely on contract performance (delivering purchased products), legitimate interests (security, service improvement), consent (marketing email and non-essential cookies) and legal obligation (tax records). U.S. state laws do not require a legal basis, but we honour the rights described in section 8.

5. Who we share it with

We do not sell your personal information, and we do not share it for cross-context behavioural advertising. We use a small number of processors ('subcontractors' under APPI Article 27) who are bound by contract to process data only on our instructions:

• Supabase — database, authentication and file storage
• Cloudflare — hosting, content delivery and security
• Paddle — payment processing and merchant of record for purchases (Paddle is the seller of record and handles sales tax, VAT and Japanese consumption tax)
• Resend — transactional and newsletter email delivery
• Google — optional sign-in, if you choose it

6. International transfer of data

Our servers and processors are located in the United States and the European Union. If you are in Japan, this means your personal information is transferred outside Japan, and by using the service you consent to that transfer under APPI Article 28. We take reasonable measures to ensure our processors maintain protection equivalent to Japanese standards, including written data processing agreements and Standard Contractual Clauses where applicable. Information about the personal information protection systems of the destination countries is available on request.

7. How long we keep it

Account, pathway, course-progress and Cost & Price Studio data is kept while your account is active and for 30 days after deletion, so accidental deletions can be reversed. Quiz submissions are kept for 24 months. Purchase and tax records are kept for 7 years, as required by U.S. and Japanese tax rules. Newsletter records are kept until you unsubscribe, plus a suppression record so we do not email you again.

8. Your rights

Wherever you live, you can ask us to do the following, free of charge, by emailing inaristationery@gmail.com. We respond within 30 days and will never discriminate against you for exercising a right.

• Access — get a copy of the personal information we hold about you
• Correction — fix anything inaccurate
• Deletion — delete your account and associated data (except records we must keep for tax or legal reasons)
• Portability — receive your data in a machine-readable format
• Opt out — unsubscribe from marketing email, or object to a particular use
• Suspension of use or third-party provision — an additional right under APPI Article 35
• Complain — to Japan's Personal Information Protection Commission (PPC), or to your U.S. state attorney general

9. Do Not Sell or Share / Global Privacy Control

We do not sell or share personal information as those terms are defined in the California Consumer Privacy Act (CCPA/CPRA) or in the Virginia, Colorado, Connecticut, Texas and other U.S. state privacy laws. We honour Global Privacy Control (GPC) browser signals as an opt-out request. We do not knowingly process sensitive personal information for inference or profiling.

10. Children

The service is for business owners and is not directed at children. We do not knowingly collect personal information from anyone under 16 (or under 15 in Japan without guardian consent). If you believe a child has given us information, email us and we will delete it.

11. Security

Data is encrypted in transit (TLS) and at rest. Access to production data is restricted, database rows are protected by row-level security so members can only reach their own records, and passwords are stored using industry-standard hashing. No system is perfect: if a breach affects your rights, we will notify you and Japan's PPC without undue delay, as APPI Article 26 requires.

12. Changes to this policy

If we make a material change we will post the new version here and email registered members before it takes effect. The date at the top of this page always reflects the current version.