Privacy policy

Last updated: September 1 2026

YUGA is a brand operated by BONSAI Inc. ("YUGA," "we," "us," or "our"), located at 9F, Ginza TH Building, 7-13-20 Ginza, Chuo-ku, Tokyo, Japan. We operate this online store and website, including the related content, features, products, and services (collectively, the "Services"). Our store is powered by Shopify, which enables us to provide the Services to you.

This Privacy Policy explains how we collect, use, disclose, retain, and protect personal information when you visit or use the Services, make a purchase or other transaction, subscribe to marketing, contact us, or otherwise interact with us. It also explains the privacy rights and choices that may be available to you.

If there is a conflict between this Privacy Policy and our Terms of Service concerning the collection, use, or disclosure of personal information, this Privacy Policy will apply to that issue.

Please read this Privacy Policy carefully. By using the Services, you acknowledge that you have read and understood this Privacy Policy. Where applicable law requires consent, we will request it separately.

1. Personal Information We Collect

"Personal information" means information that identifies you or can reasonably be linked to you. It does not include information that has been anonymized or de-identified so that it can no longer reasonably identify you.

Depending on how you interact with us, we may collect the following categories of personal information:

  • Contact and identity information, such as your name, email address, telephone number, billing address, and shipping address.
  • Order and commercial information, such as products viewed, items placed in your cart or wishlist, purchases, returns, refunds, cancellations, order history, and transaction details.
  • Payment information, such as payment method, billing details, payment confirmation, and related transaction information. Payments are processed by Shopify and other payment providers. We generally do not receive or store your complete payment card number.
  • Account information, such as your login details, account settings, preferences, and saved information, if you create an account.
  • Communications, such as information you provide when you contact customer service, submit a form, respond to a survey, or otherwise communicate with us.
  • Device and technical information, such as your IP address, browser type, device type, operating system, network information, cookie identifiers, and other online identifiers.
  • Usage information, such as how you browse, search, and interact with the Services; referring URLs; pages viewed; links clicked; and the date and time of your activity.
  • Marketing and preference information, such as your newsletter subscription status, communication preferences, interests, and responses to marketing.
  • Content you choose to submit, such as product reviews, photographs, or other user-generated content, if those features are available.

Please do not provide sensitive personal information through free-text forms or customer service communications unless it is necessary for us to assist you.

2. How We Collect Personal Information

We may collect personal information:

  • Directly from you, including when you place an order, create an account, subscribe to marketing, contact us, submit a review, or otherwise provide information to us.
  • Automatically, when you access or use the Services, including through cookies, pixels, local storage, and similar technologies.
  • From Shopify and our service providers, including payment processors, analytics providers, fraud-prevention providers, fulfillment and shipping providers, customer support providers, and technology vendors.
  • From advertising, social media, and business partners, where permitted by law and subject to their own privacy notices.

3. How We Use Personal Information

We may use personal information for the following purposes:

  • To provide the Services and fulfill our contract with you, including processing payments, confirming and fulfilling orders, arranging delivery, providing order updates, managing accounts, handling returns or refunds, and responding to customer service requests.
  • To operate, personalize, and improve the Services, including remembering preferences, understanding how customers use the Services, improving our website and products, and providing relevant product recommendations.
  • To communicate with you, including responding to inquiries and sending administrative, transactional, security, or service-related messages.
  • For marketing and advertising, including sending promotional emails where you have consented or where otherwise permitted by law, measuring campaign performance, and displaying relevant advertisements.
  • For security and fraud prevention, including authenticating accounts, protecting transactions, detecting or investigating suspected fraud or unlawful activity, and protecting our customers, business, and Services.
  • To comply with law and protect legal rights, including meeting tax, accounting, recordkeeping, regulatory, and legal obligations; responding to lawful requests; resolving disputes; and enforcing our terms and policies.
  • For other purposes disclosed to you at the time of collection, or with your consent where required.

