Privacy Policy

繁體中文日本語English

GachaJP Privacy Policy

Date of Enactment: May 15, 2026 Date of Last Revision: May 19, 2026 Business Operator: VicMe LLC (hereinafter referred to as the "Company") Controlling Language: The Japanese version of this Policy shall be the authoritative text. In the event of any discrepancy between the Japanese version and the Traditional Chinese version or any other language version, the Japanese version shall prevail.

1. Basic Policy

VicMe LLC (hereinafter referred to as the "Company") collects and uses Users' personal information in providing the online draw-based sales service "GachaJP" (hereinafter referred to as the "Service") operated by the Company. The Company complies with the Japanese Act on the Protection of Personal Information, the Taiwan Personal Data Protection Act, the Hong Kong Personal Data (Privacy) Ordinance (PDPO), and other applicable laws and regulations, and handles Users' personal information appropriately.

2. Business Operator Information

ItemDetails
Business OperatorVicMe LLC
Contactinfo@vicme.jp
Personal Information Protection ManagerVicMe LLC (contact as above)

3. Personal Information We Collect

The Company collects the following personal information in providing the Service.

3.1 Information collected at user registration

  • Name
  • Email address
  • Password (stored in encrypted form)
  • Phone number
  • Date of birth (for age verification)
  • Country/region of residence
  • Language settings

3.2 Information collected during use of the Service

  • Point purchase history
  • Pack purchase history
  • Draw result history
  • Holding and shipping status of Obtained Cards
  • Shipping address, recipient name, recipient phone number
  • Login history
  • Operation logs

3.3 Information collected at the time of payment

  • Credit card information (processed through payment processors; not retained by the Company)
  • Payment result information provided by payment processors

3.4 Information collected automatically

  • IP address
  • Browser type and version
  • Device type and OS information
  • Date and time of access
  • Referrer URL
  • Information collected through cookies and similar technologies
  • Behavioral history (page views, clicks, time spent, etc.)

3.5 Information collected upon inquiries

  • Contents of inquiries
  • Information entered in the inquiry form
  • History of communications with the Company

4. Purposes of Use of Personal Information

The Company uses the collected personal information for the following purposes:

  1. Provision of the Service (account management, draws, storage of Obtained Cards, shipping, etc.)
  2. User authentication, identity verification, and prevention of fraudulent use
  3. Payment processing and refund handling
  4. Responding to inquiries and providing support
  5. Notification of important announcements (amendments to terms, service changes, system failure information, etc.)
  6. Information on campaigns, new services, and related services (only where prior consent has been obtained)
  7. Access analysis, preparation of usage statistics, and improvement of the Service
  8. Fulfillment of legal obligations (tax laws and other applicable laws and regulations)
  9. Responding to violations of laws and regulations or of the terms, and protecting the Company's rights

5. Provision of Personal Information to Third Parties

  1. The Company will not provide personal information to third parties without the User's prior consent. However, this shall not apply in the following cases:
    1. Where based on laws and regulations
    2. Where necessary for the protection of a person's life, body, or property, and it is difficult to obtain the consent of the individual
    3. Where particularly necessary for improving public health or promoting the sound development of children
    4. Where it is necessary to cooperate with a national government agency, a local government, or a party entrusted by either of them in executing affairs prescribed by laws and regulations
    5. Where a disclosure request based on laws and regulations is made by a judicial body, administrative body, or the like
  2. Where the Company entrusts part of the operations of the Service to the contractors listed below, the Company may provide personal information to the extent necessary for the performance of the entrusted operations.

6. Entrustment of Operations

The Company may, in providing the Service, entrust the handling of personal information to the following categories of contractors to the extent necessary for the performance of the entrusted operations:

  • Payment processors
  • Cloud service providers for web hosting, databases, authentication infrastructure, etc.
  • Email delivery and SMS delivery providers
  • Access analytics and advertising delivery providers
  • Shipping carriers (within Japan and overseas)
  • Providers of communication tools related to customer support
  • Meta Platforms, Inc. (United States): advertising delivery and advertising effectiveness measurement (transmission of event information, including hashed email addresses, phone numbers, and user IDs, via Meta Pixel and the Conversions API)

The Company appropriately supervises its contractors to ensure the protection of personal information.

