นโยบายความเป็นส่วนตัว
สารบัญ
ข้อมูลของคุณได้รับการเข้ารหัสและปกป้องอย่างปลอดภัย
We may collect the following information through our website (a web app / PWA) and on site:
- Name, email, and phone number when making reservations
- Account information when you sign in (Supabase Auth)
- Payment transaction data processed by Stripe and PayPay (we do not store card numbers)
- Nickname when using chat or guestbook features
- Messages and images you send to the AI chat (“Kenji”), used to generate responses
- IP address for spam prevention
- LINE User ID when using LINE integration
- Access logs, page views, and performance metrics
- Crash logs and diagnostic data (Sentry)
- CCTV footage of shared areas on site (see “CCTV Cameras” below)
- Speech recorded by the entrance microphone when the door opens while the owner is away, and its transcript (see “Entrance microphone” below)
- Identifiers and connection records of devices that join the on-site Wi-Fi (see “On-site Wi-Fi” below)
- Your email address and booking details when you book a shower online (erased 90 days after the booking date)
- When you book through a booking site such as なっぷ (nap-camp.com): the booking notice that site sends us (lead guest name, contact details, dates, party size, plan, and any question or request). In our booking records, contact details and questions/requests are erased 90 days after check-out (operator notifications in Discord never carry contact details or the text of a question or request)
- Providing and processing lodging/camping reservations and payments
- Managing stay-pass bookings and guest accounts
- Responding to inquiries
- Preventing fraud and maintaining security (including on-site safety and crime prevention)
- Analytics to improve our services
- App stability and crash diagnostics
- Crime prevention (including the entrance microphone's recording), answering a question spoken at the entrance, and telling the owner when someone asks for a person
- Contacting creators and media at the business contact they publish, about coverage, features or working together, and keeping a record of that exchange
We use the following processors to operate our services:
- Supabase — authentication, database, storage
- Amazon Web Services (AWS) — website hosting and delivery (Amazon S3, CloudFront)
- Resend — booking email and consented email delivery (USA)
- Stripe — payment processing
- PayPay — PayPay payment processing
- Anthropic — AI chat (“Kenji”) response generation and AI trip plans (USA)
- OpenRouter — relays speech-to-text and spoken replies for the entrance microphone and the doorstep kiosk to ElevenLabs (USA)
- ElevenLabs — speech-to-text (Scribe) and spoken replies for the entrance microphone and the doorstep kiosk, through OpenRouter (USA)
- edge-tts — spoken replies when ElevenLabs does not answer; only the reply text is sent (Microsoft, USA)
- Langfuse — quality monitoring for the AI chat and AI trip plans (USA); for the chat it receives messages and replies, with email addresses, phone numbers, and booking reference codes masked before they are sent; for trip plans it never receives the text of your notes
- Sentry — crash and performance monitoring
- Google Analytics / Google Ads — web analytics and ad measurement (uses cookies)
- Meta (Facebook) — ad measurement (Pixel and Conversions API; the latter receives hashed contact details, plus the IP address, browser user agent and Meta's own cookie ids for matching)
- Google Maps — map display
- YouTube — the live stream of one field camera (see “Live stream” below). The site's player loads only when you press play (Google, USA)
- Nightbot — relays the live stream's chat commands to us (see “Live stream” below; USA)
- LINE — Official Account integration and (web only) conversion tags
- Discord — owner-only operations notifications about bookings, facilities and the network; a booking notice carries the channel, the lead guest's given name or initial, dates, party size, plan, and whether there is a question or request — never its text. When someone at the entrance microphone asks for a person, the words they spoke are included (US)
- Google Calendar and Gmail — receiving booking-site notification emails, and the operator's private booking calendar (channel, booking number, the first word of the name as entered, party size, plan, dates, arrival time and whether a reply is pending — no contact details and no request text) (US)
- Mushi — bug-report and diagnostics tool (built by the operator; processes diagnostic console/network capture)
Each provider's privacy policy applies to their processing. Ad measurement (Meta, LINE, Google Ads) can be switched off any time under “Analytics & Ad Measurement” below.
We do not sell personal information. We share data with processors listed above and when required by law.
- Run by: Tsumagoi Work&Camp (Kensaurus LLC). Security cameras cover the entrance, the shared areas and the car park. There are no cameras in private spaces such as showers or toilets.
- Purposes: (1) guest safety and crime prevention; (2) counting the people, vehicles and animals the cameras detect, to see how busy the entrance and car park are and when wild animals appear. A count records only the kind (person, vehicle, animal), the camera, the time and the zone: no image, no face and no number plate, and no one is identified. The counts are shown on the operator's on-site monitor and in the morning operations report.
- Sound: the cameras in the Kotatsu Lounge and at the entrance record sound along with the picture. The sound is kept and deleted with the footage.
