Privacy Policy

Last updated: 7 September 2026

This policy sets out how Nyarrow Studio ("we", "us") handles personal information on its company website, nyarrowstudio.com (the "site").

1. Who we are

We operate as a sole proprietorship and identify ourselves in this policy by our trade name (Nyarrow Studio). Any matter required by Article 32(1) of Japan's Act on the Protection of Personal Information that is not stated in this policy — including the name of the individual operator — will be provided without delay on request to the contact above.

2. What this site collects

2.1 When you read this site

This site is a static page made of text and images. We have put nothing in place that would identify you as an individual. Specifically:

• We set no cookies. This site stores nothing in your browser
• On this site we use cookie-less, anonymous traffic measurement (Cloudflare Web Analytics). It does not identify individual visitors or track them across other sites; we receive only aggregate statistics.
• We carry no advertising and send nothing to advertising companies
• There are no accounts, sign-ups or logins
• There are no input fields or forms on this site (contacting us means following a link to the separate support desk described in 2.2)
• The only file loaded automatically from anyone else's server is the traffic-measurement script above (static.cloudflareinsights.com). There are no third-party fonts, adverts, embeds or other scripts

In the nature of the web, both the request that delivers a page to you and the traffic-measurement request above pass through the cloud provider we use to host this site. That provider may hold connection records (including IP addresses) briefly, to run its service and to block abusive traffic. In our ordinary operation, all we can see are aggregate figures such as page views by country or region; we cannot identify an individual visitor. Section 6 describes this provider.

2.2 Information you enter in the support form

The "Contact" link on this site leads to a support desk shared across all Nyarrow Studio products (the form opens on the support desk's own site). What is sent is your message, the subject, the type of inquiry, an email address if you choose to give one, and technical information attached automatically so that we can reproduce problems (your browser type and version, and your operating system type). A thread identifier is also generated so the conversation can continue.

We use this only to answer your inquiry and to improve quality, and we store it on infrastructure operated by companies outside Japan (we cannot confirm that the server itself is in Japan). Delivery of reply notification emails is likewise entrusted to a company outside Japan. Your inquiry is anonymised automatically after a period of time, and the link that opens your thread expires after a period of time as well.

Full details — where it is stored, how long it is kept, who processes it, and how to request access or deletion — are set out in the support desk's privacy policy at https://support.nyarrowstudio.com/legal/privacy-en. For support inquiry data, that policy takes precedence over this one.

2.3 Sites we link to

This site links to each product's website and to the support desk. What happens to personal information on those sites is governed by their own privacy policies. This policy does not extend to them.

3. Why we use it

We use personal information only for the following purposes.

• To deliver the pages of this site to your device
• To block abusive traffic and keep the site available
• To understand how the site is used, as aggregate figures that identify nobody, and to improve what we publish here
• To answer your inquiry and improve quality (this purpose is described in full in the support desk's privacy policy referenced in 2.2)

We use it for nothing else, and we will publish any change of purpose on this page before it takes effect.

4. Legal bases for processing (if you are in the EEA or the UK)

Where the EU General Data Protection Regulation or the UK GDPR applies, we rely on the following legal bases.

In each case we have weighed our interests against your interests, rights and freedoms, and kept what we collect to a minimum — as 2.1 sets out, we set no cookies, our traffic measurement is anonymous and aggregate, and there is no advertising here. You can request a summary of that assessment through the contact form.

5. Who else sees your data

We do not disclose personal information to third parties except where the law requires it. Passing data to the processors in section 6 is entrustment within what our purposes require, and is not a third-party provision under Article 27 of Japan's Act on the Protection of Personal Information. Where a processor is outside Japan, Article 28 of that Act applies, and section 6 explains how we meet it.

We do not sell personal information, and we do not share it for cross-context behavioural advertising.

6. Processors and international transfers

The categories of recipient (Art. 13(1)(e) GDPR) are:

• the company that hosts this site and provides its traffic measurement (Cloudflare, Inc.; see 2.1); and
• the processors involved in running the support desk (2.2), which are described in the support desk's privacy policy.

We do not name the support desk's processors in this policy. Ask through the contact form and we will tell you who they are. (This keeps the policy accurate if we move to a different company in the same country.)