Where applicable law requires a legal basis for processing, we rely on one or more of the following:

  • Performance of a contract, including processing and delivering your order, taking payment, managing returns, and providing requested customer support.
  • Compliance with legal obligations, including tax, accounting, consumer protection, product safety, sanctions, customs, and regulatory requirements.
  • Our legitimate interests, including operating and improving the Services, securing our systems, preventing fraud, understanding store performance, and communicating with customers, provided that those interests are not overridden by your rights and interests.
  • Your consent, including for certain marketing communications, advertising technologies, and non-essential cookies where consent is required.
  • Protection of vital interests or other grounds permitted by law, in limited circumstances.

You may withdraw consent at any time, subject to legal or contractual restrictions and reasonable notice. Withdrawal does not affect the lawfulness of processing that occurred before the withdrawal.

4. Cookies and Similar Technologies

We and our service providers, including Shopify, may use cookies, pixels, tags, software development kits, and similar technologies to:

  • operate essential website, cart, checkout, account, security, and payment functions;
  • remember your settings and preferences;
  • understand website traffic and performance;
  • personalize content and product recommendations; and
  • measure and deliver advertising, where permitted.

Some technologies are necessary for the Services to function. Others may be analytics, personalization, or advertising technologies. Where required by law, we will obtain consent before using non-essential technologies.

You can manage available choices through the Cookie Preferences link or cookie banner on the Services, if displayed in your region. You can also adjust your browser settings, although blocking certain cookies may affect website functionality.

We recognize opt-out preference signals, such as Global Privacy Control (GPC), where required by applicable law and where supported by our systems. Other "Do Not Track" signals may not be recognized because there is no consistent industry standard for them.

5. How We Disclose Personal Information

We may disclose personal information for the purposes described in this Privacy Policy to:

  • Shopify, which hosts the store and processes information necessary to provide and improve Shopify services.
  • Service providers, including payment processors, website and cloud hosting providers, analytics providers, customer support tools, fraud-prevention and security providers, email and marketing platforms, professional advisers, and IT providers.
  • Fulfillment and delivery providers, including postal services, couriers, warehouses, customs authorities, and other parties necessary to deliver orders and complete international shipments.
  • Advertising and business partners, where permitted by law, to measure or deliver advertising and provide related services.
  • Parties you direct us to disclose information to, or where you otherwise request or consent to the disclosure.
  • Government authorities, regulators, courts, and other third parties, where reasonably necessary to comply with law or legal process; protect rights, safety, or property; investigate fraud or unlawful activity; or enforce our terms and policies.
  • Parties to a business transaction, such as a potential or actual merger, acquisition, financing, reorganization, sale of assets, or insolvency proceeding, subject to appropriate confidentiality and legal requirements.

We do not sell personal information for money. However, depending on the technologies and advertising services enabled on the Services, certain disclosures for personalized or cross-context behavioral advertising may be considered a "sale," "sharing," or "targeted advertising" under some U.S. state privacy laws. Where applicable, you may opt out through the Your Privacy Choices or Do Not Sell or Share My Personal Information link on the Services, or by using a recognized opt-out preference signal such as GPC.

6. Relationship With Shopify

The Services are hosted by Shopify. Shopify collects and processes personal information about your access to and use of the Services in order to provide its platform, protect the Services, and provide or improve certain consumer and merchant features.

Information submitted through the Services may be transmitted to Shopify and other service providers in countries other than your country of residence. In some circumstances, Shopify acts as our service provider or processor. In other circumstances, Shopify may act as an independent controller of personal information for its own purposes, including certain enhanced or consumer-facing services.

For more information about Shopify's privacy practices and available rights, please review the Shopify Consumer Privacy Policy and the Shopify Privacy Portal.

7. International Transfers

YUGA is operated from Japan. Your personal information may be transferred to, stored in, or processed in Japan and in other countries where Shopify and our service providers operate, which may include Canada, Singapore, the United States, and other countries. Those countries may have privacy laws that differ from the laws in your country.

Where required by applicable law, we take reasonable steps designed to ensure that international transfers are subject to appropriate safeguards. These may include an adequacy decision, contractual protections, the European Commission's Standard Contractual Clauses, the UK International Data Transfer Agreement or UK Addendum, safeguards recognized under Swiss law, transfers necessary to perform our contract with you, your consent where legally permitted, or another legally recognized transfer mechanism. We also require service providers handling personal information on our behalf to protect it in accordance with applicable law and their contractual obligations.

