Privacy Policy
Effective date: 31 August 2026
1. Who runs this site, and how to reach them
This website is operated by Sébastien Menin through Constellan, an independent one-person sole proprietorship founded in Japan in 2026. Constellan develops its own products and takes commissioned consulting work.
Name: Sébastien Menin
Business: Constellan
Address: Midori-ku, Nagoya, Aichi, Japan
Website: https://www.constellan.com
Contact: info@constellan.com
The complete address is provided without delay on request to info@constellan.com.
For GDPR purposes, Sébastien Menin is the controller for the processing described in this policy.
2. The short version
This is a static website. It handles data in five ways:
- It keeps the visitor’s analytics choice in local storage in that visitor’s own browser.
- It loads Google Analytics 4 only after the visitor consents.
- AWS Amplify Hosting processes ordinary access information when it serves a page and retains platform access logs.
- Email sent to info@constellan.com is handled through Google Workspace.
- Web fonts are self-hosted from this site’s own domain.
The site has no user accounts, login, payments, newsletter, comments, embedded video, social widgets or share buttons, advertising network, A/B testing, session recording or heatmaps, chat widget, or third-party iframes.
There is no contact form, form endpoint or website database.
3. Cookies and similar technologies
The consent record is not a cookie
The site stores the visitor’s analytics choice in the browser’s local storage. It is not stored as a cookie.
The value is exactly one word: accepted or declined. It contains no identifier, timestamp or other information that could identify anyone. It never leaves the browser. The site has no application server that reads this value back.
This record is strictly necessary to remember and honour the choice the visitor made, so it does not require analytics consent.
Analytics cookies
If the visitor accepts analytics, Google Analytics 4 uses exactly two cookies on this site:
_ga_ga_RW6W3BB75D
The second cookie corresponds to measurement ID G-RW6W3BB75D.
These cookies are not set before analytics consent. Withdrawing consent clears them immediately.
The Google Analytics user- and event-level data retention setting is 14 months.
4. Analytics, and the choice you make
Google Analytics 4 is loaded only after the visitor accepts analytics. Nothing is sent to Google Analytics before that choice is accepted.
Analytics records pages viewed, approximate location derived from IP information, device and browser information, the referrer, and GA4’s automatic measurement of scrolls, outbound link clicks and file downloads.
The site sends no custom events of its own. There is no funnel, form or bespoke measurement of an individual’s journey through the site.
The site does not send names, email addresses, phone numbers, postal addresses or form values to Google Analytics. It does not put identifying information into URLs, page titles or event parameters.
Google Signals is off. Ad personalisation is off. Data redaction is on. Google’s Data Processing Terms have been accepted.
Analytics is not used for advertising, remarketing, cross-device tracking, profiling or automated decision-making.
For visitors covered by the GDPR, the legal basis for Analytics is consent.
Consent can be withdrawn at any time. The Cookie settings button in the footer of every page and the button in this Analytics section both reopen the same choice. Withdrawal takes effect immediately and clears the Analytics cookies.
5. Server access logs
The site is static and is served through AWS Amplify Hosting in the Tokyo (ap-northeast-1) region.
Serving a page necessarily processes the visitor’s IP address, user agent and requested URL. A timestamp is recorded with the request. This happens for every visitor regardless of the analytics choice because it is part of delivering the page.
These access logs are used to:
- diagnose broken links and 404 responses;
- confirm that redirects behave correctly;
- understand total traffic, including visits from people who decline Analytics; and
- investigate security incidents.
For visitors covered by the GDPR, the legal basis is legitimate interest in operating and securing the site.
The processor is Amazon Web Services Japan G.K., a Japanese company. This is a domestic processing arrangement in Japan, not an overseas transfer by Constellan.
The CDN may answer requests from edge locations around the world.
AWS retains the platform access logs for as long as the site exists on Amplify. The service offers no shorter expiry and no way for Constellan to delete those platform logs. They are not routinely read.
If information is exported from those logs to diagnose a problem or investigate a security incident, that exported information is deleted within 90 days.
6. Email, and the transfer to Singapore it involves
The site’s contact route is a plain mailto: link to info@constellan.com. There is no contact form, form endpoint or website database.
Email received at this address is held in Google Workspace Gmail. The same address is used for privacy and data-subject requests.
Email is retained for three years after the last message in the exchange and is then deleted.
Where correspondence forms part of an actual business engagement, records that Japanese tax law requires to be retained are kept for the period required by that law: seven years.
For GDPR purposes, the legal basis for replying to ordinary correspondence is legitimate interest in receiving and responding to the message. Where the message concerns a possible business engagement, processing may instead be necessary to take steps at the sender’s request before entering into a contract.
The Gmail service provider for this account is Google Connect Asia Pacific Pte. Ltd. in Singapore. The Google Workspace contract is with Google Asia Pacific Pte. Ltd., also in Singapore.
For Japanese data-protection law, this is an entrustment of personal data to a third party in a foreign country. Constellan relies on the standards-compliant system under Article 28(1) of the Act on the Protection of Personal Information and Article 16(1) of its Enforcement Rules. That system is established through Google’s contract and its Cloud Data Processing Addendum. It is not based on the data subject’s consent.
Constellan periodically verifies Google’s protections and the relevant foreign legal environment. The information specified by law concerning these measures will be supplied without delay on request to info@constellan.com.
