Privacy Policy – hankyoto (反響灯)

This English version is provided for international readers. If there is any discrepancy, the Japanese version prevails.

IR Co., Ltd. (株式会社アイアール, “we”) provides “hankyoto” (反響灯), a business support service for real estate companies, including the website https://www.hankyoto.com , the setup application https://setup.hankyoto.com and related systems (the “Service”). This policy explains how we handle personal information and Google user data.

1. Who we are

IR Co., Ltd.

4-16-6 Kajino-cho, Koganei-shi, Tokyo 184-0002, Japan

Representative: Toshifumi Koiso, CEO

Contact: info@hankyoto.com (we accept inquiries by email only)

2. Information we collect

• Inquiry, document request, diagnosis, trial and contract information: company and contact names, email address, phone number, department, messages, diagnosis answers and results, application details, legal entity/branch/installation relationships, identity and application-authority verification records, and information needed for contracts and billing.
• Payment information: card details are handled by Stripe and are not sent to or stored by us. We receive payment outcomes, invoice identifiers and, where provided by the processor, card brand and last four digits. For bank payments, we receive the payer name, amount and payment date to confirm receipt.
• Website usage information: access logs, including IP address, browser, visited pages and time, and cookie identifiers.
• Google user data for setup, as described in Section 4.
• Runtime information sent by the hankyoto app, as described in Section 5.

3. How we use information

We use information to respond to inquiries, supply requested materials and respond to consultations using diagnosis results shared with consent; receive, review and start trials and support setup; conclude and manage contracts and billing; provide support and important notices; keep the Service secure; improve the Service using non-identifying statistics; and comply with laws. We do not use personal information beyond these purposes without prior consent.

We also check application and installation details and past correspondence, match company names and email addresses to response history, and prevent duplicate or unnecessary new outreach. Staff separately verify authority and legal entity identity when a match is used for contractual decisions.

3.1 Customer business data and information submitted to us

Business data used in the hankyoto app’s everyday operations, including customers, properties, email content, contracts, estimates, invoices and photographs, remains in the customer’s own Google environment. We do not automatically transfer and store that data in bulk on our servers.

Separately, information the customer explicitly enters or sends through our website or the app’s contract or support screens is managed in our intake, customer and contract management systems. Access to inquiry content, diagnosis information and correspondence history is restricted by staff permissions.

4. Google user data

4.1 Scope

This section applies to Google user data we receive when a customer’s administrator signs in with Google on https://setup.hankyoto.com and grants access.

4.2 Data accessed and purpose

(1) Scopes: openid, email

Data accessed: Google account email address and account identifier

Purpose: To confirm the administrator account performing setup and display it on screen

(2) Scopes: script.projects, script.deployments

Data accessed / actions: Create, update and deploy the Apps Script project (the hankyoto app) in the customer’s Google account

Purpose: To install the hankyoto app into the customer’s own Google environment

The setup application does not change the customer’s Google Cloud settings or billing information, and does not access Gmail message content, Google Drive files or Google Calendar events.

4.3 Storage

Access tokens are encrypted and kept only in server memory for at most 60 minutes, and are deleted immediately when setup is completed or cancelled. They are never written to databases, logs or backups. We do not request refresh tokens. The email address is used in memory for display only and is not stored; we store only an irreversible hash to confirm the same administrator. The hankyoto app is created inside the customer’s own Google account. We store only a setup record (the script ID of the created hankyoto app, an ID identifying its registration with the hankyoto service, and the result of each step). The one-time registration information (valid for 24 hours) that lets the hankyoto app register itself with the hankyoto service is placed only inside the customer’s hankyoto app and is never stored in our databases or logs.

4.3.1 Data handled by the hankyoto app in the customer’s Google environment

Within the permissions the customer grants on the hankyoto app’s own screen, the hankyoto app uses Gmail (receiving and sending inquiry emails), Google Sheets and Drive (storing business data) and Google Calendar (creating events). The hankyoto app runs with the customer’s own Google account; these permissions are used only inside the customer’s Google environment and are never passed to us. New emails are imported by the hankyoto app checking Gmail every few minutes.

4.4 Sharing

We do not share Google user data with third parties, except as required by law or when necessary to protect life, body or property and consent cannot be obtained.

