Privacy Policy

1. Information and purposes

The public information site has no accounts, forms, advertising trackers or uploads. Its host may process ordinary connection and request information to deliver the pages and maintain security.

The separate application is designed to handle reservation and contact details, each guest's name, address, occupation and stay dates, and records of notices, staff reviews and in-person verification. For a foreign guest without an address in Japan, it also handles nationality, passport number and the required passport copy. This supports guest registration, the statutory register, correction requests, document review and accommodation operations. Guests do not sign in with Google or authorize their own Drive.

2. Google Drive access and use

The operator's Google account authorizes the Drive API through OAuth. The app uses https://www.googleapis.com/auth/drive.file for per-file access to files and folders it creates or is authorized to use. It does not request access to the operator's entire Drive. The app creates the archive folders, uploads and retrieves the required document files, checks ownership, access permissions and integrity, and removes files when an authorized retention action permits it.

The integration requests limited Google Drive account information (account email, Drive permission identifier, and storage quota fields) and authorized file information (including identifiers, folder relationships, ownership, permissions, file size and checksums). The app uses the permission identifier to verify the connected owner. It stores server-side OAuth credentials for authorized offline access. The existing test deployment also has a separate drive.appdata grant for access to and authorized cleanup of legacy synthetic archive files; new uploads use drive.file.

JINSEI KYOTO Check-in's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements. Google API data is used to operate the document workflow described here. It is not sold, used for advertising or shared for unrelated purposes.

3. Storage, access and disclosure

Document images are transmitted to a dedicated, privately owned folder in Google Drive. Neon PostgreSQL holds application records and file references, integrity checks and access or retention status; image bodies are not stored in Neon. Vercel hosts the application and processes the request when a file is uploaded or viewed. OAuth secrets stay on the server.

The application does not create public sharing links for document images. In-app viewing is limited to staff with multi-factor authentication and permission for the relevant property and reservation. The connected Drive owner can also access their private archive directly in Drive. Sensitive in-app access and actions are audited. Information may be handled by service providers to operate the application or disclosed where lawfully required. It is not made available through this public information site.

4. Retention, deletion and revocation

Under the Kyoto City rules for the applicable private lodging business, a finalized guest register and any required passport copy are retained for at least three years. The register retention period runs from its creation. Data that is not required for a finalized register, including abandoned registrations and cancelled bookings, is retained only for the approved operational period or while a legal hold applies. Any backup or restored copy remains subject to the applicable retention and deletion rules.

The operator can revoke the app's authorization in Google Account connections. Revocation stops the app from using that grant and may interrupt access through the app; it is not a request to delete the archive or the database records. Data requests and legally required retention are handled separately.

5. Cross-border processing

Google Drive, Neon and Vercel provide hosting, storage or processing services. Data or operational support may be handled outside Japan, depending on the service, processing locations and terms. The operator must confirm the actual processing arrangements and the required notices or safeguards before opening real-data collection. This policy does not promise that all processing takes place in Japan.

6. Privacy contact and requests

For questions about access, correction, deletion, retention or Google API data, contact 合同会社E・G・O at l729455589@gmail.com. Please do not attach passports or send access codes by email. The operator may need to verify your identity and explain any statutory limits on deletion.