Privacy Policy

Article 2 (Purposes of Use of Information)

The Company uses the collected information for the following purposes.

1. Performance of Reservation Arrangement Services

• Submitting, confirming, changing, and canceling reservations
• Providing necessary information (name, number of persons, date and time, telephone number, allergies, special considerations, etc.) to the stores, facilities, and Partner Operators where reservations are made
• Notifying Users of whether reservations have been successfully made and sending advance information (meeting locations, precautions, methods of visiting the establishment, etc.)

2. Provision of Translation Chat Functions and Customer Support

• Translation processing, operator assistance, and handling of inquiries, requests, and complaints
• Quality assurance and training for customer support (including retention of records)

3. User Authentication and Prevention of Unauthorized Use

• Identity verification for accounts, login management, detection and prevention of impersonation, unauthorized access, prank reservations, and unauthorized cancellations (no-shows)
• Responding to conduct that violates the Terms of Use

4. Service Improvement, New Feature Development, Usage Analysis, and Creation of Statistical Data

• Investigation and resolution of failures and defects, functional improvements, and improvements to the UI and translation quality
• Creation and use of statistical data processed in a form that does not identify individuals (including provision to stores, facilities, and Partner Operators)

5. Delivery and Measurement of Targeted Advertising

• Displaying and delivering advertisements and promotional information tailored to Users' interests, attributes, area of stay, location information, and other information
• Measuring and analyzing advertising effectiveness, including the number of advertisement impressions, clicks, and conversions to visits or reservations
• Creating groups of Users estimated to have similar interests (audiences) and sharing such audiences with advertising service providers

6. Sending Notices and Marketing Information

• Important notifications concerning the Service and notices regarding changes to the Terms of Use
• Sending information concerning campaigns, coupons, newly listed stores, and other promotional information (Users may unsubscribe from such communications.)

7. Communications Regarding Usage Charges and Cancellation Fees

Contacting Users regarding unpaid Usage Charges or cancellation fees incurred at stores or facilities and providing information to the extent necessary

8. Compliance with Laws and Protection of Rights

Taking actions required by laws and regulations, protecting the rights, property, and safety of the Company, Users, or third parties, and handling disputes

If the Company uses information beyond the scope of the purposes of use stated above, the Company shall obtain the User's consent in advance.

Article 3 (Use of Cookies and Advertising Identifiers; Targeted Advertising)

1. The Company obtains and uses cookies, advertising identifiers (such as IDFA for iOS and AAID for Android), IP addresses, location information, and browsing and usage history (hereinafter collectively referred to as "Cookies, etc.") on the Service for the purposes of improving User convenience, analyzing access, and delivering optimal advertisements.
2. The Company may analyze the collected Cookies, etc. and provide or share them with third parties, including advertising service providers, for the purpose of delivering advertisements (Targeted Advertising) according to Users' interests, current location, and area of stay.
3. 当社が利用するCookie等は、主として以下に区分されます。
   • Essential: Information essential for providing the Service, such as maintaining login status, ensuring security, and storing language settings
   • Analytics and Measurement: Information used for access analysis, understanding usage conditions, and improving functions
   • Advertising: Information used for delivering Targeted Advertising, adjusting advertisement display frequency, and measuring advertising effectiveness
4. Where User consent or notification is legally required for the collection or use of Cookies, etc., the Company shall notify Users in advance or obtain their consent through a consent screen (consent banner) on the Service or by other means.
5. The principal third-party providers with which the Company collaborates include Google LLC (Google Analytics, Google Ads, etc.), Meta Platforms, Inc., and other advertising service providers and analytics tool providers. The handling of information by these providers shall be governed by the respective privacy policies of those providers.
6. Among Cookies, etc., information that cannot independently identify a specific individual shall be handled by the Company as "Personally Related Information" under the APPI. When providing such information to a third party, if it is anticipated that the recipient will acquire such information as personal data, the Company shall, in accordance with applicable laws and regulations, confirm in advance that the User's consent has been obtained.

Article 4 (Disabling Targeted Advertising (Opt-Out))

Users may stop the delivery of Targeted Advertising using Cookies, etc. (opt out) through the following methods.

