Privacy Policy
Last Updated: July 12, 2026 · Version: v1.0
This Policy complies with the Japanese Act on the Protection of Personal Information (APPI). For questions, contact support@everbundance.com.
Privacy Policy — CapsuleHunt
Effective Date: July 17, 2026
Last Updated: July 12, 2026
Version: v1.0
1. Introduction
At Everbundance ("CapsuleHunt," "we," "us," "our," or "Company"), we are committed to protecting your privacy. This Privacy Policy (the "Policy") explains how we collect, use, disclose, and otherwise process personal information in connection with our gashapon / capsule toy vending machine location and inventory search service (the "Service").
1.1 Scope of Application
This Policy applies to all users ("User," "you") who access the Service via web browser, mobile app, or API.
1.2 Your Consent
By using the Service, you consent to the collection and use of your information as described in this Policy. If you do not agree, please discontinue use of the Service.
1.3 Governing Law
This Privacy Policy is governed by the Act on the Protection of Personal Information (APPI) of Japan and other applicable Japanese laws and regulations.
2. Definitions of Personal Information
"Personal Information" under this Policy refers to personal information as defined in Article 2, Paragraph 1 of the APPI, and includes:
| Category | Examples |
|---|---|
| Identifying Information | Email address, username (display name), password (hashed), date of birth (for age verification) |
| Location Data | GPS coordinates (only when permitted by the User) |
| Search & Browsing History | Search keywords, viewed stores/products |
| Device Information | OS version, device ID, browser type and version |
| Activity & Submission History | Inventory reports, reviews, timestamps |
| Network Information | IP address, User-Agent, request time |
Note on Age Verification
We verify your age via your date of birth at registration.
Users under the age of 16 must obtain the consent of a parent or legal guardian to use the posting features.
Note on Target Region
The Service is provided for residents of Japan.
Browsing and searching inventory information are available to everyone regardless of location, but
account registration, posting features, and participation in rankings are limited to residents of Japan.
3. Information We Collect
Upon Registration
When you create an account, we collect:
- Email address (for account verification and login)
- Username (display name)
- Password (stored as an irreversible hash, e.g., bcrypt)
- Date of birth (for age verification)
- Parent's email address (only when a user under 16 requests parental consent)
Your date of birth is used solely for age verification (to determine minor status).
Regarding Google Account Login
When you sign in using your Google account, we only receive the following information from Google:
- Email address
We do not collect or store your name, profile picture, or any other information associated with your Google account.
During Service Use
When you use the Service, we may collect:
- Location data: GPS coordinates, collected only when you use the "Find Nearby" feature and have explicitly granted permission
- Permission mechanism: native browser or device permission prompt
- You may revoke location permission at any time
- Search history: Search keywords
- Inventory report data: Store ID, product ID, inventory status, submission timestamp
Profile Attributes (Optional — only if you provide them)
Through profile settings or surveys within the Service, you may optionally provide the following information. Providing it is optional, and the Service remains usable without it.
- Age group, gender, and region of residence (prefecture)
- Preference information such as favorite genres, titles, and motifs
- Survey responses such as capsule toy purchase frequency and budget range
We use this information for the purposes set out in Section 4 (including statistical analysis, data processing, and the data provision business). If you respond to a survey, we may grant points as a reward.
Automatically Collected Information
The following information is collected automatically when you access the Service:
- Cookie data: Session cookies and authentication tokens (see Section 6)
- Log data: IP address, User-Agent string, request time
4. How We Use Your Information
We use collected personal information only for the following purposes:
User authentication and account management
- Login and logout functionality
- Password reset
- Account deletion processing
Service provision
- Delivering location search functionality
- Sending inventory notification alerts
- Syncing favorites across devices
Service improvement and development
- Building and testing new features
- Bug fixes and quality improvements
- UI/UX optimization
Fraud detection and security
- Detecting and addressing spam and false inventory reports
- Preventing unauthorized access
- Identifying and stopping Service abuse
Legal compliance
- Responding to lawful requests from courts or law enforcement
- Cooperating with criminal investigations as required by law
Statistical analysis and data processing
- Anonymized and statistical analysis of user demographics and behavior
- Generating usage reports
- Creating the statistical information and anonymously processed information described in Section 10
Marketing (only with opt-in consent)
- Notifying users of new features and important updates
- Delivering email newsletters and surveys about gashapon and capsule toy content
Data provision business
- Providing statistical information and anonymously processed information that does not identify any individual to businesses that plan, manufacture, or sell capsule toys (including provision for a fee)
- Creating and providing market trend and demand analysis reports
5. Information Security
We implement the following measures to protect your personal information from unauthorized access, loss, disclosure, alteration, or destruction.
