Privacy Policy

Carshare (the "Company") handles members' personal information as follows in providing its car-sharing service (the "Service").

1. Information We Collect

• Registration details: name, email address, phone number, country, language preference
• Identity verification: we check your driving licence and a selfie for each booking, before you pay, using Stripe Identity (operated by Stripe). Your licence photos and selfie are kept by Stripe and are not stored on our servers. We keep the verification result and the text read from your document (name, address, licence number, issuing country and expiry date) in encrypted form. Your date of birth is used only to match your account details and is not stored.
• Driving documents: the International Driving Permit (IDP) or Japanese translation, passport photo page, entry stamp, entry date and — if the automated check cannot read your licence — a photo of your licence, which members with a foreign licence send us, are stored in a private area of our server that cannot be accessed directly from the web. Only our staff can view them, and every view is logged. We do not keep printed or downloaded copies.
• How long we keep identity data and documents: they are deleted from our server, and Stripe is asked to delete its copy, 120 days after you return the vehicle (120 days after cancellation for bookings cancelled after payment, and after about 4 days for checks that were never used for a booking). The 120 days allow us to respond to card disputes (chargebacks). If an accident, dispute or legal request is still open, we keep them until it is resolved. Deleted data may remain in our server's automatic backups for a limited period.
• Rental ledger: the records that Japanese car-rental rules (Road Transport Act) require us to keep — the driver's name, address, licence type and licence number, the vehicle, rental dates, fees and any accidents — are kept for two years after the rental ends and then deleted (longer only while an accident, dispute or legal request is open).
• Payment information: credit card numbers are processed by Stripe and never pass through or get stored on our servers. We retain only payment reference IDs and amounts.
• GPS location data: vehicle-management devices such as GPS installed in the vehicle may collect driving location data during the rental period (for the purposes set out in the next section).
• Usage records: reservation details, payment history, inquiries
• Access logs: IP address, browser information, etc. Access logs are retained for 90 days, after which they are deleted or anonymized.

2. Purposes of Use

• Providing the Service (reservation management, identity verification, payments, vehicle handover)
• Communications about the Service (reservation confirmations, billing, cancellation notices, etc.)
• Handling accidents, violations, and unpaid fees
• GPS location data: for theft prevention, accident response, and responding to serious violations of the Terms of Service (such as unauthorized extension or taking the vehicle out of Japan; this corresponds to the provisions on vehicle-management devices in Article 10 of the Terms)
• Statistical analysis for service improvement (in a form that cannot identify individuals)
• Compliance with laws and regulations

3. Provision to Third Parties

We do not provide personal information to third parties except in the following cases:

• Provision to Stripe for payment processing and identity verification (as a provision to a third party located abroad, set out in the next section)
• Where required by law (including inquiries from the police or courts)
• Where necessary to protect a person's life, body, or property and it is difficult to obtain the person's consent

4. Provision to Third Parties Located Abroad

For payment processing and identity verification, we provide personal data to a third party located abroad pursuant to Article 28 of the Act on the Protection of Personal Information of Japan, as follows. By registering as a member and using the Service, you consent to this provision.

1. Recipient: Stripe, Inc. (located in the United States of America)
2. Data provided: name, email address, information necessary for payment, and driving-licence images / photos for identity verification (at each booking; we ask Stripe to delete them after the retention period in the previous section)
3. Information about the personal-data protection regime of the United States: the United States has no comprehensive federal data-protection law; personal data is regulated by state laws and sector-specific laws. For details, you may refer to the survey of foreign regimes published by the Personal Information Protection Commission of Japan (on its website).
4. Protective measures taken by Stripe: Stripe is PCI DSS compliant (the credit-card industry security standard) and operates a data-protection program of GDPR (EU General Data Protection Regulation) standard. For details, see Stripe's privacy policy (https://stripe.com/privacy).

5. Cookies and Sessions

The Service uses cookies and sessions to keep you logged in, remember your language preference, and for security (CSRF protection). We do not use advertising or tracking cookies. If you disable cookies in your browser, some features of the Service will not be available.

6. Security

We take security measures including encrypted communications (TLS), access control, and private storage areas to prevent unauthorized access to, leakage of, or loss of personal information.

7. Your Rights and Data After Withdrawal

1. Members may make the following requests regarding their personal data held by the Company: notification of the purposes of use; disclosure; correction, addition or deletion of content; suspension of use or erasure; and suspension of provision to third parties.
2. Please contact us at the address below. We will respond without delay in accordance with applicable laws after verifying your identity.
3. Fees: requests are free of charge (if you request a response by post, actual postage costs may apply).
4. Data after withdrawal: after withdrawal of membership, personal data is deleted or anonymized without delay once any retention periods required by law (e.g. for transaction records) have expired. Identity data and driving documents are deleted when the retention period above (120 days after your return) ends, and rental-ledger records two years after the rental.

Personal Information Contact
Carshare
Email: (To be announced)

8. Language

This Policy is executed in Japanese. The English version is provided for reference only; in case of any discrepancy, the Japanese version shall prevail.