You may contact our Privacy Contact to request further information about the safeguards relevant to your personal information, subject to applicable confidentiality restrictions.

8. Data Retention

We retain personal information only for as long as reasonably necessary for the purposes described in this Privacy Policy, including to provide the Services, maintain business and transaction records, comply with tax and legal obligations, prevent fraud, resolve disputes, and enforce agreements.

Retention periods vary depending on the type of information, the nature of our relationship with you, legal requirements, and whether the information is needed for an actual or anticipated dispute. When personal information is no longer required, we will delete, anonymize, or securely dispose of it, subject to applicable law and legitimate backup or archival practices.

9. Security

We use reasonable administrative, technical, and organizational safeguards designed to protect personal information against unauthorized access, loss, misuse, alteration, or disclosure. However, no security method or transmission over the Internet is completely secure, and we cannot guarantee absolute security.

Please protect your account credentials and do not send sensitive or confidential information through unsecured channels.

10. Your Privacy Rights and Choices

Depending on where you live and subject to applicable law, you may have the right to:

  • request access to or a copy of personal information we hold about you;
  • request information about how we collect, use, or disclose your personal information;
  • request correction of inaccurate or incomplete personal information;
  • request deletion of personal information;
  • request restriction of, or object to, certain processing;
  • withdraw consent, where processing is based on consent;
  • request portability of certain personal information;
  • opt out of direct marketing;
  • opt out of the sale or sharing of personal information or the use of personal information for targeted advertising, where applicable;
  • limit certain uses or disclosures of sensitive personal information, where applicable;
  • appeal our refusal of a privacy request, where applicable; and
  • make a complaint to us or an appropriate privacy or data protection authority.

These rights are not absolute. We may refuse or limit a request where permitted by law, including where we cannot verify your identity, the information is legally privileged, retention is required by law, or an exception applies.

To exercise a right, email info@bonsai-jp.com with the subject line "Privacy Request." Please describe your request and the country or U.S. state where you reside. We may request information reasonably necessary to verify your identity. If an authorized agent submits a request on your behalf, we may require proof of authorization and may also verify your identity directly.

We will respond within the period required by applicable law. We will not discriminate against you for exercising an applicable privacy right.

Marketing choices

You may unsubscribe from promotional emails at any time by selecting the unsubscribe link in the message or contacting us. Even if you opt out of marketing, we may still send non-promotional messages relating to your account, orders, or our ongoing business relationship.

11. Additional Information for Residents of Certain Regions

Canada

You may request access to personal information under our control, ask how it has been used or disclosed, and request correction of inaccurate or incomplete information. You may also withdraw consent, subject to legal or contractual restrictions and reasonable notice. Questions or challenges concerning our privacy practices should first be directed to our Privacy Contact using the details below. If your concern is not resolved, you may have the right to contact the Office of the Privacy Commissioner of Canada or the applicable provincial privacy authority.

United States

Residents of certain U.S. states may have rights to know, access, correct, delete, or obtain a portable copy of personal information; to opt out of sale, sharing, targeted advertising, or certain profiling; to limit certain uses of sensitive personal information; and to appeal a decision concerning a request. The exact rights depend on your state and whether the relevant law applies to YUGA.

For purposes of applicable U.S. state privacy laws, the categories of personal information we have collected and disclosed for business purposes during the preceding 12 months are described in Sections 1 and 5. We do not knowingly sell or share the personal information of individuals under 16 years of age.

Where required, you may opt out through the Your Privacy Choices or Do Not Sell or Share My Personal Information link on the Services. We will also process a recognized GPC signal as an opt-out request for the browser or device that sends the signal, where required.

Europe (EEA, United Kingdom, and Switzerland)

If you are located in the European Economic Area ("EEA"), the United Kingdom, or Switzerland, applicable data protection law may provide you with the right to:

  • access personal information we hold about you;
  • correct inaccurate or incomplete personal information;
  • request deletion of personal information;
  • restrict certain processing;
  • receive certain personal information in a structured, commonly used, machine-readable format and transmit it to another controller;
  • object to processing based on legitimate interests;
  • object at any time to processing for direct marketing;
  • withdraw consent at any time where processing is based on consent; and
  • lodge a complaint with the data protection authority in your country of residence, place of work, or place of the alleged infringement.