1. Disabling Cookies: Users may refuse to accept Cookies by changing the settings of their web browser.
2. Restricting Advertising Identifiers (IDFA / AAID): Users may restrict tracking using advertising identifiers by changing the settings of their smartphone device (for iOS, turning off "Allow Apps to Request to Track"; for Android, selecting "Delete advertising ID" or "Disable ad personalization," etc.).
3. 広告配信事業者のオプトアウトページ：提携する第三者広告事業者のオプトアウトページにアクセスし、個別に無効化手続を行うことができます。主なものは以下のとおりです。
   • Google Ads Settings: https://adssettings.google.com/
   • Google Analytics Opt-out Add-on: https://tools.google.com/dlpage/gaoptout
   • Meta (Facebook/Instagram): "Ad Preferences" settings for each service
4. Settings within the Service: If the Company provides a consent management or advertising settings function within the Service, Users may change their consent preferences through such function.

Notes

• If essential Cookies are disabled, Users may become unable to use certain functions of the Service, including login, retention of language settings, and acceptance of reservation arrangement requests.
• Even if a User opts out, this does not mean that advertisements themselves will no longer be displayed. General advertisements not based on the User's interests may still be displayed.
• Opt-out settings are stored separately for each browser and device; therefore, if the User changes their browser or device or deletes Cookies, the settings must be configured again.

Article 5 (Provision of Information to Third Parties and Sharing with Stores, etc.)

1. 当社は、以下の場合に、取得した情報を第三者に提供または共有します。
   1. 予約手配を目的とした店舗・施設等への提供
      • Recipients: Restaurants, amusement facilities, experience and leisure operators, tourist facilities, beauty-related stores, medical institutions (including providers of online medical consultations), and other establishments where reservations are made
      • Information provided: Name, telephone number and other contact information, nationality/country of residence, language, preferred reservation date and time, number of persons, allergies, dietary restrictions, special considerations, declared symptoms, etc. (in the case of online medical consultations or beauty-related services), and other information necessary for arranging and providing reservations
      • Purpose of provision: Submission, confirmation, modification, and cancellation of reservations and handling of acceptance on the day of the reservation
      • Method of provision: Telephone, email, fax, reservation management systems, or management screens for Partner Operators
   2. 広告配信事業者および分析ツール提供事業者との情報連携
      • Recipients: Google LLC, Meta Platforms, Inc., and other advertising service providers and analytics tool providers
      • Information provided: Cookies, etc. (advertising identifiers, IP addresses, browsing and behavioral history, estimated regional information, etc.)
      • Purpose of provision: Delivery of Targeted Advertising, measurement of advertising effectiveness, and access analysis
   3. Provision Relating to Payments: Provision of information necessary for payment processing to payment processors
   4. Where Required by Law: When responding to legally required disclosure requests or lawful requests from courts, police, or other public authorities
   5. Where Necessary to Protect Life, Body, or Property: Where necessary to protect the life, body, or property of a person and it is difficult to obtain the User's consent, including responses to sudden illness, accidents, and disasters
   6. Where Particularly Necessary to Improve Public Health or Promote the Sound Development of Children, and where cooperation with a national government organization or similar entity is necessary to perform duties prescribed by law, and obtaining the User's consent may interfere with the performance of such duties
   7. In the Case of Business Succession: When information is provided in connection with the succession of a business due to a merger, company split, business transfer, or other event (in such cases, the information shall be handled within the scope of the purposes of use applicable prior to the succession.)
   8. Where the User Has Given Consent
2. Except in the cases specified in the preceding paragraph, the Company shall not provide personal information to any third party without obtaining the User's consent in advance.
3. The Company may provide statistical information or anonymously processed information that has been processed so that individuals cannot be identified to stores, facilities, Partner Operators, or third parties for research or analytical purposes.
4. Provision to Third Parties Located Overseas: The Company may provide information to third parties located overseas due to the use of cloud services, collaboration with advertising service providers, or other reasons. In such cases, the Company shall take necessary measures in accordance with applicable laws and regulations, including providing information concerning the personal information protection system of the relevant foreign country and the measures taken by the recipient to protect personal information. The principal countries where recipients are located include the United States and other countries or regions separately indicated by the Company on the Service. With respect to the handling of personal data of Users located in the European Economic Area (EEA), Switzerland, or the United Kingdom, the special provisions set forth in Appendix 1 shall apply.

