Privacy Policy — Wabisabi Japan Tours

1. Who we are

Wabisabi (wabisabi-trips.com) is a Japan-based tour operator offering small-group walking tours and custom day trips across Japan. References to "Wabisabi", "we", "us", or "our" in this policy refer to Wabisabi and its operators.

For questions about this policy or your personal data, contact us at hello@wabisabi-trips.com.

2. What data we collect

Information you provide directly

Name and email address when you register or make a booking
Messages you send through our contact form
Reviews you submit after a tour
Tour preferences, group size, and booking dates

Information collected automatically

Pages visited, time spent, and navigation paths (analytics only, with your consent)
Device type, browser, and approximate country (inferred from IP, not stored)
Referral source (e.g. search engine or social media link)

3. How we use your data

To process and manage your tour bookings
To communicate booking confirmations and updates
To respond to enquiries sent through the contact form
To improve our website and tour offerings (with your consent, via analytics)
To display your reviews on tour pages (with your consent at submission)

We do not sell your personal data to third parties, use it for advertising, or share it with any party not directly involved in delivering your tour.

4. Cookies and analytics

We use Google Analytics 4 (GA4) to understand how visitors use our site. GA4 is only allowed to set cookies or collect identifiable usage data after you click Accept all cookies in our consent banner.

If you click Reject non-essential, GA4 operates in cookieless mode — it collects aggregate, anonymised signals only (no cookies are set, no personal identifiers stored). This is compliant with Google's Consent Mode v2.

Cookies we use

Cookie	Purpose	Duration
wb_consent	Stores your cookie preference	1 year (localStorage)
_ga, _ga_*	Google Analytics — session & visit tracking	2 years (consent required)

You can change your preference at any time by clearing your browser's localStorage or site data for wabisabi-trips.com.

5. Data storage and security

Your booking and account data is stored in Google Firebase (Firestore), hosted in data centres operated by Google Cloud. Data is encrypted in transit (TLS) and at rest. Firebase is SOC 2 Type II and ISO 27001 certified.

Tour photos are stored on Cloudflare R2, a secure object storage service with automatic encryption at rest.

6. Data retention

Booking records: retained for 3 years to comply with tax and accounting obligations
Contact form messages: deleted after 12 months unless ongoing correspondence
Analytics data: retained by Google Analytics for 14 months (default GA4 setting)
Account data: retained until you request deletion

7. Your rights

Depending on your location (EU/EEA, UK, California, etc.) you may have the right to:

Access the personal data we hold about you
Correct inaccurate data
Delete your account and associated data
Object to or restrict certain processing
Withdraw consent for analytics at any time
Data portability — receive a copy of your data

To exercise any of these rights, email hello@wabisabi-trips.com. We will respond within 30 days.

8. Third-party services

The following third-party services may process data on our behalf:

Google Firebase — authentication, database, hosting (Google LLC, USA)
Google Analytics 4 — website analytics, consent-gated (Google LLC, USA)
Cloudflare R2 — photo storage (Cloudflare, Inc., USA)

All US-based processors are covered by Google's and Cloudflare's standard contractual clauses for international data transfers under GDPR.

9. Changes to this policy

We may update this policy from time to time. The "Last updated" date at the top of this page will always reflect the most recent version. We will notify registered users of material changes by email.

← Back to Wabisabi