Back to Registration

Privacy Policy

Last updated: June 11, 2026

1. Introduction

GK Setup ("Company", "we", "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, store, and protect your personal information when you use the GK Setup Portal ("Portal"). We comply with Japan's Act on the Protection of Personal Information (個人情報保護法, "APPI") and applicable international data protection standards.

2. Information We Collect

2.1 Account Information

  • Full name
  • Email address
  • Password (stored encrypted, never in plaintext)

2.2 Incorporation Information

Through the intake form, we collect information necessary for GK incorporation, including:

  • Company name (Japanese and English)
  • Registered office address in Japan
  • Business purposes and fiscal year
  • Member (shareholder) details: names, nationalities, addresses, capital contributions
  • Representative member designation
  • Capital structure and funding arrangements

2.3 Identity Documents

During the incorporation process, you may be asked to provide:

  • Passport copies or government-issued identification
  • Proof of address (utility bills, bank statements)
  • Seal registration certificates (印鑑証明書) or equivalent
  • Notarized documents as required by Japanese law

2.4 Payment Information

  • Payment is processed through Square, Inc. We do not store credit card numbers, CVVs, or full payment card details on our servers.
  • We retain invoice references, payment status, and amounts for bookkeeping purposes.

2.5 Technical Information

  • IP address, browser type, and device information
  • Session data and authentication tokens
  • CAPTCHA verification data (processed by Cloudflare Turnstile)

3. How We Use Your Information

We use your personal information exclusively for:

  • Service delivery: Processing your GK incorporation, preparing legal documents, coordinating with our partner Shiho-shoshi Lawyer and government agencies
  • Communication: Sending case updates, document requests, invoices, and service-related notifications
  • Account management: Authenticating your identity, managing your Portal access
  • Legal compliance: Meeting our obligations under Japanese corporate law and anti-money laundering regulations
  • Service improvement: Analyzing usage patterns to improve the Portal (aggregated and anonymized only)

We do not sell, rent, or trade your personal information to third parties for marketing purposes.

4. Information Sharing

We share your information only with:

  • Licensed Shiho-shoshi Lawyer (judicial scrivener): To prepare and file incorporation documents with the Legal Affairs Bureau
  • Government agencies: As required for company registration, tax registration, and regulatory compliance
  • Payment processor (Square, Inc.): To process fee payments and issue invoices
  • Hosting provider (Railway): Our infrastructure provider, which processes data in accordance with their privacy policy
  • Object storage (Cloudflare R2): Documents you upload through the Portal (identity documents, capital remittance proofs, signed scans) are stored in Cloudflare R2 in the Tokyo region
  • Email service provider (Resend): To deliver transactional emails
  • Law enforcement: When required by law, court order, or government request

5. Data Storage and Security

We implement appropriate technical and organizational measures to protect your data:

  • All data is transmitted over HTTPS (TLS 1.2+)
  • Passwords are hashed using bcrypt with a minimum of 12 rounds
  • Database access is restricted and encrypted at rest
  • Administrative access requires authenticated sessions with role-based permissions
  • CAPTCHA protection prevents automated abuse of authentication endpoints
  • Rate limiting is enforced on login attempts (maximum 5 per minute)

While we take reasonable precautions, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security.

6. Data Retention

  • Active cases: Data is retained for the duration of the incorporation process and for 7 years thereafter, as required by Japanese corporate and tax law
  • Completed cases: Core records (company name, registration number, filing dates) are retained indefinitely for legal reference
  • Cancelled accounts: Personal data is deleted within 90 days of account closure, except where retention is required by law
  • Technical logs: Server and access logs are retained for up to 12 months

7. Your Rights

Under APPI and applicable data protection laws, you have the right to:

  • Access: Request a copy of the personal information we hold about you
  • Correction: Request correction of inaccurate or incomplete information
  • Deletion: Request deletion of your personal information (subject to legal retention requirements)
  • Suspension of use: Request that we stop using your personal information for specific purposes
  • Disclosure of third-party sharing: Request details about with whom your information has been shared

To exercise any of these rights, contact us at privacy@gksetup.tokyo. We will respond within 30 days.

8. Cookies and Tracking

The Portal uses only essential cookies required for:

  • Session management and authentication
  • CSRF (Cross-Site Request Forgery) protection
  • Language preference

We do not use advertising cookies, analytics trackers, or third-party tracking pixels. Cloudflare Turnstile may set its own cookies for CAPTCHA verification purposes, governed by Cloudflare's Privacy Policy.

9. International Data Transfers

Your data may be processed on servers located outside Japan (e.g., by our hosting and email providers). When transferring data internationally, we ensure appropriate safeguards are in place in accordance with APPI requirements.

10. Children's Privacy

The Portal is not intended for use by individuals under 18 years of age. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us immediately.

11. Changes to This Policy

We may update this Privacy Policy periodically. Material changes will be communicated via email or Portal notification. The "Last updated" date at the top indicates the most recent revision. Continued use of the Portal after changes constitutes acceptance.

12. Governing Language

This Privacy Policy is prepared in Japanese, English, Simplified Chinese, and Traditional Chinese. In the event of any discrepancy or inconsistency between the language versions, the Japanese version shall be the official text and shall prevail. This English version is provided for reference.

13. Data Protection Officer

For privacy-related inquiries or complaints, please contact:

GK Setup — Privacy Desk
Email: privacy@gksetup.tokyo
Website: gksetup.tokyo

If you are not satisfied with our response, you may file a complaint with the Personal Information Protection Commission of Japan (個人情報保護委員会).