Privacy Policy

Last updated: 22 September 2026

Japanese Car Trading LLC (“we”, “us”, or “our”) operates the cross-border used vehicle export service JAPACAR (the “Service”). This Privacy Policy explains how we collect, use, disclose, and otherwise process personal information in connection with the Service, in accordance with applicable laws including the Act on the Protection of Personal Information of Japan (the “APPI”) and, for people in the European Economic Area (EEA) and the United Kingdom, the EU General Data Protection Regulation (“GDPR”) and the UK GDPR.

By using the Service, you acknowledge that you have read this Privacy Policy. If you do not agree, please do not use the Service.

Who we are (data controller)

We are the controller of the personal data described in this Policy. We have not appointed an EU or UK representative because our processing of EU/UK personal data is occasional and low-risk (GDPR Article 27(2)(a)). We will update this policy if this changes.

1. Information we collect

1.1 Information you provide

1. Account data: email address, password (stored hashed).
2. Seller (manager) profile: company name (Japanese/English), representative name (kanji/kana/Roman), corporate or tax ID, phone, address (postal code, prefecture, city, street), date of birth.
3. Buyer profile: name, email, address, phone, country, and (for business buyers) company name and registration or VAT number.
4. Consignee (shipping) details: name, email, country, address, phone.
5. Vehicle request details: the make, model, year, budget, destination country and other conditions you give us when asking for a quote or an auction purchase.
6. Bank account data: used for Stripe Connect registration; not stored on our servers in plain form as account credentials for payouts.
7. Identity documents: images such as secondhand dealer permit, driver’s license (front/back), or other government ID as required.
8. Vehicle-related documents: images such as vehicle inspection certificate (shaken-sho), export-related documents, and other registration paperwork.
9. Vehicle listing data: VIN/frame number, model codes, year, mileage, condition, repair history, photos, etc.
10. Transaction data: quote requests, prices, deposit invoices, payment proofs (bank transfer receipts), bills of lading, export documents, and related correspondence.
11. Public bulletin comments: comments posted on vehicle pages (Japanese/English).
12. Chat messages: what you write in the support chat on the Service.
13. Optional staff notification email (sellers): an additional email address store staff may register to receive operational or deal-related notifications.

1.2 Social login (Google, LINE)

If you sign in with Google or LINE, we receive from that provider, for example:

1. Email address
2. Display name
3. Provider user ID

1.3 Automatically collected information

1. Login environment: IP address, OS, and browser type recorded on login.
2. One-time login codes: when you sign in by email code, we record the email address, the time the code was sent and used, and the IP address.
3. Email delivery logs: recipient address, subject, sending time and delivery result of emails we send you.
4. Vehicle view logs: vehicle ID viewed, date, counts, browser language; IP address and user agent are stored only as SHA-256 hashes (we do not retain the raw values for those fields in this log).
5. Share logs: shared vehicle ID, date, method; IP hashed where applicable.
6. Favorites: vehicle IDs you save.
7. Cookies: see Section 7.
8. Web Push subscription data: push endpoint URL and encryption keys generated by your browser, stored per device.

1.4 What we do not hold

• Card numbers. Card payments are processed by our payment provider Stripe. Full card numbers never reach our servers.
• Special categories of data (health, religion, etc.) or criminal records. We do not ask for them; please do not send them.

2. How we collect information

1. Forms and uploads on the Service
2. Social login (Google, LINE)
3. Automatic collection when you browse or use the Service (cookies, server logs)
4. Email, phone, or chat inquiries
5. Payment provider (Stripe) onboarding and transactions
6. AI-assisted parsing of documents you upload (Section 8)
7. AI-assisted market estimates for sellers (Section 8)
8. Email delivery through our email infrastructure providers (Section 5)

3. Purposes of use and legal bases

We use personal information for the purposes below. For people in the EEA and the UK, the legal basis under GDPR / UK GDPR is shown for each purpose.