- We do not use face recognition (matching a person by their face) and do not read number plates.
- Retention: footage (with its sound) is recorded on the on-site computer and backed up to Amazon Web Services (Tokyo region). Recordings are kept for at most 180 days and then deleted automatically.
- Operator notices: when a camera detects a person or similar, a still image may be sent to the operator's notification channel (Discord, in the USA). The morning operations report there carries a still from each camera and the previous day's counts. These notices are kept as the operating record.
- Footage is used only for those purposes and is not shared with third parties except as required by law (including lawful police inquiries).
- One camera on the field streams the sky and the view live on YouTube around the clock (never its microphone). It is a separate camera from the security cameras: we do not record the stream's video. From this camera we take a daily count of people and animals, kept as numbers, and daytime stills of the view for a timelapse video (see “Live stream” below).
- Questions about the cameras: LINE @012pteqb (or the contact details under “Contact” below).
- What is streamed: to share the weather and the view, one camera on our deck streams the field, Mt Asama and the sky live and publicly, around the clock, on our YouTube channel (@tsumagoicamp). Anyone can watch. On the picture we show the weather from our own station, the clock, a booking QR code, Sennin's lines, the names of the mountains, where the camera points, the computed positions of the sun, moon and stars, and the day's counts of people and animals.
- How it is framed: the camera is there for the view. It never follows anyone or zooms in. It turns slowly within a fixed range, and a chat vote can point it at one of three fixed views. People or vehicles in the field, and part of the public road, can appear.
- Pixelation: when guests are staying in the tents, the tents' doors and windows are pixelated. While they are, the camera holds one position, and if it is moved the stream switches to a pause screen automatically. To ask for the pixelation, contact LINE @012pteqb.
- Counts of people and animals: our on-site computer counts, from the same camera picture as the stream, how many people and animals appeared on the screen that day, and how many people came to the platform of the neighbouring “Aisai no Kane” bell (not part of our facility), and shows only those numbers on the stream. It counts only while the stream is live, never while it is paused. There is no face recognition and nobody is identified. To count each person once, where they appeared is held in memory for a few minutes; no image or position is ever written down. Only the day's numbers remain; they reset at midnight every day and go nowhere except the numbers on the stream.
- Sound: the camera's microphone is never streamed. The camera's audio is muted, and the only sound is a soft wind generated by computer. No guest's voice is ever streamed.
- Recording: we do not record the stream's video. YouTube's rewind (DVR) is off, and if YouTube keeps a recording (archive) of the stream, we delete it. The stills taken for the timelapse are described next.
- The live page's still: for the live page (/live) we save a still of the same picture once a minute. Only the latest still is kept, overwritten each time (Supabase, Tokyo), and a still older than five minutes is never shown.
- Timelapse: in daylight only (from 5 minutes after sunrise to 12 minutes after sunset), our on-site computer saves one still of the view from the same camera every 20 seconds. These stills carry no text and no pixelation, so none is saved while the tents are pixelated (guests staying in them) or while the stream is paused. Each night the previous day's stills become a timelapse video. Stills with a person or a vehicle moving near the camera, and night-time infrared stills, are left out of the video, not blurred. The stills are deleted after about 2 days and the videos after 14 days. The daily timelapse video itself is not published.
- Shorts (published): only on a day when the view changes enough (moving cloud, sunrise or sunset colour, first snow and similar), a short vertical video (at most 35 seconds) is made from the same stills as the timelapse and published, at most one a day, as a YouTube Short on our channel (@tsumagoicamp). Anyone can watch it, and it stays on the channel. It never shows a tent with guests in it or a person near the camera, but people or vehicles far off in the field or on the public road can appear, small. To have one taken down, contact LINE @012pteqb.
- Flashback: from the same stills as the timelapse, a small copy (384×216 pixels) every 5 minutes is kept for 14 days and shown small on the left of the stream as “24 hours ago”, “12 hours ago”, “1 week ago” or a “best shot”.
- Sunrise, sunset and stars: at dawn and dusk the colour of the sky in the same stills becomes a “sunset glow” number. At night, only while the stream is live and the tents are not pixelated, the sky is photographed every 10 minutes to count the stars, and each picture is deleted straight away. We keep only the day's best sunset still (one of the timelapse stills) and, from the night's best starry sky, only the strip of sky and ridges (never the field or the tents); both are deleted after 14 days.
