Privacy policy

Who we are

Kimasu, operated by Nicolas Weber (sole proprietor), Kyoto Building 402, 227 Daikokucho, Shichijodori Aburanokoji Higashi-iru, Shimogyo-ku, Kyoto, 600-8223, Japan, is the controller responsible for your personal data. For any privacy question or request, contact us at [email protected].

Data we collect

We collect only what we need to answer you and run your booking:

• Inquiry data you submit: name, email address, phone number, and the content of your message.
• Booking data: the tour, date, party size, and any preferences or details you provide to deliver the experience.
• Payment confirmation data: we never see or store your full card number. Card details are entered directly with our payment processor; we receive only a confirmation and limited transaction metadata.
• Usage data, only with your consent to Google Analytics: pages viewed, approximate region, device type and cookie identifiers that distinguish visits. These identifiers can be personal data.
• The email address you enter to receive a promo code: used to send you that code. If you also tick the box, we use it to send you our travel tips and new tours until you unsubscribe.

Why we use your data and our legal bases

• To respond to your inquiries and to provide the tour you book: necessary to take steps at your request and to perform our contract with you.
• To operate, secure, and improve the website: our legitimate interest in running a reliable service.
• To meet accounting, tax, and other legal obligations: compliance with the law.
• To measure site usage with Google Analytics: based on your consent.
• To email you our travel tips and new tours: based on your consent, given by ticking the box under the promo code form. Every one of these emails has a one-click unsubscribe link, and you can also withdraw by writing to us.

Service providers we share data with

We do not sell your personal data. We share it only with the providers needed to deliver our service, each acting under their own privacy terms:

• Stripe: payment processing. See stripe.com/privacy.
• Google Analytics: website usage measurement, only with your consent. See policies.google.com/privacy.
• Cloudflare: website delivery and security. See cloudflare.com/privacypolicy.
• Resend: sending the emails about your requests and bookings. See resend.com/legal/privacy-policy.
• OpenStreetMap and OpenFreeMap: map display on tour pages. Your IP address reaches their map servers; no tracking cookies.

Cookies

Necessary cookies support sign-in and the preferences you choose. Google Analytics is optional: its script and cookies load only after you accept analytics cookies. Refusing does not limit access to our tours or contact forms. We do not enable Google advertising signals or personalised advertising.

kimasu_cookie_consent (Kimasu, necessary)

Remembers your acceptance or refusal of analytics cookies for 180 days. The same period applies to both choices.

_ga and _ga_11CZG9S9W4 (Google Analytics, optional)

Distinguish visits and sessions so we can measure which pages are used. Stored for up to 180 days after creation, without renewing this period on each visit. Only used with your consent.

kimasu_currency (Kimasu, preference)

Remembers the display currency you select for one year. It is set when you change currency.

better-auth.session_token, with the __Secure- prefix on HTTPS (Kimasu, necessary)

Keeps you signed in to your account for up to seven days, renewed while the session is active. Short sign-in or verification cookies may also be used during authentication.

kimasu_popup_dismissed_* (Kimasu, preference)

Remembers that you closed an announcement so it is not shown again straight away. The period depends on the announcement, normally two days and no more than one year.

__stripe_mid and __stripe_sid (Stripe, payment security)

Stripe may set these cookies on its hosted checkout to assess fraud risk. Stripe lists a duration of one year for __stripe_mid and 30 minutes for __stripe_sid. Other payment cookies depend on the payment method. See stripe.com/cookie-settings.

You can reopen Cookie preferences at the bottom of any public page and accept or refuse analytics in one click. Withdrawing your consent stops Google Analytics measurement and removes its cookies from our domain. It does not delete data already sent to Google; contact us if you want to exercise your data rights. Browsing or closing a preference panel does not count as consent.

Cloudflare delivers and protects this site. Its separate Web Analytics service uses a browser beacon without cookies or local storage, according to Cloudflare. We do not currently load that beacon on this site. See developers.cloudflare.com/web-analytics/faq/.

Your browser settings also let you block or delete cookies. Blocking necessary cookies may prevent sign-in or stop your preferences from being saved.

International transfers

Kimasu is based in Japan, which the European Commission recognises as offering an adequate level of data protection. Some providers (Stripe, Google, Cloudflare, Resend) also process data in the United States; those transfers rely on the EU-US Data Privacy Framework or on standard contractual clauses.

How long we keep your data

Inquiries that do not lead to a booking: 3 years after our last exchange. Booking and customer account data: 3 years after your last tour or last activity on your account. Accounting records: 7 years, the legal period in Japan. Marketing email: 3 years after your opt-in or your last interaction with us, or until you unsubscribe; after unsubscribing we keep only your address and the date, so we never write to you again. Cookies: see the Cookies section above.

Your rights

Subject to applicable law, you may ask us to access, correct, delete, or export your personal data, and to restrict or object to certain processing. To exercise any of these rights, email [email protected]; we will respond within the period required by law. If you are in the EU, you also have the right to lodge a complaint with your local data protection authority.

Children

Our website and bookings are not directed at children under 16, and we do not knowingly collect their data. Bookings are made by adults, who remain responsible for any minors in their party.

Changes to this policy

We may update this policy from time to time. The current version is always the one posted here, with the date shown above.