Privacy Policy

We collect account information, profile data, identity documents, financial information, medical information, and contact information that you provide directly to us.

We automatically collect usage data, device information, location data, audit logs, and PWA data when you use our platform.

Our audit log records security-relevant actions. This includes recording when you open an offer or a contract: the record identifies you, the item you opened, and the date. We keep at most one such record per item per day.

These view records are not shown to the other party to that offer or contract. They are visible to you, and to our compliance and security staff, and we use them only to protect the platform, detect misuse, and resolve disputes about what was seen and when. We do not use them for advertising or profiling.

We use information to provide and improve our platform, facilitate connections, process transactions, send notifications, personalize content, verify identities, moderate content, and generate analytics.

Where data protection law requires us to identify a legal basis, we rely on the following.

Performance of a contract: to create and operate your account and deliver the services you sign up for.

Legitimate interests: to keep the platform secure, prevent fraud and misuse, maintain audit records, and resolve disputes. This includes the view records described in section 2. We have assessed these interests against your rights and freedoms and concluded they do not override them. You may object at any time using the contact details in section 18.

Consent: for optional features such as marketing communications and any processing we specifically ask you to agree to. Where we rely on consent you may withdraw it at any time, without affecting processing carried out before withdrawal.

Legal obligation: where we are required to collect or retain records under applicable law, including accounting and tax rules.

Security and audit records are not based on consent. They are necessary to operate the platform safely and cannot be switched off per user.

Our messaging features collect message content, typing indicators, read receipts, and blocking/reporting records.

Community posts, comments, likes, shares, watch party participation, fan club memberships, event attendance, and follow relationships may be visible to other users.

We do not sell your personal information. We may share information with your consent, for profile visibility that you control, with service providers acting on our instructions and under contract, to meet legal obligations, or to protect the safety of users and the public.

We keep personal data only for as long as it is needed for the purpose it was collected for.

Account and profile data: for the life of your account. After your account is closed we delete it or irreversibly anonymise it, except where a longer period is required below.

Activity and view records described in section 2: 12 months, after which they are deleted or anonymised.

Security and access-control records, including role assignments, permission changes, account approvals and changes to platform settings: 24 months. We keep these longer than ordinary activity records because they are how we investigate misuse and answer questions about who had access to what, and when. Twelve months is not long enough to trace an access problem discovered late.

Financial, transaction and contract records: 7 years, to meet accounting, tax and legal retention obligations. These may survive an account deletion request for that reason.

Other personal data: for as long as your account is active and for a reasonable period afterwards to handle queries and disputes.

Where data is connected to a live dispute, investigation or legal claim, we keep it until that matter concludes, even if the period above has expired.

We implement row-level security, encrypted transmission, secure authentication, role-based access controls, and regular security audits. Administrative access is split into limited roles rather than a single all-access account, so no one person can read every category of data.

Push notification tokens are used solely to deliver notifications. You can disable them at any time through your device settings.

Uploaded files are stored in secure cloud storage, organized by user, and protected by access policies.

You have the right to access, correct, delete, port, restrict, and object to processing of your personal data, and to withdraw consent where processing is based on consent.

To exercise any of these rights, contact us using the details in section 18. We will respond within one month. We may ask you to verify your identity before we act on a request.

Some records may be kept after an erasure request where we are required or permitted by law to retain them — in particular the financial, contract and audit records described in section 8. Where we cannot delete a record we will tell you why.

If you believe we have not handled your personal data properly, you have the right to lodge a complaint with your local data protection or supervisory authority. In Japan this is the Personal Information Protection Commission. You may do this without contacting us first, though we would prefer the chance to put things right.

We use cookies and local storage to maintain sessions, remember preferences, cache data for offline use, and track PWA state.

We integrate with Supabase, Mapbox, and Google Fonts. We encourage you to review their privacy policies.

Our platform is not intended for children under 13. We do not knowingly collect personal information from children under 13.

Your information may be transferred to and processed in countries other than your country of residence, including Japan, where our operating company is established. Where we transfer personal data across borders we put appropriate safeguards in place.

We may update this policy from time to time with notification of material changes. The date at the top of this page shows when it was last revised.

Spolinka is operated by DreamsGate Co., Ltd. (株式会社DreamsGate), established in Japan, which is the controller of the personal data described in this policy.

For any question about this policy, or to exercise the rights in section 12, email contact@dreamsgate.jp, or reach us through our Contact page. Our registered address is available on request.

If you are contacting us to exercise a data protection right, please say so in your message so we can route it correctly.