7. External transmission
The following table is published voluntarily for transparency. It describes the requests that leave the visitor’s browser.
| Activity | Information involved | Destination | When |
|---|---|---|---|
| Google Analytics 4 | Pages viewed, device and browser information, referrer, automatic measurements of scrolls, outbound link clicks and file downloads, Analytics cookie values, and IP information used to derive approximate location | Google Analytics | Only after analytics consent. Nothing is sent to Google Analytics before consent. |
| Hosting request | IP address, user agent and requested URL. AWS records a timestamp for the request. | AWS Amplify Hosting, operated by Amazon Web Services Japan G.K. | Every time a page or other site resource is requested, regardless of analytics consent. |
Web fonts are deliberately absent from this table. They are served from this site’s own domain. No request is made to Google Fonts, so a visitor’s IP address is not sent to Google for fonts.
8. Who else processes data, and where
Email is handled through Google Workspace Gmail. The Gmail service provider is Google Connect Asia Pacific Pte. Ltd. in Singapore, and the Workspace contract is with Google Asia Pacific Pte. Ltd. in Singapore.
This foreign entrustment uses the standards-compliant system described in section 6 rather than data-subject consent.
Google also processes Analytics data after analytics consent. For transfers of Analytics data outside the EEA, Google’s Data Processing Terms and Standard Contractual Clauses apply.
Amazon Web Services Japan
Amazon Web Services Japan G.K. processes the hosting requests and platform access logs described above. The site is hosted in the Tokyo (ap-northeast-1) region.
This is domestic processing in Japan. The use of CDN edge locations around the world does not change the identity of the processor described here.
9. Security measures
Constellan limits processing on this site to the data and purposes described in this policy.
Analytics is blocked until consent is given. Google Signals and ad personalisation are disabled, and data redaction is enabled. The site sends no custom Analytics events.
The contact route is email rather than a website form, and the site has no form endpoint or website database.
Web fonts are self-hosted, so font loading does not disclose visitor IP addresses to Google Fonts.
AWS platform access logs are not routinely read. Information exported from those logs for diagnosis or a security investigation is deleted within 90 days.
For personal data handled outside Japan, Constellan carries out 外的環境の把握, meaning that the relevant foreign data-protection environment is considered. For the Singapore arrangement with Google, Google’s protections and the relevant foreign regime are periodically verified.
10. How long information is kept
| Information | Retention |
|---|---|
| Browser consent record | Kept only in the visitor’s own local storage. It is not retained by Constellan on a server. |
| Google Analytics user- and event-level data | 14 months |
| AWS Amplify platform access logs | Retained by AWS for as long as the site exists on Amplify. The platform provides no shorter expiry and no operator deletion mechanism. The logs are not routinely read. |
| Information exported from access logs | Deleted within 90 days |
| Ordinary email correspondence | Three years after the last message in the exchange |
| Correspondence that forms part of an actual business engagement and must be retained under Japanese tax law | Seven years |
Withdrawing Analytics consent immediately clears the Analytics cookies.
11. Your rights
Japan
Under Japan’s Act on the Protection of Personal Information, a person may request disclosure, correction or suspension of use of retained personal data where the law provides those rights.
Requests can be sent to info@constellan.com.
Personal data is entrusted to processors only as described in this policy. Hosting through Amazon Web Services Japan G.K. is a domestic entrustment. Gmail involves a separate foreign entrustment to Singapore under the basis described in section 6.
EU and EEA
For processing covered by the GDPR, the legal bases used by Constellan are:
- consent for Google Analytics;
- legitimate interest in operating and securing the site for server access logs; and
- legitimate interest in responding to email, or steps at the sender’s request before entering into a contract where appropriate.
You may withdraw Analytics consent at any time. Use either the Cookie settings button in the footer of every page or the button in the Analytics section of this policy. Both reopen the same choice. Withdrawal takes effect immediately and clears the Analytics cookies.
Where the GDPR applies, you may have rights of access, rectification, erasure, restriction of processing, objection and data portability. You also have the right to complain to the competent supervisory authority.
Constellan is established in Japan. Japan is covered by an EU adequacy decision, so personal data transferred from the EU or EEA to Constellan in Japan does not require an additional transfer safeguard on that account.
Google may process Analytics data outside the EEA under its Data Processing Terms and Standard Contractual Clauses.
No Data Protection Officer has been appointed.
No EU representative under GDPR Article 27 has been appointed. Constellan relies on the exemption for processing that is occasional, low-risk and below the relevant Article 27 thresholds.
United Kingdom
Where UK data-protection law applies, requests for access, rectification, erasure, restriction, objection and portability may be sent to info@constellan.com. Analytics consent may be withdrawn at any time in the same way described above.
You may also complain to the relevant UK supervisory authority.
California
Constellan does not sell personal information and does not share personal information for cross-context behavioural advertising. It has not done either in the preceding twelve months.
Because there is no sale or sharing, there is no Do Not Sell or Share My Personal Information link.
A Global Privacy Control signal is honoured by treating it as a decision to decline Analytics.
Where the CCPA/CPRA provides the applicable right, a California resident may request to know, delete or correct personal information and may exercise those rights without discrimination.
Requests can be sent to info@constellan.com.
12. Changes to this policy
This policy is updated when the site’s data practices change.
The effective date of this version is 31 August 2026.
13. How to make a request
Send privacy, data-subject or other requests concerning this policy to:
The complete operator address will be provided without delay on request to that address.
Information that Japanese law requires to be supplied on request concerning the foreign entrustment to Google in Singapore will also be provided without delay.