Privacy Policy

Who we are

This Privacy Policy is issued by Wayfarer K.K. (WAYFARER株式会社), a company registered in Japan, with its registered office at 1-17-1 Toranomon Hills Tower, Minato, Tokyo 105-6415.

EU representative (Article 27 GDPR): Europe Services, SE, Na Cecelicce 425/4, Smíchov, 150 00 Praha 5, Czech Republic. Data subjects may contact our EU representative at info@gdprrepresentative.com regarding the processing of their personal data.

This Privacy Policy describes how your personal information is collected, used, and shared when you use the Kabin Crew app, visit the Kabin website, check in using the Kabin Pad tablet at our reception, or stay at one of our properties, including what our staff record about you as a guest during your stay. It is organized into three parts: our mobile app, our website, and how we collect, use, and share your data more broadly across your stay with us. Where a section applies to more than one part, it appears once, in the part it applies to most directly.

Wayfarer built the Kabin app as a free app, provided at no cost and intended for use as is. This page is used to inform visitors and users regarding our policies on the collection, use, and disclosure of personal information.

The personal information we collect is used for providing and improving our service. We will not use or share your information with anyone except as described in this Privacy Policy.

The terms used in this Privacy Policy have the same meanings as in our Terms and Conditions, unless otherwise defined here.

Part 1: The Kabin App

Information Collection and Use

For a better experience while using our app, we may require you to provide us with certain personally identifiable information. Part 3 below lists everything we may collect across our app, website, the Kabin Pad, and your stay, and explains why.

The app uses third-party services that may collect information used to identify you.

Link to the privacy policy of third-party service providers used by the app:

‍Log Data

Whenever you use our app, in the case of an error we collect data and information (through third-party products) on your phone called Log Data. This may include your device's Internet Protocol (“IP”) address, device name, operating system version, the app's configuration when using our service, the time and date of your use of the service, and other statistics.

App Cookies

Cookies are files with a small amount of data that are commonly used as anonymous unique identifiers. The app does not use these “cookies” explicitly. However, the app may use third-party code and libraries that use cookies to collect information and improve their services. You may accept or refuse these cookies. If you refuse them, you may not be able to use some portions of the app.

Part 2: The Kabin Website

This part applies to your use of the Kabin website. In most countries, we ask for your consent before any non-essential cookie or tracking tool is activated. A banner appears on your first visit, letting you choose which categories of cookies to allow, and only cookies strictly necessary for the site to function are active before you make a choice. In the United States, Japan, Hong Kong and Australia, the defaults are different, as described in Part 5.

Cookie Categories

We group our website cookies into four categories:

Functional (always on). These are required for the site to work properly and cannot be turned off. This includes Sentry, which helps us detect and fix technical errors, Stripe for payments and personal information collection, and a dedicated consent cookie described below.
Analytics. These help us understand how visitors use our site. Currently this covers our analytics platform, Mixpanel, Google Analytics, and Stape (which forwards website events to our analytics and marketing tools).
Marketing. These are used for advertising and promotional communications. Currently this covers Meta (Facebook) Pixel, Customer.io, RightMessage, Triptease and Google Ads.
Identity Sharing. When you are signed in or book with us, this lets us send your account ID and hashed (scrambled) versions of your email address, name, phone number, city, postcode and country to Meta, so the ads you see on its services can be matched to you. In Japan, Hong Kong and Australia it is a separate choice. In the United States it is part of the "Sale or sharing for targeted ads" choice. Everywhere else it follows your Marketing choice.

Your Choices

You can accept all, reject all (except Functional), or choose categories individually. If your browser sends a Global Privacy Control (GPC) signal, we treat this as a request to opt out of Marketing and Identity Sharing automatically, without needing to ask you again.

You can change your choice at any time using the “Cookies Settings” link in the footer of our site. When you make a choice, we record the time it was made and what you chose, so we can honor it going forward. We keep your choice for 13 months. After that, the default for your country applies again until you choose again (see Part 5). If your browser sends a Global Privacy Control signal, we apply it on every visit.

To remember your choice, we store it in a dedicated first-party cookie tied to a randomly generated, anonymous identifier. This cookie is used only to remember your privacy preferences — never for tracking, analytics, or marketing — which is why it falls under the Functional category and does not require its own opt-in. We also keep a matching record on our servers, so that we can demonstrate what was consented to and when, if ever required to do so.

Website Service Providers

Some tools listed above act on our behalf under the categories described. For example, Customer.io is used only to send marketing emails; transactional messages, such as booking confirmations, are sent through a separate provider (SendGrid) and are not affected by your cookie choices.

