Privacy Policy

1. Operator

The Service is operated by the business operator identified in the Commercial Transactions Disclosure published on this website (trade name: Soracross; "we", "us"). Contact: notify@soracross.com, or the contact form on this website.

2. Information We Collect

• Information you enter: name, email address, hotel name and address, preferred pickup date, details of requested products (URLs, quantities, etc.), pickup preferences, special notes, and inquiry content.
• Reviews you choose to leave after an order is completed: star rating, comment, and your choice on whether the review may be shown publicly.
• Information generated in the course of a transaction: the content and status of quotes and orders, the date/time of approval and the version of the Terms agreed to, purchase receipts and product photographs kept as evidence, and email delivery records.
• Information collected automatically: communication logs such as IP addresses (aggregated for fraud and attack prevention), and referral information (UTM parameters, referrer domain, landing page). Referral information is held in your browser and attached to your quote request when you submit it; we do not track individuals across other websites.
• Information we do NOT collect: card details. Payment is completed on pages operated by Square, Inc., and we never receive or store your card number.

3. Purposes of Use

1. Preparing and sending quotes, performing the purchase agency service, handover of products, and handling refunds and cancellations.
2. Communications about your transaction (emails at each stage: receipt of request, quote, payment guidance, purchase, delivery, completion, etc.).
3. Identity confirmation; prevention of fraud, bots and attacks; and responding to payment disputes (chargebacks).
4. Responding to inquiries.
5. Compliance with laws, and exercise or defense of legal rights.
6. Displaying customer reviews on our website — only where you have expressly consented to public display, in anonymized form (your name is never shown; only the star rating, the comment and the month), and only after we have screened and approved the review for publication.
7. Statistical analysis for service improvement (in a form that does not identify individuals).

4. Provision to Third Parties

We do not provide personal data to third parties except in the following cases:

• Provision necessary for performance of the Service: your name to the hotel you are staying at (for delivery), and to parcel locker operators and similar providers.
• Where required by law, or where necessary to protect a person’s life, body or property.

5. Outsourcing and Overseas Service Providers

We entrust parts of our operations (including the storage and processing of personal data) to the following providers. Their servers are located primarily in the United States. We keep ourselves informed of the data-protection regimes of the relevant countries and the measures taken by each provider, and supervise them appropriately through contracts and related means.

• Vercel Inc. (hosting / USA)
• Supabase, Inc. (database and storage / USA)
• Resend (email delivery / USA)
• Block, Inc. (Square) (payment / USA and Japan)
• Cloudflare, Inc. (DNS, security, cookie-less web analytics / USA)

6. Retention Periods

• Operational contact information (email address, hotel name and address, pickup address and special notes) is masked (anonymized) 90 days after a transaction ends (completed, cancelled or lapsed).
• Accounting records of a transaction — the other party’s name, amounts, dates and purchase receipts — are retained for the retention period required by tax law (bookkeeping and record-keeping rules) and deleted thereafter.
• Where other laws require us to keep particular records for longer, those records are kept for the legally required period.

7. Security Measures

We take measures including: encryption of communications (TLS/HSTS); access controls (two-factor protection and separation of privileges for the administration console); encrypted storage of secrets; bot and attack countermeasures (human verification, rate limiting, monitoring and alerting); and periodic log review.

8. Cookies, Local Storage and Analytics

We do not use advertising cookies or tracking pixels, and we do not track you across other websites. We use only the following, each of which is necessary to operate the site or protect it:

• Strictly necessary cookies: a sign-in session cookie for the "My orders" page (set only if you sign in by email verification), a session cookie for our own administrators, and a cookie that remembers your language choice.
• Local draft storage: while you fill in the quote form, a draft is saved in your browser’s local storage (kept for up to 48 hours) so that your input is not lost. It stays on your device and is sent to us only when you submit the form.
• Bot protection: Cloudflare Turnstile runs on our public forms to distinguish humans from bots. It is provided by Cloudflare, Inc. and may use cookies or similar technologies on our pages for that sole purpose.
• Web analytics: Cloudflare Web Analytics, which is cookie-less and does not track individuals.
• Payment pages: payment takes place on pages operated by Square, Inc.; cookies on those pages are governed by Square’s own privacy policy.

Because we use no cookies other than those strictly necessary for the operation and protection of the site, no cookie-consent banner is currently displayed. If we ever introduce technologies that require consent (such as advertising or measurement pixels), we will update this Policy and put a consent mechanism in place beforehand.

9. Disclosure, Correction and Suspension of Use

You may request disclosure, correction, addition, deletion or suspension of use of your personal data held by us. Please contact us at the address in Section 1. After confirming your identity, we will respond without undue delay in accordance with applicable law.

10. Revisions

This Policy may be revised as necessary. Material changes will be announced on this website.