Privacy policy

Last updated: 27th April 2026

1. Controller

This Privacy Policy explains how ANKH LLC / ANKH 合同会社, which operates The Blue Brook, collects, uses, discloses, stores, transfers, and protects personal data in connection with The Blue Brook website, application, storefront, design tools, messaging tools, scheduling tools, support services, and related services (collectively, the “Services”).

If the user does not agree with this Privacy Policy, the user must not use the Services.

2. Scope

This Privacy Policy applies to personal data collected from:

users and account holders;
senders of Cards;
Recipients of Cards;
Creators and creator applicants;
website and application visitors;
customer support contacts; and
other individuals whose personal data Blue Brook receives in connection with the Services.

This Privacy Policy applies regardless of whether the personal data is collected through the website, the application, email, checkout, support channels, or other service interfaces.

3. Categories of personal data collected

Blue Brook collects the following categories of personal data as needed to operate the Services:

Account information, such as name, email address, password, login identifiers, and profile settings.
Order and transaction information, such as purchased items, billing details, payment status, subscription details, and transaction history.
Recipient information, such as Recipient name, Recipient email address, scheduled delivery details, and message delivery metadata.
User Content, such as Card messages, personalization text, uploaded profile content, and other materials submitted by the user.
Creator information, such as legal name, professional name, contact details, payout details, tax information, portfolio data, and creator submissions.
Support information, such as communications with customer support, complaint records, dispute records, and service follow-up information.
Device and usage information, such as IP address, browser type, device identifiers, operating system, pages viewed, actions taken, timestamps, referral data, crash data, and log data.
Marketing and preference information, such as communication preferences, consent settings, and cookie or tracking preferences.

Blue Brook collects only the information reasonably needed to provide, secure, maintain, improve, and support the Services, to process Orders, and to comply with law.

4. Sources of personal data

Blue Brook receives personal data directly from the individual, from the user who initiates a Card, from Creators, from payment providers, from hosting and analytics providers, from support interactions, and automatically through the Services when the Services are used.

A sender may provide Recipient information for the purpose of sending a Card. The sender is responsible for having authority to provide that Recipient information to Blue Brook.

5. Purposes of use

Blue Brook uses personal data for the following purposes:

to create and manage Accounts;
to process Orders, payments, credits, and Subscriptions;
to deliver Cards and other digital products;
to personalize Cards and display Creator Content;
to authenticate users and secure Accounts;
to provide customer support and resolve disputes;
to moderate content, prevent fraud, and enforce platform rules;
to communicate service notices, transactional messages, and account updates;
to comply with legal obligations, tax obligations, accounting requirements, and lawful requests;
to analyze, maintain, secure, improve, and develop the Services;
to measure usage and performance; and
to send marketing communications where permitted by law and, where required, with consent.

Blue Brook does not use personal data for purposes materially inconsistent with the purposes described in this Policy unless Blue Brook obtains a new lawful basis or provides notice required by law.

6. Legal bases and APPI framework

Blue Brook processes personal data under the legal bases and conditions applicable in the relevant jurisdiction.

For users in Japan, Blue Brook processes personal data in accordance with the Act on the Protection of Personal Information (APPI) and related guidelines.

For users in other jurisdictions, Blue Brook applies the requirements of the relevant data protection laws to the extent applicable.

Where consent is required, Blue Brook obtains consent in a clear and specific manner.

Where processing is necessary to perform a contract, provide a service, comply with law, or pursue legitimate operational purposes, Blue Brook processes the data to that extent.

7. Third-party service providers

Blue Brook uses third-party service providers to operate the Services, including payment processors, hosting providers, cloud infrastructure providers, analytics providers, email delivery providers, and support tools.

Blue Brook may disclose personal data to those providers only as needed to provide the Services, support internal operations, prevent fraud, or comply with law.

Blue Brook does not permit service providers to use personal data for their own independent purposes except where the individual has separately agreed to that use or where applicable law permits it.

Blue Brook may use Stripe or another payment processor to process payments. Blue Brook does not store full payment card details on its own systems.

8. International transfers

Blue Brook operates from Japan and may store, access, process, or transfer personal data in Japan and in other countries where Blue Brook or its service providers operate.

Where Blue Brook transfers personal data outside Japan, Blue Brook uses a lawful transfer mechanism permitted by applicable law, which may include contractual safeguards, adequacy-based transfers, consent where required, or other lawful protections.

Where an individual’s consent is required for an overseas transfer, Blue Brook provides the information required by law about the destination country, the applicable legal framework, and the safeguards used for the transfer.

9. Disclosure to third parties

Blue Brook may disclose personal data to third parties in the following situations:

to payment processors and fraud-prevention providers to complete transactions;
to hosting, cloud, analytics, and email providers that support the Services;
to Creators or creator administrators when needed to fulfill Orders, support content operations, or resolve disputes;
to law-enforcement authorities, regulators, courts, or other parties when required by law or to protect legal rights;
to professional advisers, auditors, insurers, and other service providers under confidentiality obligations; and
in connection with a corporate transaction, reorganization, financing, acquisition, or transfer of assets.

