Privacy Policy

1. Introduction

Japan Pop Now ("we," "us," "our") operates the website japan-pop-now.com. We are an independent, English-language editorial site covering anime collab cafes, pilgrimage spots, area guides, and pop-culture travel for international visitors to Japan. The site is operated by Takashi Kiyohara, a Tokyo-based editor working under the byline used across the site.

This Privacy Policy describes what personal data we collect when you visit the site, how we use it, the legal basis for processing under EU GDPR and similar privacy regimes, your rights as a data subject, and how to exercise those rights. The policy covers japan-pop-now.com and any subdomains we operate. It does not cover third-party sites linked from articles (Klook, operator pages, etc.) — those have their own privacy practices.

We update this policy when site features, partner programs, or applicable law change. The "Last updated" date at the top of this page reflects the most recent revision. Material changes are also announced on the homepage or via our Threads feed for at least 14 days. Continued use of the site after a material change constitutes acceptance of the updated policy.

2. What data we collect

Site visit data (analytics): When you accept cookies, we use Google Analytics 4 (GA4) to collect anonymized browsing data — pages visited, time on site, approximate location at country/city level, device type, browser type, screen size, referral source, and click-through events on internal links. We use Google's IP-anonymization feature so your full IP address is never stored on our side or transmitted to GA in raw form.

Cookies: The detailed cookie inventory is in section 5 below. The consent banner at the bottom of the page on first visit controls whether analytics and advertising cookies are set.

Newsletter subscription: If you subscribe to our weekly digest, we collect your email address through our partner Beehiiv. The address is used solely to send you the newsletter and confirmation emails (double-opt-in), and is never sold or shared with third parties beyond Beehiiv's role as an email-delivery processor.

Comments (Giscus / GitHub Discussions): If you leave a comment via the Giscus widget, your GitHub username, avatar URL, and comment text are stored on GitHub under our public discussions repository. Comments are public. We do not separately store comment data; deletion is handled by GitHub's own tools.

Contact form / direct email: When you reach us via the contact form or by emailing snsganbaro@gmail.com, the message contents are received in our standard email inbox. We retain those messages for as long as needed to respond and for any follow-up that might reasonably arise (typically 12 months unless the thread becomes part of a longer relationship).

We do not collect: financial data, government identifiers, biometric data, health data, or sensitive special categories under GDPR Article 9. We do not run any user-account system on the site.

3. Legal basis for processing (GDPR Article 6)

Where you are an EU/EEA visitor and GDPR applies, we rely on the following legal bases under Article 6 of the General Data Protection Regulation:

Consent (Article 6(1)(a)): Analytics cookies and any future advertising cookies are loaded only after you actively click "Accept" on the consent banner. Newsletter subscription is also consent-based — you must enter your email and confirm via the double-opt-in confirmation email before any newsletter content is sent.

Legitimate interest (Article 6(1)(f)): We rely on legitimate interest for: (a) basic site security and abuse prevention (server logs, rate-limiting), (b) measuring aggregate site performance via privacy-respecting tools that do not require consent (Vercel Analytics counts page views without setting tracking cookies), and (c) responding to inbound contact-form messages. Our legitimate-interest assessment weighs these processing activities against your reasonable expectations as a visitor to a public editorial website.

Performance of a contract (Article 6(1)(b)): When you subscribe to our newsletter, processing your email to deliver the newsletter is necessary to perform the implicit subscription contract.

You can withdraw consent at any time via the cookie banner (set to decline) or by unsubscribing from the newsletter (one-click link in every email). Withdrawing consent does not affect the lawfulness of processing performed before withdrawal.

4. Cookies — full inventory

The table below lists every cookie that japan-pop-now.com or its embedded third-party services may set on your browser. Cookies marked "only with consent" do not load until you click "Accept" on the consent banner.

The consent banner only sets the essential jpn_cookie_consent cookie until you make a choice. Declining the banner does not set any analytics or advertising cookie. Your declined-state preference is stored so the banner does not re-prompt every visit.

5. Data subject rights (GDPR + UK GDPR)

If you are in the EU/EEA or the UK, you have the following rights under GDPR:

Right of access (Article 15): Request a copy of the personal data we hold about you. For most visitors this will be limited to your newsletter email (if subscribed) and any contact-form correspondence.

Right to rectification (Article 16): Ask us to correct inaccurate or incomplete data we hold about you.

Right to erasure / "right to be forgotten" (Article 17): Ask us to delete your personal data. We will action requests within 30 days unless we have a legal basis to retain (e.g., active dispute, legal hold).

Right to restrict processing (Article 18): Ask us to suspend processing while a question about accuracy or lawful basis is being resolved.

Right to data portability (Article 20): Receive your data in a structured, commonly used, machine-readable format (CSV or JSON), or have it transferred to another controller where technically feasible.

Right to object (Article 21): Object to processing based on legitimate interest or for direct marketing purposes (the latter is unconditional — we will stop immediately).

Right to lodge a complaint (Article 77): If you believe our processing infringes GDPR, you may lodge a complaint with your local supervisory authority. We would appreciate a chance to address the issue first via the contact below, but the right to complain is independent of any prior contact with us.

To exercise any right above, email snsganbaro@gmail.com with subject prefix "GDPR Request — ". We aim to respond within 30 days as required by Article 12(3).

