Privacy Policy
What we collect
- Alert subscribers' email + consent records (kept until unsubscribe + 90 days)
- Anonymous API client IPs, SHA-256-hashed (deleted after 90 days)
- API-key holders' company / contact names (for the life of the contract)
- Admin action audit log
Purpose
Sending accommodation-tax change alerts, metering API usage and preventing abuse, and contract administration. The alert list is never reused for anything else without a separate recorded opt-in (個人情報保護法 / 特定電子メール法).
Cookies
No cookies are used outside /admin (so no consent banner is needed). Caddy access logs follow the VPS-wide rotation policy.