Gluten Free Japan LogoGF Japan

Privacy Policy

Effective date: August 23, 2026

1. Who We Are

Gluten-Free Japan (“the Service”, “we”, “us”) is operated by Focus LLC (合同会社Focus), registered at 6F N&E BLD., 1-12-4 Ginza, Chuo-ku, Tokyo 104-0061, Japan. This policy explains what personal data we collect when you use the Service, why we collect it, and the choices you have.

2. Information We Collect

  • Account information — when you sign in with Google, we receive your email address. If you register with email and password instead, we store that email and an encrypted password via our authentication provider.
  • Profile information you add — on My Page you may optionally enter allergies, celiac severity, preferred cuisines, dining budget, preferred areas, cross-contamination tolerance, and similar travel preferences to personalize recommendations.
  • Reviews you submit — rating, written comment, display name, safety rating, communication rating, whether you'd recommend the restaurant, celiac-safety confirmation, and visit date.
  • Concierge and Travel Kit requests — name, email, cities, travel dates, allergy severity, party size, the restaurants you want us to contact, and any message you add.
  • Allergy card requests — when you ask us to email your printable allergy card, we keep the email address you entered. The allergens you selected are used to build that card and are not saved to our database.
  • Chat assistant messages — the question you type into the chat widget, the reply you receive, the page you asked from, the language you asked in, a randomly generated session identifier that lets the assistant follow one conversation, and your browser's user-agent string. We also store a salted, one-way hash of your IP address — never the address itself — solely to rate-limit the assistant. You do not need an account to use the chat, and we do not link these messages to your account when you have one.
  • Payment information — handled entirely by Stripe. We never see or store your card number.
  • Usage data — pages viewed, device/browser information, and error diagnostics, collected as described in Section 6 (Cookies & Analytics).

3. Health-Related Information

Allergy, celiac-severity, and cross-contamination-tolerance information you provide is used only to personalize restaurant recommendations, to brief restaurants on your behalf when you use the Concierge service, and to print the allergens onto the allergy card you asked us to email you — which means that card, and the allergens on it, pass through our email provider. We do not sell this information, use it for ad targeting, or share it with anyone beyond the processors listed in Section 5. You can remove it at any time by editing your profile or deleting your account.

4. How We Use Your Information

  • Operate the Service: authentication, saved favorites, personalized recommendations
  • Process payments and deliver the Travel Kit or Concierge service you purchased
  • Contact restaurants on your behalf when you request the Concierge service
  • Review, moderate, and publish restaurant reviews you submit
  • Respond to messages sent through our contact form
  • Send the printable allergy card to the address you give us, and keep a record of that request so we can confirm it was sent and see which tools are used
  • Monitor and fix errors, and improve the Service
  • Answer questions asked through the chat assistant, and rate-limit it to prevent abuse
  • Prevent fraud and abuse

5. Third-Party Service Providers

We share data with the following processors, and with no one else, to operate the Service:

  • Supabase, Inc. (United States) — database and authentication.
  • Google LLC (United States) — Google sign-in, and Google Analytics 4 (see Section 6).
  • Stripe, Inc. (United States) — payment processing for the Travel Kit and Concierge service.
  • Resend (United States) — delivery of transactional emails: Concierge confirmations, and the allergy card, which carries the allergens you selected in its body.
  • Slack Technologies, LLC (United States) — internal notification of Concierge and Travel Kit requests to our team; not used for marketing.
  • Sentry (Functional Software, Inc.) (United States) — error monitoring and session replay (see Section 6).
  • Anthropic, PBC (United States) — the chat assistant. Your question, and the recent messages in that same conversation, are sent to Anthropic's API so a reply can be generated. Under Anthropic's commercial terms, inputs sent through the API are not used to train their models.
  • Vercel, Inc. (United States) — website hosting.

6. Cookies, Analytics & Session Monitoring

On your first visit, a cookie banner lets you choose “Essential Only,” “Accept Analytics,” or “Accept All.” We use Google Consent Mode v2, so analytics and advertising cookies stay off until you opt in; your choice is remembered in your browser.

  • Essential: required for the Service to function (session, sign-in, cookie preference) and always active.
  • Analytics (Google Analytics 4): only active if you choose “Accept Analytics” or “Accept All”; helps us understand how the Service is used.
  • Advertising: only active if you choose “Accept All”; currently unused beyond the consent signal itself.

Separately, we use Sentry for error monitoring on every visit, which can include your IP address. Sentry also records on-screen activity (session replay), but only for sessions in which an error actually occurs — if nothing goes wrong on your visit, nothing is recorded. The allergy card tool is excluded from these recordings, so the allergens you tick are not captured even when an error happens on that page. Because this runs only on failure and exists to diagnose faults, it is treated as an essential reliability tool and is not gated by the cookie banner.

7. International Data Transfers

All of the processors listed in Section 5 are based in the United States, so your data is transferred outside Japan. We only work with providers whose services include contractual or certification-based safeguards for handling personal data. By using the Service, you consent to this transfer.

8. Data Retention

We keep your account and profile data for as long as your account exists. If you delete your account, we delete your personal data within a reasonable period, except where we must keep records to comply with law (for example, payment records) or to resolve disputes.

Chat assistant messages are kept so we can check the quality and safety of the answers given, and to understand which questions travelers actually ask. They are not tied to your account; everything stored alongside them is listed in Section 2.

9. Security

Data is encrypted in transit (HTTPS). Our database uses Supabase row-level security so that each user can only access their own data. Access to personal data is limited to the people who need it to operate the Service.

10. Your Rights & Choices

  • Edit or delete your saved preferences at any time from My Page
  • Request access to, correction of, or deletion of your personal data by contacting us through the contact form
  • Withdraw analytics/advertising cookie consent by clearing your browser's site data

We aim to respond to requests within a reasonable time and in accordance with applicable law.

11. Changes to This Policy

We may update this policy from time to time. Material changes will be announced on this page with an updated effective date.

12. Contact Us

Questions about this policy or your data can be sent through our contact form.