4.5 Restrictions

We do not sell Google user data. We do not use it for advertising (including personalized, retargeting or interest-based advertising), for credit-worthiness or lending purposes, or to develop, improve or train generalized AI and/or machine learning models. Our staff do not read Google user data unless (a) we have the user’s affirmative consent, (b) it is necessary for security purposes such as investigating abuse, (c) it is necessary to comply with applicable law, or (d) the data is aggregated and anonymized for internal operations.

4.6 Limited Use

hankyoto’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.

4.7 Revoking access and deletion

You can revoke hankyoto’s access at any time at https://myaccount.google.com/connections . Clicking “Cancel setup and discard sign-in information” on the setup page deletes the access token immediately. To request deletion of the setup record, contact info@hankyoto.com; after verifying your identity we will delete it within 30 days, except where retention is required by law or contract. Resources created in your Google environment belong to you and are never deleted automatically by us.

5. Data sent by the hankyoto app

For license checks, trial counting and failure detection, the app sends only company/installation IDs and app version; license status and valid trial inquiry counts; function health, error codes and aggregated counts/durations; and security event codes to our API (https://api.hankyoto.com). Those runtime transmissions do not include customer names, contact details, email content or property information from everyday business operations. The API rejects fields outside the predefined runtime format.

Identity verification, applications, contract and billing review, payment-method changes, cancellation and support are separate procedures. Information explicitly submitted by the customer on those screens, including their email address, verification information, application details, contract identifiers and support messages, is sent to our API and management systems to carry out the procedure.

6. Service providers and international transfers

We may entrust the handling of personal data to service providers to the extent necessary, and we supervise them appropriately. Our payment processor, Stripe (Stripe, Inc., United States, and its affiliates), processes personal data in data centers in the United States as needed for payments. Stripe states that its privacy practices comply with the APEC Cross-Border Privacy Rules (CBPR) and Privacy Recognition for Processors (PRP) systems. Information on the measures taken is available on request.

7. Cookies and analytics

The website uses essential cookies for functionality and security. We use Google Analytics to understand website use. Page URLs, visit times, referring pages, browser/device types and cookie identifiers are sent to Google. Names, email addresses, phone numbers, company names and inquiry content are not sent. Analytics is configured so that IP addresses are not recorded or stored. Google’s handling is described at Google’s partner sites policy.

You can select “Stop analytics” below to stop analytics in that browser. You can also use Google’s opt-out tool. Stopping analytics does not prevent inquiries or trials.

Stop analytics Resume analytics

We may compare variations in website presentation (A/B tests). The assigned variation is stored in the browser. Visitors who stop analytics are excluded from that comparison. The setup application uses only a security session cookie and does not use analytics.

8. Retention

• Google access tokens: up to 60 minutes (deleted immediately on completion or cancellation)
• Setup records: during the contract and for 5 years after it ends
• Inquiries, requested materials, diagnosis answers/results and correspondence history: no fixed expiry or automatic deletion period is configured; retention is indefinite. We periodically review whether continued retention is needed for consultation, ongoing contracts/support and prevention of duplicate outreach. Information without a reasonable retention purpose is deleted or made non-identifying. Requests for restriction or deletion are handled under Section 10.
• Contract and billing information: as required by law
• Operational data: 90 days (health), 180 days (performance aggregates), 400 days (security events)
• Access logs: 1 year

9. Security

We use multi-factor authentication for administration, TLS encryption, mutual authentication between our systems, least-privilege access, hashing/encryption of credentials, access logging and regular backups with restore tests.

10. Your rights

You may request disclosure, correction, deletion or suspension of use of your personal data by contacting info@hankyoto.com. No fee is charged.

11. Changes

We will post changes on this page with their effective date. If we change how we handle Google user data, we will announce it here beforehand and ask for renewed consent where required.

12. Contact

IR Co., Ltd. – info@hankyoto.com (email only)

Effective: September 26, 2026

Updated: October 2, 2026 (3rd edition: bank transfer added)

Updated: October 3, 2026 (4th edition: analytics controls)

Last updated: October 12, 2026 (5th edition: web intake, diagnosis, contract management and retention)