This site ("we") is run by an individual seller providing purchasing and usage assistance for buyers in mainland China of the Japan Rakuten SIM. We take your privacy seriously; this policy explains how we collect, use, store and protect your information.
💡 Please read this policy carefully before using our services. Continuing to register or order means you understand and accept it.
1. Information We Collect
To provide our services, we collect the following information:
- Account information: email and password (stored as a PBKDF2 hash — we can't see the plaintext)
- Order information: the phone number, WeChat ID, shipping address and notes you enter when ordering
- Technical information: IP address, browser UA, visit time, page-view behaviour (anonymous event level; no form contents)
- Traffic source: the referral channel you arrived from (such as a search engine, an external link's domain, or utm parameters on a promotional link), landing page, device type and country/region — used to measure traffic and conversions per channel. We do not use tracking cookies. Our in-house analytics deduplicates with a daily-rotating anonymous identifier derived from an irreversible hash of "IP + UA + date", which cannot be linked across days or reversed to your IP or UA. In addition, srcstat stores a randomly generated anonymous visitor ID (
_sv_vid) in your browser's localStorage to attribute later orders to the original channel; this ID is kept long-term and can be linked across days but contains no personal information and is not used for cross-site tracking — you can delete it by clearing your browser's site data at any time.
- Email codes: the 6-digit code sent to your email for sign-up / password reset (stored as a hash, valid for 5 minutes)
We do not collect: ID numbers, bank card numbers, biometric data, chat records, contacts or location data.
2. How We Use Your Information
- Processing orders, shipping and after-sales service
- Email sign-up verification and password recovery
- Maintaining login state (30-day session cookie)
- Anti-abuse and security (rate limiting, banning abnormal accounts)
- Aggregated anonymous data analysis (never individual) for product improvement
We will not sell your personal information to third parties, nor use it for marketing unrelated to this service.
3. Third-Party Services
To keep the service running, we use these third parties:
- Cloudflare Workers / D1: hosts the site and database (stored on Cloudflare's global edge nodes, including APAC)
- Resend: sends sign-up verification codes and password-reset emails
- Google Analytics / Cloudflare Web Analytics: anonymous site traffic statistics
- Mixpanel: event-level user behaviour analytics (Session Replay is disabled; form inputs are not collected)
- srcstat (stats.imwsl.com): anonymous traffic-source statistics. It receives an anonymous visitor ID, referral channel and order-conversion records (order ID, amount) but not your name, phone number, WeChat ID or shipping address
We also run our own cookie-free anonymous traffic-source statistics (stored only in our own Cloudflare D1 database), used solely to understand traffic and conversions per channel — never to identify individuals.
Each of these providers has its own privacy policy, and some of your technical information (such as IP) is processed briefly on their servers. We've limited the data they can access as much as possible.
4. Data Storage & Retention
- Account and order data are stored in Cloudflare D1 (SQLite)
- Account data is kept until you close your account
- Order data is kept for 2 years for after-sales traceability
- Email codes expire automatically after 5 minutes and are marked used immediately upon successful verification
- Session cookie expires after 30 days
- Rate-limit counters are kept only short-term (minutes to hours)
5. Your Rights
Under the Personal Information Protection Law (PIPL), you have the right to:
- Access: sign in to My Account to view your email, registration date and order history
- Correct: update your password and other information
- Delete: to close your account and delete your data, contact us via the "Support" widget at the bottom right (processed within 3 business days)
- Withdraw consent: at any time, clear cookies and site data (including localStorage) in your browser, log out, or ask support to stop processing your information
- Opt out of analytics: use your browser's "Do Not Track" setting or an ad-blocking extension to stop GA / Mixpanel / srcstat collection; clearing site data removes srcstat's anonymous visitor ID
6. Security Measures
- Passwords use PBKDF2-SHA256 with a unique salt, so the original can't be recovered even if data leaks
- Sessions use HttpOnly + Secure cookies, preventing JS access
- Session Replay is disabled on sensitive form fields to avoid recording personal information
- All POST endpoints validate the Origin header to mitigate CSRF
- Rate limiting prevents brute-force attacks and malicious fake orders
- In the event of a data breach, affected users will be notified by email within 72 hours
7. Protection of Minors
This service is not intended for minors under 14. If we discover we've collected a minor's information inadvertently, we'll delete it immediately. Guardians who find a minor using the service without consent should contact us.
8. Changes to This Policy
This policy may be updated due to legal changes or service upgrades. Major changes will be noted at the top of the page; minor adjustments will update the "Last updated" date. Continuing to use the service means you accept the updated policy.
9. Contact Us
For any questions, complaints or to exercise your rights, contact us via the Support widget at the bottom right; we usually reply within minutes and never later than 3 business days.