K-LOULUX App Privacy Policy
K-LOULUX (pronounced "Kay-Roo-Lux" in Japanese: ケー・ルルクス) ("we", "the studio") is an Afro-Japanese made-to-order sewing studio in Tokyo. We handle the personal information of the people who use our smartphone app "K-LOULUX" ("the app") with care, in accordance with Japan's Act on the Protection of Personal Information ("APPI") and other applicable laws.
Personal information related to browsing and buying on the website k-loulux.com (which runs on Shopify) is covered by the website's privacy policy. This page covers the app.
1. Who we are
- Business name: K-LOULUX (sole proprietorship)
- Operator: K-LOULUX (sole proprietorship; name disclosed without delay on request to info@k-loulux.com)
- Address: 188-0014 Tokyo, Nishi-Tokyo-shi, Shibakubo 1-15-5-110, Japan
- Person responsible for personal information: the operator (name disclosed on request)
- Contact: info@k-loulux.com
2. Information we collect
| Category | What | How |
|---|---|---|
| Account | Email address; password (protected by the authentication system, never readable by us in plain text); display name; account type (customer / studio); record of your acceptance of the Terms of Use (date and time, and terms version) | You enter it when signing up |
| Chat | Message text and photos you send | When you use chat |
| Orders and quotes | Category, your request, indicative budget, desired timing, category-specific details (size, measurements, fabric, purpose, etc.), reference photos (up to 5), quote, approval and progress status | When you request an order |
| Community (feed) | Post text, post images (up to 4), comments, likes, blocks, reports (target, reason, details) | When you post, comment or act |
| Follows | Who follows whom and when. Follower / following counts are calculated from this | When you follow |
| Payments | Quote amounts, deposit and balance invoices and payment status, and the payment identifier from our payment provider (Stripe). We do not collect card numbers. | When you pay |
| Device and settings | Your device language (used to choose the display language and the notification language); an authentication token that keeps you signed in (stored in the device's secure storage) | Automatically |
| Push notifications | Device push token (Expo Push Token), platform (iOS/Android), notification language; a record of notifications to be sent (type, recipient, destination screen path, time). The notification title and body are held only while sending and erased afterwards | When you turn notifications on / when a notification is triggered |
| Connection logs | Connection information (such as IP address) recorded on our hosting provider's servers | Automatically |
The app accesses your photo library only when you choose an image to send or post. We do not collect your location, contacts or advertising identifiers (IDFA/AAID), and the app includes no analytics, advertising or tracking SDKs.
Card details are handled only by our payment provider, Stripe, Inc.: they never reach our servers, are not stored in the app, and we cannot see them. When you pay, we send Stripe your email address (for the receipt), the amount, and management data attached to the payment (order ID, quote ID, your user ID).
Refunds are normally made manually by the studio from the Stripe dashboard. If a payment is completed for an order that has already been cancelled, it is refunded in full automatically. Card disputes (chargebacks) are handled by the studio in the Stripe dashboard.
3. Why we use it
- Creating your account, verifying it is you, keeping you signed in
- Receiving orders, preparing and presenting quotes, making and delivering items, after-sales support
- Answering your messages in chat, and push notifications (new messages, quote and order progress, payments, comments, new followers, new posts from studios you follow), only if you allow notifications
- Invoicing, payment, refunds and accounting for the deposit and balance
- Providing community features (showing posts and comments, managing follows and counts, handling reports and blocks)
- Preventing inappropriate posts and misuse, enforcing the Terms of Use, complying with the law
- Answering enquiries
- Operating the app safely, investigating bugs and improving it
If we change the purposes, we will do so only within a range reasonably related to the previous purposes, and announce it by updating this policy.
4. What other users can see
Posts, images and comments you publish in the community feed are visible to other users signed in to the app (except users you have blocked). Your display name is shown with your posts and comments to the signed-in users who can see them. The studio account's name is shown to all signed-in users. Please do not include information that identifies you in your posts. Chat messages and photos, and order and quote details, can be seen only by you and the studio.
Follows: when you follow another user or the studio, the relationship "who follows whom" is recorded. It can be seen only by the two people concerned and the studio (the app has no list screen, only counts). Follower / following counts are shown to signed-in users who can view that profile. Following is one-way and needs no approval, and you can unfollow at any time.
Images are stored in a private storage area and shown only to users who are allowed to see them, through time-limited signed URLs.