- Chat: if you type !おみくじ, !仙人, !予想, !見る, !おはよう, !答え, !見た (!saw), !初雪 (!firstsnow), !1, !2, !番付 (!rank) or !かくれる (!hide) in the YouTube live chat, it reaches us through Nightbot (USA) and Sennin answers on the stream. We keep your chat display name (cleaned of symbols, at most 16 characters), a hash of your YouTube channel id (SHA-256; never the id itself), your guess, vote, answer or report (at most 40 characters; a !見た report keeps only one word from a fixed list, never what you wrote) and the time. Your name may appear on the stream (for example “○○さん、今日の一番乗り！”, “first today”, the weekly “Sennin ranking”). These records are deleted after 7 days; the “first of the day” records (to count streaks) and the season's first-snow guesses (until the season ends) are kept for about 400 days. Typing !かくれる keeps your name off the stream and the ranking; that record is kept until you undo it with “!かくれる やめる” (!hide off). There are no prizes. For the channel's polls we read only the totals (vote counts), and Sennin says the result. If you do not type a command, nothing about you reaches us. The chat itself is handled under YouTube's privacy policy.
- Pausing: if you would rather not appear, or for a shoot or an event, tell us on LINE @012pteqb. We switch the stream to a pause screen (a still picture; the camera is not used).
- Watching: the stream runs on YouTube (Google, USA), and viewers' information is handled under Google's privacy policy. The player on our site loads from youtube-nocookie.com only when you press play.
- For crime prevention, there is a microphone and a speaker at the entrance, inside the front door. When the owner is away (away mode) and the door opens, a short chime plays and what is said is recorded (up to 8 seconds a phrase, up to four phrases a visit). During quiet hours (22:00–08:00 Japan time) there is no chime and no spoken reply: it only records. When the owner is here, during an event, or when it is switched off, opening the door records nothing. Pressing the doorbell never records.
- The on-site computer transcribes the recording (Whisper). The audio may also go to speech-to-text (ElevenLabs Scribe, through OpenRouter, in the USA). Outside quiet hours, a question is answered briefly by an AI (Anthropic's Claude, in the USA), and the answer is spoken (ElevenLabs, through OpenRouter). When ElevenLabs does not answer, only the reply text goes to a read-aloud service (edge-tts, Microsoft, in the USA).
- What is kept: the audio file is deleted as soon as it has been transcribed. The transcript is kept with the AI-chat history, so a later question in the same visit can be answered, and is deleted automatically after 30 days. Operations logs and quality monitoring (Langfuse) record only how many characters were said, never the words.
- Who can see it: only we, the operator, can read that history. If you ask for a person, your words are sent to the owner's operations channel (Discord, in the USA). The speaker does not say that the owner was notified; a person is reached from the LINE QR on the wall.
- The owner's talk page opens the entrance microphone only while Talk is held, and sends that audio live to the device that opened the page. That call is not sent to speech-to-text.
- For devices that join the on-site Wi-Fi, we record the device identifier (MAC address), device name, the access point used, and connection and disconnection times. We do not record the content of your traffic (such as sites visited or messages).
- These records are used only for network security, detecting unauthorised connections, and troubleshooting, and are not shared with third parties except as required by law (including lawful police inquiries).
- A new device joining may be reported to our operator-only notification channel (Discord). The notice shows the device name, MAC address, its IP address on the site network, the access point it joined and its signal strength.
- If you use the Wi-Fi sign-in page (portal), we record the access period confirmed by your booking number or access code, the device identifier (MAC address), the device type (browser information), its IP address on the site network, when it first and last connected, and how much data each device used (bytes received and sent, nothing more). We do not record the content of your traffic or where it goes. These records are deleted within 90 days after your access period ends.
- The sign-in page shows you your access period, your registered devices and the data each has used, plus a support code that lets us find your device if you contact us.
- For the free short session for guests without a code (once per device per day), we record the device identifier (MAC address) and the date so it can be used only once a day, kept up to 90 days like the other Wi-Fi records.
- If you send the 4-digit code from the free session's screen to our LINE Official Account, the session is extended. We receive that message and your LINE display name, and ask LINE whether you have added us as a friend. To allow it once a day, we keep a one-way converted value (a hash) of your LINE user ID, never the ID itself, and delete it within three days. The code is deleted by the morning after it stops working (the end of that day, or of the extended session).
- Unusual use, such as more devices than a code allows, devices swapped in and out quickly, or many entries in a short time, is reported to our operator-only notification channel (Discord). That notice carries only the last four digits of the MAC address, the support code, the type of access (for a stay, the site name) and what happened, such as the device count, the data used or why a connection step failed; never your name or contact details.
- Records are kept only as long as those purposes require and are then deleted.
We plan to introduce a self-checkout step where guests upload photos of their site's condition. When it launches, photos will be kept for a limited period solely for condition verification and damage settlement, and this policy will be updated accordingly. We do not collect these photos today.
We measure page views and the reservation funnel with Google Analytics 4, and ad performance with the Google Ads conversion tag, the Meta Pixel, and LINE Tag. For enhanced conversion measurement on completed bookings, your email address and phone number are SHA-256-hashed in your browser before being sent to Google — raw values are never transmitted. Meta's Conversions API, on a completed booking and when you send a charter enquiry, likewise receives hashed contact details, plus the IP address, browser user agent and Meta's cookie ids (_fbp, _fbc) for matching (for enquiries, only if you allow ad measurement).
