Privacy Policy

We collect only the personal information necessary for the purpose for which it is provided. The categories of information we may collect include:

• Account information — your name, email address, and password (stored as a salted hash). Collected when you create an account so we can authenticate you and personalise the journey.
• Quiz and preference responses — your answers to our recommendation quiz, including budget range, property preferences, and family composition. Used to generate matches between you and Northern Japan snow-country areas.
• Enquiry information — the contents of any message you send us through the contact form, lead-capture forms, or via the introductions you opt into.
• Saved items, notes, and bookmarks — content you choose to save inside your account. Visible only to you.
• Technical information — IP address, browser type, and operating system, captured at the time of authentication and significant actions (such as policy acknowledgments) for security and audit purposes.

We do not collect or process payment-card information; no transactions occur on JapanoMa.

We collect personal information in the following ways:

• Directly from you when you create an account, complete the recommendation quiz, send us a contact message, save an item, or opt into an introduction.
• Automatically through privacy-respecting analytics (we use Plausible, which is cookieless and does not track individuals across sessions or sites).
• From third parties only where you have authorised the connection (for example, if you choose to sign in via a third-party identity provider).

We use your personal information for the following purposes:

• To provide, operate and improve the JapanoMa platform.
• To generate the personalised area recommendations, decision tools, and content shown on your account.
• To respond to your enquiries and, where you have requested it, to introduce you to licensed Japanese real-estate professionals or service providers.
• To maintain audit logs of authentication events and policy acknowledgments — required for our own legal protection and to demonstrate consent.
• To comply with our legal obligations and to enforce our Terms & Conditions.

We will not use your personal information for direct marketing without your express, separate consent. You can withdraw any such consent at any time.

We may disclose your personal information to:

• Licensed Japanese real-estate firms and service providers — only when you have explicitly opted into an introduction. We disclose any referral relationship before the handoff.
• Service providers and processors who host and operate the platform on our behalf (database, authentication, error monitoring, email delivery, analytics). These providers process your data only on our instructions and under contractual confidentiality and security obligations.
• Legal and regulatory authorities where we are required to do so by law, court order, or to establish or defend legal claims.
• A successor entity in the event of a merger, acquisition, or sale of assets, subject to the same protections set out here.

We do not sell your personal information. We do not share it with advertising networks.

JapanoMa is operated from Australia and serves users primarily in Australia. Your personal information may be transferred to and processed in:

• Australia — the location of our primary database (Supabase Sydney region).
• Japan — when you opt into an introduction to a Japanese partner, your relevant contact details are transferred to that partner.
• Other jurisdictions — limited operational data may be processed by our service providers outside Australia (for example, error monitoring or content delivery). We use providers that maintain industry-standard data-protection commitments.

Where personal information is transferred outside your country of residence, we take reasonable steps to ensure the recipient handles it consistent with this policy.

We protect personal information using a combination of technical and organisational measures:

• Encryption in transit (HTTPS / TLS) on every connection.
• Encryption at rest in the database for sensitive fields and authentication credentials.
• Row-level access controls so that one user cannot read another user's data, enforced at the database layer.
• Role-based administrative access on a least-privilege basis.
• Audit logs for authentication events and policy acknowledgments.
• Regular review of dependencies for known security vulnerabilities.

No system is perfectly secure. If we become aware of a breach affecting your personal information we will notify you and the relevant authority where required by law.

We retain your personal information only for as long as it is necessary to fulfil the purposes for which it was collected, or as required by law:

• Account data — for the lifetime of your account. When you delete your account, we remove the associated personal information within 30 days, except where we are required to retain it for legal, audit, or anti-fraud purposes.
• Quiz responses, saved items and notes — for the lifetime of your account. Deleted with your account.
• Enquiry messages — retained for up to seven years to support continuity of the introduction relationship and for tax / record-keeping obligations.
• Policy acknowledgment records — retained indefinitely so that we can demonstrate the version of the Terms and Privacy Policy you accepted at signup, even after the policy has changed. This is for our legal protection and yours.

Subject to applicable law, you have the following rights in relation to your personal information:

• Access — request a copy of the personal information we hold about you.
• Correction — ask us to correct information that is inaccurate or out of date.
• Deletion — ask us to delete your personal information, subject to lawful retention requirements.
• Withdraw consent — for any processing that relies on your consent.
• Object or restrict — object to, or ask us to restrict, certain types of processing.
• Portability — request a machine-readable copy of the data you have provided.
• Lodge a complaint — with your local privacy regulator (see Jurisdiction-Specific Notices below).

To exercise any of these rights, contact us at privacy@japanoma.com.au. We will respond within the timeframe required by applicable law (generally 30 days in Australia and the EU).

Cookies. We use a single first-party session cookie for authentication. We do not use third-party advertising cookies. Our analytics provider (Plausible) does not use cookies or persistent identifiers.

Children. JapanoMa is not directed at children under 18. We do not knowingly collect personal information from children. If you believe a child has provided us with information, please contact us so we can delete it.

Changes to this policy. We may update this policy from time to time. When we make material changes we will increment the version (shown at the top of this page) and you will be prompted to re-acknowledge on next signin.

Australia (Privacy Act 1988 and Australian Privacy Principles). If you are unsatisfied with our handling of your personal information you can lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

Japan (Act on the Protection of Personal Information — APPI). Where the APPI applies to your personal information, you may exercise the rights granted under the APPI by contacting us. The supervisory authority is the Personal Information Protection Commission of Japan.

European Economic Area / United Kingdom (GDPR / UK GDPR). Where the GDPR or UK GDPR applies, our lawful bases for processing include contract, consent, legitimate interests, and legal obligation. You have the right to lodge a complaint with your local data-protection authority.

California (CCPA/CPRA). California residents have the right to know, delete, correct, and opt out of the sale or sharing of personal information. We do not sell personal information.

For privacy enquiries, requests to exercise your rights, or to report a concern:

• Email privacy@japanoma.com.au
• Postal: Go&C Partners, c/o JapanoMa Privacy Officer (address available on request)

We will acknowledge receipt within 7 days and respond substantively within the timeframe required by applicable law.