AIRSTAY Co., Ltd. (hereinafter "the Company") establishes the following Privacy Policy (hereinafter "this Policy") regarding the handling of personal information on the website "AIRSTAY DISCOVER" (hereinafter "this Site") operated by the Company.

1Scope of Application

1. This Policy applies to personal information obtained by the Company in connection with browsing this Site, inquiries sent to the Company's inquiry email address, Google Forms managed by the Company, and other activities related to this Site.
2. External services operated by third parties linked from this Site — including listed operators' websites, reservation pages, payment pages, and other external services — are governed by the rules established by their respective operators.
3. Personal information acquired, stored, or used by listed operators under their own management is managed by those operators in accordance with applicable laws and regulations.

2Personal Information Controller

The personal information controller for this Site is as follows.

Business Name: AIRSTAY Co., Ltd.

Representative: Representative Director, Shunichi Kajiya

Address: 3-29-43 Oizumimachi, Nerima-ku, Tokyo 178-0062

Contact: discover@airstay.jp

3Information Collected

1. Information Collected via General Inquiry Emails

The Company may collect the following information through emails sent to the inquiry email address listed in the footer of this Site, the Terms of Use, or this Policy.

• Sender's name or display name
• Email address
• Phone number and other contact information included in the email body
• Relevant listed service
• Inquiry content
• Attachments
• Date and time of transmission and receipt
• Email headers and other technical information related to transmission and receipt
• Record of consent to information sharing between the Company and listed operators
• Other information necessary for responding to inquiries

Inquiry emails are received and stored in the Google Group conversation history managed by the Company as well as in the designated mailboxes of the primary and backup persons in charge.

The Company does not send automatic replies to general inquiries.

2. Information Collected via Google Forms Managed by the Company

When the Company sets up a Google Form for individual listed services, it may collect the following information within the scope displayed on the form.

• Full name
• Email address
• Phone number
• Preferred date and time
• Number of guests
• Nationality
• Inquiry content, requests, and other input
• Consent result for this Policy
• Consent result for information sharing between the Company and the relevant listed operator
• Submission date and time
• Other fields necessary for handling inquiries or reservation requests for listed services

The fields collected and whether they are required or optional vary depending on the content of the listed service.

The Company's managed forms are, in principle, set up for each individual service offered by a single listed operator.

The individual name of the listed operator receiving the information may not be displayed on the form. Even in such cases, the recipient is limited to the single listed operator that actually provides the service covered by the form.

The Company's managed forms include the following two consent items:

• I have read and agree to the AIRSTAY DISCOVER Privacy Policy.
• I agree to my submitted information being shared between AIRSTAY Co., Ltd. and the listed operator as needed to handle my request.

The Company's managed forms display the effective date or version of this Policy at the time of use.

The Company manages the form display content, revision history, and response submission timestamps in combination so that the version of this Policy and consent text applicable at the time of submission can be confirmed.

Google Forms are configured to allow responses without requiring a Google account login, and the file upload feature is not used.

Users cannot edit their responses after submission. The Company does not automatically send copies of responses to users, and does not display other respondents' answers or aggregated results.

3. Google Form Notifications and Response Spreadsheets

Google Form responses are provided to the Company and the relevant listed operator by the following methods:

• Notification email containing the response content
• Response spreadsheet linked to the Google Form

Notification emails to AIRSTAY are received and stored in the Company's Google Group as well as in the designated mailboxes of the primary and backup persons in charge.

Notification emails and response spreadsheets for the relevant listed operator are provided and shared with the email address or Google account designated by that operator.

A personal Gmail address or other personal email address may be used if designated by the listed operator.

In principle, notification and sharing destinations are limited to one per listed operator; however, multiple addresses or accounts may be used when operationally necessary.

4. Information Collected from Listed Operators

The Company may collect the following information from listed operators to the extent necessary for handling inquiries, reservation requests, complaints or disputes, fact verification, referral performance tracking, performance-based compensation confirmation, and other site operations.

• Whether a reservation or use was made
• Date of use
• Number of guests
• Service or plan used
• Sales amount
• Status of handling inquiries, reservations, or service delivery
• Information related to communication or correspondence with users
• Information necessary for verifying complaints, accidents, disputes, or other facts
• Other minimum necessary information for handling matters

Regular monthly reports from listed operators to the Company cover, in principle, only concluded cases.

Regular monthly reports do not include names, email addresses, or phone numbers. However, the minimum necessary identifying information may be collected when required for matching individual cases or verifying facts.

5. Access Logs

The Company may collect the following information as access logs in connection with browsing this Site.

• IP address
• Access date and time
• Pages viewed or URLs accessed
• Query strings appended to URLs
• Referrer URL
• Browser, OS, device, and other user agent information
• Data transfer volume
• HTTP status and other technical information

4Purposes of Use

The Company uses the personal information collected for the following purposes.