Technical Measures
- Encrypted communications: All data in transit is encrypted via SSL/TLS 1.2 or higher (HTTPS required)
- Password protection: Passwords are stored as irreversible hashes (e.g., bcrypt); plaintext passwords are never stored
- Data-at-rest protection: Personal information is protected by our database provider's at-rest encryption (AES-256)
- Access controls: Access to personal information is limited to the operator of the Service
Organizational Measures
The Service is operated by a single operator, and no employees other than the operator handle personal information. In addition, we implement the following measures:
- Periodic self-inspection of how personal information is handled
- Data protection agreements with, and necessary and appropriate supervision of, our service providers (Section 10.5)
- In the event of a data breach, reporting to the Personal Information Protection Commission and notifying affected individuals as required by the APPI
Physical Measures
- Storage in service providers' data centers with appropriate physical security measures
- Data redundancy through backups
Notice: No service delivered over the Internet can guarantee 100% security. While we implement reasonable security measures, we cannot entirely eliminate the risk of data breaches.
6. Cookies and Tracking
6.1 Cookies We Use
We currently use only the essential cookies required to keep you logged in. We do not use tracking cookies for advertising or behavioral tracking, nor any third-party analytics cookies.
Session Cookies (Required)
| Type | Expiry | Purpose |
|---|---|---|
| Authentication token | End of session | User authentication and maintaining login state |
| Session refresh token | End of session | Session management |
6.2 Opt-Out
- Browser settings: You may disable cookies via your browser settings. Note that disabling required cookies (such as session cookies) will prevent login and other core Service functionality
6.3 Future Changes
If we introduce web analytics (such as Google Analytics) in the future, we will update this Policy and provide a means of obtaining consent where required.
7. Location Data
7.1 Collection and Use
GPS and other location data is collected and used solely for the following purpose:
- Powering the "Find Nearby Stores / Vending Machines" feature
We do not use location data for marketing, targeted advertising, or any other purpose, and we do not share it with third parties.
7.2 Retention
- Location data is not stored on our servers. It is used only to process your "Find Nearby" search request and is not retained afterward.
- We do not keep access logs or activity history of location data.
7.3 User Control
- You can grant or revoke location permission at any time via your browser or device settings
- Revoking location permission disables the "Find Nearby" feature, but all other features remain available
7.4 Note on Privacy
- We do not store or record location data on our servers, and we do not track individual movement patterns.
- We do not provide location data to third parties for marketing purposes.
- Note that when displaying maps, the coordinates of the visible map area, your IP address, and related data are transmitted to our map service provider (Mapbox, Inc., USA) to fetch map tiles. See the "Transmission to External Services" section of our Cookie Policy for details.
8. Data Retention
While Your Account Is Active
| Data Type | Retention Period |
|---|---|
| Identifying information (email, username) | Until account deletion |
| Submission history (inventory reports, etc.) | Until account deletion |
| Location data | Not stored on our servers (used transiently for search only) |
Upon Account Deletion
When you delete your account, you are immediately signed out and can no longer log in, and your posts are no longer publicly visible (effectively a deleted state).
Your personal information and posted content (email address, password, settings, display name, inventory reports and other posts, and usage history such as points and referrals) are retained only for the period necessary to address misuse and to respond to legal or lawful disclosure requests, and are then permanently deleted. The retention period is determined according to the purposes for which the data was collected and in accordance with applicable law.
After permanent deletion, and except for records subject to the "Legal Retention Obligations" below, the data cannot be restored.
Legal Retention Obligations
| Data Type | Retention Period |
|---|---|
| Tax records | 7 years (under Japanese tax law) |
| Security incident investigation records | Until investigation is complete |
Handling of Personal Information for Minor Users
We verify your age via your date of birth at registration.
Users under the age of 16 must obtain the consent of a parent or legal guardian to use the posting features. At registration, we send a consent confirmation email to the parent's email address, and posting features are enabled once the parent consents. Until consent is obtained, the user may only browse and search.
In accordance with Japan's Act on the Protection of Personal Information (APPI), the handling of personal information of children under the age of 16 is subject to the consent of a parent or legal guardian. If a parent wishes to delete their child's account, they can do so immediately via the link in the consent confirmation email.
9. Your Rights (Access, Correction, Deletion)
Under the APPI and applicable law, you have the following rights:
9.1 Right to Access
You may request disclosure of personal information we hold about you.
How to request:
Email: support@everbundance.com
Subject: Personal Information Disclosure Request
Body: Include your username, the information you are requesting, and your reason for the request
Response time: Within 14 business days of receipt.
9.2 Right to Correction
If your personal information is inaccurate, you may request correction by:
- Editing directly in your account settings page
- Emailing
support@everbundance.com
9.3 Right to Deletion
You may request deletion of your personal information by:
- Using the "Delete Account" feature in your account settings
- Or emailing
support@everbundance.com
Processing time: Using the "Delete Account" feature immediately disables your account (login blocked, posts hidden); your data is then permanently deleted after the retention period. Email requests are handled in the same manner.
Note: When you delete your account, your posted content such as inventory reports is deleted as well (and is hidden from public view during the retention period).