When you arrive from an ad, we store the ad click identifier (Google Ads gclid, gbraid or wbraid; Meta fbclid) and the campaign tags (utm) with your enquiry or booking record to measure our advertising (bookings keep the gclid and utm only; an enquiry keeps click identifiers only if you allow ad measurement). They are kept for the same period as that record (see “Data Retention” below). If you allow ad measurement, the click identifier is also kept in your browser for up to 90 days, so a booking made on a later day can still be measured; switching ad measurement off deletes that browser copy on your next page load. Only if you allow analytics, we also store your GA4 client ID (the value of the _ga cookie) with the payment record so the purchase is measured correctly.
For visitors from the EEA, UK and Switzerland, ad-measurement tags do not load until you accept the consent banner (Google measurement runs storage-less under Google Consent Mode until then). We also honor your browser's Global Privacy Control (GPC) signal by disabling ad measurement. Everywhere else you can switch it off below at any time (by design, LINE Tag stops from your next page load).
For diagnostics we use Sentry (crashes/performance) and Mushi (bug reports). We do not send personally identifying data to Sentry — it is scrubbed automatically before transmission.
When using our LINE Official Account (@012pteqb), LINE's Terms of Service and Privacy Policy also apply.
Our AI chat (“Kenji”) sends the messages and images you submit to an AI provider (Anthropic, in the USA) to generate responses. Message text and replies are also sent to an LLM monitoring service (Langfuse, in the USA) so we can review answer quality. Email addresses, phone numbers, and booking reference codes are automatically masked before this happens; the rest of the message text is sent as written. Neither we nor Anthropic use data submitted through the API to train AI models. Some conversation data may be retained for a limited period for quality improvement and abuse prevention. Please avoid entering sensitive personal data or another person's personal information. See this policy and each provider's policy for details.
“Plan your trip with AI” on the Access page sends the travel notes you type to an AI provider (Anthropic, in the USA) to write the plan. Before they are sent, names, phone numbers, email addresses, booking codes, addresses, social handles and links carrying a token are removed automatically (a name written on its own in a sentence may not be caught, so please leave names out). If you are not signed in, we do not save your notes or the plan in our database (if you choose to sign in, the plan waits in this browser tab and is saved once you are signed in). When you are signed in, we save the notes, with personal details removed, and the plan to your account automatically (the newest 20 automatic saves are kept; a plan you Keep is never cleared automatically). A saved plan is never public unless you make a share link. Anyone with that link sees the title, dates, party size, the day-by-day plan and the three priced ways to stay, never your notes, your questions or your account. Before the link exists you see exactly what it will show, with names in the plan replaced by [name]. You can turn a link off and delete any plan at any time under “My trip plans” in your account. Our quality monitoring (Langfuse, in the USA) never receives the text of your notes: it gets their length, how many details were removed, the plan's title and a booking summary such as party size, arrival date and nights (and your account ID if you are signed in).
To operate the Service, your personal data may be processed or stored by third parties located outside Japan (cloud, payment, AI, and monitoring providers). Destination countries include the United States (e.g., Anthropic [AI chat and trip plans], Langfuse [quality monitoring for both], OpenRouter [speech relay], ElevenLabs [speech-to-text and spoken replies], Microsoft [edge-tts], Stripe [payments], Sentry [monitoring], Discord [owner notifications], Google [booking calendar]; some, such as Supabase, vary by region setting). We apply appropriate safeguards through our contracts with these providers in accordance with applicable law. On request, we will give you information about the measures we take to ensure these overseas recipients keep applying safeguards equivalent to those Japanese law requires (ask through “Your Rights” below).
Contact details, tags, service notes, and interaction history in our guest-management system are kept for seven years after the latest stay or interaction, then deleted or anonymized unless a longer period is required by law. Booking and payment records may be retained separately for the period required by tax, accounting, and other legal obligations.
To prevent leakage, loss, or damage of personal data, we maintain safeguards including TLS encryption in transit, row-level access control on our database, least-privilege permissions, secure credential management, and contractual supervision of our processors. Given our size, data handling is limited to the operating representative.
You may request notification of the purpose of use, disclosure, correction, addition or deletion, suspension of use or erasure, and suspension of third-party provision of your retained personal data. To make a request, contact us below (LINE, or email kensaurus@gmail.com). After verifying your identity, we will respond in accordance with law. We also handle complaints about our handling of personal data through the same contact.
Data controller: ｋｅｎｓａｕｒｕｓ合同会社 (Kensaurus LLC, reg. T5011003021894) · Representative: 櫻元賢次 (Kenji Sakuramoto)