6. CCPA / California Privacy Rights

If you are a California resident, the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) give you specific rights:

Right to know: what personal information we collect, the source, the business purpose, and any third-party recipients. Right to delete: request deletion of personal information we have collected. Right to opt out of sale or sharing:California residents can opt out of any sale or sharing of personal information. We do not sell personal information in the conventional sense, but cookie-based ad-tech can constitute "sharing" under CPRA. The cookie consent banner's Decline option is your opt-out. There is no separate "Do Not Sell or Share My Personal Information" link required because we do not engage in cross-context behavioral advertising at this time. Right to non-discrimination: we will not deny service, charge a different price, or provide a different quality of service because you exercised a CCPA right.

To exercise CCPA rights, email snsganbaro@gmail.com with subject prefix "CCPA Request — ". You may use an authorized agent; we will request reasonable proof of authority before acting on agent requests.

7. Cross-border data transfer

The site is hosted on Vercel infrastructure (United States). Google Analytics 4 processes data on Google's US servers. Beehiiv (newsletter) operates from the United States. As a result, personal data collected from EU/EEA / UK visitors is transferred to the United States.

We rely on the EU-US Data Privacy Framework (where applicable to the relevant processor) and on Standard Contractual Clauses (SCCs) approved by the European Commission for transfers to processors that have not self-certified under the framework. Vercel and Google both publish DPA / SCC documentation; copies are available on request.

For UK visitors, the equivalent UK International Data Transfer Agreement (IDTA) or Addendum to SCCs governs the same transfer relationships.

8. Data retention

Analytics data: retained according to GA4 default retention (14 months). After 14 months, GA4 aggregates and discards the user-level event records. Newsletter email addresses: retained until you unsubscribe. Unsubscribe is one-click via every email; we remove the address from the active list within 24 hours and from backups within 90 days. Contact-form correspondence: retained 12 months unless an active relationship exists. Cookie consent preferences: stored for 1 year on your browser. Comments (Giscus): stored on GitHub indefinitely under the public comments repository; you can delete your own comments via your GitHub account.

9. Cookie banner mechanism

The consent banner appears at the bottom of the page on every first visit. The banner DOM is rendered server-side so it is visible in the initial HTML before any JavaScript executes. Your selection (Accept or Decline) is stored in the jpn_cookie_consent cookie for one year; subsequent visits do not re-prompt unless you clear the cookie. Declining sets the GA opt-out flag (ga-disable-G-XXXXXXXXXX) on the window object, preventing GA4 from initializing on this device.

Withdrawing consent later: clear the jpn_cookie_consentcookie via your browser's Site Settings, then reload to see the banner again and choose Decline.

10. Third-party services

The site embeds the following third-party services:

Google Analytics 4 — anonymized website analytics, only after consent. Google Privacy Policy.

Google AdSense — currently DISABLED pending approval. Will only load when both NEXT_PUBLIC_ADSENSE_ENABLED=true AND a publisher ID env var are set in our hosting config. When enabled, AdSense may set ad-personalization cookies; your consent banner choice controls whether they load.

Beehiiv — newsletter management. Beehiiv Privacy Policy.

Vercel — website hosting + Vercel Analytics (page-view counter, no tracking cookies). Vercel Privacy Policy.

Giscus / GitHub Discussions — article comments. Stored on GitHub. GitHub Privacy Statement.

Affiliate partners (Klook, Agoda, Booking.com, GetYourGuide, Viator, Amazon Associates) — when you click an affiliate link, the partner site sets its own cookies and processes your visit per their own policy. We earn a commission on qualifying purchases; see Affiliate Disclosure.

11. Newsletter terms

The newsletter is a weekly digest of new articles, calendar updates, and curated event roundups. We use double-opt-in: subscribing the form sends a confirmation email; you must click the confirmation link before any newsletter content is sent. Unsubscribe is one-click via the link in every email; on click, you are removed from the active list within 24 hours.

We do not share your email address with third parties beyond Beehiiv (the email-delivery processor) and we do not run third-party ads inside the newsletter. The newsletter occasionally references our affiliate partners with the same disclosure standard as the website articles.

12. Comments policy

Comments on japan-pop-now.com are powered by Giscus and stored on GitHub Discussions. To comment, you need a GitHub account; logging in via Giscus uses GitHub's OAuth flow. We do not see your GitHub password or session token.

Comments are public. We do not pre-moderate every comment but reserve the right to hide comments that are spam, unlawful, harassing, defamatory, or off-topic. To delete your own comment, use the GitHub Discussions interface.

13. Children (COPPA)

The site targets adults aged 13 and over. We do not knowingly collect personal information from children under 13, and we do not run targeted advertising or marketing aimed at children. If you are a parent or guardian and believe your child under 13 has submitted personal information through the site, please email snsganbaro@gmail.com and we will delete the information promptly.

14. Affiliate disclosure

The site participates in affiliate programs as listed in section 10. The full affiliate disclosure with details on partner identification and commission structure is at /affiliate-disclosure.

15. Contact for privacy questions

For any privacy-related question, request, or complaint, please email snsganbaro@gmail.com with subject prefix "Privacy — ". We acknowledge inquiries within 5 business days and substantive responses within 30 days as required by GDPR Article 12(3).

The primary point of contact is Takashi Kiyohara, the operator of the site. We do not have a separately appointed Data Protection Officer (DPO) — the volume of personal data we process does not require one under GDPR Article 37 — but Takashi Kiyohara acts as the informal data-protection point of contact and handles all DSR requests directly.

16. Changes to this policy

We may update this Privacy Policy when site features, partner programs, or applicable law change. The "Last updated" date at the top of this page reflects the most recent revision. Material changes are announced on the homepage and our Threads feed for at least 14 days before taking effect. Non-material changes (typos, formatting) ship silently. Continued use of the site after a material change constitutes acceptance of the updated policy.