Last updated: 5 September 2026
This policy describes how Nyarrow Studio ("we", "us") handles personal information at our
support desk (support.nyarrowstudio.com, the "support desk").
Inquiries about all of our products are received through this one shared desk.
| Business name | Nyarrow Studio, the trading name of a sole proprietorship established in Japan |
|---|---|
| Address | 1-4-3 Sengencho, Wizard Building 402, Yokohama-shi Nishi-ku, Kanagawa-ken 220-0072, Japan |
| Contact and complaints | The support form on this site |
We operate as a sole proprietorship and identify ourselves in this policy by our trade name (Nyarrow Studio). Any matter required by Article 32(1) of Japan's Act on the Protection of Personal Information that is not stated in this policy — including the name of the individual operator — will be provided without delay on request to the contact above.
| Your message | Required |
|---|---|
| Subject | Optional |
| Type of inquiry | Chosen from the options defined for each product (required where options are set) |
| Email address | Optional. Only if you want to be notified of replies |
You are not required by law or by contract to give us any of this. But if you do not tell us what the problem is, we cannot answer; and if you do not give us an email address, we cannot tell you when we have replied, so you will need to keep your thread link (2.3) in order to see the answer. There is no other consequence.
To help us reproduce problems, the following technical information is attached automatically. What is attached depends on where you opened the form.
| From a web browser | The User-Agent string your browser sends. It contains your browser type and version and your operating system type and version, and on some devices your device model |
|---|---|
| From an iOS / Android app | Your operating system type and version, your device model, and the app version |
| Either way | The display language of the form, and the time of submission |
Some products also attach an identifier for the content you are reporting on — for example, the ID of the question when you report an error in a question or explanation. Where this applies, it is stated in that product's own privacy policy.
When the form opens, your browser also loads a component that checks submissions are not automated. Loading it makes your IP address and browser information visible to the processor named in 6.1. Your IP address is used for that check only and is never written to our database.
For each inquiry we generate a thread identifier so that the conversation can continue. The URL containing that identifier is your private link to the thread.
As we handle your inquiry we also record its status, its priority, the labels our staff apply to organise their work, internal notes written by our staff, and the replies we send you. The labels and the internal notes are not shown to you on screen, but they are within the scope of an access request under section 10.
| Name, address, phone | There are no fields for them (unless you choose to write them in your message) |
|---|---|
| Your IP address | It reaches our processor for the check described in 2.2, but is never stored in our database. Separately, the cloud infrastructure provider that carries the connection handles the source IP address as part of running its network |
| Browser language setting | We read it to decide which language to show you, but we store only the language the form was actually displayed in |
| Tracking or advertising cookies | We set none and we do not profile you. The only thing we store in your browser is the language you choose (the check described in 2.2 may store a short-lived technical value of its own, which is not used to identify or profile you) |
| In-app data | Advertising identifiers, location, study history and the like are never sent to the support desk |
In future we may use an external AI service to help draft or categorise replies. We will amend this policy before we begin, naming the category and country of the processor and describing what it does.
Now and in future, we do not make decisions with legal or similarly significant effects on you by automated means alone.
Where the EU General Data Protection Regulation or the UK GDPR applies, we rely on the following.
| What we do | Legal basis | Where the basis is legitimate interests, the interest we pursue |
|---|---|---|
| Answering your inquiry and telling you when a reply has arrived | Performance of a contract, Art. 6(1)(b), where you have a contract with us for the product concerned. Otherwise our legitimate interests, Art. 6(1)(f) |
Being able to help someone who has asked us for help |
| Attaching information about your device and app version | Legitimate interests, Art. 6(1)(f) | Being able to reproduce and fix the defect you are reporting, which we usually cannot do from a description alone |
| Checking that a submission is not automated | Legitimate interests, Art. 6(1)(f) | Keeping the support desk usable and protecting it against automated abuse |
| Counting and categorising inquiries in aggregate | Legitimate interests, Art. 6(1)(f) | Understanding what our users struggle with, so we can fix the underlying cause instead of answering the same question repeatedly |
In each case we have weighed our interest against your interests, rights and freedoms, and limited what we collect accordingly: we ask for no name and no account, your email address is optional, we attach only what is needed to reproduce a defect, and we do not store your IP address. You can ask us for a summary of that assessment through the support form.
Where we rely on legitimate interests — the rows marked Art. 6(1)(f) above — you have the right to object to that processing at any time, on grounds relating to your particular situation (Art. 21(1) GDPR). Tell us through the support form; it costs nothing.
If you object, we will stop that processing unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or unless we need the data to establish, exercise or defend a legal claim.
Your inquiry, and everything listed in section 2 and 8.1, is stored in a database held with the cloud provider we use. We have not enabled replication of that database to any other region. Whichever country you write to us from, there is one place we write your inquiry to.
That provider neither publishes nor guarantees the specific country or facility in which data is held, so we cannot tell you which country the server is in. What we can tell you is that the database runs in the Asia-Pacific region — a broad regional grouping, not a particular country.
Processing, by contrast, happens at whichever of the provider's locations worldwide is closest to you. If you write to us from outside the Asia-Pacific region, your data leaves your country of residence. If you are within it, we still cannot guarantee that your data stays in your own country.
The following process personal data on our behalf, to the extent necessary for the purposes above. They act only on our instructions and cannot use your data for their own purposes.
| Cloud infrastructure provider (United States) | |
|---|---|
| What they do | Database and application hosting; checking that a submission is not automated |
| What they handle | Everything listed in section 2 and 8.1; and your IP address, for that check only |
| Email delivery provider (United States) | |
|---|---|
| What they do | Delivery of notification emails |
| What they handle | The recipient address, the standard wording of the email, and the link to your thread |
In addition, the provider of the business mailbox we use (United States) handles the alerts we send ourselves, which as stated in 6.2 contain none of your inquiry. Each processor may in turn use its own sub-processors as needed for its service. We will tell you the name of each processor, and of its main sub-processors, on request.