Link to the privacy policy of third-party service providers used by the website

Regulatory Compliance

This list reflects our current practices and may be updated as regulations change or as our compliance program evolves.

We design our website's cookie and consent practices to meet the requirements of the following regulations: the EU General Data Protection Regulation (GDPR) and ePrivacy Directive, the UK GDPR and Privacy and Electronic Communications Regulations (PECR), Japan's Act on the Protection of Personal Information (APPI), U.S. state privacy laws (including honoring the Global Privacy Control signal where required), Canada's PIPEDA and Quebec's Law 25, Australia's Privacy Act 1988, Singapore's Personal Data Protection Act (PDPA), New Zealand's Privacy Act 2020, Hong Kong's Personal Data (Privacy) Ordinance (PDPO), and Taiwan's Personal Data Protection Act (PDPA).

Part 3: How We Collect, Use, and Share Your Data

This part applies across our app, our website, the Kabin Pad, and your stay with us as a guest.

What We Collect

Account (website and app): first and last name, email, username, password, country, profile photo (app), and your marketing email choice. If you sign in with Apple or Google, we receive your name and email from them.
Booking: name, email, and your newsletter choice. Stripe collects your card details directly; we never see your card number. Apple Pay and Google Pay may share your billing address and phone number with us.
Booking sites: if you book through a third-party booking site, we receive your booking and contact details from that site through our hotel management system, Mews.
Pre-check-in and check-in (website, app, and the Kabin Pad): name, home address, email, phone number, occupation, where you're arriving from and where you're going next, your signature, and your agreement to our house rules. For each companion travelling with you: name, country of residence, and age group.
ID documents: a photo of each foreign guest's passport or ID, and the details we read from it — document type, number, name, date of birth, sex, nationality, issuing country, and issue and expiry dates. Guests who live in Japan are not asked for this, except at our Minpaku properties. If the back of a My Number card is scanned by mistake, we delete the image and never retain the number itself.
During your stay: your door codes, and any messages you send to our chat assistant or to our staff.
Extras you book:
- Restaurant and food experiences (through ByFood): name, email, phone, gender, party size, and any note you add.
- Hotel experiences: whatever information that specific experience asks for, such as your name or height.
- eSIM: only your order details. No personal information is shared with the eSIM provider.
Contact form and newsletter: name, email, your reservation number and message, or, for the newsletter alone, just your email address.
What our staff record: ID-check decisions, task notes, and billing notes, which may include the last four digits of a card.
Collected automatically: cookies on our website (see Part 2); how you use our app and website — including, on the website, session recordings — through Mixpanel; error reports through Sentry; your app version and language; and your IP address and browser details. If you enable Face ID or fingerprint login, only a device-level key reaches us; we never receive your fingerprint or facial data itself.

Why We Use It (Legal Basis)

Booking, your stay, payments, door access, chat, your account, and extras (ByFood, hotel experiences, eSIM): to provide the service you booked (performance of a contract).
Guest register and passport copy: required by Japanese hotel law, and necessary for us to be able to host you — our legitimate interest in complying with the Japanese law under which we operate, together with the necessity of this data to provide your stay.
Keeping payment and accounting records: our legitimate interest in complying with Japanese tax and company law.
Marketing emails: your consent, which you may withdraw at any time.
Analytics cookies, marketing cookies and Identity Sharing: your consent, where the law of your country requires it before we start. In the countries listed in Part 5 where these are on by default, we rely instead on our legitimate interest in understanding how our website is used and promoting our services, and you can turn them off at any time. In Japan, Hong Kong and Australia, Identity Sharing always requires your consent.
Keeping stay details for 5 years to recognize returning guests: our legitimate interest in welcoming back repeat guests.
Error monitoring and security: our legitimate interest in keeping our service working and secure.

ID Requirement at Check-In

Japanese law requires all foreign guests to present a valid passport at check-in. We are unable to check you in without it.

Who We Share It With

Hotel operations: Mews (our hotel management system, which holds reservations and guest profiles); AWS (hosting and file storage, including passport photos, and app sign-in).
ID documents: Anthropic, United States (reads passport and ID photos taken at the Kabin Pad, and companion photos uploaded through the app or website); Stripe Identity (verifies passports within the app, without a selfie).
Payments: Stripe.
Messages: Twilio, United States (text messages, including door codes); SendGrid, United States (emails); OpenAI, United States (your chat assistant's responses).
Booking partners: ByFood (restaurant and food bookings, as described above); Yumeyakata (kimono experience bookings: names, email, each participant's kimono type and height, and stay dates).
Sign-in: Apple and Google, when you use their sign-in option.
Analytics and marketing: Mixpanel, Meta, Google (Tag Manager and Analytics), Triptease, RightMessage, Customer.io, and Stape.
Monitoring: Sentry and New Relic.
Internal tools: Google Sheets (internal reports containing guest names and emails) and Slack (door codes by room number, for staff use).

