Privacy Policy

This section is published under the external-transmission rules (外部送信規律) of Japan's Telecommunications Business Act, Article 27-12.

Only if you choose "Accept all" in the cookie banner, our website sends the following information to an external company. If you choose "Essential only", none of it is sent.

How Meta handles this information is described in the Meta Privacy Policy.

We use YouTube API Services in an internal publishing tool. It uploads videos to our own YouTube channel and adds their titles, descriptions, translations, subtitles and thumbnails. Only our staff use it. It is not offered to customers or the public, and it never accesses a visitor's or customer's YouTube or Google account.

When you watch or interact with YouTube content we publish, the YouTube Terms of Service apply. How Google handles data is described in the Google Privacy Policy.

What the tool accesses and stores

• It accesses only our own channel, through an authorisation granted by our company Google account: our videos, their details, subtitle tracks and thumbnails.
• It does not collect, store or share personal information about YouTube users.
• The authorisation token is stored only on our company computer and is never shared with third parties.
• Publishing logs (our own video IDs and what was changed) are kept on the same computer for no more than 30 days.

Revoking access and deletion

Our company can revoke the tool's access at any time on the Google security settings page (myaccount.google.com/permissions). When access is revoked, we delete the stored token and any remaining logs within 7 days. Questions: info@dreamax.co.jp

We take the following measures to keep your personal data safe from leaks, loss and damage.

(1) Basic policy

To make sure personal data is handled properly, this privacy policy sets out our basic policy, including that we comply with the law and guidelines and that we have a contact point for questions and complaints. That contact point is given in section 12.

(2) Rules for handling personal data

How long we keep personal data is set out in section 4. What we delete, and which records we keep, when you delete your account is set out in section 5.

(3) Organisational measures

• The person in charge of personal data is our Representative Director, 林 惠民.
• Only staff we have authorised can handle booking data and identity documents in our admin system.
• Key admin actions (such as changing a booking, adding or removing documents, and refunds) are logged, so that we can check how data has been handled.
• If a leak or similar incident occurs, staff report it to the person in charge, who decides whether it must be reported to the Personal Information Protection Commission and whether the people affected must be notified.
• We review staff access rights every 6 months and change them where needed.

(4) Physical measures

Your data is stored mainly with cloud services (Google Cloud / Firebase), whose data centres have physical security such as access controls run by the provider.

(5) Technical measures

• Access control: only you and staff we have authorised can access your data. Our database and file storage cannot be read or written directly from the website or app; the server checks who you are and what you may see before it returns anything.
• Sign-in: members sign in with Google or Apple, and we store no passwords. If you book without signing in, you receive a time-limited link that works for that booking only. The link cannot cancel the booking or change its dates, car or price.
• Payment details: card details are handled by our payment provider, Stripe, and card numbers are never stored on our servers.
• Protection against unauthorised access: all traffic is encrypted (HTTPS). We limit large numbers of requests in a short time and verify the signatures of notifications from outside services.
• Encryption at rest: data we store in the cloud is encrypted at rest by our cloud provider.
• Backups and monitoring: the database is backed up daily and protected against accidental deletion. We run monitoring that detects outages and unusual activity.
• Deletion: if you ask us to delete your account, we delete your account details, saved driver details and uploaded identity documents, except the records the law requires us to keep.

(6) Understanding the foreign environment

We store and handle personal data in Japan and also in other countries, such as the United States. We take the measures needed for security based on our understanding of the personal information protection systems of those countries. Where the data is held, the systems of those countries and the measures the recipients take are set out in section 10, "Where Your Data Is Stored and Transfers Outside Japan".

(7) If a leak occurs

If personal data is leaked, lost or damaged, or may have been, we investigate promptly and act to contain the harm and prevent it from happening again. Where Article 26 of the APPI and Article 7 of its Enforcement Rules require it, we report to the Personal Information Protection Commission and notify the people affected.

Our main database and servers are in Japan (Google Cloud, Tokyo and Osaka). Some of the providers in section 3 handle personal data outside Japan, as listed below. The last column shows whether the provider was on the EU-U.S. Data Privacy Framework (DPF) list at dataprivacyframework.gov when we checked it on 10 November 2026.

Provision to third parties in foreign countries (APPI Article 28)

• Countries: as listed in the table.
• Protection in those countries: Japan's Personal Information Protection Commission (PPC) recognises the EU (including Ireland) and the UK as having personal information protection systems equivalent to Japan's. The United States has no single comprehensive federal privacy law; protection comes from sector-specific federal laws and state laws such as the California Consumer Privacy Act. India has the Digital Personal Data Protection Act, 2023. For details, see the PPC's survey of foreign personal information protection systems (in Japanese).
• What the providers do: Google, Stripe, Resend and Anthropic handle the data under data processing terms that limit its use to providing their service and require security measures. Stripe also states that it puts written contracts in place that give protection equivalent to the APPI. Microsoft, Meta, Apple and SORACOM handle the data under their own terms and privacy policies, linked above.
• We regularly check these measures and any rules in those countries that may affect them. On request, we will provide the information described in Article 18(3) of the APPI Enforcement Rules.

Users in the EEA and the UK

The European Commission has found that Japan protects personal data adequately (Decision (EU) 2019/419). Where a provider in the United States receives your data, we rely on the EU-U.S. Data Privacy Framework (and its UK Extension) if the provider is certified, and otherwise on the European Commission's Standard Contractual Clauses. You can ask us for a copy of these safeguards at info@dreamax.co.jp.

If you are in the EEA or the UK, we rely on these legal bases (GDPR Article 6(1)):

• Contract: to make and carry out your rental and provide your account (booking, payment, driver documents, messages about your booking).
• Consent: analytics and advertising cookies, the AI assistant, booking reminders, offers you asked for, and your device location. You can withdraw consent at any time; this does not affect processing before you withdrew.
• Legitimate interests: vehicle security and accident handling by GPS, preventing fraud and abuse, keeping the records Japanese law requires, handling legal claims, telling past customers about similar offers, and improving our service. You can object to these.

We need the driver's licence and passport details to rent you a car; without them we cannot accept the booking. We do not make decisions about you based solely on automated processing.