Article 6 (Security Measures and Outsourcing)

1. 当社は、取り扱う情報の漏えい、滅失または毀損の防止その他の安全管理のために、以下の措置を講じます。
   • Organizational Security Measures: Establishment of internal rules concerning the handling of personal information, appointment of responsible personnel, recording and regular inspection of handling conditions, and establishment of a reporting system for incidents such as information leakage
   • Personnel Security Measures: Regular education and training for employees and obtaining written undertakings concerning confidentiality obligations
   • Physical Security Measures: Access control for business areas, prevention of theft or loss of equipment and recording media, and appropriate disposal of recording media
   • Technical Security Measures: Appropriate and minimized access permissions, encryption of communications (such as TLS), password hashing, collection and monitoring of logs, and implementation of measures against unauthorized access
2. The Company may outsource all or part of the handling of information to external service providers to the extent necessary to achieve the purposes of use (including cloud infrastructure, translation engines, chat systems, call center operations, email delivery, access analysis, payment processing, etc.). In such cases, the Company shall conduct appropriate screening of contractors based on appropriate selection criteria, establish security measures and confidentiality obligations through contracts, and exercise necessary and appropriate supervision.
3. If an incident concerning the security of personal data occurs, including leakage, loss, or damage, and there is a risk of harm to the rights and interests of individuals, the Company shall, in accordance with applicable laws and regulations, report the incident to the Personal Information Protection Commission and notify the affected individual.
4. The Company shall retain information only for the period necessary to achieve the purposes of use and for any period required to be retained under applicable laws and regulations. After the expiration of such period, the Company shall promptly delete or dispose of the information in a manner that prevents restoration.

Article 7 (Disclosure, Correction, and Deletion of Personal Information)

1. ユーザーは、当社が保有する自己の個人情報について、法令の定めに従い、以下の請求を行うことができます。
   • Notification of the purposes of use
   • Disclosure (including disclosure by providing an electronic record)
   • Correction, addition, or deletion of content
   • Suspension of use or erasure
   • Suspension of provision to third parties
   • Disclosure of records concerning provision to third parties
2. To make a request under the preceding paragraph, Users shall submit an application to the contact point specified in Article 9 using the method designated by the Company. The Company shall conduct identity verification and other necessary confirmation to verify that the applicant is the individual concerned or a duly authorized representative.
3. After reviewing the details of the request, the Company shall respond within a reasonable period in accordance with applicable laws and regulations and this Policy and shall notify the User of the result. The Company may charge a fee where permitted by law.
4. 次の場合には、請求の全部または一部にお応えできないことがあります。この場合、当社は、その理由を説明するよう努めます。
   • Where the identity of the individual or duly authorized representative cannot be verified
   • Where there is a risk of harming the life, body, property, or other rights or interests of the individual or a third party
   • Where there is a risk of seriously interfering with the proper conduct of the Company's business
   • Where compliance with the request would result in a violation of applicable laws or regulations
5. Even if an account is deleted (withdrawal from the Service), the Company may retain information for the necessary period to the extent required by legal retention obligations, handling of disputes, prevention of unauthorized use, accounting or tax requirements, or other legitimate reasons.
6. Users may request that the delivery of marketing information be stopped at any time by using the unsubscribe link included in marketing emails, the settings within the application, or by contacting the inquiry contact point specified in Article 9.
7. If a User is dissatisfied with the Company's response, the User may file a complaint with the Personal Information Protection Commission or another competent supervisory authority.

Article 8 (Revision of the Privacy Policy)

1. The Company may revise this Policy if necessary due to changes in laws and regulations, changes in business operations, additions or changes to the information collected or purposes of use, or other circumstances.
2. The revised Policy shall take effect when it is posted on the Service. However, where applicable laws and regulations require the User's consent for a revision, the Company shall obtain the User's consent again.
3. When making an important revision, the Company shall notify Users in advance of the details of the revision and its effective date by posting the information on the Service, providing an in-app notification, sending it to the registered email address, or by other appropriate means.
4. The Japanese version of this Policy shall be the authoritative text. In the event of any discrepancy in interpretation between this Policy and a translated version in another language, the Japanese version shall prevail.

Article 9 (Contact Information)

For inquiries concerning this Policy and the handling of personal information, as well as requests specified in Article 7, please contact the following.