9.4 Right to Restrict Use or Third-Party Sharing
You may request that we stop using or sharing your personal information if:
- We are using your information in violation of this Policy
- Your information is being used or shared without your consent
Contact: support@everbundance.com
10. Disclosure to Third Parties
10.1 Disclosure of Personal Data
Except in the following cases, we do not disclose information that identifies a specific individual (personal data) to third parties without your consent:
- Where you have consented
- Where required by law (Section 10.4)
- Where we entrust processing to service providers (Section 10.5)
- Disclosure to subsidiaries or affiliates of Everbundance that apply protections equivalent to or greater than this Policy
10.2 Provision of Statistical Information
We may aggregate and statistically process the information of multiple users to create statistical information that does not identify any specific individual. Because such statistical information is not personal information, we may provide it — whether for a fee or free of charge — to third parties, including businesses that plan, manufacture, or sell capsule toys.
10.3 Creation and Provision of Anonymously Processed Information
In accordance with the standards set out in Article 43 et seq. of the APPI, we may create "anonymously processed information" (kameishin-kakō jōhō) that is processed so that no specific individual can be identified and the original personal information cannot be restored, and may provide it to third parties.
- When we create anonymously processed information, we publish the categories of information about individuals contained therein in this Policy or on our website.
- When we provide anonymously processed information to a third party, we publish in advance the categories of information to be provided and the method of provision, and expressly indicate to the recipient that the information is anonymously processed information.
- In handling anonymously processed information, we do not collate it with other information for the purpose of identifying the individual to whom the original personal information relates.
Categories that may currently be provided (anonymously processed information)
| Category | Examples |
|---|---|
| Attributes | Age group, gender, region of residence (at the prefecture level) |
| Preferences | Favorite genres, titles, and motifs |
| Behavior | Trends in searching, browsing, favorites, and inventory reports |
| Purchasing | Purchase frequency and budget range (based on survey responses) |
- All of the above are handled only after being processed so that no specific individual can be identified.
10.4 Disclosure Required by Law
- In response to lawful requests from courts or law enforcement following due process. Except where notice is prohibited by law, we will consider notifying you.
10.5 Disclosure to Service Providers
To provide the Service, we may entrust the handling of personal data to service providers in the following categories. We execute data protection agreements with each provider and exercise necessary and appropriate supervision.
| Category | Purpose | Primary Location |
|---|---|---|
| Database & Authentication | User account management and database storage | USA |
| Hosting, CDN & Security | Website delivery and protection against unauthorized access | USA |
| Email Delivery | Email notification and survey delivery | USA |
| AI Image Analysis | Reading product names from submitted images (OCR) | USA |
| Map Services | Map display and tile delivery | USA |
For inquiries about specific service providers, please contact support@everbundance.com.
10.6 Provision to Third Parties Located in Foreign Countries
The service providers listed above include businesses located in foreign countries (primarily the United States). In accordance with Article 28 of the APPI, we provide personal data to third parties located in foreign countries (including by way of entrustment) only where:
- We have obtained your prior consent (obtained as part of your consent to this Policy at account registration); or
- The third party has established a system that conforms to standards for continuously implementing measures equivalent to those required under the APPI (including equivalent protections secured through our data processing agreements).
The United States does not have a comprehensive data protection law equivalent to Japan's APPI; however, we endeavor to secure a level of protection equivalent to Japanese law through our agreements with each provider. For information on the data protection regimes of foreign countries, please refer to the surveys published by Japan's Personal Information Protection Commission (https://www.ppc.go.jp/).
11. Contact Information
For questions, requests, or complaints regarding our handling of personal information, please contact:
Business name: Everbundance
Address: Hamamatsucho Daiya Bldg. 2F, 2-2-15 Hamamatsucho, Minato-ku, Tokyo 105-0013, Japan
Email: support@everbundance.com
Response time: Within 7 business days
Business Hours: Monday–Friday, 10:00–18:00 (JST)
In accordance with Article 32 of the APPI, the name of the business operator will be disclosed without delay upon request sent to the email address above.
12. Policy Updates
12.1 Right to Amend
We may amend this Policy from time to time in response to changes in applicable law, the Service, or other relevant factors.
12.2 Notice of Changes
- Minor changes: Posted to the Service without separate notification
- Material changes: Notified via email to your registered address and/or in-app announcement at least 30 days before taking effect
12.3 Deemed Consent
If you continue to use the Service after the updated Policy takes effect, you will be deemed to have consented to the revised Policy. If you do not agree, you may delete your account at any time. However, for material changes to the purposes of use or any other changes for which your consent is required by law, we will obtain your explicit consent rather than relying on deemed consent.
Revision History
| Version | Date | Summary of Changes |
|---|---|---|
| v1.0 | July 17, 2026 | Initial release |
Copyright © Everbundance. All rights reserved.
Last Updated: July 12, 2026
Version: v1.0
Effective Date: July 17, 2026
Language: English
Governing Law: Act on the Protection of Personal Information (APPI), Japan
Related Documents