Privacy Policy

ikura Inc. (株式会社ikura, "ikura," "we," "us" or "our") handles information, including personal information, provided by everyone who uses the services and websites we develop and operate (the "Services") in accordance with this policy. This is an English translation of our Japanese 個人情報保護方針. If the two versions differ, the Japanese version prevails.

Company name: ikura Inc. (株式会社ikura)
Address: Hamamatsucho Daiya Building 2F, 2-2-15 Hamamatsucho, Minato-ku, Tokyo, Japan
Representative: Eiko Nakazawa (中澤英子), Representative Director
Personal Information Protection Manager: Eiko Nakazawa, Representative Director, ikura Inc. (contact: hello@ikura.io)
Personal information contact: hello@ikura.io

‍
Basic Policy
As a company that develops and operates AI services for inbound tourism and operates a travel business, we regard the protection of personal information as an important responsibility and commit to the following.

1. We acquire, use and provide personal information appropriately, taking into account the nature and scale of our business. We do not handle personal information beyond the scope necessary to achieve the specified purposes of use, and we take measures to ensure this.
2. We comply with the laws, national guidelines and other rules on the handling of personal information.
3. We work to prevent the leakage, loss or damage of personal information, and if any occurs, we promptly take corrective action.
4. We respond promptly and sincerely to complaints and inquiries about our handling of personal information.
5. We continuously improve our personal information protection management system. We also set personal information protection objectives for each fiscal year and check how well they are achieved.

‍
1. Information We Collect and How We Collect It
We automatically collect records of your use of the Services. We also collect the information you enter in our forms within the Services, information provided by social networking services you have allowed to connect with the Services, and information you give us when you contact us about the Services. Through WhatsApp (a messaging service provided by the Meta group), we collect the messages you send us, including your phone number, display name and message content. In the course of providing the Services, answering inquiries and handling bookings and applications, we may also collect your name, user name, phone number, email address, address, date of birth, travel itinerary, accompanying travelers, dietary restrictions, allergies and similar information (we obtain health-related information only with your consent), booking and usage history, inquiry details and other information needed to provide the Services.

Log files and cookies: like most websites, we record standard log information when you visit our sites, such as IP address, browser type, internet service provider, date and time, referring and exit pages, and clicks. We also use cookies to remember your preferences and improve your experience. Third party ad servers or ad networks may use cookies, JavaScript or web beacons in advertisements and links on our sites to measure ad effectiveness and personalize content. Their own privacy policies apply to them.

Google sign in: if you sign in with Google, we use your email address and Google account ID to authenticate you and to send you product updates and account notices. Our use, and any transfer to other apps, of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

‍
2. Purposes of Use
We use the information we collect (including personal information) only within the following purposes and only as far as necessary for our business.

1. Verifying your identity
2. Notifying you of matters necessary to operate the Services
3. Adjusting the content of the Services we provide to you
4. Promotional and other activities that support the operation and growth of the Services, after processing the information so that individuals cannot be identified
5. Creating and using statistical information in a form that does not identify individuals
6. Analyzing data to improve the Services and develop new ones
7. Exercising rights and performing obligations under contracts and laws
8. Responding to service requests and inquiries
9. Stopping use of the Services that violates our Terms of Use
10. Providing advertising from us to you
11. Informing you about our products, services, campaigns, events and other ikura information, and for marketing activities
12. Booking and arranging travel products and providing travel services (including providing necessary information to guides and other service providers with your consent)
13. Using the personal information of contact persons at business partners and prospective business partners for sales activities, introducing our Services, concluding and performing contracts, business communication, and invoicing and payment
14. Using the personal information of staff and applicants for recruitment, employment management, management of service contracts, payment of fees, and communication
15. Using the personal information of shareholders and stock acquisition right holders for shareholder management, running shareholders' meetings, and other procedures required by law
16. Other purposes incidental to the above

‍
3. Use of Personal Information
"Personal information" means personal information as defined in Japan's Act on the Protection of Personal Information (the "APPI"): information that can identify a specific individual by name, address, phone number, email address, date of birth or other descriptions, or information that contains an individual identification code. We use your personal information by lawful and fair means in accordance with the APPI and other applicable laws.

