Privacy Policy

• Account Information: name, email address, phone number, password, and profile preferences.
• Transaction Information: billing and shipping addresses, payment details (credit card, PayPal, Apple Pay, Google Pay), and order history.
• Communication Data: messages, inquiries, feedback, and customer support correspondence.
• Letter Sign-Up: if you sign up for our letter (Sunday Stillness), your email address, the language and the form you signed up from, the version of the consent wording you saw, and when you consented, confirmed and unsubscribed. We do not store your IP address with it.
• Virtual Try-On Information: if you choose to use virtual try-on, the full-length photo you upload, the images generated from it, your height and weight (if you enter them), and any request you write for the image. See “Virtual Try-On” below.
• Identity Verification: government-issued ID or documentation when required for high-value transactions or regulatory compliance.

• Device Data: IP address, browser type and version, operating system, device identifiers, screen resolution, and language preferences.
• Usage Data: pages viewed, products browsed, search queries, click patterns, referral URLs, session duration, and interaction timestamps.
• Location Data: approximate geographic location derived from your IP address.
• Cookies & Tracking: see the “Cookies & Tracking Technologies” section below.

• Payment Processors: transaction confirmation and fraud prevention data from Shopify, Stripe, or other providers.
• Social Login: basic profile information when you sign in via Google or other OAuth providers.
• Blockchain Networks: publicly available on-chain data such as wallet addresses and transaction records.
• Analytics Providers: aggregated usage insights from services such as Google Analytics.

Transactions recorded on a blockchain (e.g., Ethereum, Polygon) are public and permanent. Your wallet address and transaction history are visible on the public ledger. We cannot modify, delete, or restrict access to this data once recorded.

We use Web3Auth for wallet generation and authentication. This utilizes Multi-Party Computation (MPC) technology, ensuring a non-custodial experience where we do not have access to your private keys. We do not store your private keys, seed phrases, or full wallet credentials.

Your profile information (email, display name) is stored in Supabase, separate from your on-chain assets. Off-chain metadata may be stored on IPFS or centralized servers.

NFTs and tokenized assets offered by SOWAKA are digital certificates of authenticity, provenance, or membership — they are not offered as financial investments. We comply with applicable regulations in each jurisdiction where we operate, including but not limited to the EU Markets in Crypto-Assets Regulation (MiCA), Japan's Payment Services Act and Financial Instruments & Exchange Act (FIEA), Singapore's Payment Services Act, and applicable U.S. federal and state laws. We may be required to collect additional identity information for NFT/RWA transactions to comply with Anti-Money Laundering (AML) and Know Your Customer (KYC) requirements.

• Your photo: the full-length photo you upload.
• Generated images: the try-on images created from your photo and the product image.
• Height and weight (optional): used to suggest a size and, if you order, passed to the maker.
• Your request (optional): any text you write to describe the image you want, such as the colour, pose or setting. It is sent to Google with your photo to create the image. We do not store it or record it in our logs.
• Usage records: when you used try-on, kept so we can enforce daily limits and prevent misuse.

Your photo, the product image and any request you write are sent to Google's Gemini API, which returns the generated image. We use Google's paid service, under which Google does not use your images to train its models; Google may keep request data for a limited period to detect abuse, as described in its terms. Generated images are an illustration only — orders are based on measurements, not on the image.

We do not use your photo to identify you, and we do not create facial or other biometric templates from it.

Your photos and generated images are stored in a private storage area that only you can access through your account. They are kept for up to one year and then deleted. You can delete any image, or all of them, from your account at any time; deleting everything also withdraws your consent. Withdrawing consent does not affect images generated before you withdrew it.

Google LLC is based in the United States, and processing may take place in the United States or other countries where Google operates. The United States does not have a single comprehensive federal privacy law; protection depends on federal sector rules and state laws such as the CCPA/CPRA. We rely on Google's data processing terms and the safeguards described in “International Data Transfers” below.

Essential for site operation: session management, shopping cart, checkout, security, and authentication. These cannot be disabled.

Help us understand usage patterns and improve site performance. We use Google Analytics with IP anonymization enabled. You can opt out at tools.google.com/dlpage/gaoptout.

Used to deliver relevant advertisements. These are only set with your consent. You may opt out via:

• Facebook Ad Settings
• Google Ad Settings
• Digital Advertising Alliance Opt-Out
• Your Online Choices (EU)

If you are located in the EEA, UK, or Switzerland, you have the rights described above. You also have the right to lodge a complaint with your local supervisory authority. For a list of authorities, visit edpb.europa.eu.

California residents: we do not “sell” or “share” your personal information as defined by the CCPA/CPRA. You have the right to know, delete, correct, and opt out. We do not use sensitive personal information for purposes beyond those permitted by law. Residents of other U.S. states with privacy legislation (Virginia, Colorado, Connecticut, Texas, Oregon, etc.) have similar rights under their respective laws.

We handle your personal information in accordance with Japan's Act on the Protection of Personal Information. We will indicate the purpose of use, manage data securely, and provide access and correction upon request. We provide notice before transferring data to third parties, and cross-border transfers are governed by PPC guidelines. For virtual try-on, your photo is processed on our behalf by Google LLC in the United States; we ask for your consent before the first use and describe the U.S. legal framework in “Virtual Try-On” above.

Brazilian residents have rights under the LGPD including access, correction, anonymization, portability, and deletion. Our Data Protection Officer can be contacted at info@sowaka.life. International transfers comply with ANPD-approved Standard Contractual Clauses.

For individuals in China, we process data in accordance with the Personal Information Protection Law. We obtain separate consent for cross-border transfers and sensitive data processing. You have the right to access, correct, delete, and restrict processing of your data.

We comply with South Korea's Personal Information Protection Act, including notice, consent, and data minimization requirements for Korean data subjects.

South African residents benefit from the protections under POPIA, including the right to access, correction, and objection to processing. Cross-border transfers are subject to adequate safeguards.

We comply with the Personal Data Protection Act, including consent, purpose limitation, and data protection obligations for Singapore residents.