Yonihon (“we”, “us”, “our”) operates the website yonihon.com (the “Site”), a marketplace that connects travellers with local workshop partners offering hands-on experiences in Japan. This Privacy Policy explains what information we collect, why we collect it, how we use and share it, and the choices and rights you have. By accessing or using the Site, or making a booking, you agree to the practices described in this policy.
1. Information We Collect
We collect information that you provide to us directly, information that is collected automatically when you use the Site, and information we receive from third parties. The types of personal data we collect include:
- Account and registration information – your name, email address, password (stored as a secure hash only), language preference, time zone, and, if you upload one, a profile photo.
- Identity provider information – if you sign in with Google or Facebook (OAuth), we receive your name, email address, and profile picture from that provider, together with the provider’s unique identifier for your account. We never receive or store your social login password.
- Booking information – the experience, workshop, date, time slot, party size, participant names, meeting point, and any special requests you provide when booking or amending a reservation.
- Guest booking information – when you book without an account, we collect the contact details you supply (such as your name, email address and phone number) so we can confirm and communicate about your booking. You may later create an account to link these bookings to your profile.
- Partner business information – if you register as a workshop partner, we collect your business name, contact details, workshop descriptions, images, policies, pricing, location coordinates, and information about your team members.
- Payment information – we record booking value and payment status (for example paid, unpaid, refunded and refund amounts) so we can manage transactions and partner payouts. We do not collect or store full card numbers; card payments are intended to be processed by a third-party payment provider.
- Communications – messages exchanged with workshop partners or our support team through the Site, email correspondence, and any attachments you choose to share.
- Reviews and feedback – reviews, ratings, and reports that you submit about workshops, partners, or other users.
- Technical and usage information – collected automatically, including your IP address, browser type and version, device type, operating system, referring pages, pages and experiences you view, search queries, click behaviour, session information, and the date and time of your visits. We and our service providers may use cookies, local storage, and similar technologies to gather this information.
2. How We Use Your Information
We use your information for the following purposes:
- To create and manage your account, including sign-in with email, password, or a third-party identity provider such as Google.
- To process, confirm, manage, and deliver your bookings, including sending confirmation emails, reservation tickets, reminders, amendments, and calendar attachments.
- To share the necessary booking details with the workshop partner who will host your experience so they can prepare for your session.
- To verify your identity and email address, including sending one-time passcodes (OTPs) for login, registration, email changes, and password resets.
- To respond to your enquiries and provide customer support.
- To communicate with you about cancellations, schedule changes, alternative slots, and other service-critical updates.
- Where you consent, to send you promotional communications about experiences, events, and travel guides that may interest you. You can opt out at any time.
- To enable partners to manage their workshops, availability, bookings, payments, reviews, and team members.
- To moderate reviews, detect and prevent fraud, abuse, unauthorised access, and other illegal activity, and to enforce our Terms and Conditions.
- To operate, maintain, improve, and secure the Site, including debugging, analytics, and performance monitoring.
- To comply with our legal obligations and to exercise or defend legal claims.
3. Legal Bases for Processing
Where data protection law requires a legal basis, we process personal data on the following grounds: (a) performance of a contract, so we can provide the services you request, such as creating an account or making a booking; (b) your consent, which you may withdraw at any time without affecting the lawfulness of processing carried out before withdrawal; (c) our legitimate interests, such as improving and securing our services, preventing fraud, and marketing our platform, balanced against your rights and freedoms; and (d) compliance with a legal obligation.
4. Google Sign-In Data
When you choose to sign in or register with Google, Google shares your name, email address, and profile picture with us through their OAuth service. We use this information solely to create and populate your Yonihon account and to let you sign in without a separate password. We do not request or access your Google contacts, email contents, drive files, or any other Google account data beyond your basic profile, and we never post to or publish on your behalf. You can revoke Yonihon’s access to your Google account at any time from your Google Account security settings. Please also review Google’s Privacy Policy to understand how Google processes your data.
5. Sharing Your Information
We do not sell, rent, or trade your personal information to third parties. We share your information only in the following circumstances:
- With workshop partners – the partner hosting your booked experience receives your name, contact details, party size, preferences, and any other details reasonably needed to prepare for and deliver your session. You should review the partner’s own privacy practices before providing additional information.
