Privacy Policy

NamiFlow (Inbound) · Last updated: 2026-09-12

1. Our approach

We collect the minimum personal data needed to run the service, and we are transparent about how we use it. This policy is governed by the laws of Japan (including the Act on the Protection of Personal Information).

2. Information we collect

Category	Details
Contact	Email address (collected at checkout by our payment processor), used to deliver your agreement link and evidence PDF.
Agreement info	Venue type, amount, agreed conditions, reference code, language.
Consent records	Captured when the venue agrees: IP address, User-Agent, timestamp, GPS location, press-and-hold duration, and a device fingerprint (to prove intentional consent and deter fraud).
Payment	Purchase history, date and amount. Card details are handled by Stripe; we do not store them.
Automatically	Access logs (date/time, referrer, frequency), cookies, and basic device information.

3. How we use it

• To provide the service: record the agreement and consent, generate and deliver the PDF, and let you re-open your agreement by link/reference code.
• To deliver essential messages (your agreement/pass link, evidence PDF, important notices).
• To prevent fraud and abuse, and to maintain and improve the service (including anonymized statistics).
• To comply with law and to protect rights (responding to lawful requests; handling violations).

4. Third parties & cross-border transfer

We use the following providers, and relevant data is shared with them for the stated purpose. We do not otherwise sell or share your personal data without consent, except as required by law.

Provider	Destination country	Data	Purpose
Stripe, Inc.	United States	Payment info, email	Payment processing
Supabase Inc.	United States	Agreement & consent data	Database
Cloudinary Ltd.	United States	Generated PDF records	File storage
Resend, Inc.	United States	Email address	Email delivery

These transfers are to third parties located outside Japan (in the United States). We have obtained information on that country's data-protection framework by appropriate means, including materials published by Japan's Personal Information Protection Commission (個人情報保護委員会). Each recipient continuously implements protective measures equivalent to those required by Japan's Act on the Protection of Personal Information, under standard contractual clauses or a data-processing agreement. Further details on these measures are available on request at [email protected].

5. Security

We use access controls, encryption in transit, restricted database access, and rate limiting. No method is perfectly secure, but we take reasonable measures to protect your data.

6. Retention & deletion

• Practice (demo) records: deleted 24 hours after creation.
• Production agreement records: retained for a limited period (about 30 days), then automatically deleted.
• Single credits: deleted after they expire (7 days). Stay passes: deleted after they expire (14 days).

To request deletion of your data earlier, email [email protected] with your reference code.

7. Your rights

You may request access to, correction of, or deletion of your personal data. Contact us at [email protected].

8. Cookies

We use minimal cookies needed to operate the service. You can disable cookies in your browser, but some features may not work.

9. Minors

The service is intended for adults. We do not knowingly collect data from minors.

10. Changes & contact

We may update this policy; the latest version applies. Questions: [email protected].