7. Provision of Personal Information to Third Parties Located in Foreign Countries (Response to Article 28 of the APPI)

  1. Among the contractors listed in Section 6 above, the Company provides personal information, to the extent necessary for the performance of operations, to operators located outside Japan (mainly in the United States of America).
  2. The United States of America does not have a comprehensive personal information protection legal framework; however, each contractor used by the Company implements security control measures compliant with SOC 2, the GDPR, the CCPA, and other international standards.
  3. If you wish to confirm details of the systems for the protection of personal information in the relevant country, please contact us via the contact form.
  4. By agreeing to this Policy, Users shall be deemed to have also consented to the provision of personal information to these third parties located in foreign countries.

8. Additional Provisions for Users in Taiwan and Hong Kong

8.1 Users in Taiwan (Response to the Personal Data Protection Act)

  1. Personal data collected from Users residing in Taiwan is stored on servers in Japan (Supabase, Vercel, etc.) for the provision of the Service, and is shared with the contractors listed in Section 6 above as necessary.
  2. Such transfer constitutes a cross-border transfer under Article 21 of the Taiwan Personal Data Protection Act; however, the Japanese Act on the Protection of Personal Information is recognized as a framework providing a level of protection generally equivalent to that of the Taiwan Personal Data Protection Act.
  3. Users residing in Taiwan may exercise the following rights with respect to the personal data held by the Company under the Taiwan Personal Data Protection Act:
    1. Right to review
    2. Right to request a copy
    3. Right to request supplementation or correction
    4. Right to request the discontinuation of collection, processing, or use
    5. Right to request deletion
  4. If you wish to exercise the above rights, please contact us via the contact form.

8.2 Users in Hong Kong (Response to the Personal Data (Privacy) Ordinance (PDPO))

  1. Personal data collected from Users residing in Hong Kong is stored on servers in Japan for the provision of the Service, and is shared with the contractors listed in Section 6 above as necessary.
  2. Such transfer falls within the scope set forth in Section 33 of the Hong Kong Personal Data (Privacy) Ordinance; however, Japan's personal information protection framework provides a level of protection equivalent to that of the Hong Kong PDPO.
  3. Users residing in Hong Kong may exercise the following rights with respect to the personal data held by the Company under the Hong Kong PDPO:
    1. Data Access Request
    2. Data Correction Request
    3. Request for discontinuation of use or deletion
  4. If you wish to exercise the above rights, please contact us via the contact form.

9. Use of Cookies and Similar Technologies

  1. The Company uses cookies and similar technologies (web beacons, local storage, etc.) for purposes such as improving the convenience of the Service, analyzing usage, and delivering advertisements.

  2. The main uses of cookies are as follows:

    • Maintaining login status
    • Remembering user preferences such as language and display settings
    • Analyzing usage (Google Analytics 4, etc.)
    • Optimizing advertising delivery (Meta Pixel, etc.)
    • Detecting unauthorized access

  3. Users may refuse to accept cookies through their browser settings; however, in that case, some functions of the Service may become unavailable.

  4. The main analytics and advertising tools used by the Company are as follows:

    • Google Analytics 4: The Company analyzes usage of the Service using anonymized information. For information collection and use by Google, please see the Google Privacy Policy. You can opt out via the Google Analytics Opt-out Add-on.
    • Meta Pixel: Used for the optimization of advertising delivery by Meta. For details, please see the Meta Privacy Policy.

  5. Transmission of hashed information for advertising effectiveness measurement

    When a User performs certain events such as a purchase, the Company applies one-way, irreversible hashing (SHA-256) to the email address and phone number provided at user registration, and transmits the hashed values and event information (purchase amount, order ID, etc.) to Meta Platforms, Inc. via the Conversions API, for use in measuring and optimizing advertising effectiveness.

