Privacy Policy

This Privacy Policy explains how SOWAKA LLC (“SOWAKA,” “we,” “us,” or “our”) collects, uses, shares, and protects your personal information when you visit sowaka.life (the “Site”), use our applications, interact with our blockchain-based services (including NFTs and tokenized assets), or communicate with us.

We are committed to protecting your privacy in compliance with applicable global data protection laws, including but not limited to the EU General Data Protection Regulation (GDPR), the UK GDPR, Japan’s Act on Protection of Personal Information (APPI), the California Consumer Privacy Act as amended by the CPRA (CCPA/CPRA), Brazil’s Lei Geral de Proteção de Dados (LGPD), China’s Personal Information Protection Law (PIPL), South Africa’s Protection of Personal Information Act (POPIA), South Korea’s Personal Information Protection Act (PIPA), and other applicable regional and national privacy laws.

The data controller responsible for your personal information is:

We process your personal information for the following purposes and on the following legal bases:

We do not sell your personal information. We may share your data with:

• Service Providers: hosting (Vercel), e-commerce platform (Shopify), payment processing (Stripe), email delivery, analytics (Google Analytics), and customer support tools — all under data processing agreements.
• Blockchain Networks: wallet addresses and transaction data are recorded on public blockchains and cannot be erased. See “Web3 & Blockchain” below.
• Authentication Providers: Supabase (for account management) and Web3Auth (for wallet generation), both operating under data protection agreements.
• Legal Authorities: when required by law, court order, or to protect our rights, safety, or property.
• Corporate Transactions: in connection with a merger, acquisition, or sale of assets, with prior notice.

SOWAKA offers blockchain-based features including NFTs and tokenized real-world assets (RWAs). Please note the following unique aspects:

SOWAKA is headquartered in Japan with customers worldwide. Your personal information may be transferred to and processed in countries other than your country of residence, including Japan, the United States, and the European Union/EEA.

We safeguard international transfers using appropriate mechanisms, including:

• Adequacy decisions by relevant authorities (e.g., EU adequacy decisions for Japan)
• Standard Contractual Clauses (SCCs) approved by the European Commission
• Binding Corporate Rules (BCRs) where applicable
• Consent, where other mechanisms are unavailable and permitted by law

For EEA/UK residents: your data may be processed outside the EEA/UK. We rely on EU-approved SCCs and adequacy decisions. For Brazilian residents: transfers comply with LGPD requirements including ANPD-approved SCCs. For Chinese residents: cross-border transfers comply with PIPL requirements including security assessments where mandated. For Japanese residents: transfers follow the APPI framework and guidelines issued by the PPC.

We use cookies and similar technologies to enhance your experience. Categories include:

You can manage cookie preferences through your browser settings or our cookie consent banner. We honor Global Privacy Control (GPC) and “Do Not Track” signals where required by law.

We retain personal information only as long as necessary for the purposes described in this policy, unless a longer retention period is required or permitted by law. Typical retention periods:

• Account data: for the duration of your account plus 3 years after deletion request.
• Transaction data: 7 years (for tax and legal compliance).
• Marketing data: until you withdraw consent or opt out.
• Blockchain data: permanently, as blockchain records cannot be deleted.
• Log & analytics data: up to 26 months.

Depending on your jurisdiction, you may have some or all of the following rights regarding your personal information:

• Access: request a copy of the personal data we hold about you.
• Rectification: correct inaccurate or incomplete data.
• Erasure (“Right to Be Forgotten”): request deletion of your data, subject to legal obligations and blockchain immutability.
• Restriction: limit processing of your data in certain circumstances.
• Portability: receive your data in a structured, machine-readable format.
• Objection: object to processing based on legitimate interests or for direct marketing.
• Withdraw Consent: where processing is based on consent, withdraw at any time without affecting prior processing.
• Non-Discrimination: exercise your rights without receiving discriminatory treatment.
• Automated Decision-Making: opt out of solely automated decisions that produce legal or significant effects.

To exercise your rights, contact us at info@sowaka.life. We will respond within the timeframes required by applicable law (typically 30 days under GDPR, 45 days under CCPA/CPRA).

Our Site and services are not directed to individuals under the age of 16 (or the applicable age of digital consent in your jurisdiction — 13 in the U.S., 16 in the EU, 20 in Japan for certain services). We do not knowingly collect personal information from minors. If you believe a minor has provided us with data, please contact us at info@sowaka.life and we will promptly delete it.

We may use automated systems for fraud prevention and order risk assessment. These systems may temporarily deny transactions from IP addresses or payment methods associated with suspicious activity. You have the right to request human review of any automated decision that significantly affects you.

We implement industry-standard technical and organizational measures to protect your data, including TLS encryption in transit, encryption at rest, access controls, regular security audits, and incident response procedures. Despite these measures, no system is completely secure — we cannot guarantee absolute security.

We may update this Privacy Policy periodically. Material changes will be communicated through email notification, a banner on our Site, or other appropriate means. We encourage you to review this policy regularly. The “Last Updated” date at the top indicates the most recent revision.

For questions, requests, or complaints regarding this Privacy Policy or your personal data:

If you are unsatisfied with our response, you may lodge a complaint with your local data protection authority. EEA residents may contact their national supervisory authority; UK residents may reach the Information Commissioner’s Office (ICO); Japanese residents may contact the Personal Information Protection Commission (PPC).