Privacy policy
Last updated 13 October 2026 · 日本語（正本）
Makana Partners K.K. ("we") runs The Hardest Market (hardestmarket.com) in compliance with Japan's Act on the Protection of Personal Information (APPI) and other applicable law. The Japanese version of this policy is authoritative.
1. Who we are
Makana Partners K.K. (corporate number 7020001128427)
Ocean Gate Minatomirai 8F, 3-7-1 Minatomirai, Nishi-ku, Yokohama, Kanagawa 220-0012, Japan
Representative Director: Yan Sen Lu
Contact: editor@hardestmarket.com
2. What we collect and why
| Buyers | Name, email, company, billing address and purchase history: to deliver products, manage licences, issue invoices and receipts, send renewal notices and answer questions. Card details are collected by the payment providers (Stripe, Polar); we do not hold them. |
|---|---|
| Dashboard users | Email address and sign-in records, including a hashed device identifier: to send sign-in links, manage the users on a licence and prevent misuse of licence keys. |
| Enquiries and corrections | Name, email and your message: to reply and to check and correct published figures. |
| Company PR and HR contacts | Contact details a company publishes (for example a press office address): to tell the company about its published figures and rankings. |
| Survey respondents | Covered by the survey's purpose of use and privacy page. |
| Newsletter readers | The newsletter is sent through Substack, Inc.; your subscription is handled under Substack's privacy policy. |
| Site visitors | Cookies and similar information for analytics (section 6): to improve the site. |
The figures on company pages are company-level data that employers publish under Japanese law; they are not about individuals. If we change a purpose, we do so only within what is reasonably related to the original purpose and publish it here.
3. Sharing and processors
We do not give personal data to third parties without your consent, except where the law requires. These providers process it for us, only as needed:
| Netlify, Inc. (US) | Website hosting, data storage, forms |
|---|---|
| Google LLC (US) | Email (Google Workspace), analytics (Google Analytics) |
| Stripe, Inc. and Stripe Japan K.K. | Payments in yen |
For purchases in US dollars, Polar Software, Inc. (US) is the seller (merchant of record) and collects personal data under Polar's own privacy policy.
4. Transfers outside Japan
Our US providers process personal data under contracts that require them to keep it secure, which meets the standard in APPI article 28(1). A summary of those arrangements and information on the US privacy regime are available on request. The US has no comprehensive federal privacy law equivalent to the APPI; protection rests on state and sector laws (see the Personal Information Protection Commission's survey of foreign regimes).
5. Security
- Organisation: the Representative Director is responsible for personal data, and its handling is limited to defined purposes.
- People: everyone who handles it is bound to confidentiality.
- Technical: traffic is encrypted; data is stored in our providers' encrypted environments; admin functions require authentication and exports are logged; licence keys are stored only as hashes.
- Environment: as our providers are in the US, we take account of the US regime in these measures.
6. Cookies and external transmission
Japan's Telecommunications Business Act requires us to list what our pages send to other companies:
| Recipient | Information sent | Purpose |
|---|---|---|
| Google LLC (Google Analytics) | Page address, referring page, time, browser and device type, IP address, cookie identifiers | Measuring how the site is used, to improve it |
| Google LLC (Google Fonts) | IP address, browser type, page | Displaying web fonts |
You can switch analytics off for this browser here: Google also offers an opt-out browser add-on; see Google's privacy policy for how it uses data.
7. How long we keep it
Purchase records: the legal retention period (seven years for accounting records) or three years after the licence ends, whichever is longer. Dashboard user details: 90 days after the user is removed. Enquiries: three years after we close them. Then we delete them.
8. Your requests
To ask for the purposes of use, a copy of your personal data, correction, deletion, suspension of use, an end to sharing, or records of sharing, write to editor@hardestmarket.com. We confirm your identity and respond without delay. There is no fee.
9. Visitors in the EEA and UK
For people in the European Economic Area or the UK, we process personal data under the GDPR and UK GDPR on these bases: performing our contract with you (purchases and licences), legitimate interests (answering enquiries, preventing misuse) and consent (analytics, which stays off until you agree). You also have the rights to data portability, to object and to withdraw consent, and you may complain to your local supervisory authority.
10. Changes and contact
We will publish any change on this page. Complaints and questions about personal data: editor@hardestmarket.com.