Notification emails to you contain none of the subject, body, inquiry type or technical information. All that passes through the delivery provider is the recipient address, the standard wording, and the link to your thread.
The alerts we send ourselves contain none of the subject, body, inquiry type, technical information or email address — only a link to our administration screen and the fact that something new has arrived.
We are established in Japan. If you are in the EEA or the UK, the European Commission and the UK government have each decided that Japan provides an adequate level of protection for personal data, so your data reaching us in Japan does not depend on any additional safeguard.
From there we pass your data to the processors in 6.1, which are established in the United States, and it is stored in a database running in the Asia-Pacific region (section 5). Those onward transfers are not covered by an adequacy decision. For them we rely on the Standard Contractual Clauses adopted by the European Commission and, for transfers from the UK, on the International Data Transfer Addendum. These form part of our written contract with each processor.
Separately, Japan's Act on the Protection of Personal Information requires us to secure by contract that these processors continuously implement measures corresponding to those the Act requires of us (Article 28 of the Act; Article 16 of the Enforcement Rules). We confirm this, and check whether any law of that country could affect it, once a year and whenever we amend this policy. If those measures come under strain we take appropriate action, and if their continued implementation cannot be secured we stop providing personal data to that processor. We will provide the further details listed in Article 28(3) of the Act on request.
Apart from the processors in section 6 — which act only on our instructions — we do not give your inquiry data to anyone, except where the law requires us to. Under Japanese law those processors are entrusted parties rather than "third parties", but because they are located outside Japan the transfer rules described in 6.3 apply to them.
We do not sell personal information, and we do not share it for cross-context behavioural advertising ("selling" and "sharing" within the meaning of California law).
Two years after the last exchange — the last message sent by either you or us — we automatically erase everything in the inquiry that identifies you or that was written in free text.
| Erased | Email address, device information (the User-Agent string, OS and device model), subject, all message bodies, our internal notes, the thread identifier |
|---|---|
| Kept (statistics only) | Product, inquiry type, status, priority, the labels our staff applied, platform, app version, display language, content identifier, internal reference number, and the number of exchanges with their timestamps (including which side sent each one) |
What remains contains nothing you wrote and gives us no way to contact you. In our ordinary operation what has been erased cannot be restored. This is the removal of identifying information; it is not the creation of "anonymously processed information" as defined by Japanese law.
The link that opens your private thread expires 90 days after the last exchange. While a conversation is ongoing, a reply from either side resets that window. After the link expires the data is still held until the period in 8.1 elapses, and remains within the scope of the requests in section 10.
To protect personal data against loss, alteration and unauthorised disclosure, we:
If a breach occurs that is likely to harm your rights and interests, we will report it to Japan's Personal Information Protection Commission (and, where applicable, to the competent EEA or UK supervisory authority) and notify you. If we cannot reach you directly — because you gave us no email address, for instance — we will publish notice on this page and in the relevant product instead.
All requests are handled through the support form. There is no charge. We also accept requests made by a legal guardian or by an agent you have authorised (we may ask for evidence of that authority).
For the data we hold about you, you may ask us to:
You may also request the information described in 6.3, and you may raise the matter with Japan's Personal Information Protection Commission.
You have the rights of access, rectification, erasure, restriction of processing, data portability, and objection (for objection, see also section 4).
We respond within one month of receiving your request. If a request is complex, or you have made several, we may extend that by up to two further months and will tell you within the first month that we are doing so and why. There is no charge. Only where a request is manifestly unfounded or excessive may we charge a reasonable fee or refuse it, and we would tell you before doing either.
You also have the right to lodge a complaint with a supervisory authority: in the EEA, with the
authority in the Member State of your habitual residence, your place of work, or the place where you
believe the infringement took place; in the UK, with the Information Commissioner's Office
(ico.org.uk).
We are a one-person business in Japan and do not meet the thresholds that make the California Consumer Privacy Act, or the comparable laws of other US states, apply to us. We have nevertheless set out above what we collect, why, how long we keep it and how to ask us to correct or delete it, and those routes are open to you wherever you live. As stated in section 7, we do not sell personal information and we do not share it for cross-context behavioural advertising.
In short: if you are young, you can write to us. Do not send us anything private that you would not want an adult to read, and it is a good idea to tell a parent or guardian that you did.
We do not check anyone's age when an inquiry is submitted, and we do not ask for one. We collect no name and no account, and an email address is optional, so we deliberately hold as little about you as we can. If you are under the age at which you can decide these things for yourself in your country, please use the support desk with the agreement of a parent or guardian.
If a parent or guardian asks us to delete an inquiry sent by their child, we handle it through the same procedure as section 10.
This policy and the support desk itself are provided in Japanese and English. You are welcome to write to us in any language, but we reply in Japanese or English, and may use machine translation to do so. Where the Japanese and English versions of this policy differ, the Japanese version governs.
We may amend this policy to reflect changes in the law or in how we handle data. Where a change is significant we will publish it on this page before it takes effect, update the date above, and carry any necessary changes through to each product's own privacy policy.
For questions about this policy, any of the requests above, or to make a complaint, please use the support form.
| 5 Sept 2026 | First issued |
|---|---|
| 5 Sept 2026 | Sections 2.3 and 8.1 updated: our staff now record labels on an inquiry to organise their work |
| 6 Sept 2026 | Our business address is now stated in section 1 (previously provided only on request) |
Nyarrow Studio Support