International Data Transfers

Some of our providers are outside Japan and the EU: in the United States (AWS, Anthropic, OpenAI, Stripe, Twilio, SendGrid, Mixpanel, Meta, Google, Customer.io, Sentry, New Relic, Slack, Stape, RightMessage), and in the United Kingdom (Triptease). When we send your data to these providers, we rely on the EU-U.S. Data Privacy Framework where the provider is certified under it, and otherwise on the European Commission's Standard Contractual Clauses. The United Kingdom is covered by a European Commission adequacy decision. Japan has also been recognized by the European Commission as providing an adequate level of data protection since 2019. Mews, our hotel management system, is based in the Netherlands (EU) and is not included in this list.

How Long We Keep Your Data

Guest register and passport copies: 3 years from the date the register entry is made, as required by the enforcement rules of the Japanese Ryokan Business Act.
Payment and accounting records, including the reservations and invoices they relate to: 10 years, under Japanese tax and company law
Analytics data (Mixpanel): 5 years, after which Mixpanel deletes it automatically; website session recordings are kept for 30 days.
Error reports (Sentry): 90 days, deleted automatically.
ID photos submitted for reading (Anthropic): deleted within 30 days.
Chat assistant messages (OpenAI): retained by OpenAI for up to 30 days.
Stripe Identity verification data: retained by Stripe for up to 7 years under its own policies.
Account information: until you delete your account.
Marketing emails: until you unsubscribe.
Door codes: a new code is generated for each stay and stops working at checkout.
Other stay details (chat messages, and check-in details that are not part of the guest register): 5 years after your last stay, so that we can recognize you as a returning guest.

Your Rights

Subject to applicable law, you can:

see your data and get a copy of it
receive your data in a format you can transfer to another company (data portability)
correct it
delete it
restrict or object to how we use it
withdraw your consent at any time

You can exercise any of these rights by submitting a request through this link.

We will respond within one month. You also have the right to lodge a complaint with the data protection authority in your country of residence.

Part 4: Applies to Both the App and the Website

Security

We value your trust in providing us your personal information, and we strive to use commercially acceptable means of protecting it. However, no method of transmission over the internet, or method of electronic storage, is 100% secure, and we cannot guarantee its absolute security.

Links to Other Sites

Our app and website may contain links to other sites. If you click a third-party link, you will be directed to that site, which we do not operate. We strongly advise you to review the privacy policy of any external site; we have no control over and assume no responsibility for the content, privacy policies, or practices of any third-party sites or services.

Changes to This Privacy Policy

We may update our Privacy Policy from time to time. We advise you to review this page periodically for changes. We will notify you of any changes by posting the new Privacy Policy on this page.

This Privacy Policy was last updated on November 4, 2026.

Contact Us

You can reach us at our registered address above, or by submitting a request through this link.

Part 5: Information for Specific Regions

Our website applies different cookie defaults depending on the country your IP address points to. We work this out using IP geolocation by DB-IP, not from the language you choose on the site. If we cannot tell which country you are in, we apply the rules for all other countries.

United States: Analytics, Marketing and Identity Sharing are on until you turn them off.
Japan, Hong Kong and Australia: Analytics and Marketing are on until you turn them off. Identity Sharing stays off until you agree to it.
All other countries: everything except Functional stays off until you agree to it, as described in Part 2.

A choice you make yourself in our cookie settings applies wherever you are. The defaults above only fill in the categories you have not chosen.

United States

This section applies if you live in a US state with a consumer privacy law.

Sale, sharing and targeted advertising

We do not sell personal information for money. We do let Meta and Google collect information through cookies and pixels on our website, such as the pages you visit, your IP address and cookie identifiers, and we use them to show you Kabin ads on other websites and apps. When you are signed in or book with us, we may also send Meta your account ID and hashed (scrambled) versions of your email address, name, phone number, city, postcode and country, so it can match those ads to you. Under some US state laws, this counts as "selling" or "sharing" personal information, or as "targeted advertising".