• To receive, review, and respond to inquiries
• To provide information about listed services
• To convey users' inquiries or reservation requests to the relevant listed operator
• To enable the relevant listed operator to contact users
• To assist with reservations, applications, and requests for use
• To assist with communication, fact verification, and resolution of complaints, accidents, disputes, or other issues arising after a reservation
• To confirm response status and other necessary information from both users and listed operators
• To verify, correct, update, or optimize listed content
• To confirm referral performance, performance-based compensation, and other transaction status based on agreements with listed operators
• To aggregate and analyze usage of this Site and listed services to improve services
• To prevent unauthorized use, nuisance, unauthorized access, and other acts that compromise the safety of this Site
• To investigate failures or security issues
• To verify identity when necessary
• To respond to violations of this Site's Terms of Use
• To respond to lawful requests from laws and regulations, government agencies, courts, or other public authorities
• To carry out operations incidental to each of the foregoing purposes

Except where the Company has separately obtained the user's consent, the Company does not use collected personal information for advertising, sales solicitation, newsletter distribution, or other marketing purposes.

5Information Users Should Refrain from Submitting

Users must not include or attach the following information in general inquiry emails or the Company's managed forms, unless the Company has specifically requested the user to input or submit such information.

• Detailed medical information such as medical history, diagnoses, or treatment history
• Detailed information about physical or mental condition
• My Number (Individual Number)
• Images or numbers of driver's licenses, passports, residence cards, or other identity documents
• Credit card numbers, security codes, or other payment information
• Personal information of third parties not necessary for responding to the inquiry
• Other information not necessary for handling the inquiry or reservation request

If it is necessary to communicate information about health conditions, allergies, religious or dietary restrictions, or other matters in connection with using a listed service, please communicate such information directly to the listed operator after being contacted by that operator, to the extent necessary.

6Provision of Information to Listed Operators

1. General Inquiry Emails

When the Company needs to provide the content or personal information from a general inquiry email to a listed operator, the Company will, unless the user's consent is not required by law, confirm with the user by email the recipient and the information to be provided, and obtain explicit consent before providing such information.

The Company retains the email in which the user's consent was obtained, the user's consent email, and the email actually provided to the listed operator as records of the information provision.

2. Company-Managed Forms

Based on the user's consent given in the Company's managed form, the Company provides the submitted information to the relevant listed operator.

The name of the recipient listed operator may not be individually displayed on the form; however, the recipient is limited to the listed operator that actually provides the service covered by the form.

The information provided may include the user's name, email address, phone number, preferred date and time, number of guests, nationality, inquiry content, and other information necessary for handling the matter.

3. Information Provided from Listed Operators to the Company

Based on the user's consent, the Company may receive minimum necessary information from listed operators for purposes such as handling inquiries, reservation requests, complaints or disputes, fact verification, referral performance tracking, and performance-based compensation confirmation.

4. Management by Listed Operators

In principle, the Company and listed operators each independently manage the personal information they have respectively acquired or hold.

The Company does not set a uniform retention period for personal information acquired by the relevant listed operator through notification emails, response spreadsheets, downloaded data, or other means, nor for the timing of deletion or management methods.

Listed operators manage personal information at their own responsibility in accordance with applicable laws and regulations and actual operational needs.

7Third-Party Provision

The Company does not provide users' personal data to third parties except in the following cases.

1. When the user has given consent
2. When providing to the relevant listed operator pursuant to Article 6
3. When required by law
4. When necessary to protect someone's life, body, or property, and obtaining the person's consent is difficult
5. When particularly necessary for improving public health or promoting the sound development of children, and obtaining the person's consent is difficult
6. When it is necessary to cooperate with the national or local government in carrying out duties prescribed by law, and obtaining the person's consent is likely to impede the performance of such duties
7. When the provision does not constitute third-party provision under the Act on the Protection of Personal Information or other applicable laws

The Company does not sell users' personal information to third parties.

8External Services and Service Providers

To the extent necessary for operating this Site, storing information, sending and receiving emails, and achieving the purposes of use set forth in Article 4, the Company uses the following external services.

1. Server services provided by Xserver, Inc.
2. Google Workspace, Google Groups, Gmail, Google Forms, and Google Sheets provided by Google LLC and other Google group companies
3. Other services necessary for operating this Site

When the Company entrusts handling of personal data to an external service provider, the Company appropriately selects the provider and exercises necessary and appropriate supervision.

The provision of information to listed operators is treated, in principle, not as outsourcing but as third-party provision pursuant to Articles 6 and 7.

9Handling of Information Outside Japan

Personal information or information related to personal information may be stored or processed on servers or other facilities outside Japan in connection with the use of services provided by Google or other operators with bases outside Japan.

The Company confirms the contractual protection measures, personal information protection systems, and other necessary matters of service providers in accordance with applicable laws and regulations, and takes necessary and appropriate measures.

