ICON HOTEL
Menu
Instagram
EN日本語한국어简体繁體

Privacy policy

Last updated: 2026-10-31

Information we collect
At booking: name, email, telephone, address, nationality, number of guests and payment details (card data is processed by Stripe; we do not store it). Before your stay: ID documents required for the guest register under Japanese hotel and lodging laws (a copy of your passport if you live outside Japan). When you send the contact form: name, email, property and dates (if given), your message, page language, the country you connect from (estimated from your connection) and your browser type. When you browse: cookies and device identifiers, analytics data (Google Analytics 4), ad measurement data (Google Ads) and, if you arrive from an ad, the campaign code (utm parameters, gclid).
How we use it
Managing and fulfilling your booking, keeping the legally required guest register, contacting you (confirmation, check-in details, emergencies), answering enquiries, aggregate analytics to improve the service, and measuring how well our ads work.
AI assistants and our booking API

We offer a read-only service for AI assistants (for example ChatGPT or Claude) at https://iconhotel.jp/mcp and the REST API under /agent/v1/. It lets an assistant look up our properties, check live prices and create a link to our booking page.

  • What we receive: the search details the assistant sends (area, dates, number of guests, pets, sauna, language) and, if the assistant provides it, the assistant's name. We do not ask for or receive your name, email, phone number, payment details or conversation.
  • Your connection: your IP address (or the assistant's) is processed only in memory for a few minutes, to limit the number of requests and to protect the service. We do not save it as a record, do not link it to your search and do not use it to identify you.
  • Counts: we keep daily totals of how often each tool is used and by which assistant (for example "get_quote · chatgpt · 12"), of quote results (for example "available" or "sold out"), and of visits to our pages from these links (for example "ai-agent-chatgpt · 3"), for up to 400 days, to understand how guests find us. They contain no personal data.
  • Booking: the link opens our booking page. Your booking and payment details are entered there and handled as described above (Beds24, Stripe). The link carries a source code (utm_medium=ai-agent) so we can count bookings that came through AI assistants.
  • How long we keep it: IP addresses — not stored (a few minutes in memory only). Daily counts — up to 400 days. Search details — not stored after the reply is sent.
  • Providers: the service runs on Cloudflare (USA). To check prices, we send only the property, dates and number of guests to Beds24 (Germany) through our own cached service; this contains no personal information.
  • Service providers outside Japan (Act on the Protection of Personal Information, Article 28): We use Cloudflare, Inc. (USA), which runs this service, under Cloudflare's customer Data Processing Addendum, which provides a system that meets the standards set by the rules of Japan's Personal Information Protection Commission (equivalent measures by contract). We use Beds24 GmbH (Berlin, Germany) for rates and booking management under its data processing agreement; Germany is in the EU, which the Commission recognises as having a level of protection equivalent to Japan's. On request we will tell you without delay about the personal information protection system of the USA and the measures we take (https://iconhotel.jp/contact).
Service providers
Booking management: Beds24 (Beds24 GmbH, Germany). Payments: Stripe (Stripe, Inc., USA). Analytics, ad measurement, maps and our mailbox (Gmail): Google (Google LLC, USA). Website hosting, storage of contact-form messages and forwarding of email sent to us: Cloudflare (Cloudflare, Inc., USA). Notifying our staff of contact-form messages (name, email, property, dates, message and country): Telegram (servers outside Japan). If you message us on LINE, your messages are handled on the LINE service. We do not sell personal data. We do not share it with any other third party except where required by law (e.g. police or public health authorities).
Cookies, analytics and advertising
We use Google Analytics 4 and the Google Ads tag. They use cookies and identifiers to measure how the site is used and whether our ads lead to visits to the booking page and to bookings. Google Ads may set cookies used for advertising. If you arrive from an ad, the campaign code (utm parameters, gclid) is kept in your browser for 30 days and attached to your booking record (Beds24) as its source. You can disable or limit this in your browser settings (block or delete cookies), with the Google Analytics opt-out add-on, or in Google's ad settings (https://adssettings.google.com).
Transfers outside Japan and security
Of the providers above, Beds24 (Germany), Stripe, Google and Cloudflare (USA; their servers may also be in other countries) and Telegram (outside Japan) handle personal data outside Japan. The EU, including Germany, is recognised by Japan's Personal Information Protection Commission as having a level of personal-data protection equivalent to Japan's. The Commission publishes information on other countries' systems, and each provider's handling is set out in its own privacy policy and data-processing terms. We will provide more details on request through the contact form. We protect your data by limiting access to the staff handling your booking or enquiry, encrypting connections (HTTPS) and setting retention limits.
Retention
Guest register: 3 years as required by law. Booking and payment records: for the period required by tax and accounting law (up to 7 years). Contact-form messages: stored on Cloudflare for up to one year, then deleted automatically. Staff notifications in Telegram remain until our staff delete them.
Your rights
You may request access to, correction of, suspension of use of, or deletion of your data. We will respond without delay after verifying your identity. Please use the contact form and include your name and your booking number or the email address you contacted us from. A deletion request also covers your contact-form record and the staff notification. Information we must keep by law (such as the guest register) cannot be deleted until its retention period ends.
Controller
logy Co., Ltd. (3-20-1-22 Kyuhoen, Yao, Osaka 581-0817, Japan)