Purpose	Legal basis (EEA / UK)
Providing and operating the Service: registration, login, listings, quotes, auction purchase requests, deposits, invoices, deals, shipping and delivery of documents	Performance of a contract with you, or steps you ask us to take before a contract (Art. 6(1)(b))
Payments: subscription charges (including Stripe-issued invoices) and buyer tips processed via Stripe. Vehicle sale proceeds are remitted to the seller's registered bank account in Japanese Yen (JPY) by bank transfer and do not pass through Stripe.	Performance of a contract (Art. 6(1)(b))
Shipping and customs processes, including sharing necessary data with forwarders, shipping lines and customs brokers	Performance of a contract (Art. 6(1)(b)); legal obligation for export and customs records (Art. 6(1)(c))
Identity verification, fraud prevention, account security (login records, one-time codes, rate limits)	Our legitimate interests in preventing fraud and keeping the Service secure (Art. 6(1)(f))
Customer support (chat, email), including AI-assisted first replies (Section 8.3)	Performance of a contract (Art. 6(1)(b)); our legitimate interest in answering your questions (Art. 6(1)(f))
Analytics on how the Service is used (Google Analytics) and listing performance (views, quotes, favorites, shares)	Your consent for analytics cookies in the EEA / UK (Art. 6(1)(a)); otherwise our legitimate interest in improving the Service (Art. 6(1)(f))
Web Push notifications (deal updates, comments, etc.) for sellers and buyers who opt in	Your consent (Art. 6(1)(a))
Notifying optional staff email addresses registered by sellers	Performance of a contract (Art. 6(1)(b))
Improving the Service and developing features	Our legitimate interests (Art. 6(1)(f))
Recording agreement to our Terms and this Policy (timestamp, IP where applicable)	Legal obligation and legitimate interests (Art. 6(1)(c), (f))
Keeping transaction, export, customs and tax records	Legal obligation under Japanese tax and export law (Art. 6(1)(c))
Legal compliance and responding to lawful requests from public authorities	Legal obligation (Art. 6(1)(c))

4. How we protect information

We implement appropriate safeguards, including:

1. Passwords stored hashed, not in plain text
2. Hashed IP/user agent in vehicle view and share logs as described above
3. Photos and documents stored in encrypted cloud object storage (Amazon S3, Tokyo region)
4. Card and bank details processed by Stripe, not stored by us as payment card data

5. Recipients: third parties, processors, and disclosures

We disclose or entrust personal information to the categories below where necessary. Some processing occurs outside Japan (see Section 6). Entrustment (processing on our behalf) is listed here for transparency alongside disclosures to independent third parties.

Recipient	Examples of data	Purpose
Hosting providers (Japan)	All data held by the Service (database, backups, server logs)	Running the Service on servers located in Japan — processing on our behalf
Amazon Web Services, Inc. (Tokyo region, Japan)	Uploaded files and related backups	Encrypted storage and delivery (S3) — processing on our behalf
Stripe, Inc. (USA)	Seller name, address, DOB, bank/KYC documents; buyer card data (used for subscription and tip payments)	Subscription billing (card and invoice-based), Connect onboarding, KYC, tip payouts to sellers. Vehicle sale proceeds are not processed through Stripe; they are remitted to the seller's registered bank account in Japanese Yen (JPY) by bank transfer.
Email delivery providers (Mailgun; SendGrid as backup)	Recipient addresses, subject, body, delivery metadata	Transactional and operational email — processing on our behalf
Google LLC (USA)	Cookies, pages viewed, device/environment data	Google Analytics (GA4), Google Tag Manager, and the optional page-translation widget (Section 7.3). In the EEA / UK these load only after you accept analytics cookies.
Support chat tool (Chatwoot, hosted on our own servers in Japan)	Hashed user ID, display name, email (when logged in), your chat messages	Customer chat support (Section 8.3 for AI-assisted replies)
Forwarders, shipping lines, customs brokers	VIN, vehicle data, consignee name/address/phone, export documents	Transport, customs clearance and delivery of your vehicle, as needed for the export
Auction houses and auction access providers (Japan)	Vehicle-related data only (the vehicle you ask us to bid on, bid amounts). We do not pass your name or contact details to them beyond what is needed to complete the purchase.	Buying the vehicle you requested at auction
Anthropic PBC (USA)	Images/PDFs of vehicle documents and identity documents. Entire files are sent to the API. Any name, address, or permit number visible on the document is included as image data. Chat messages for AI-assisted replies (Section 8.3).	Assisted data entry and structured reading of permitted fields; first replies in the support chat
OpenAI, LLC (USA)	Text describing vehicle attributes (make, model, year, mileage, etc.); optional aggregated statistics from our own closed deals	Reference export price range estimation for sellers

5.1 Other disclosures

We may also disclose information when required by law or legal process, to protect vital interests, in connection with a merger or asset transfer, or with your consent.