‍
4. Use of Analytical Data
Based on purposes 4 and 5 in Section 2, we may process your information so that individuals cannot be identified and create statistics and other analytical data. We handle such information appropriately in accordance with the APPI and other applicable laws.

‍
5. Provision to Third Parties
We do not provide personal information to third parties without your prior consent, except in the following cases.

1. Where required by law, or in any other case listed in Article 27, Paragraph 1 of the APPI
2. Where we outsource all or part of the handling of personal information within the scope necessary to achieve the purposes of use
3. Where it is provided as part of a business succession due to a merger or other reason
4. Where we need to cooperate with a national or local government body, or a party entrusted by one, in carrying out duties prescribed by law, and obtaining your consent may interfere with those duties

When we outsource the handling of personal information, we supervise the contractor as necessary and appropriate. When we provide personal data to a third party in a foreign country, we take the steps required by the APPI and other applicable laws.

‍
6. Security Measures
To prevent the leakage, loss or damage of personal information, we take the following measures.

1. Basic policy: we have established this policy.
2. Internal rules: we have rules on how personal information is handled at each stage of acquisition, use, storage, provision, deletion and disposal.
3. Organizational measures: we have appointed a Personal Information Protection Manager, limited who may handle personal information, and set up a system for reporting leaks and other incidents.
4. Human measures: we train our staff regularly and obtain confidentiality pledges from them.
5. Physical measures: we encrypt devices and use screen locks, and we do not handle personal information on paper.
6. Technical measures: we restrict access rights and use multifactor authentication, antivirus protection and encrypted communications.
7. Understanding the external environment: we may handle personal information in the United States (processing by generative AI, messaging services, email delivery, payment systems and cloud data storage) and the United Kingdom (handling by a contractor). We take security measures based on our understanding of these countries' personal information protection systems. When we outsource handling to a third party in a foreign country, we comply with Article 28 of the APPI.

We also apply access control to personal information, necessary and appropriate supervision and training of staff, information security measures, and other necessary and appropriate safeguards. When we outsource the handling of personal information, we supervise the contractor as necessary and appropriate.

‍
7. Requests for Disclosure and Other Rights
Under the APPI, you may request the following for the retained personal data we hold about you: notification of the purposes of use; disclosure (including records of provision to third parties); correction, addition or deletion; suspension of use or erasure; and suspension of provision to third parties (together, "Disclosure and Other Requests").

1. How to request: email the contact point in Section 9. We will explain the procedure.
2. Identity check: to confirm that you are the person concerned, we may compare the request with information we hold or ask you to show an identity document. If an agent makes the request, please also provide a document confirming the agent's authority.
3. Fees: there is no charge for Disclosure and Other Requests.
4. Method of disclosure: we disclose by electronic record or in writing, whichever you choose. If disclosure by the method you choose is difficult, we will tell you and disclose in writing.
5. Response: after confirming your identity and any other necessary matters, we will respond without delay in accordance with the APPI and other applicable laws. If we cannot meet your request, including where the law provides so, we will tell you and give the reason.

‍
8. Users in the European Economic Area and the United Kingdom (GDPR)
For users in the European Economic Area and the United Kingdom, we act as a data controller under the General Data Protection Regulation. We process your personal information on the following legal bases: to perform a contract with you; with your consent; for our legitimate interests; and to comply with the law. We keep personal information only as long as necessary for the purposes in this policy, and as required to comply with law, resolve disputes and enforce our policies. In certain circumstances, you have the right to access, correct or delete your information; to object to or restrict processing; to data portability; and to withdraw your consent. To exercise these rights, contact us at hello@ikura.io. You also have the right to lodge a complaint with your local data protection authority.

‍
9. Contact and Complaints
For questions about this policy, our handling of personal information, Disclosure and Other Requests, or any other inquiry, complaint or consultation about personal information, please contact:
ikura Inc. Personal Information Contact
Personal Information Protection Manager: Eiko Nakazawa
Email: hello@ikura.io

‍
10. Children's Information
We collect personal information about children under 16, such as children traveling with you, only with the consent of a parent or guardian. If you believe your child has provided personal information to us without such consent, please contact us and we will delete it.

‍
11. Changes to This Policy
We may revise this policy to take more appropriate measures.

‍
12. Dates
Established: January 10, 2026
Revised: October 18, 2026

ikura Inc.
Eiko Nakazawa, Representative Director