The company that hosts this site and provides the traffic measurement described in 2.1 is established in the United States. It does not publish the country in which the servers handling the data sit, so that country cannot be identified, and we cannot confirm that any such server is in Japan. We have informed ourselves about the framework for protecting personal information in the United States (there is no comprehensive federal privacy statute; the field is governed by state laws and sector-specific laws, and there are legal regimes under which government agencies may access data), and by contract we have secured that the provider continuously implements measures equivalent to those required by Japan's Act on the Protection of Personal Information (Art. 28 of the Act; Art. 16 of the Enforcement Rules). Those measures include the standard contractual clauses used for transfers from the EEA and the UK.

We check how our processors are implementing those measures, and whether anything in the United States framework might affect that implementation, once a year and whenever we revise this policy. If implementation runs into difficulty we will take whatever steps are necessary and appropriate, and if we cannot secure its continued implementation we will stop providing personal data to the processor concerned.

Under Article 28(3) of the Act, we will provide the following on request:

• how the third party has put its framework in place
• an outline of the equivalent measures it implements
• how often, and by what method, we check the above
• the name of the foreign country concerned (the United States)
• whether anything in the United States framework might affect the implementation of those measures, and an outline of it
• whether there is any difficulty with that implementation, and an outline of it
• an outline of the steps we would take if there were

7. How long we keep it

We keep no personal data about your reading of this site. The connection records described in 2.1 are held briefly by the company that hosts the site and measures its traffic, for the running of its own service; we neither store nor consult them at the level of an individual. What reaches us from the traffic measurement is aggregate statistics, not a record of any individual visitor.

Support inquiries are anonymised automatically after a period of time. The support desk's privacy policy referenced in 2.2 states that period.

8. Security measures

We do not describe how these protections are implemented, because that would help an attacker.

9. Your rights and how to exercise them

Every kind of request goes through the support desk's contact form. We charge no fee. Requests may be made by a statutory representative or by an agent you have authorised (we may ask for something showing that authority).

9.1 Under Japan's Act on the Protection of Personal Information

In relation to retained personal data we hold about you, you may request:

• notification of the purpose of use
• disclosure, or disclosure of records of provision to third parties
• correction, addition or deletion
• cessation of use or erasure, and cessation of provision to third parties

You may also ask for the information listed in section 6. You may raise how we handle personal information with the Personal Information Protection Commission of Japan.

9.2 Under the GDPR / UK GDPR (if you are in the EEA or the UK)

You have the rights of access, rectification, erasure, restriction of processing, data portability and objection (see also section 4 on objection).

We will respond within one month of receiving your request. For complex or numerous requests we may extend that by up to two further months, and we will tell you so, with our reasons, within the first month. There is no charge. Only where a request is manifestly unfounded or excessive may we charge a reasonable fee or refuse to act, and we will tell you beforehand if that happens.

You also have the right to lodge a complaint with a supervisory authority: in the EEA, with the authority of the member state of your habitual residence, place of work or the place of the alleged infringement; in the UK, with the Information Commissioner's Office (ico.org.uk).

9.3 If you are in the United States

We are a Japanese sole proprietorship and do not meet the size thresholds that make the California Consumer Privacy Act or comparable state laws applicable to us. That said, what we collect, why we use it, how long we keep it and how to ask for correction or deletion are as stated in this policy, and these channels are open to you wherever you live. As section 5 states, we do not sell personal information and we do not share it for cross-context behavioural advertising.

10. Children and young people

This site is a company profile and is not directed at children. As 2.1 explains, we collect nothing that identifies a visitor, so we neither verify nor ask anyone's age.

If you are not old enough to decide for yourself, please get a parent's or guardian's agreement before contacting us. If a parent or guardian asks us to delete an inquiry sent by their child, we handle it under the same procedure as section 9.

11. Languages

This policy is published in Japanese and English. If the two versions differ, the Japanese version governs.

12. Changes to this policy

We may revise this policy as the law or our handling changes. Where a change is significant, we will publish it on this page before it takes effect and update the date at the top.

13. Contact and complaints

Questions about this policy, requests of any kind and complaints all go through the support desk's contact form.

Revision history