Privacy policy

Data controller

The controller of the personal data processed through this site is oyatsu. For any question about your data or about this policy, write to us and we will get back to you as soon as possible.

Contact: [email protected]

Data we collect

Depending on how you use the site, we may process the following categories of data:

• Audience measurement: before your consent, only a cookieless, identifier-free visit signal is sent (normalized page path, language, UTM parameters only); after your consent, PostHog collects browsing data (pages viewed, navigation), with café URLs normalized so no identifier is ever sent.
• Performance metrics (Web Vitals) reported to our server, attached to a normalized page path.
• Preferences stored locally in your browser: chosen language, analytics consent and your “My wishlist” of saved cafés. This data never leaves your device.
• Owner account data: email address, password (stored only as a hash on the server) and the login session cookie.
• Invitation requests and verification codes sent by email when an owner account is created.
• Technical connection logs, strictly required for security and incident diagnosis.

Purposes and legal bases

Under Japan’s APPI, we use this data for the following purposes:

• Operating and improving the site — performance of the service you asked for.
• Measuring audience in an aggregated way — your consent, withdrawable at any time from the footer.
• Managing owner accounts, sign-in and invitations — performance of the contract between you and us.
• Securing the site and preventing abuse — our legitimate interest.
• Complying with legal obligations — legal obligation.

Cookies and local storage

The site only uses the following storage, all strictly functional or consent-based:

We do not use advertising cookies or cross-site trackers.

• maison.analyticsConsent (localStorage) — your analytics consent choice, kept until you change it.
• maison.language (localStorage) — your preferred language.
• Wishlist (localStorage) — the cafés you save, stored only on your device.
• PostHog (localStorage + cookie) — a random identifier and usage events, set only if you accept; you can withdraw your consent at any time from the footer (“Manage cookies”).
• maison_owner_session (cookie) — the owner login session, deleted on sign-out.

Retention

Audience measurement data is kept for at most 12 months. Owner account data is kept while the account is active, then deleted or anonymized within 30 days of account deletion. Wishlist and language preferences stay in your browser until you clear them. Security logs are kept for 90 days.

Backups follow the same retention periods.

Processors and transfers

We rely on a small number of providers, bound by confidentiality and data protection commitments:

• Audience measurement: PostHog, self-hosted on our own infrastructure (juice.oyatsutime.com).
• Email delivery (verification codes, invitations): the SMTP server we operate.
• Hosting of the site, the database and media storage: our hosting providers (OVH), with infrastructure in Europe or, for object storage, in Singapore.

We never sell your data. Some technical providers may process data outside Japan (hosting in Europe, object storage in Singapore); under Japan’s APPI, such cross-border transfers are made only with your consent or when the destination country guarantees an equivalent level of protection.

Your rights

Under Japan’s Act on the Protection of Personal Information (APPI) and other applicable laws, you have the following rights over your data:

• Access — obtain a copy of your personal data.
• Rectification — correct inaccurate or incomplete data.
• Erasure — request the deletion of your data.
• Restriction — ask us to pause the processing of your data.
• Objection — object to processing based on legitimate interest.
• Portability — receive your data in a structured, machine-readable format.
• Withdraw consent — at any time, without affecting past processing.
• Third-party provision records — obtain the records of personal data shared with third parties (APPI).

To exercise any of these rights, email [email protected]. You may also lodge a complaint with the Japanese Personal Information Protection Commission (PPC, www.ppc.go.jp).

Security

We apply appropriate technical and organizational measures: HTTPS everywhere, passwords stored only as hashes, secured session cookies, restricted access and logging. No system is perfectly secure, so please use a strong, unique password for your owner account.

Changes to this policy

This policy may evolve as the service does. The date at the top of the page always reflects the latest version. If a change is significant, we will announce it on the site and, if you have an owner account, by email.