Where we process personal information subject to the EU GDPR, UK GDPR, or applicable Swiss data protection law, the legal bases we rely on are described in Section 3. You are not required to provide personal information merely to browse the Services. However, certain information is necessary for us to enter into or perform a contract with you, including processing payment, fulfilling an order, and arranging delivery. If you do not provide that information, we may be unable to complete your transaction or provide the requested service.

Where required, we ask for consent before placing or accessing non-essential cookies or similar technologies on your device. You may withdraw or change your consent through the Cookie Preferences link available on the Services. Withdrawal does not affect the lawfulness of processing that occurred before withdrawal.

We may process personal information outside the EEA, United Kingdom, or Switzerland, including in Japan and the countries described in Section 7. Where required, we rely on a valid transfer mechanism, such as an adequacy decision, the European Commission's Standard Contractual Clauses, the UK International Data Transfer Agreement or UK Addendum, or safeguards recognized under Swiss law.

You may submit a request or ask for information about the applicable transfer safeguards by contacting our Privacy Contact. We will generally respond to a valid request within one month, although applicable law may permit an extension in certain circumstances.

Australia

You may request access to personal information we hold about you or ask us to correct it. You may also complain about our handling of personal information by contacting our Privacy Contact. We will acknowledge and investigate a complaint and respond within a reasonable period. If you are not satisfied with our response, you may have the right to contact the Office of the Australian Information Commissioner.

As described in Section 7, we are likely to disclose personal information to overseas recipients, including recipients in Japan, Canada, Singapore, the United States, and other countries where our service providers operate. Because service-provider locations may change, it is not always practicable to identify every country in advance.

Singapore

You may request access to personal data in our possession or control and information about how it has been used or disclosed, and you may request correction of an error or omission. You may withdraw consent by giving us reasonable notice, subject to legal or contractual restrictions. We will inform you of the likely consequences of withdrawal where required. Our Privacy Contact identified below is responsible for receiving questions and requests relating to personal data.

When personal data is transferred outside Singapore, we take steps required by applicable law to ensure that it receives a standard of protection comparable to that required under Singapore's Personal Data Protection Act, unless an exception applies.

Hong Kong

You may request access to personal data we hold about you and request correction of inaccurate personal data, subject to applicable law. You may also require us at any time, and without charge, to stop using your personal data for direct marketing. To make a request, contact our Privacy Contact using the details below. We may require a written request and information necessary to verify your identity.

Japan

Where Japan's Act on the Protection of Personal Information applies, you may request notification of the purpose of use, disclosure of retained personal data or records of third-party provision, correction, addition or deletion, suspension of use, erasure, or suspension of third-party provision, subject to applicable requirements and exceptions.

12. Children's Privacy

The Services are intended for a general audience and are not directed to children under 16. We do not knowingly collect personal information from children under 16. If you believe that a child has provided personal information to us, please contact us so that we can review and, where appropriate, delete it.

13. Third-Party Websites and Services

The Services may contain links to websites, social networks, or services operated by third parties. We do not control and are not responsible for their privacy or security practices. Please review the privacy notices of those third parties before providing information to them.

14. Complaints

If you have a concern or complaint about how we handle personal information, please contact our Privacy Contact. Please include enough detail for us to understand and investigate the matter. We will review the complaint and respond within a reasonable period or within the time required by applicable law.

If you are not satisfied with our response, you may have the right to contact the privacy or data protection authority in your place of residence. Nothing in this Privacy Policy limits any right you have to contact an authority directly.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to our practices, technologies, services, or legal obligations. We will post the revised policy on the Services, update the "Last updated" date, and provide any additional notice required by law. We encourage you to review this Privacy Policy periodically.

16. Contact Us

For questions, complaints, or requests concerning this Privacy Policy or our handling of personal information, contact:

Privacy Contact / Data Protection Contact
YUGA / BONSAI Inc.
Email: info@bonsai-jp.com
Postal address: 9F, Ginza TH Building, 7-13-20 Ginza, Chuo-ku, Tokyo, Japan