Privacy Policy

Operator

Geneura株式会社 (Geneura Inc.) Address: 1-1-5 Chuo, Kasukabe, Saitama, Japan Representative Director: 廖 民君 (LIU MANKWAN) Company and officer information: https://geneura.co.jp/

Use the contact form on this page for questions about personal information handled by this service.

1. Information we handle

We handle your ratings, stay month, traveller type, comments, saved hotels, Firebase user ID, linked Google account status, email, display name and profile photo supplied by your sign-in provider, and profile settings. If you register with an email address, we handle that address and records of sending and confirming verification codes. Firebase Authentication stores your password in hashed form; our operators cannot see the password itself. In our database, verification codes are stored only temporarily, as a keyed hash (HMAC) used for matching; the code itself is sent in the email. Hotel-listing requests include the submitted hotel name, reference URL, region and user ID. We do not publish your name or email in hotel reviews.

Contact and reporting records include the name, reply email, URL and message you submit, the user ID at submission, receipt time and handling status. Do not include room numbers, passwords or identity documents in the form. We do not handle booking payment details.

Anti-abuse processing uses App Check/reCAPTCHA tokens, a random device ID, daily HMAC identifiers for IP/network, and review patterns. We do not store raw IP addresses in Firestore for anti-abuse checks; device IDs are also HMAC-protected on the server. Hosting and authentication providers may process IP addresses in network operations and access logs. To limit how often verification codes can be sent and checked, and how often password reset emails can be requested, we temporarily store email addresses, IP addresses and similar data as keyed hashes (HMAC).

2. Purposes

We use information to display and aggregate reviews; provide accounts and saved hotels; prevent abuse; moderate content; handle enquiries, rights and deletion requests; analyse and improve the service; and develop business reports, datasets and APIs.

3. Service providers and browser storage

We use Google Firebase for authentication, storage and server processing; Google reCAPTCHA for abuse prevention; Vercel for hosting; Discord for notifications to our operators; and Resend to send verification codes and password reset emails. Necessary information is sent to these providers and may be processed outside Japan, including in the United States. We send Resend the recipient address and the email body, which contains a verification code or a password reset link.

We send notifications to Discord so our operators can check new reviews, enquiries and reports. Notifications include receipt numbers, the hotel concerned, internal review and report IDs, timestamps, publication status, report counts and links to the admin area. We do not send users' names, email addresses, review text or enquiry messages.

We send hotel names, addresses and coordinates to Google Maps Platform for server-side matching and photo display, not your review text or email. We do not persist Google photos or photo references. Google's Privacy Policy also applies to Google photo display.

Google: https://policies.google.com/privacy Vercel: https://vercel.com/legal/privacy-policy Discord: https://discord.com/privacy Resend: https://resend.com/legal/privacy-policy

Cookies and browser storage support sign-in, anti-abuse checks, review drafts, your choice to save a hotel after signing in, and dismissal of the review invitation banner. Clearing browser storage may remove sign-in state or drafts. After account deletion is accepted, we attempt to clear drafts saved in this browser. This does not erase drafts on other devices or in open review forms.

Booking links contain affiliate identifiers. Information entered on linked booking services is governed by those providers' terms and privacy policies.

The links in the "Search on booking sites" section on pages for hotels outside Japan redirect through Stay22 (Stay22 Technologies Inc., Canada) to the booking site (Booking.com, Agoda, Expedia or Hotels.com). The link sends Stay22 our identifiers (aid and campaign) and the hotel's name, address (where recorded) and coordinates, and our page is configured not to send its referring URL to Stay22. We do not send your name, email address, your user ID on this service, consent records or location data obtained through your device's location features. During the redirect, Stay22 and the service providers it uses (for delivery, analytics and monitoring) may receive your IP address and browser information from your browser and may set or read cookies and similar identifiers, for example to count clicks and attribute bookings. Processing on the destination booking site is governed by that site's terms and privacy policy. See Stay22's privacy policy for details. Other booking links, including those for hotels in Japan, do not go through Stay22. Stay22: https://www.stay22.com/privacy

Change of 2026-09-30: the explanation above of the information sent for the links in the "Search on booking sites" section on pages for hotels outside Japan (Stay22) was added. This change applies from 2026-09-30.

