ALVA Inc. ("ALVA") and VAULT LLC ("VAULT", and together with ALVA, "we", "us" or "our") handle personal information obtained through "iroiro" (the "Service"), a mobile data service for travelers visiting Japan, in accordance with the Act on the Protection of Personal Information of Japan (the "APPI"), other applicable laws, and this Privacy Policy (the "Policy").
This English text is a translation provided for convenience. The Japanese version is the authoritative text, and it prevails in the event of any inconsistency.
1. Controllers and Roles
- ALVA, as operator of the Service, is responsible for the overall handling of personal information obtained through the Service.
- VAULT, as joint seller of eSIMs, uses personal information relating to payments and orders jointly with ALVA.
- The items, scope, purposes, and responsible party for jointly used personal information are set out in Section 6.
- Contact details for inquiries about this Policy are set out in Section 12.
2. Information We Collect
2.1 Information you provide
- The email address to which the eSIM is delivered
- Order details (selected plan, date and time, order ID, display language at purchase)
- Your email address and authentication details, if you use the sign-in feature
- The company name entered as the addressee, if you request a receipt in a company's name
- Messages you enter into AI Support
- Your name, email address, and message when you contact us
2.2 Payment information
Card numbers and other payment details are collected directly by our payment processor, Stripe, Inc. and its affiliates ("Stripe"), and are not stored on our servers. We receive from Stripe the payment identifier, payment status, amount, and the status of any refunds or chargebacks.
2.3 eSIM information
To issue your eSIM, we obtain from the supplier the profile identifiers (ICCID, activation code, QR code), issuance status, expiry, and data usage, and manage them linked to your order.
2.4 Information collected automatically
- Access information such as IP address, browser type, operating system, language settings, and referrer
- Identifiers obtained through cookies and similar technologies described in Section 4
- If you arrived via a partner facility, the facility identifier and the referral channel (email, booking site, QR code, etc.)
- Server logs and security records
We do not receive booking information such as your name, reservation number, or email address from facilities.
3. Purposes of Use
We use the information we collect for the following purposes.
- Issuing eSIMs, sending and resending QR codes and setup page links, and displaying validity and usage
- Processing payments, refunds, and chargebacks, and keeping accounting and tax records
- Providing AI Support and human support, and responding to inquiries
- Issuing receipts
- Verifying identity and detecting and preventing fraud, unauthorized access, and abusive requests
- Identifying referrals through facilities, calculating facility commissions, and compiling sales by facility
- Improving the Service, handling incidents, analyzing usage, and developing new features
- Sending important notices about the Service
- Complying with legal obligations and protecting our rights
We do not send marketing emails without your explicit consent.
4. Cookies and Similar Technologies
The Service uses the following cookies. Apart from the advertising measurement and analytics cookies listed at the end of the table, all are used only to the extent necessary to provide the Service, and none are used for cross-site tracking.
| Name | Purpose | Retention |
|---|---|---|
| IR_LOCALE | Remembers your display language | While stored in your browser |
| ir_anon | Anonymous ID that identifies ownership and continuity of your conversation when you use AI Support | 30 days |
| ir_chat | ID that identifies an ongoing support conversation, including handoff to human support | 30 days |
| ir_ref | Facility identifier when you arrive via a facility-specific URL (used for sales attribution) | 30 days |
| ir_ch | Referral channel for facility introductions (email, booking site, QR code, etc.) | 30 days |
| Authentication cookies | Maintaining your session if you use the sign-in feature | End of session or a fixed period |
| _gcl_au, _gcl_aw, _gcl_gs (Google LLC) | Set by the Google Ads tag on public pages only, to measure whether a Google ad led to a purchase. Not set on your eSIM setup page or receipt page. Personalization is off, and in the EEA, UK and Switzerland the tag runs in a consent-denied mode that sets no cookie | Up to 90 days |
| __oppref (OpenAI) | Set by the OpenAI Ads measurement pixel on public pages only, to measure whether an ad in ChatGPT led to a purchase. Not set on your eSIM setup page or receipt page | Up to 30 days |
| ir_utm | Where you came from when you arrive through an ad on Google or in ChatGPT (the ad platform, campaign and similar URL parameters). Recorded on your order at purchase to measure advertising cost. No ad click ID is stored | 30 days |
| _ga, ga* (Google LLC) | Google Analytics 4 analyzes public page views, checkout starts and purchases. Google Signals and ad personalization are disabled. In the EEA, UK and Switzerland, consent-denied mode does not set analytics cookies | Up to 90 days |
ir_anon is not set when you simply browse plans. When a purchase is completed, we report the order amount and a short order reference (not your email address, QR code or full order ID) to Google Ads and OpenAI so that the advertising cost can be measured. You can delete or block cookies in your browser settings, but some features, such as continuing an AI Support conversation or applying facility benefits, may then be unavailable.