You can opt out at any time:

Use the "Your Privacy Choices" link in the footer of any page, and turn off "Sale or sharing for targeted ads".
Turn on Global Privacy Control (GPC) in your browser. We treat the signal as a valid request to opt out of sale and sharing for that browser, and the site shows "Opt-out preference signal honored" when we have applied it.

Your choice is saved in the browser you use. If you use several browsers or devices, opt out on each of them. If you opt out, we will not ask you to opt back in for at least 12 months.

Sensitive personal information

We collect passport and ID details, which can reveal your citizenship, and your account login details. We use them only to check you in as Japanese law requires, to verify your identity and to keep your account secure. We do not sell or share them, and we do not use them to infer characteristics about you.

Your rights

Depending on the state you live in, you may have the right to:

know what personal information we collect, use and disclose about you, and get a copy of it
correct inaccurate personal information
delete your personal information
opt out of the sale or sharing of your personal information, and of targeted advertising
not be treated differently for exercising any of these rights

To make a request, send us a request, or write to our registered address in "Who we are". We will ask you to confirm details we already hold, such as your email address and booking number, so that we can verify the request comes from you. You can ask someone else to make a request for you, as an authorized agent, if you give them signed permission. We will respond within 45 days. If we need more time, we will tell you why, and we may take up to another 45 days.

If we turn down your request, you can appeal by replying to our answer. We will respond to your appeal within the time your state's law sets. If you are not satisfied with the result, you can contact your state's attorney general.

We do not knowingly sell or share the personal information of anyone under 16.

California: Notice at Collection

This notice applies to California residents. It lists the categories of personal information we collect, why we collect them, and whether we sell or share them.

Identifiers: your name, email address, phone number, postal address, account ID, IP address and cookie identifiers. Used to take and manage bookings, run your account, contact you, keep our services secure, measure how our website is used, and show you our ads. Cookie identifiers and IP address are shared with Meta and Google for targeted advertising. Account ID and hashed email address, name, phone number, city, postcode and country are shared with Meta for the same purpose.
Personal records: your signature, home address, occupation, and where you are arriving from and travelling to next, which we record at check-in. Used to keep the guest register that Japanese hotel law requires. Not sold or shared.
Characteristics of protected classifications: your nationality, sex, date of birth, and the age group of each companion. Used for check-in and the guest register. Not sold or shared.
Commercial information: your bookings, the extras you buy and payment records. Used to provide your stay and keep accounting records. Details of a completed booking, such as its value, are shared with Meta and Google to measure our advertising.
Internet activity: the pages you visit, how you use our website and app, including session recordings on the website, and error reports. Used to improve our services and fix problems. Browsing activity collected by Meta and Google cookies and pixels is shared with them for targeted advertising.
Approximate location: the country your IP address points to. Used to apply the right cookie rules for your country. We do not collect your precise location.
Audio or visual information: photos of passports and ID documents. Used for check-in. Not sold or shared.
Sensitive personal information: passport and ID details, citizenship, and account login details. Used only as described under "Sensitive personal information" above. Not sold or shared.

We keep each category for the periods listed under "How Long We Keep Your Data" in Part 3. Information that Meta and Google collect through their cookies and pixels is kept under their own policies.

Your right to opt out of sale or sharing

You can opt out of the sale or sharing of your personal information at any time, using the "Your Privacy Choices" link in the footer of any page, or by turning on Global Privacy Control in your browser. The "United States" section above explains how this works and your other rights.

Notice of financial incentive: member rates

Kabin members get lower room rates than non-members, up to 20% off, when they book directly with us. To become a member, you create a free account with your name, email address and country, and you can choose to receive our marketing emails. This is the personal information the offer involves.

You join by creating an account and agreeing to our terms, for example by clicking "Join for FREE". You can withdraw at any time by sending us a request to delete your account. Member rates then stop applying to new bookings.

We estimate the value of your personal information to us as the discount you receive: the difference between the member rate and the non-member rate for the same stay, up to 20% of the room price. We give this discount in exchange for the information, so we base our good-faith estimate on that difference.

We do not charge you a different price because you exercise your privacy rights.

Japan

This section applies when you visit our website from Japan, under the Act on the Protection of Personal Information (APPI).

Analytics and advertising cookies

Analytics and advertising cookies are on when you first visit. We use them to understand how our website is used, to improve it, and to show you Kabin ads on other websites and apps. Google and Meta collect browsing information through their own tags on our website. You can turn these cookies off at any time in "Cookies Settings" in the footer.