    • All transmitted data is hashed data, and Meta cannot restore the original personal information from the hashed values
    • The purposes of this use are limited to advertising effectiveness measurement, advertising optimization, and the creation of lookalike audiences
    • Users may refuse tracking through browser settings, or request that the Company stop such transmission via the contact form

10. Retention Periods of Personal Information

  1. The Company retains personal information for the period necessary to achieve the purposes of use.
  2. The main retention periods are as follows:
    • Account information: for the duration of the account's validity and for 30 days after deletion (for backup recovery)
    • Point and Pack purchase history: for the retention period required by laws and regulations (up to 10 years, based on the Act on Specified Commercial Transactions and tax laws)
    • Shipping-related information: for 3 years after completion of product delivery
    • Inquiry history: for 3 years after completion of handling
    • Login and operation logs: for 1 year from collection
  3. After the above periods have elapsed, personal information will be deleted or anonymized without delay.

11. Security Control Measures

The Company takes the following necessary and appropriate measures to prevent the leakage, loss, or damage of personal information and to otherwise ensure the security of personal information:

  1. Organizational security control measures: appointment of a personal information protection manager and periodic review of handling status
  2. Personnel security control measures: limiting the persons who handle personal information and ensuring appropriate handling
  3. Physical security control measures: appropriate management of devices and storage media that handle personal information
  4. Technical security control measures: access control, encryption (HTTPS, TLS), countermeasures against unauthorized access, anti-virus measures, and periodic vulnerability assessments
  5. Supervision of external contractors: where entrusting the handling of personal information, selecting contractors that implement appropriate protection measures and conducting necessary and appropriate supervision

12. Users' Rights

  1. Users may request that the Company take the following actions with respect to their own personal information held by the Company:
    1. Request for disclosure
    2. Request for correction, addition, or deletion
    3. Request for suspension of use or erasure
    4. Request for suspension of provision to third parties
    5. Request for notification of the purposes of use
  2. To make any of the above requests, please contact us via the contact form. The Company will respond within a reasonable period after confirming that the request has been made by the User in person.
  3. The Company may be unable to respond in certain cases, such as where required by laws and regulations.
  4. No fee shall be charged for the above responses (provided, however, that in the case of complex responses, Users may be asked to bear an amount equivalent to actual costs).

13. Handling of Phone Numbers

  1. Phone numbers collected by the Company are used solely for the following purposes:
    1. Identity verification for accounts
    2. Prevention of fraudulent use
    3. Emergency contact (shipping issues, system failures, etc.)
    4. Important announcements from the Company
  2. Where the Company uses phone numbers for purposes other than the above (marketing, advertising, etc.), the Company will obtain separate explicit consent from the User.
  3. The Company will not provide Users' phone numbers to any third party other than the Company's contractors (Twilio, SMS delivery providers, and shipping carriers).

14. Personal Information of Minors

  1. Persons under 18 years of age are not eligible to use the Service (see Article 3 of the Terms of Service).
  2. If the Company discovers at the time of registration that a person is under 18 years of age, the Company will invalidate the relevant account and delete the personal information it holds without delay.
  3. If the Company unintentionally collects the personal information of a person under 18 years of age, the Company will promptly delete it upon request from a parent or guardian.

15. Inquiries Regarding the Handling of Personal Information

Questions, requests, complaints, and other matters regarding the handling of personal information are accepted at the following contact point:

  • Contact point: VicMe LLC Personal Information Protection Manager
  • Email: info@vicme.jp

When you make a request, we may ask you to confirm information for identity verification purposes (name, email address, phone number registered at signup, etc.).

16. Revision of This Privacy Policy

  1. The Company may revise this Policy in response to amendments to laws and regulations, changes to the contents of the Service, or as otherwise necessary.
  2. When revising this Policy, the Company will notify Users of the revised contents and the effective date by posting on the Service or by other methods the Company deems appropriate.
  3. If a User uses the Service on or after the effective date of the revised Policy, such User shall be deemed to have agreed to the revised Policy.

17. Language Priority

The Japanese version of this Policy shall be the authoritative text, and in the event of any discrepancy between the Japanese version and the Traditional Chinese version or any other language version, the Japanese version shall prevail.

Supplementary Provisions

This Policy shall come into effect on May 15, 2026.

End of Document