Google Analytics 4 receives public page URLs (with only permitted campaign parameters), referral sources, purchased plans, quantities, amounts and a short order reference. We do not send email addresses, payment session IDs, eSIM setup URLs or receipt URLs.
5. Disclosure to Third Parties and Processors
5.1 Disclosure to third parties
We do not disclose personal information to third parties except in the following cases.
- With your consent
- Where required by law
- Where necessary to protect a person's life, body, or property and obtaining consent is difficult
- In connection with a business transfer
5.2 Processors and external services
To provide the Service, we entrust the handling of personal information to, or process personal information through, the following providers. Some of them are located outside Japan.
| Provider / service | Information processed | Main location |
|---|---|---|
| Stripe (payment processing) | Payment information, email address, order amount | United States |
| Supabase (database and authentication) | Order information, email address, eSIM identifiers, facility identifiers, conversation content, authentication data | United States and other regions (data center region selected by us) |
| Resend (email delivery) | Email address, QR code, activation code, setup page link | United States |
| Anthropic (AI model provider) | AI Support conversation content (order IDs, activation codes, ICCIDs, etc. are redacted before sending) | United States |
| eSIM suppliers and carriers | Order identifiers, eSIM profile information, and usage data needed to issue the eSIM and provide connectivity | Japan, Singapore, Hong Kong, and others |
| Hosting provider | Access information, server logs | United States and other regions |
5.3 Transfers to third parties outside Japan
When providing personal information to providers located outside Japan, we confirm the personal information protection regime of the destination country in accordance with the APPI and ensure, through contracts or otherwise, that measures equivalent to those required by the APPI are in place. Information about the regime in each destination country is available on request through the contact in Section 12.
6. Joint Use
We jointly use personal information as follows.
- Parties: ALVA Inc. and VAULT LLC
- Items: email address, order details, payment identifier, status and amount, refund and chargeback status, receipt addressee, inquiry content
- Purposes: the purposes in Section 3, items 1 to 5, 8, and 9
- Responsible party: ALVA Inc. (Konoto Bldg. 7F, 1-1-14 Shimomeguro, Meguro-ku, Tokyo; Representative Director Takumi Kawamori)
7. Retention
- Order, payment, and receipt records are retained for the period required by tax and other laws (in principle, seven years).
- AI Support conversations are retained for as long as needed for support and quality improvement, then deleted or anonymized.
- eSIM QR codes and activation codes are deleted within a reasonable period after expiry.
- Access information and security records are retained for as long as needed for fraud detection and incident response.
- Other information is deleted or anonymized without undue delay once the purpose of use has been fulfilled.
8. Security Measures
To prevent leakage, loss, or damage of personal information, we take the following measures.
- Encryption in transit (HTTPS), access controls on databases, and least-privilege permissions
- Hard-to-guess identifiers and no-index settings for setup and receipt pages
- Redaction of activation codes, ICCIDs, order IDs, and similar data before sending to AI Support
- A design in which payment details are never stored on our servers
- Staff training and supervision of processors
9. Your Rights
- You may request disclosure, correction, addition, deletion, suspension of use, suspension of third-party disclosure, and disclosure of third-party disclosure records regarding your personal information.
- Please send requests to the contact in Section 12 from the email address used for your order. After verifying your identity, we will respond within a reasonable period in accordance with the law.
- We may be unable to delete information that we are legally required to retain or that is essential for payment or eSIM provision. In that case, we will explain the reason.
10. Minors
If you are under 18, please use the Service with the consent of a parent or guardian.
11. Changes to This Policy
We may amend this Policy in response to changes in law or the Service. The amended Policy takes effect when published on the Service or on the effective date stated at publication. Where your consent is legally required for a change, we will obtain it in an appropriate manner.
12. Contact
For inquiries about the handling of personal information, requests regarding your rights, or any other matter concerning this Policy, please contact:
ALVA Inc. (responsible party) / VAULT LLC Konoto Bldg. 7F, 1-1-14 Shimomeguro, Meguro-ku, Tokyo, Japan Email: iroiro@vault-tec.jp
The Japanese version of this Policy is the authoritative text. In the event of any discrepancy between a translation and the Japanese text, the Japanese text prevails.