• Business Operator: Inbound Holdings Co., Ltd.
• Address: 2F Yotsubashi Building, 1-5-7 Shinmachi, Nishi-ku, Osaka City, Osaka Prefecture
• Representative: Masaki Sakamoto
• Person Responsible for Personal Information Protection: Head of the Marketing Department
• Email Address for Inquiries: marketing@inbound-hd.jp
• Hours: 07:00-21:00 Japan Standard Time (JST) *Inquiries received between 21:00 JST and 07:00 JST the following day will be handled sequentially after the next Service Hours begin.

Appendix 1 (Special Provisions for Residents of the European Economic Area (EEA), Switzerland, and the United Kingdom)

This Appendix applies where the handling of personal data of Users located in the European Economic Area (EEA), Switzerland, or the United Kingdom (hereinafter referred to as "Overseas Users") is subject to the EU General Data Protection Regulation (Regulation (EU) 2016/679; hereinafter referred to as the "GDPR"), the Swiss Federal Act on Data Protection, or the UK GDPR and Data Protection Act 2018 (collectively, the "GDPR, etc."). In the event of any discrepancy between the provisions of this Appendix and the main body of this Policy, this Appendix shall prevail with respect to Overseas Users.

1. Controller

The controller of personal data concerning Overseas Users is as follows.

• Name: Inbound Holdings Co., Ltd.
• Address: 2F Yotsubashi Building, 1-5-7 Shinmachi, Nishi-ku, Osaka City, Osaka Prefecture
• Contact: marketing@inbound-hd.jp

2. Legal Basis

The Company processes personal data based on the following legal bases.

• Account registration and authentication, acceptance and arrangement of reservation requests, provision of Translation Chat, and customer support: Performance of a contract or steps taken at the request of the data subject prior to entering into a contract (GDPR Article 6(1)(b))
• Delivery and measurement of Targeted Advertising using Cookies, etc., use of non-essential Cookies, sending of marketing information, and collection of location information: Consent of the data subject (GDPR Article 6(1)(a). Consent may be withdrawn at any time using the method specified in Paragraph 5.)
• Detection and prevention of unauthorized use, impersonation, prank reservations, service improvement, creation of statistical data, and defense of the Company's rights: Legitimate interests pursued by the Company or a third party (GDPR Article 6(1)(f). The Company conducts a balancing assessment against the rights and freedoms of Users.)
• Disclosure required by law and retention of accounting and tax records: Compliance with a legal obligation (GDPR Article 6(1)(c))
• Provision of information to protect life or physical safety in cases of sudden illness, accidents, or disasters: Protection of vital interests (GDPR Article 6(1)(d))

Symptoms, medical history, and other health-related information entered by Users in connection with online medical consultations or reservation arrangements for beauty-related services constitute special categories of personal data under Article 9 of the GDPR. The Company processes such information based on the User's explicit consent (GDPR Article 9(2)(a)) and only for the purpose of arranging the User's request with the relevant medical institution or service provider. If the User does not consent, the User may be unable to use the relevant reservation arrangement service; however, other functions of the Service remain available.

3. Retention Period

The Company retains personal data only for the period necessary to achieve the respective purposes of use. The general retention periods are as follows.

• Account Information: During the validity of the account and for six months after deletion (withdrawal from the Service)
• Reservation arrangement information and chat history: Three years from the date on which the relevant reservation is completed (or until resolution where necessary to address complaints, disputes, or unpaid amounts)
• Health-related information: One year from the date on which the relevant reservation is completed
• Cookies, etc. and advertising-related identifiers: Up to 13 months from the date of collection (or until consent is withdrawn where consent has been withdrawn)
• Accounting and tax records: The retention period prescribed by applicable laws and regulations

After the above periods have elapsed, the Company shall delete personal data in a manner that prevents restoration or process it into a form in which individuals cannot be identified.

4. Rights of Data Subjects

Overseas Users may exercise the following rights under the GDPR, etc.