The Trip.com booking links in our staff stay reports are links of the affiliate programme of Trip.com (Trip.com Travel Singapore Pte. Ltd., Singapore). The links contain an identifier for us, and we may receive a commission from Trip.com for bookings made through them. We do not send Trip.com your name, email address, user ID on this service or consent records. The links are set not to send the URL of our page as the referrer. When you open a link, Trip.com may receive your IP address and browser information from your browser and use cookies or similar identifiers, for example to attribute bookings. Browsing, input and bookings on the linked site are governed by Trip.com's terms and privacy policy. Trip.com: https://www.trip.com/contents/service-guideline/privacy-policy.html

Videos in our staff stay reports are loaded from the delivery service of Cloudflare (Cloudflare, Inc., United States) when you press the play button. Cloudflare then receives your IP address and browser information from your browser. No video is loaded until you press play. Cloudflare: https://www.cloudflare.com/privacypolicy/

Change of 2026-10-06: the explanations above of the Trip.com booking links (affiliate) and of video delivery (Cloudflare) in our staff stay reports were added. This change applies from 2026-10-06.

4. Sharing and business transfers

We may share information as necessary with service providers to operate the service, or with recipients as required by law. We do not currently provide review datasets, reports or APIs to business customers. Before doing so, we will explain what information we will provide and for what purposes, and obtain any consent required by law. Review content and statistics shared with partners or business customers in the future will exclude direct identifiers such as names and email addresses. If comments contain personal data, we will exclude or remove it, or establish a lawful basis such as separate consent before sharing it. We do not sell personal data for advertising.

User information, reviews, consent and operational records may transfer with a sale, merger or reorganization of the business. The successor must handle them in accordance with this policy.

5. Retention and deletion

Users linked to Google and users who verified their email address can delete individual reviews or their account on My page. Others (including registrations whose email address was never verified), or anyone who cannot sign in, can use the contact form. When leaving, choose to keep or delete all your reviews. Both choices remove your sign-in account, saved hotels, profile and hotel-listing request inputs. If you keep reviews, we retain ratings, comments, publication status, consent records and an internal contributor ID to prevent duplicate counting. Names and emails are not published. You cannot delete reviews yourself after leaving, so first delete any review containing personal information. After leaving, we can no longer match you to the original contributor, so we may be unable to fulfill a removal request based on authorship. We still accept enquiries concerning personal information and rights violations. Deletion is permanent; caches and daily aggregates may take longer to update.

Records used to check verification codes (including the recipient address) expire 24 hours after issue and are then eligible for automatic deletion. Registrations made only with an email address and password whose address is never verified become eligible for automatic deletion, together with their data (such as saved hotels), 7 days after they were last used. Temporary rate-limit and replay-prevention records (including limits on sending and checking verification codes and on password reset requests) expire 48 hours after they were last written and are then eligible for automatic deletion. The user ID and state needed to prevent repeat account-deletion processing (including automatic deletion) expire 30 days after completion. Actual deletion is not instantaneous at expiry.

We retain enquiry information as needed to handle enquiries and delete information that is no longer necessary. Reports, consent, audit and anti-abuse records, including user-ID-linked records that prevent duplicate hotel-listing or equipment-demand counts, may be retained after account deletion as necessary for legal obligations, disputes or fraud prevention. You may also request deletion or restriction of these records through the contact form.

6. Security and your requests

We use authentication and administrative access restrictions, encrypted transport, and validation of submission and management operations. Use the contact form to request information about safeguards or purposes; access to your personal data or third-party disclosure records; correction; deletion; or restriction of use or disclosure. We verify identity or authority as needed and respond under applicable law, explaining any refusal. If the form is unavailable, use the email address on this page.