PRIVACY POLICY

Infinite Story TOWA (infinitestorytowa.com) is operated by Shigeru Ito, a sole trader (autónomo) based in Barcelona, Spain.

• Address: C/Espronceda, Barcelona, Spain 08027
• Contact: shigeru@infinitestorytowa.com

For the purposes of the EU General Data Protection Regulation (GDPR), Shigeru Ito is the data controller for personal data collected through this website.

This website is informational and does not sell products or process payments. If you make a purchase, it takes place on our separate shop at shop.infinitestorytowa.com, which has its own Privacy Policy governing order and payment data.

When you browse this website or contact us, we may collect:

• Technical data: IP address, browser type, device information, and basic usage data collected via our hosting and content-delivery providers
• Analytics data, only if you consent via our cookie banner: pages viewed, session duration, device and browser type, approximate location (country/city level), and how you arrived at the site — collected through Google Analytics
• Contact details: name, email address, and message content, if you reach out via the Contact page
• Local storage data: a marker on your device recording whether you’ve seen the onboarding guide (see Section 8) — this stays on your device and is not sent to us

Technical/log data is retained only as long as necessary for security and website operation, in line with our hosting providers’ standard practices. Messages sent via the Contact page are kept only as long as necessary to handle your enquiry. Analytics data is retained in Google Analytics according to our configured retention setting.

We share the minimum data necessary with the following categories of third parties, solely to run this website:

• Vercel (hosting) — hosts the website and processes standard access logs
• Supabase (database) — stores structured content (such as city descriptions) used to render the website
• Cloudinary (media delivery) — delivers images and video content shown on the website
• Google Ireland Limited (Google Analytics), only if you consent to analytics cookies — receives pseudonymized usage data (see Section 3) to help us understand how the site is used. This data is not used for advertising, and Google Signals / ad personalization features are disabled on our account.

These providers act as independent data processors for infrastructure purposes. We do not sell your personal data to anyone.

Because our hosting and infrastructure providers operate global networks, your technical data may be processed outside the European Economic Area. These providers maintain their own data-protection safeguards; please see their respective privacy policies for details.

If you consent to analytics cookies, Google Analytics data may also be transferred to and processed in the United States. Google Ireland Limited is certified under the EU-U.S. Data Privacy Framework, which the European Commission recognises as providing an adequate level of protection for such transfers. Please see Google’s privacy policy for details.

This website uses two categories of tracking technology:

• Local storage (not a cookie)— used to remember display preferences on your device, such as whether you’ve already seen the onboarding guide, so it isn’t shown again on return visits. This data is not transmitted to us and can be cleared at any time through your browser settings. No consent is required for this, as it does not involve any data leaving your device.
• Analytics cookies (Google Analytics) — only set if you actively accept them via our cookie banner. These help us understand how visitors explore the site. We do not use cookies for advertising or third-party marketing tracking.

You can change your cookie preferences at any time using the “Cookie Settings” link in the footer. Your choice is stored on your device for 12 months, after which you will be asked again.

We take reasonable technical and organisational measures to protect the personal data we hold from unauthorized access, loss, or misuse. Access is restricted to those who need it to fulfil the purposes described in this policy, and our third-party processors (see Section 6) are required to apply appropriate safeguards.

Under GDPR, you have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Request deletion of your data (“right to be forgotten”)
• Object to or restrict certain processing
• Request a copy of your data in a portable format
• Withdraw your cookie consent at any time (see Section 8)
• Lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, aepd.es)

To exercise any of these rights, contact us at shigeru@infinitestorytowa.com.

We may update this policy from time to time. The “Last updated” date at the top reflects the most recent version.