Effective date: 2026-07-20
Wilsao (wilsaojapan.com, "this site") is operated by an individual operator resident in Taiwan ("we", "us"). We take your privacy seriously and process personal data in accordance with the Personal Data Protection Act of the Republic of China (Taiwan). For users in Japan and the European Union we additionally align with Japan's Act on the Protection of Personal Information (APPI) and the EU General Data Protection Regulation (GDPR) to provide equivalent safeguards.
This policy applies to the processing of your personal data whenever you visit or use any page or feature of this site. By using this site you confirm that you have read and understood this policy.
Privacy contact address: privacy@wilsaojapan.com.
This policy is published in several languages. In the event of any discrepancy between language versions, the Traditional Chinese version prevails — the site operator is resident in Taiwan and the processing of personal data is governed by the Personal Data Protection Act of the Republic of China (Taiwan).
Account data: when you register we collect your email address, your password (stored as a hash — we cannot read the original), your username, and optionally the avatar and bio you choose to add.
Order data: when you buy a product or request an experience we collect the orderer's name, contact details (phone, email or messaging ID), delivery details (for physical products), the experience date, and the last five digits of the account you provide when reporting a transfer. Payment is completed by bank transfer — we never receive or store your full bank account or credit card details.
Application and request data: when you apply to become a planner, author or vendor, or send a planning request or review to a planner, we collect what you write in those forms.
Content you create: articles, trip plans, uploaded images and similar.
Automatically collected data: cookies required to keep you logged in and remember your language, server logs (including IP address), and anti-abuse and audit records. We also use Google Analytics for anonymised traffic statistics (see section 5). We do not use advertising trackers.
To provide and perform the service: creating your account, processing orders and requests, and displaying content you have created (necessary for performance of a contract).
To notify you about the service: order confirmations, review outcomes, request progress — as on-site notifications and email.
Security and abuse prevention: detecting unusual use, rate-limiting abuse, and retaining operational records.
To meet legal obligations: tax, accounting and other statutory retention duties.
We do not sell your personal data, and we do not share it with third parties for marketing purposes.
We use the following service providers, each processing data only as far as necessary to provide their service: Supabase (database, authentication, file storage), Vercel (site hosting and server logs), Resend (email delivery) and Google (Google Analytics traffic analysis).
These providers' servers may be located outside Taiwan, Japan or the EU (for example in the United States). We choose providers with industry-standard security and compliance measures — such as SOC 2 certification and GDPR data processing agreements — so that cross-border transfers receive a comparable level of protection.
Account data and content you create: kept until you delete your account or that piece of content.
Order and transaction records: to meet tax and accounting obligations these are kept for the period required by law after the transaction completes (as a rule five years), then deleted or de-identified.
After you delete your account we begin an erasure process that removes data identifying you. Records we are legally required to keep are excepted.
Under Article 3 of the Personal Data Protection Act you have the following rights over your personal data: to enquire about or request access to it, to request a copy, to request that it be supplemented or corrected, to request that its collection, processing or use be stopped, and to request its deletion.
Users in Japan have equivalent rights under the APPI, and users in the EU under the GDPR — including data portability, restriction of processing, and the right to lodge a complaint with their local supervisory authority.
How to exercise them: account data and content you have created can be edited or deleted yourself on the site. To delete your account, email privacy@wilsaojapan.com and we will process your request and reply within the statutory period (15 to 30 days).
All data in transit is encrypted with HTTPS/TLS. Passwords are stored as hashes and we cannot read the originals.
The database uses Row Level Security so that users can only reach their own data, and administrative actions leave audit records.
No transmission over the internet can be guaranteed to be completely secure. Should a personal data breach occur, we will notify affected users as the law requires.
This service is not directed at children under 13 and we do not knowingly collect their personal data. Minors should obtain the consent of a legal guardian before using this site or making a transaction.
If you believe we have collected a child's personal data without a guardian's consent, please contact us and we will delete it as quickly as we can.
We may revise this policy as the service or the law changes. When we do, the effective date shown on this page is updated; changes that materially affect your rights will additionally be announced on the site.
Continuing to use this site after a revision takes effect is taken as acceptance of the revised policy.
For any question, request or complaint about this policy or our handling of personal data, please contact: privacy@wilsaojapan.com.