Privacy Policy

1. Introduction

This Privacy Policy explains how worXwap合同会社 (“worXwap,” “we,” “us,” or “our”) collects, uses, stores, and protects your personal information when you use the worXwap platform, including our website (worxwap.com), mobile applications, and all related services (the “Platform”).

We are the business operator (個人情報取扱事業者) responsible for your personal information under Japan’s Act on the Protection of Personal Information (APPI). Our identity and contact details are in Section 14.

2. Information We Collect

2.1 Information You Provide

• Account information: First name, last name, username, email address, and password when you create an account.
• Profile information: Profile picture, bio/description, skills you offer, skills you are looking for, country, and portfolio items.
• Deal page content: Service descriptions, images, and other content you upload to your deal pages.
• Swap data: Negotiation messages, agreed terms, uploaded deliverables, and reviews.
• Payment information: When you subscribe, your card details are collected and processed directly by Stripe. We never receive or store your card number. We store only the identifiers Stripe returns to us (customer and subscription IDs), your subscription status, and the billing email you gave Stripe.
• Communications: Messages you send to other users through the Platform, and messages you send to our support team.

2.2 Information Collected Automatically

• Content interaction counts: When you view or click a short, deal, or profile, we record that event together with your user ID so we can show creators how their content performs.
• IP address: Our infrastructure providers process your IP address as an unavoidable part of serving requests, and use it for security and abuse prevention. We do not maintain our own log of your browsing within the Platform.
• Approximate country at signup: If your browser does not tell us your region, the signup form asks a third-party geolocation service (ipapi.co, operated by Kloudend, Inc., United States) to suggest your country. Your IP address is sent to that service directly from your browser. We receive only a country code, and you can change it before submitting.

We do not collect device identifiers, operating system, browser type, screen resolution, or session duration, and we do not track your activity across other websites.

2.3 Information From Google Sign-In

If you choose to sign in with Google, Google authenticates you and returns your name, email address, and profile picture URL, which we use to create your account. Google receives the fact that you signed in to worXwap, along with your IP address and browser information. Your Google profile picture is displayed directly from Google’s servers, so viewing a profile that uses one discloses the viewer’s IP address to Google.

3. Purpose of Use (利用目的)

We use your information to:

• Provide, operate, and maintain the Platform.
• Create and manage your account and authenticate you.
• Process subscriptions and payments, and manage billing status.
• Facilitate Swaps between users, including discovery, communication, and delivery.
• Display your profile, deal pages, shorts, and reviews to other users and to visitors.
• Send you notifications about your account, Swaps, and Platform updates.
• Respond to your support requests and inquiries.
• Investigate reports, enforce our Terms, and detect and prevent fraud, abuse, and security incidents.
• Show creators aggregate view and click counts for their own content.
• Comply with legal obligations.

We do not sell your personal information, and we do not use it for advertising or for automated decision-making that produces legal effects.

4. How Your Information Is Shared and Published

4.1 Publicly Accessible Content

Please read this section carefully, because some content is accessible without logging in.

• Your username, display name, profile picture, bio, skills, country, reviews, ratings, deal pages, and shorts are visible to other users, and profile and deal pages can be viewed by visitors who are not signed in.
• Uploaded files are served from public URLs. Profile pictures, deal images, shorts videos, thumbnails, and files attached to Swaps and messages are stored on a public content-delivery network. Anyone who has the URL can open the file without signing in. Treat anything you upload as potentially public, and do not upload files containing information you need to keep confidential.
• Your email address, password, payment details, and private messages are not published on your public profile.

4.2 Access by worXwap Staff

Authorized administrators can access account records and, where necessary to investigate a report, enforce these Terms, resolve a dispute, or respond to a support request, the contents of messages and Swap submissions. Access is limited to those purposes.

4.3 Service Providers

We use the following providers to operate the Platform. Each receives only what it needs for its function:

• Supabase (database, authentication, and server functions) — hosted in Singapore. Holds your account, profile, messages, Swaps, and reviews.
• Amazon Web Services (media storage, video transcoding, and content delivery) — storage and processing in Japan (Tokyo region), delivered through a global CDN with edge servers in many countries. Holds your uploaded videos, images, and attachments.
• Stripe (payment processing and subscription management) — processed in the United States and other countries where Stripe operates. Receives your name, email address, and payment details.
• Resend (transactional email delivery) — United States. Receives your email address and the contents of notification emails we send you.
• Google (sign-in and profile-picture hosting, if you use Google Sign-In) — United States.
• Kloudend, Inc. (ipapi.co) (country suggestion during signup) — United States. Receives your IP address.

4.4 Embedded Third-Party Content

Some pages embed content served by third parties. When such a page loads, your IP address and browser information are disclosed to those parties even if you do not interact with the content. This currently includes portfolio previews embedded from Behance (Adobe, United States) and country flag images hosted on GitHub (United States).

4.5 For Legal Reasons

We may disclose your information if required by law, regulation, legal process, or governmental request, or where disclosure is necessary to protect the rights, safety, or property of worXwap, our users, or the public.

4.6 Business Transfers

If worXwap is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you before your information becomes subject to a different privacy policy.