- With service providers – we engage trusted vendors who help us run the Site, such as cloud infrastructure and hosting providers (including Cloudflare for content delivery, hosting, bot protection, and email services), analytics providers, and email/communications providers. These providers process your data only on our instructions and are bound by confidentiality and data protection obligations.
- With your consent – we may share your information with third parties when you have asked us to do so or given us permission.
- For legal and safety reasons – we may disclose your information where we believe in good faith that disclosure is required by law, regulation, legal process, or a government request, or where necessary to protect the rights, property, or safety of Yonihon, our users, partners, or the public.
- In a business transition – if Yonihon is involved in a merger, acquisition, reorganisation, or sale of assets, your information may be transferred as part of that transaction, subject to the protections in this policy.
6. International Data Transfers
Yonihon is based in and operates servers and services through Cloudflare’s global network, which means your information may be processed outside the country in which you reside, including in countries that may not have laws equivalent to those of your country. Where we transfer personal data internationally, we rely on appropriate safeguards, such as standard contractual clauses and other lawful transfer mechanisms, to protect your information.
7. Data Retention
We retain personal data only for as long as necessary to fulfil the purposes described in this policy, to comply with legal and accounting obligations, and to resolve disputes and enforce our agreements. For example:
- Account data is kept while your account is active and for a reasonable period afterwards.
- Booking records and messages are retained to support the services, historical records, and ongoing partner/customer relationships.
- Email OTPs, sessions, and rate-limiting counters are deleted automatically after short retention periods.
- Technical logs are retained for a limited period for security and debugging purposes.
When we no longer need personal data, we delete or anonymise it.
8. Security
We take reasonable technical and organisational measures to protect your personal data against unauthorised access, loss, alteration, or disclosure. These include encryption in transit (TLS/HTTPS), secure password storage using strong hashing, bot protection and rate limiting, access controls on our internal tools, and pseudonymised session management. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your login credentials confidential.
9. Cookies and Similar Technologies
We use cookies, local storage, and similar technologies to operate and improve the Site. These include: strictly necessary cookies required for functionality such as authentication and session management; functional and preference cookies, such as language selection; analytics cookies that help us understand how visitors use the Site; and security cookies that help detect and prevent abuse. Third-party services we use may also set their own cookies in accordance with their privacy policies. Most browsers let you control, block, or delete cookies through their settings; however, disabling certain cookies may affect your ability to use parts of the Site, such as staying signed in.
10. Your Rights and Choices
Depending on your location, you may have the following rights regarding your personal data:
- Access – to obtain a copy of the personal data we hold about you.
- Rectification – to correct inaccurate or incomplete data, for example by updating your profile settings.
- Erasure – to request deletion of your personal data where we no longer have a lawful basis to retain it.
- Restriction – to ask us to limit how we process your data in certain circumstances.
- Portability – to receive your data in a structured, machine-readable format, where technically feasible.
- Objection – to object to processing based on our legitimate interests or for direct marketing.
- Withdrawal of consent – to withdraw any consent you previously gave, without affecting the lawfulness of processing that occurred before withdrawal.
- Complaint – to lodge a complaint with a data protection supervisory authority in your country.
You can exercise many of these rights directly through your account settings, such as updating your profile, changing your password, or deleting conversations with partners. You can also opt out of promotional emails at any time using the unsubscribe link in any marketing message. To exercise any other right, please contact us using the details below. We may need to verify your identity before responding and will respond within the timeframe required by applicable law.
11. Children’s Privacy
The Site is a marketplace for cultural experiences and is not directed to children. We do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, please contact us so we can delete it.
12. Third-Party Links
The Site may contain links to third-party websites, including partner workshop websites, booking platforms, and social media. This Privacy Policy applies only to yonihon.com. We are not responsible for the privacy practices of third parties, and we encourage you to read their privacy policies.
13. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, the law, or the services we offer. When we make material changes, we will update the “last updated” date below and, where appropriate, notify you by email or a prominent notice on the Site. Your continued use of the Site after changes take effect constitutes acceptance of the revised policy.
14. Contact Us
If you have any questions, concerns, or requests about this Privacy Policy or how we handle your personal data, please contact us through our Contact page or by emailing privacy@yonihon.com. We will do our best to respond promptly.
Last updated: September 15, 2026.