5. Sharing and processors
Except where required by law, we do not give your personal data to third parties without your consent. We do entrust handling to the following providers, to the extent necessary for the purposes above, and we supervise them appropriately.
| Provider | Role | Data | Country / location |
|---|---|---|---|
| Supabase, Inc. | Database, authentication, file storage, real-time messaging | Account, chat, order/quote and community data and images from section 2 | Japan (Tokyo region). The company is US-based |
| Stripe, Inc. | Card payment processing, receipts, refunds, dispute handling | Payment information (card details are handled only by Stripe), amount, email address, management data (order ID, quote ID, user ID) | United States and others |
| Expo (Expo Push Service) and Apple (APNs) / Google (FCM) | Delivering push notifications | Device push token; notification title and body (e.g. sender name, first ~80 characters of a chat message, type and amount of an order or payment, display name of a new follower, first ~80 characters of a studio post); destination screen path | United States and others |
| Resend, Inc. (email delivery) | Sending verification emails | Email address, email subject and body (including the verification code) | United States (sending is processed in the Tokyo region) |
Notification titles and bodies travel through the Expo, Apple and Google notification systems to reach your device, and these providers handle them as needed to deliver them. Notifications may appear on your lock screen. You can turn them off as described in section 9.
We may disclose data without consent where the APPI permits it, for example on a legal disclosure request, or where necessary to protect life, body or property and consent is hard to obtain.
6. Transfers to third parties abroad
The providers above (Supabase, Stripe, Expo and the Apple and Google notification systems) include companies in other countries such as the United States. In line with the APPI, we check the security measures and other information of these providers and take the necessary steps. On request, we will explain, as far as we can, the legal systems of those countries and the providers' measures.
7. Security measures
- Encryption in transit (HTTPS/TLS)
- Access control (row-level security in the database: only you and the studio account can read your data)
- Private image storage (temporary display via signed URLs)
- Authentication token kept in the device's secure storage (OS keystore)
- Payments accepted only through Stripe notifications whose signature is verified; amounts are calculated on the server from the quote
- Free text in notification records (chat excerpt, names) erased once sending is complete
- Studio-side access management: only the operator accesses the studio account, which is protected by a password
8. How long we keep data
- Account, chats, posts, etc.: kept while your account is active.
- When you delete your account in the app, we delete: your profile (including email address and display name), chat messages and photos, posts, comments, likes, blocks, follows (both those you made and those following you), reports you made, post images and reference photos, and device push tokens. Chats linked to your orders are deleted too. Deletion takes place immediately after you confirm.
- Transaction records (orders, quotes, payments): even after deletion, orders and quotes are anonymised (the link to you is removed; free-text requests, measurements and other details, reference photos and budget notes are erased; category, status, dates and amounts are kept) and kept for about 7 years, as required by bookkeeping and other laws and for accounting. Payment records (amount, status, Stripe payment identifier) are kept in the same way. They are used only for that purpose. You cannot delete your account while you have an order in progress (approved, in production, ready for handover). Unapproved orders are cancelled automatically on deletion.
- Payment records held by Stripe are kept by Stripe under its own terms and the law.
- Push tokens: deleted when you turn notifications off, sign out, delete your account, or when a device is found to be unreachable.
- Notification send records (type, recipient, destination path, time; free text erased after sending): deleted 7 days after creation.
- Reports and abuse-handling records: kept for about 1 year.
- Follows: deleted when you unfollow, when either account is deleted, or when either user blocks the other (both directions are removed).
- Backups: deleted data may remain in backups for a limited time.
9. Your rights and deleting your account
Under the APPI you may ask us to inform you of the purposes of use, disclose, correct, add to or delete the personal data we hold about you, stop using or erase it, or stop providing it to third parties.
- Change your display name and language on the app's profile screen.
- Turn push notifications on or off at any time with the "Notifications" switch on the profile screen (turning them off deletes the device token), or in your device's OS settings.
- Unfollow from the person's profile page at any time. Blocking a user automatically removes follows between you in both directions and prevents following each other.
- Delete your account in the app (Profile > Delete account). It is not possible while you have an order in progress or for the studio account. See section 8 for what remains.
- For requests outside the app, email info@k-loulux.com. We will verify your identity and respond without delay (fee for disclosure requests: free of charge).
- Records we are legally required to keep may not be deletable on request; we will explain why.
10. Advertising, analytics, cookies
The app uses no advertising, behavioural tracking, third-party analytics or crash-reporting tools, and does not collect advertising identifiers. It reads your device language only to choose the display and notification language. If we introduce any of these later, we will update this policy.
(The website k-loulux.com runs on Shopify; cookies, analytics and advertising on the website are covered by the website's privacy policy.)
11. Children
The app is intended for people aged 16 or older. We do not knowingly collect information from younger users. Minors should use the app with a parent's or guardian's consent.
12. Users outside Japan
The app is intended for users in Japan.
13. Changes to this policy
If we change this policy, we will announce it in the app or on https://k-loulux.com. For important changes we will notify you again in the app.
14. Contact
K-LOULUX personal information enquiries
Email: info@k-loulux.com
Address: 188-0014 Tokyo, Nishi-Tokyo-shi, Shibakubo 1-15-5-110, Japan
Operator: K-LOULUX (sole proprietorship; name disclosed without delay on request to info@k-loulux.com)
Last updated: 2026-10-09 / Version 2026-10 (matches the Terms of Use version 2026-10 in the app)