Privacy Policy

Carshare (the "Company") handles members' personal information as follows in providing its car-sharing service (the "Service").

1. Information We Collect

• Registration details: name, email address, phone number, country, language preference
• Identity verification: verification (matching of your photo and ID document) is processed by Stripe Identity, operated by Stripe. ID images and photos are never stored on our servers — we only retain the verification result (verified / failed).
• International Driving Permit (IDP) images: IDP images uploaded by members are stored in a private, non-web-accessible encrypted area of our server and automatically deleted 90 days after your rentals are completed.
• Payment information: credit card numbers are processed by Stripe and never pass through or get stored on our servers. We retain only payment reference IDs and amounts.
• GPS location data: vehicle-management devices such as GPS installed in the vehicle may collect driving location data during the rental period (for the purposes set out in the next section).
• Usage records: reservation details, payment history, inquiries
• Access logs: IP address, browser information, etc. Access logs are retained for 90 days, after which they are deleted or anonymized.

2. Purposes of Use

• Providing the Service (reservation management, identity verification, payments, vehicle handover)
• Communications about the Service (reservation confirmations, billing, cancellation notices, etc.)
• Handling accidents, violations, and unpaid fees
• GPS location data: for theft prevention, accident response, and responding to serious violations of the Terms of Service (such as unauthorized extension or taking the vehicle out of Japan; this corresponds to the provisions on vehicle-management devices in Article 10 of the Terms)
• Statistical analysis for service improvement (in a form that cannot identify individuals)
• Compliance with laws and regulations

3. Provision to Third Parties

We do not provide personal information to third parties except in the following cases:

• Provision to Stripe for payment processing and identity verification (as a provision to a third party located abroad, set out in the next section)
• Where required by law (including inquiries from the police or courts)
• Where necessary to protect a person's life, body, or property and it is difficult to obtain the person's consent

4. Provision to Third Parties Located Abroad

For payment processing and identity verification, we provide personal data to a third party located abroad pursuant to Article 28 of the Act on the Protection of Personal Information of Japan, as follows. By registering as a member and using the Service, you consent to this provision.

1. Recipient: Stripe, Inc. (located in the United States of America)
2. Data provided: name, email address, information necessary for payment, and ID images / photos for identity verification (when Stripe Identity is used)
3. Information about the personal-data protection regime of the United States: the United States has no comprehensive federal data-protection law; personal data is regulated by state laws and sector-specific laws. For details, you may refer to the survey of foreign regimes published by the Personal Information Protection Commission of Japan (on its website).
4. Protective measures taken by Stripe: Stripe is PCI DSS compliant (the credit-card industry security standard) and operates a data-protection program of GDPR (EU General Data Protection Regulation) standard. For details, see Stripe's privacy policy (https://stripe.com/privacy).

5. Cookies and Sessions

The Service uses cookies and sessions to keep you logged in, remember your language preference, and for security (CSRF protection). We do not use advertising or tracking cookies. If you disable cookies in your browser, some features of the Service will not be available.

6. Security

We take security measures including encrypted communications (TLS), access control, and private storage areas to prevent unauthorized access to, leakage of, or loss of personal information.

7. Your Rights and Data After Withdrawal

1. Members may make the following requests regarding their personal data held by the Company: notification of the purposes of use; disclosure; correction, addition or deletion of content; suspension of use or erasure; and suspension of provision to third parties.
2. Please contact us at the address below. We will respond without delay in accordance with applicable laws after verifying your identity.
3. Fees: requests are free of charge (if you request a response by post, actual postage costs may apply).
4. Data after withdrawal: after withdrawal of membership, personal data is deleted or anonymized without delay once any retention periods required by law (e.g. for transaction records) have expired.

Personal Information Contact
Carshare
Email: (To be announced)

8. Language

This Policy is executed in Japanese. The English version is provided for reference only; in case of any discrepancy, the Japanese version shall prevail.