Blue Brook may also disclose personal data with the individual’s consent or direction.

10. Cookies and similar technologies

Blue Brook uses cookies, pixels, SDKs, local storage, and similar technologies to operate the Services, remember preferences, secure sessions, measure performance, and improve the user experience.

Essential technologies are used to make the Services function properly.

Non-essential technologies, such as certain analytics or marketing technologies, are used only where permitted by law and, where required, with consent.

The user may be able to manage cookie or tracking preferences through device settings, browser settings, in-product controls, or a cookie banner where available.

11. Communications

Blue Brook sends transactional communications such as account notices, purchase confirmations, delivery notices, service updates, and support replies as needed to provide the Services.

Blue Brook sends marketing communications only where permitted by law and, where required, only with consent.

The user may opt out of marketing communications by using the unsubscribe link or another method Blue Brook provides, subject to lawful exceptions for transactional or service communications.

12. Data retention

Blue Brook retains personal data for as long as necessary to provide the Services, comply with law, resolve disputes, enforce agreements, preserve records, prevent fraud, and support legitimate business operations.

Retention periods vary by category and purpose. Blue Brook may retain different categories of data for different periods based on legal, tax, accounting, security, support, and operational needs.

Blue Brook will delete, anonymize, or aggregate personal data when it is no longer needed, unless retention is required or permitted by law.

13. Retention schedule

Unless a different period is required or permitted by law, Blue Brook applies the following baseline retention approach:

Account data: retained while the Account is active and for a reasonable period afterward for support, dispute, tax, fraud-prevention, and compliance purposes.
Order and billing records: retained for the period required by accounting, tax, and legal obligations.
Recipient delivery records: retained for the period needed to support delivery, support, abuse prevention, and legal compliance.
Creator records: retained for the period needed to manage the creator relationship, payout obligations, tax compliance, and legal claims.
Support records: retained for the period needed to resolve the request, improve support, and manage disputes.
Device and log data: retained for a shorter period unless needed for security, fraud, or legal reasons.
Marketing preferences: retained until changed or withdrawn, subject to legal retention needs.

14. Security

Blue Brook uses administrative, technical, and physical safeguards designed to protect personal data against unauthorized access, disclosure, alteration, loss, and misuse.

Those safeguards may include access controls, encryption in transit or at rest where appropriate, logging, monitoring, vendor management, network protections, backup procedures, and staff access restrictions.

No system is completely secure, and Blue Brook cannot guarantee absolute security.

15. User rights

Depending on the individual’s location and applicable law, the individual may have rights to access, correct, delete, restrict, port, object to, or withdraw consent for certain processing of personal data.

The individual may also have the right to request information about the categories of personal data Blue Brook holds, the purposes of use, and third-party disclosures where required by law.

Blue Brook may need to verify identity before responding to a request.

Blue Brook may decline a request where the law permits or requires Blue Brook to do so, including where the request would conflict with legal obligations, third-party rights, security needs, or legitimate retention requirements.

16. Japan-specific rights

For individuals whose personal data is handled in Japan, Blue Brook complies with the APPI and any applicable guidance regarding disclosure, correction, addition, deletion, suspension of use, cessation of third-party provision, and complaint handling.

Blue Brook will respond to valid requests in accordance with applicable law.

17. International users

Blue Brook may offer the Services to users outside Japan.

Where foreign privacy laws apply, Blue Brook will meet the requirements that apply to the relevant processing activity to the extent required by law.

This Policy is intended to be read together with any jurisdiction-specific disclosures or notices Blue Brook provides.

18. Children’s privacy

The Services are not directed to children.

Blue Brook does not knowingly collect personal data from children under the minimum age permitted by applicable law for using the Services without appropriate authorization.

If Blue Brook learns that it has collected personal data from a child in a manner not permitted by law, Blue Brook will delete or otherwise handle the data as required by law.

19. Automated decision-making

Blue Brook does not make decisions based solely on automated processing that produce legal or similarly significant effects on an individual, unless Blue Brook expressly states otherwise and the law allows it.

Blue Brook may use automated tools for moderation, fraud prevention, abuse detection, ranking, recommendation, or operational support.

20. Business transfers

Blue Brook may transfer personal data in connection with a merger, acquisition, financing, reorganization, sale of assets, or similar transaction, subject to applicable law and appropriate safeguards.

21. Third-party links and embedded content

The Services may contain links to third-party websites, apps, or services.

Blue Brook is not responsible for the privacy, security, or content practices of third parties.

The user should review the privacy policies of any third-party service before using it.

22. Changes to this Policy

Blue Brook may update this Privacy Policy from time to time.

Blue Brook will post the updated version on the Services and may provide additional notice where required by law or where Blue Brook considers the change material.

The updated version applies from the effective date stated in the update, unless applicable law requires otherwise.

23. Contact

Questions about this Privacy Policy, privacy requests, complaints, and other data-related inquiries may be sent to the contact details listed in the Services or in the applicable legal disclosure page.

If a separate privacy contact is published, that contact prevails for privacy requests.