We do not sell personal data.

6. International transfers

Your data is stored on servers in Japan. Japan has been recognised by the European Commission as providing an adequate level of data protection (adequacy decision of 23 January 2019), and by the United Kingdom under its adequacy regulations. Transfers of your data from the EEA or the UK to us in Japan are therefore permitted without further safeguards.

Some of our providers process data outside Japan, the EEA and the UK (mainly in the USA). Where that happens, we rely on the provider's contractual safeguards recognised under GDPR / UK GDPR (such as standard contractual clauses) and, where the provider is certified, the EU-U.S. Data Privacy Framework and its UK extension. The providers and their privacy policies:

• Stripe, Inc. — Privacy Policy
• Anthropic PBC — Privacy Policy
• OpenAI, LLC — Privacy Policy
• Google LLC — Privacy Policy
• Amazon Web Services, Inc. — Privacy Policy

7. Cookies and similar technologies

7.1 Categories

• Essential cookies keep you logged in, protect forms against forgery, and remember your cookie choice. They are always on.
• Analytics and support cookies are set by Google Analytics, the optional page-translation widget and the support chat. If you visit from the EEA or the UK, these load only after you click Accept all in the cookie banner. In other regions they load when you use the Service, as described in the notice banner.

Name	Category	Purpose	Duration
japacar_session	Essential	Session / login state	Up to 7 days
XSRF-TOKEN	Essential	CSRF protection	Session
jpc_consent	Essential	Remembers your cookie choice (all / essential)	12 months
jpc_utm	Analytics	Remembers which campaign link brought you to the Service, so we can attribute sign-ups (first-party cookie set by us)	90 days
_ga, _ga_*	Analytics	Google Analytics 4: distinguishes visitors and sessions	Up to 2 years
googtrans	Support (translation)	Stores your selected page-translation language (set by Google Translate widget). Set only when you choose a non-English language.	Up to 1 year
cw_* (browser storage)	Support (chat)	Keeps your support chat conversation open between pages	Until logout or cleared

7.2 Changing your choice

Click Cookie settings in the footer of any page to open the cookie banner again and change your choice. You can also control cookies through your browser; disabling essential cookies may limit some features.

7.3 Third-party analytics

• Google Analytics (GA4): measures how the Service is used. You may use Google’s opt-out tools (e.g. browser add-on) as described on Google’s sites.
• Google Tag Manager: used to manage analytics and related tags.

7.4 Page translation (Google Translate)

To make the Service accessible to international buyers, we provide an optional page-translation widget powered by Google LLC's Translate service. Translation is offered only on public, non-logged-in pages (e.g. vehicle search and detail pages). When you select a non-English language (either via the language selector at the top of the page or automatically based on your browser's preferred language on first visit):

• What is sent to Google: the visible text content of the page is transmitted to Google's servers so a translation can be generated and rendered back into the page. We do not intentionally include account credentials, payment details, or other sensitive information; however, any text that is visible on screen will be processed by Google.
• When it activates: only after you select a non-English language or your browser advertises a non-English preferred language and matches one of our supported options. English-language users are not subject to any translation traffic. In the EEA / UK the widget is available only after you accept all cookies.
• Logged-in pages excluded: account, deal management, and other pages that may display your personal information are excluded from translation to minimise third-party transmission of personal data.
• Cookie: the googtrans cookie (see §7.1) stores your language preference so the page reloads in the same language on subsequent visits.
• Opt out: set the language back to "English" via the language selector at the top of the page, or clear the googtrans cookie. You may also disable the widget at the browser level via JavaScript / privacy extensions.
• Vendor terms: see Google's Privacy Policy.

8. AI-assisted processing

8.1 Document images (Anthropic)

We send full document images/PDFs to Anthropic’s API to extract structured fields to assist registration and compliance workflows. Any personal data printed on the document may be included in that image data. How Anthropic processes API data may change; see their current Privacy Policy.

8.2 Market estimate (OpenAI)

We may send text describing vehicle attributes (and optional aggregate deal statistics) to OpenAI’s API to generate a reference price range. See OpenAI’s Privacy Policy.