1. Right of Access: The right to request access to personal data concerning the individual processed by the Company and information regarding such processing (GDPR Article 15)
2. Right to Rectification: The right to request correction of inaccurate personal data and completion of incomplete personal data (Article 16)
3. Right to Erasure (Right to Be Forgotten): The right to request erasure of personal data under certain conditions (Article 17)
4. Right to Restriction of Processing: The right to request restriction of processing under certain conditions (Article 18)
5. Right to Data Portability: The right to request that personal data processed on the basis of consent or contract performance and processed by automated means be provided in a structured, commonly used, and machine-readable format or transferred to another controller (Article 20)
6. Right to Object: The right to object to processing based on legitimate interests. With respect to processing for direct marketing purposes (including Targeted Advertising), Users may object at any time and for any reason, and the Company shall immediately cease processing for such purposes (Article 21)
7. Right to Withdraw Consent: The right to withdraw consent at any time where processing is based on consent. Withdrawal does not affect the lawfulness of processing carried out before withdrawal (Article 7(3))
8. Rights Relating to Automated Decision-Making: The right not to be subject solely to automated decision-making that produces legal effects or similarly significant effects concerning the individual (Article 22. Please also refer to Paragraph 7.)
9. Right to Lodge a Complaint with a Supervisory Authority: The right to lodge a complaint with the data protection supervisory authority having jurisdiction over the individual's habitual residence, place of work, or place where the alleged infringement occurred (in the United Kingdom, the Information Commissioner's Office (ICO); in Switzerland, the Federal Data Protection and Information Commissioner (FDPIC)) (Article 77)

To exercise these rights, please contact marketing@inbound-hd.jp. Following identity verification, the Company shall, in principle, respond within one month of receiving the request. Where a request is complex or numerous, the Company may extend the period by up to an additional two months after notifying the User of such extension. Responses shall, in principle, be provided free of charge; however, for requests that are manifestly unfounded or excessively repetitive, the Company may charge a reasonable fee or refuse to respond.

5. Withdrawal of Consent and Disabling Targeted Advertising

Overseas Users may withdraw consent or stop the delivery of Targeted Advertising at any time through the consent management function (consent banner) on the Service, device settings, or by contacting marketing@inbound-hd.jp. For specific methods, please also refer to Article 4 of this Policy.

6. International Transfers

The Company is located in Japan, and the personal data of Overseas Users is processed in Japan. Japan has received an adequacy decision from the European Commission pursuant to Article 45 of the GDPR (and the equivalent adequacy recognition remains in effect in the United Kingdom).

For transfers not covered by an adequacy decision, including transfers to cloud service providers, advertising service providers, or analytics tool providers located in the United States, the Company shall enter into and implement the Standard Contractual Clauses (SCCs) adopted by the European Commission, the UK International Data Transfer Agreement (IDTA) or UK Addendum, or other appropriate safeguards specified in Article 46 of the GDPR. Copies of such safeguards may be requested by contacting marketing@inbound-hd.jp.

7. Automated Decision-Making and Profiling

In delivering Targeted Advertising, the Company conducts profiling based on Users' attributes, usage history, and location information. Such profiling is conducted for the purpose of optimizing the content of advertisements displayed and does not involve automated decision-making that produces legal effects or similarly significant effects concerning Users. Users may stop such profiling by exercising the right to object described in Paragraph 4.6 above.

8. EU Representative and UK Representative (GDPR Article 27)

If the Company appoints a representative pursuant to Article 27 of the GDPR or Article 27 of the UK GDPR, the name and contact details of such representative shall be stated below.

• EU Representative: [To be stated upon appointment]
• UK Representative: [To be stated upon appointment]

If no representative has been appointed, Overseas Users should contact the Company using the contact information specified in Paragraph 1 above.

9. Data Protection Officer (DPO)

If the Company is required to appoint a Data Protection Officer pursuant to Article 37 of the GDPR, the Company shall appoint one and publish the contact information in this Policy. The current contact point for data protection inquiries is marketing@inbound-hd.jp.

10. Necessity of Providing Personal Data

The provision of name, email address, contact information, preferred reservation details, and other information is contractually necessary for account registration and use of reservation arrangement services. If such information is not provided, the Company may be unable to provide reservation arrangement services and certain other functions. On the other hand, consent to Targeted Advertising using Cookies, etc., location information, and receipt of marketing information is optional, and the basic functions of the Service remain available even if the User does not provide such consent.

Supplementary Provisions

• Date of Enactment: August 24, 2026
• Date of Last Revision: August 24, 2026