This site is run by Junpei Takeya, Niigata, Japan (junpei.takeya[at]gmail.com). This page explains what personal data the site and its newsletters handle, and why.
Newsletter
If you subscribe, your email address is collected and stored by Substack, which sends the letters on my behalf. It is used only to send the newsletters you chose and occasional notes about them. You can unsubscribe at any time with the link in every email. See Substack’s own privacy policy for how they process data.
This website
The site does not use advertising or tracking cookies. Fonts are served from this site, not from third parties. [If you add analytics, name the tool here and state whether it uses cookies.] The hosting provider ([HOST NAME]) keeps standard server logs for security.
Your rights
If you live in the EU or UK, you can ask to see, correct or delete the personal data I hold about you, and you can complain to your local data protection authority. Write to [YOUR EMAIL].
Last updated: [2026.10.01]
1. Who I am
Effective date: [1.10.2026]
Take Your Time — Letters from an Unfound Japan is an independent magazine written and run by one person, Junpei Takeya, from Niigata, Japan. In this policy, “I”, “me” and “my” refer to him. I am the controller of the personal data described here, within the meaning of the EU and UK General Data Protection Regulation (GDPR).
This policy covers takeyourtime.junpeitakeya.com, the newsletters Gangi and Lagoon, and any paid subscriptions or purchases connected to them. I collect as little as I can, and I never sell your data.
Contact
- Email: [info@junpeitakeya.com]
- Based in: Niigata, Japan
- EU representative (Art. 27 GDPR)
I aim to reply to any privacy request within one month.
2. What I collect, why, and on what legal basis
I only process personal data for the purposes below. Each has a lawful basis under Article 6 GDPR.
| Data | When | Purpose | Lawful basis |
|---|---|---|---|
| Email address, subscription status, plan | You subscribe to Gangi or Lagoon | Sending the newsletters you asked for; managing free and paid access | Contract (Art. 6(1)(b)); consent for free subscriptions (Art. 6(1)(a)) |
| Name, email, billing country, payment record | You pay for a subscription or purchase | Processing payment, issuing receipts, handling refunds | Contract (Art. 6(1)(b)) |
| Transaction records | After a payment | Meeting tax and accounting duties under Japanese law | Legal obligation (Art. 6(1)(c)) |
| Name, email, message | You email me or use a contact form | Replying to you | Legitimate interest in answering correspondence (Art. 6(1)(f)) |
| Name, email, comment text, IP address | You leave a comment | Publishing the comment; preventing spam | Legitimate interest (Art. 6(1)(f)) |
| IP address, browser data, server logs | You visit the site | Security, keeping the site running | Legitimate interest (Art. 6(1)(f)) |
| Anonymous or pseudonymous usage data | You visit the site | Understanding which pieces are read | See section 5 |
Where I rely on legitimate interest, I have weighed it against your rights and kept the processing minimal. Where I rely on consent, you can withdraw it at any time; this does not affect processing that happened before.
I do not use your data for automated decision-making or profiling, and I do not knowingly collect special categories of data.
3. Newsletters on Substack
Gangi (monthly) and Lagoon (weekly) are delivered through Substack, Inc., based in the United States. When you subscribe — on Substack or through a sign-up form on this site — your email address goes to Substack.
- Substack processes your account data under its own privacy policy and acts as an independent controller for its platform.
- I receive your email address, subscription type and basic engagement data (for example, whether an issue was opened). I use this only to run the newsletters, never to build profiles or for advertising.
- Every email has an unsubscribe link. You can also manage or delete your Substack account in your Substack settings.
- If you would rather I did not see open rates, most email clients let you block tracking images.
4. Payments via Stripe
All payments — paid newsletter subscriptions on Substack and any purchases or support on this site — are processed by Stripe. I never see or store your full card number.
- Stripe receives your card or wallet details, name, email, billing country and device information needed to process the payment and prevent fraud.
- Stripe acts partly as my processor and partly as an independent controller (for fraud prevention and legal compliance). See Stripe’s privacy policy.