8.3 AI-assisted chat replies (Anthropic)

The chat widget at the bottom-right of our site uses AI (Claude, provided by Anthropic PBC in the USA) to handle initial responses. For complex inquiries, contractual matters, or any case the AI cannot adequately address, a human staff member will take over the conversation.

• What we send: the message you type, the recent conversation history needed for context, and (where relevant) the vehicle you are inquiring about, are sent to Anthropic’s API to generate a reply.
• Please do not send: passwords, full credit card numbers, government ID numbers, or other highly sensitive information. We display a notice in the widget reminding you of this.
• Retention: chat transcripts are retained on our servers for up to 2 years for dispute resolution and quality improvement.
• Vendor terms: see Anthropic’s Privacy Policy for details on how API data is handled.

AI is used only to draft replies and read documents. We do not make decisions about you by automated means that have legal or similarly significant effects. A person decides whether to accept a request, confirm a payment or ship a vehicle.

9. Web Push notifications

Sellers and buyers may opt in to browser push notifications. Subscription data (endpoint, keys) is stored to deliver notifications to you. You can disable push in your browser or through the Service; subscriptions may be removed on logout or when expired.

10. Retention

• Account data: retained while your account exists. When you ask us to close your account, we deactivate it and anonymise your personal details (name, address, phone, email, consignee and bank details). Records that we must keep by law (below) are kept for the legal period and then deleted.
• Transaction, export, customs and tax records (quotes that led to a deal, invoices, payment proofs, bills of lading, export documents): 7 years, as required by Japanese tax and export law.
• Chat transcripts: up to 2 years (Section 8.3).
• Login records, one-time login codes and email delivery logs: up to 12 months.
• Application and server logs: up to 12 months (application error logs are rotated after 7 days).
• View/share logs: retained in hashed form for analytics.
• Push subscriptions: deleted when you unsubscribe, when expired, or when removed after logout as applicable.
• KYC documents on Stripe: governed by Stripe’s retention policies; we cannot delete them on your behalf from Stripe’s systems.

11. Your rights and how to exercise them

You may access and update much of your profile in the Service. For anything else, contact [email protected].

11.1 Rights under the APPI (Japan)

You may request disclosure, correction, addition, deletion, or cessation of use of your personal information held by us. We may refuse where permitted by law (e.g. risk to rights of others, serious disruption, inability to verify identity).

11.2 Rights under GDPR / UK GDPR (EEA and UK)

If you are in the EEA or the UK, you have the right to:

• Access the personal data we hold about you and receive a copy;
• Rectify inaccurate or incomplete data;
• Erase your data, unless we must keep it by law (Section 10);
• Restrict processing in certain cases;
• Receive your data in a portable format (data you gave us, processed by automated means under a contract or consent);
• Object to processing based on our legitimate interests, and to direct marketing at any time;
• Withdraw consent at any time where we rely on consent (for example analytics cookies, via Cookie settings in the footer). Withdrawal does not affect processing before it.

11.3 How we handle a request

1. Email [email protected] from the email address registered to your account and tell us what you want (access, correction, deletion, etc.).
2. We verify your identity. We may ask you to confirm one detail of your account or a transaction. We do not ask for identity documents unless necessary.
3. We reply within one month. If your request is complex, we may extend this by up to two further months and will tell you why.
4. We do not charge a fee unless a request is manifestly unfounded or excessive.

11.4 Complaints

You can complain to us first at [email protected]. You also have the right to lodge a complaint with your data protection supervisory authority: in the EEA, the authority of the country where you live or work; in the UK, the Information Commissioner's Office (ICO). In Japan, the Personal Information Protection Commission (PPC).

12. Marketing emails

We send you emails needed for your account and transactions (registration confirmation, quotes, invoices, reminders). We do not currently send marketing emails. If we start, we will send them only with your consent (or, for existing customers, only about similar services and with an easy way to opt out), and every marketing email will include an unsubscribe link.

13. Security

We use TLS for transmission, hashed passwords, hashed identifiers in certain logs, encrypted object storage, and access controls. No online service is completely secure.

14. Minors

The Service is intended for business users (B2B). If a minor uses the Service, verifiable guardian consent is required.

15. Changes

We may update this Privacy Policy. The “Last updated” date will change when we do. Material changes may be notified on the Service or by email where appropriate.

16. Contact

For privacy inquiries and requests about your data:

Japanese company name: 日本車貿易合同会社 (Japanese Car Trading LLC).