5. Transfers to Third Parties Outside Japan (外国にある第三者への提供)

As set out in Section 4.3, your personal information is stored and processed outside Japan — in particular in Singapore (Supabase) and the United States (Stripe, Resend, Google, Kloudend). Content delivery may also place cached copies of uploaded media on servers in other countries.

Information about the personal-information protection regimes of those countries is published by Japan’s Personal Information Protection Commission at ppc.go.jp. Singapore has a comprehensive data protection law (the Personal Data Protection Act 2012). The United States has no single comprehensive federal data protection law; protection depends on sector-specific and state laws and on the contractual commitments made by each provider.

Each provider listed in Section 4.3 is engaged under its standard data processing terms, which require it to implement appropriate security measures and to process personal information only on our instructions or as needed to provide its service.

By creating an account, you consent to the transfer of your personal information to the providers and countries described above. If you do not consent, please do not create an account — we cannot operate the Platform without these providers.

6. Data Retention and Deletion

We retain your personal information for as long as your account is active or as needed to provide the Platform.

If you delete your account, we delete or anonymize your account record, profile, and associated database records within 30 days, except where we must retain information for legal, accounting, tax, or security purposes. In particular:

• Reviews and Swap records may be retained in anonymized form so that other users’ histories stay intact.
• Moderation and safety records (including reports and administrative action logs) are retained so that enforcement decisions remain auditable.
• Billing records held by us and by Stripe are retained as required by tax and accounting law.
• Files you uploaded may remain on our storage and content-delivery network after the corresponding record is deleted. If you need specific uploaded files erased, contact us at privacy@worxwap.com and we will remove them.

7. Security Measures (安全管理措置)

We take the following measures to protect personal information:

• Organizational: Administrative access is limited to authorized personnel, and administrative actions are recorded in an audit log.
• Technical: All traffic is encrypted in transit (HTTPS). Data is stored in managed services with access controls and row-level security rules that restrict each account to its own records. Passwords are stored only as salted hashes by our authentication provider. Card details never reach our servers.
• Awareness of the external environment (外的環境の把握): We are aware that personal information is held in Singapore and the United States as described in Section 5, and we take that into account when selecting and reviewing providers.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If a breach occurs that is likely to harm your rights, we will notify you and the Personal Information Protection Commission as required by law.

8. Your Rights

8.1 All Users

• Access and update your personal information through your account settings.
• Request a copy of your data.
• Delete your account and associated data.

8.2 Users in Japan (APPI)

You may request disclosure (開示), correction (訂正), addition, deletion (削除), cessation of use (利用停止), or cessation of third-party provision of your retained personal data, and disclosure of records of third-party provision.

Procedure: send your request to privacy@worxwap.com from the email address registered to your account, stating what you are requesting. We may ask for additional information to confirm your identity. We respond without undue delay and normally within 30 days. We do not charge a fee for these requests.

8.3 Users in the European Economic Area and the United Kingdom (GDPR)

If you are in the EEA or UK you also have the rights to erasure, restriction of processing, data portability, objection to processing, and withdrawal of consent. Our legal bases are: performance of our contract with you (operating the Platform and your subscription), your consent (where asked), our legitimate interests (security, abuse prevention, and improving the Platform), and compliance with legal obligations. You may lodge a complaint with your local supervisory authority.

8.4 Complaints (苦情の申出先)

If you are dissatisfied with how we handle your personal information, contact privacy@worxwap.com. In Japan you may also contact the Personal Information Protection Commission.

9. Cookies and Local Storage

We use cookies and browser storage only to operate the Platform. We do not use advertising cookies, and we do not use third-party analytics services.

• Authentication cookies: keep you signed in. Required — the Platform cannot function without them.
• Preference storage: remembers settings such as your theme.
• Local caching: to keep the app responsive, your browser stores copies of data you have already loaded — including conversations, the name and picture of people you are talking to, and drafts. This stays on your device and is not sent anywhere.

On a shared or public computer, cached content may remain in the browser after you sign out. Clear your browser data before handing the device to someone else.

10. Children’s Privacy

The Platform is intended for users aged 18 and over. We do not knowingly collect personal information from anyone under 18. We do not verify age at registration, so if you believe a person under 18 has created an account or provided us with personal information, contact privacy@worxwap.com and we will delete it promptly.

11. Third-Party Links

The Platform may contain links to third-party websites or services. We are not responsible for their privacy practices, and we encourage you to review their policies. Content embedded from third parties is described in Section 4.4.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you through the Platform or by email, and update the “Last Updated” date above. Your continued use of the Platform after changes take effect constitutes acceptance of the updated Privacy Policy.

13. Language

This Privacy Policy is provided in English. In the event of any discrepancy between translated versions, the English version shall prevail.

14. Contact and Business Identification

Under APPI Article 32 we identify ourselves as follows:

• Business operator: worXwap合同会社 (worXwap LLC)
• Representative: 【要記入 / to be completed: 代表社員の氏名】
• Registered address: 【要記入 / to be completed: 登記上の住所】
• Privacy and data rights: privacy@worxwap.com
• General support: support@worxwap.com