Privacy policy

01Who controls your information

Dohar Co. Ltd, operating the Hana Yoshida brand, is the data controller for the information described in this policy.

Gumroad separately controls information it collects for its own checkout, account, fraud-prevention, tax and payment purposes. Its handling of that information is explained in the Gumroad privacy policy.

02What we collect

Please do not send sensitive personal information that is not needed to answer your request.

03Why we use it

Where processing relies on legitimate interests, we limit the data and consider the effect on your rights. Where the law requires consent for a particular use, we will request it first.

04How our website analytics work

The Hana website sends a short heartbeat to our Cloudflare Worker while a page is visible. This tells us how many different browsers visited that day, which pages they reached, the referring hostname, the deepest part of a page reached, and an approximate location derived by Cloudflare from the connection.

To avoid storing a raw IP address, the Worker combines the IP address and browser user-agent with a random salt that changes each calendar day, then stores only the resulting one-way token. Tokens from different days cannot be matched by our system. The raw IP address is not written into the Hana analytics database.

Country is kept with the daily count. Region, city, approximate coordinates, current page and last-seen time are used for the private live view and are removed after they have been stale for approximately 30 minutes.

The site also uses browser local storage for limited on-device functions: remembering that a promotional prompt was already shown, and avoiding an unnecessary duplicate visit-count request. This information stays in your browser and can be cleared through your browser settings.

05Checkout, payment and delivery

The payment form is provided by Gumroad. Gumroad and its financial partners process the payment, perform fraud and compliance checks, calculate transaction taxes where applicable, and generate the relevant receipt or invoice. They may use cookies or similar technology within the checkout under their own privacy terms.

For new purchases, Gumroad provides the receipt and ebook download access and makes order information available to us for support and accounting. Historical orders and their support records remain available through our existing Cloudflare and Resend services. Failed payments are not treated as completed orders.

06Who receives information

We do not sell or rent personal information. We may also disclose information when required by law, to protect legal rights or security, or as part of a business transfer subject to appropriate safeguards.

07International transfers

We are established in Bulgaria, but some providers operate in the United States or other countries outside the European Economic Area. Where EU or UK data-protection law requires a transfer safeguard, the provider or we use an approved mechanism such as an adequacy decision or standard contractual clauses, together with any additional measures required for the transfer.

You may contact us for more information about the safeguards relevant to your information.

08How long we keep information

• Orders, payments, refunds, payouts and accounting records: for the period required by applicable tax and accounting law, which may be up to ten years.
• Delivery records: while needed to provide replacement access, prevent duplicate delivery and support the order.
• Daily website statistics: retained as privacy-limited daily tokens and aggregated business measurements. The daily salt prevents our system from connecting the same visitor between days.
• Live-presence details: removed after approximately 30 minutes without a new heartbeat.
• Support and complaint messages: while needed to resolve the request and then for a reasonable period to establish or defend legal claims.

We may keep information longer where the law requires it or where it is needed for an active dispute, fraud investigation or legal claim.

09Your privacy rights

Depending on where you live and the law that applies, you may have the right to:

• ask whether we hold personal information about you and receive a copy;
• correct inaccurate or incomplete information;
• ask us to delete information where no legal reason requires us to keep it;
• restrict or object to certain processing;
• receive information you provided in a portable format where applicable;
• withdraw consent, where consent is the legal basis; and
• complain to a data-protection authority.

Email hanayoshida.support@gmail.com with “Privacy request” in the subject. We may ask for enough information to verify that the request relates to you. We normally respond within one month where the GDPR applies.

You may complain to the Bulgarian Commission for Personal Data Protection or, where applicable, the supervisory authority in your country.

10Security and children

We use access controls, encrypted connections, signed webhook verification and limited data collection to protect the service. No system is perfectly secure, but we review access and keep payment-card handling with the specialist payment providers.

The ebook and website are intended for adults. We do not knowingly collect personal information directly from children under 16. If you believe a child has provided information to us, contact us so we can review and delete it where appropriate.

11Changes and contact

We may update this policy when our website, providers or legal obligations change. The date at the top shows the latest revision. Material changes will be presented in an appropriate way.

For a privacy question or request, email hanayoshida.support@gmail.com.