Privacy Policy
What we collect, who processes it, and how to get it back or get it deleted.
Last updated
Tokyo Legends is a wholesale channel, not a data business. We collect what an order or a wholesale application needs and nothing beyond it, and we do not sell, rent or trade personal information to anyone, for any purpose.
Who this policy is from
This site is operated by Tokyo Legends Trading Co.(“Tokyo Legends”, “we”, “us”), a wholesaler of authentic Japanese Pokémon sealed product selling to business buyers in the United States. Questions about anything on this page go to tokyolegends@outlook.com.
Pending — registered detailsThe registered business address and the jurisdiction Tokyo Legends Trading Co. is formed in have not yet been published on this site. Until they are, this placeholder stands in for them rather than a guessed address. Email us and we will give you both in writing.
What we collect
All of it comes from you, directly, at one of three moments. Nothing is bought from a data broker and nothing is inferred about you from anywhere else.
When you place a card order
- The contents of your order — which sealed product, how many boxes, and the price resolved for you at the time.
- Your email address, name and shipping address, collected by Stripe on the checkout form and passed back to us so we can ship and invoice.
- Payment confirmation: the brand of card, the last four digits, and whether the charge succeeded. We never see or store your full card number— it is entered inside Stripe’s hosted checkout and never reaches our servers.
When you send a wholesale inquiry or apply for an account
- Business name and contact name.
- Work email address and phone number.
- Your resale certificate number, where you give one. We use it to confirm you are buying for resale and to set your tier — it is not published anywhere and it is not shared outside the processors named below.
- Whatever you write in the message field, including any cart you carry across.
When you simply browse
- Standard server request logs kept by our host: IP address, user agent, the URL requested and the time. These are operational and security records.
- Aggregate page-view and page-speed measurements — see Cookies and browser storage below for exactly what is and is not set.
Why we hold it, and what we do with it
- To take payment, ship your order, and invoice freight and duty at cost.
- To decide a wholesale application and set the tier attached to your account.
- To answer the email you sent us.
- To meet our own record-keeping obligations — tax, customs and accounting records have retention periods we do not get to choose.
- To keep the site up, and to investigate abuse of it.
We do not use your details for advertising, we do not build a profile of you, and we do not run automated decision-making that produces a legal effect. A wholesale application is read by a person.
Who processes it for us
These are service providers acting on our instructions, not partners we share data with for their own purposes. Each one is listed with what it actually touches.
- Stripe — payments. Handles the checkout form, the card details, and the billing/shipping address you type into it. Stripe is the controller of your card data, not us.
- Resend — transactional email. Sends sign-in links and the notifications that tell us an inquiry has arrived; sees the sending and receiving addresses and the body of those messages.
- Neon — the Postgres database that stores wholesale accounts, applications, inquiries and order records.
- Vercel — hosting, server request logs, and the aggregate analytics described below.
Beyond these, we disclose personal information only where the law requires it, or where it is unavoidable to ship your order — a carrier and the destination country’s customs authority necessarily receive the consignee’s name and address.
Cookies and browser storage
Most of what this site remembers about you never leaves your own browser. Three values are written to localStorage, which is storage on your device that is not transmitted to us with any request:
tl-theme— whether you chose the light or dark theme.tl-cart— the contents of your cart, so it survives a reload. It is sent to our server only at the moment you start a checkout or request a quote.tl:owned:<setId>— one entry per set for the collection tracker on the set pages, recording which card numbers you have ticked as owned. This never leaves your browser at all: we have no copy of it, we cannot see it, and clearing your site data deletes it permanently.
No advertising or cross-site tracking cookies are set by this site. Aggregate traffic and page-speed measurement is done with Vercel Analytics and Vercel Speed Insights, which are cookieless. If a Google Analytics 4 measurement ID is configured for the deployment you are reading, that tag does set its own cookies for visit measurement; it is off unless configured, and it is never used for advertising or remarketing.
If you sign in to a wholesale account, a session cookie is set. It is strictly necessary — it is what keeps you signed in — and it disappears when you sign out.
How long we keep it
- Order and invoice records — kept for as long as tax, customs and accounting rules require, which is measured in years and is not ours to shorten on request.
- Wholesale accounts and applications — kept while the account is open, and for a reasonable period afterwards so we can answer a question about a past order.
- Inquiries that never became an order — kept while the conversation is live, then deleted on request.
- Server logs— kept on our host’s standard schedule, which is short.
- Browser-local values — kept until you clear your site data. We have no hand in this.
Your rights
Email tokyolegends@outlook.com and ask. You can request a copy of what we hold about you, a correction to anything wrong in it, or deletion of it. We will confirm receipt and act within 30 days.
Two honest limits. We cannot delete a record we are legally required to retain — an invoice for a shipment that cleared customs is one of those. And deleting your account means we can no longer service your orders, so we will say so before we do it rather than after.
We do not sell personal information and we do not share it for cross-context behavioural advertising, so there is nothing here for a “Do Not Sell or Share My Personal Information” request to switch off. If your jurisdiction gives you rights beyond the ones above, exercise them at the same address and we will honour them.
Children
This is a wholesale site for businesses. It is not directed at children, we do not knowingly collect personal information from anyone under 16, and we have no product or feature intended for them. If you believe a child has given us information, email us and we will delete it.
International transfers
Product is sourced in Japan and shipped to the United States, and the processors above operate infrastructure in the United States and Europe. Placing an order or sending an inquiry therefore involves your details crossing borders — including to our suppliers and freight forwarders in Japan, who receive what a shipment needs and nothing else.
Security
The site is served over HTTPS, card data is handled entirely by Stripe, and access to the admin console and the database is restricted to the people who need it. No system is perfect; if we ever become aware of a breach affecting your data we will tell you and the relevant authority as required.
Changes to this policy
When this policy changes, the “Last updated” date at the top changes with it — that date is set in one place for all six of our policy pages, so they can never disagree about when they were reviewed. A change that materially affects how we handle your data will also be emailed to account holders.
Related: Terms of Sale · Shipping & Returns · Contact