Identity Sharing: providing your information to Meta

When you are signed in or book with us, we can send your account ID and hashed (scrambled) versions of your email address, name, phone number, city, postcode and country to Meta, so the ads you see on its services can be matched to you and so we can measure our advertising. This is a provision of your personal information to third parties, so we do it only with your consent. You give consent by clicking "Join for FREE" or "Proceed to payment" next to the line that describes this sharing, or by turning on "Identity sharing" in "Cookies Settings". Until you consent, these details are removed before any information is sent. You can withdraw your consent at any time in "Cookies Settings".

Providing information to third parties in a foreign country

Meta is in the United States. The United States has no single federal law that covers personal information in general. Instead, federal laws cover particular sectors, the Federal Trade Commission acts against unfair or deceptive practices, and many states have their own consumer privacy laws. Meta publishes a privacy policy describing how it protects personal information, and takes part in the EU-U.S. Data Privacy Framework. The Personal Information Protection Commission publishes information on foreign data protection systems on its website.

Global Privacy Control has no legal effect in Japan, but if your browser sends it, we still turn off Marketing and Identity Sharing.

Business operator

The business operator handling your personal information is Wayfarer K.K., 1-17-1 Toranomon Hills Tower, Minato, Tokyo 105-6415. Representative: Winston Chu.

Hong Kong: Personal Information Collection Statement

This statement applies when you visit our website from Hong Kong, under the Personal Data (Privacy) Ordinance (PDPO).

Purposes: we use analytics and advertising cookies to understand how our website is used, to improve it, and to show you relevant Kabin ads on other websites and apps. We use the details you give us when you book or create an account to provide your stay and run your account, as described in Part 3.
Is it obligatory: analytics and advertising cookies are voluntary. If you turn them off in "Cookies Settings", you can still use our website and book with us. The details marked as required on our booking form are needed to make your booking. Without them, we cannot take it.
Classes of transferees: our analytics and advertising providers, Google and Meta, receive cookie data for the purposes above. The service providers listed under "Who We Share It With" in Part 3 receive data to provide our services.
Direct marketing: we will not use your personal data in direct marketing, or provide it to others for their use in direct marketing, without your consent. We send your account ID and hashed (scrambled) versions of your email address, name, phone number, city, postcode and country to Meta only if you agree to Identity Sharing, either by clicking "Join for FREE" or "Proceed to payment" next to the line that describes it, or in "Cookies Settings". You can withdraw at any time.
Access and correction: you have the right to ask whether we hold your personal data, to get a copy of it, and to ask us to correct it. We may charge a fee for access that is not excessive, as the PDPO allows.
Contact: send us a request, or write to our registered address in "Who we are".

Australia

This section applies when you visit our website or book with us from Australia, under the Privacy Act 1988 and the Australian Privacy Principles.

Collection notice

Who we are: Wayfarer K.K., whose details are in "Who we are".
What we collect and how: analytics and advertising cookies and pixels collect information about how you use our website, such as the pages you visit, your IP address and cookie identifiers. When you book, we collect your name, email address and country of residence, and the other details listed in Part 3.
Why: to take and manage your booking and contact you about it, to understand and improve our website, and to show you Kabin ads on other websites and apps.
If you do not give us your details: we cannot take your booking. You can turn analytics and advertising cookies off and still use our website.
Who receives it: our analytics and advertising providers, Google and Meta, and the service providers listed under "Who We Share It With" in Part 3.
Overseas disclosure: these recipients are likely to be in the United States, the United Kingdom, the Netherlands and Japan, where we are based.
Access, correction and complaints: Part 3 explains how to access or correct your information. To make a complaint, send us a request. We will respond within 30 days. If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner at www.oaic.gov.au.

Targeted advertising

You can opt out of targeted ads at any time, using "Opt out of personalised ads" in the notice on our website or by turning off Marketing in "Cookies Settings". We send your account ID and hashed (scrambled) versions of your email address, name, phone number, city, postcode and country to Meta only if you agree to Identity Sharing, either by clicking "Join for FREE" or "Proceed to payment" next to the line that describes it, or in "Cookies Settings".

Decisions made by computer programs

We use computer programs that make, or help us make, some decisions about you using your personal information.

Payment screening. When you pay, our payment provider Stripe screens the payment for fraud, using your card and billing details, email address, IP address, device and browser information, and booking details. The program decides whether the payment is accepted, declined or held for review. If it is declined, the booking is not made.

Identity document checks. When you check in online or at a Kabin Pad, a computer program reads the passport or other ID you scan, using the image and the details on it (name, nationality, document number, date of birth, expiry date). It decides whether the document is accepted. If it is not, you cannot finish check-in until our staff review it.

To ask about one of these decisions or have it reviewed, send us a request.