- I receive a payment record: your name, email, amount, date, country and the last four digits of your card. I keep it for tax and accounting.
- Stripe may use cookies on its checkout pages for security and fraud detection. These are strictly necessary for the payment to work.
5. Cookies, analytics and embedded content
This site uses only the cookies it needs to work, unless you agree to more. Non-essential cookies load only after you accept them in the cookie banner, and you can change your choice at any time via [“Cookie settings” link in the footer].
| Type | Examples | Consent needed? |
|---|---|---|
| Strictly necessary | WordPress login and comment cookies, cookie-consent preference, Stripe security cookies | No |
| Analytics | See below | [Option A: No / Option B: Yes] |
| Embedded content | YouTube, Vimeo, Spotify, Substack embeds | Yes |
Analytics — keep one option:
- Option A (cookieless): I use [Plausible / Jetpack Stats / other], which counts visits without cookies and without identifying you. IP addresses are not stored in a form that identifies you.
- Option B (Google Analytics): With your consent, I use Google Analytics 4 by Google Ireland Ltd. to see which pages are read. IP anonymisation is enabled, advertising features are off, and data is kept for [14] months.
Embedded content from other sites behaves as if you had visited that site. Those providers may set cookies and log your visit. I load such embeds only after you consent, or show a placeholder you can click.
6. Who receives your data, and international transfers
I share personal data only with the service providers that run this magazine, and only as far as they need it.
| Recipient | Role | Location |
|---|---|---|
| Xserver Inc. | Website hosting | Japan |
| Substack, Inc. | Newsletter delivery and subscriptions | United States |
| Stripe | Payment processing | United States / EU |
| [Analytics provider] | Site statistics | [Location] |
| [Form / anti-spam plugin, e.g. Akismet] | Contact form, spam filtering | [Location] |
I may also disclose data where Japanese or other applicable law requires it.
Transfers outside the EEA and UK. As I am based in Japan, your data is processed there. The European Commission has recognised Japan as providing an adequate level of protection (Adequacy Decision, 2019), and the UK has a corresponding arrangement. For transfers to the United States, providers rely on the EU–US Data Privacy Framework where they are certified, or on the Commission’s Standard Contractual Clauses.
7. How long I keep it
I keep data only as long as the purpose requires, then delete or anonymise it.
| Data | Retention |
|---|---|
| Newsletter subscription data | Until you unsubscribe, then removed from active lists |
| Payment and transaction records | 7 years, as required by Japanese tax law |
| Emails and contact-form messages | Up to 2 years after our last exchange |
| Comments | Until you ask me to remove them or the post is deleted |
| Server logs | Up to [30] days |
| Analytics data | [Option A: aggregated, no personal data / Option B: 14 months] |
8. Your rights
Under the GDPR you have the right to:
- Access the personal data I hold about you
- Rectify data that is wrong or incomplete
- Erase your data (“right to be forgotten”), unless I must keep it by law
- Restrict how I process it
- Data portability — receive your data in a common, machine-readable format
- Object to processing based on legitimate interest
- Withdraw consent at any time, where processing is based on consent
To use any of these rights, email [privacy@…]. I may ask you to confirm your identity. I will respond within one month, free of charge.
Complaints. If you think I have handled your data unlawfully, you can complain to the data protection authority in the EU country where you live or work, or to the UK Information Commissioner’s Office. I would be grateful if you contacted me first, so I can try to put it right.
9. Security
The site is served over HTTPS, accounts are protected by strong passwords and two-factor authentication, and software is kept up to date. No system is perfectly secure; if a breach affecting your data occurs, I will notify you and the relevant authorities as the law requires.
10. Children
This magazine is not directed at children under 16, and I do not knowingly collect their data. If you believe a child has given me personal data, please contact me and I will delete it.
11. Changes to this policy
I may update this policy when the magazine or the law changes. The effective date at the top will show the latest version. For significant changes, I will tell newsletter subscribers by email.