10Joint Use

1. The Company does not currently share collected personal data jointly with affiliated companies or other operators.
2. If joint use is to commence, the Company will announce in advance, in accordance with applicable law, the items of personal data to be jointly used, the scope of joint users, the purpose of use, the person responsible for management, and other necessary matters.

11Security Management Measures

To prevent leakage, loss, damage, unauthorized access, unauthorized use, and other incidents involving personal data, the Company implements the following measures.

1. Establishing internal rules regarding the handling of personal information
2. Limiting the personnel who handle personal information and their access rights
3. Limiting the persons who can view Google Group conversations
4. Limiting the persons with whom Google Forms and response spreadsheets are shared
5. Prohibiting sharing settings that allow unspecified numbers of people to view content, such as "Anyone with the link"
6. Operating without sharing account passwords among multiple persons
7. Revoking access rights when personnel changes, resignation, or other circumstances render access unnecessary
8. Appropriately managing the systems and software in use
9. Establishing reporting and response systems for when leakage or other incidents occur
10. Exercising necessary and appropriate supervision over service providers
11. Other measures appropriate to the nature and scale of the personal information handled

Regarding the details of security management measures, the Company will respond to user inquiries to the extent not precluded by law or not prejudicial to security.

12Retention Period

1. General Inquiries

General inquiry emails, attachments, and correspondence records for which personal data was not provided to a listed operator are retained for one year from the date the response to the inquiry is completed.

2. General Inquiries for Which Information Was Provided to a Listed Operator

For general inquiries for which personal data was provided to a listed operator, the original inquiry email, attachments, the user's consent email, the email provided to the listed operator, correspondence records, and other records related to that provision are retained for three years from the date on which personal data was last provided to the listed operator for that case.

3. Google Groups and Personnel Mailboxes

General inquiry emails and Google Form notification emails are retained in both the Company's Google Group and the designated mailboxes of the primary and backup persons in charge for the retention periods specified in the preceding items or the following item.

4. Google Forms

Responses to Company-managed forms, consent results, notification emails, response spreadsheets managed by the Company, and other original data are retained, in principle, for three years from the date of form submission.

The version of this Policy displayed on the form, the consent text, and other displayed content are managed in association with the submission timestamp through the form's revision history or other means so that they can be verified.

5. Data Related to Usage Results and Performance-Based Compensation

Data necessary for confirming performance-based compensation, such as date of use, number of guests, service or plan used, and sales amount, is retained for three years from the date the Company acquired such data.

6. Statistical Information

Statistical information aggregated by month, listed operator, or service — such as number of cases, number of guests, sales amounts, and nationalities — from which the association with specific individuals has been removed and individuals can no longer be identified, may be retained indefinitely for purposes such as service improvement.

7. Access Logs

Access logs for this Site are retained, in principle, for 30 days after collection.

However, if an investigation is required due to a security issue, unauthorized access, failure, or other matter, the logs may be retained for the period necessary for such investigation and response.

8. Retention Required by Law or Other Reasons

Notwithstanding the foregoing items, personal information may be retained for the necessary period when there is a legal retention obligation, litigation, dispute, accident, response to a government agency, or other legitimate reason.

13Deletion after Retention Period

1. Personal information for which the retention period has expired and is no longer necessary for the achievement of the purpose of use will be deleted within a reasonable period, or rendered in a state in which individuals can no longer be identified.
2. With respect to Google Groups and the designated personnel mailboxes, emails for which the retention period has arrived will be deleted from each.
3. Deleted information may, depending on the specifications of the services used, be retained in trash, backups, or other areas for a certain period before being permanently deleted.
4. The Company does not use deleted information in its regular operations.

14Requests Regarding Retained Personal Data

Users may make the following requests under applicable law regarding their own retained personal data held by the Company.

1. Notification of the purpose of use
2. Disclosure of retained personal data or third-party provision records
3. Correction, addition, or deletion of content
4. Suspension of use or erasure
5. Cessation of third-party provision

To make a request, please contact the following inquiry email address.

Contact: discover@airstay.jp

To confirm that the requester is the person themselves or a lawful agent, the Company may ask for confirmation of the person's name, email address, phone number, past inquiry content, and other necessary information.

If identity documents are required, instructions on how to submit them will be provided on an individual basis. Identity documents obtained will be promptly deleted upon completion of identity verification.

There is, in principle, no fee for requests.

The Company may be unable to fulfill all or part of a request if the legal requirements are not met, identity cannot be confirmed, there is a risk of harm to the rights or interests of the person or a third party, there is a risk of significant impediment to the proper conduct of the Company's operations, or in other cases permitted by law.

15Response to Leakage and Other Incidents

1. If a leakage, loss, damage, or other incident involving personal data occurs or is suspected to have occurred, the Company will promptly investigate the facts and take measures necessary to prevent the spread of damage, identify the cause, and prevent recurrence.
2. When required by law, the Company will report to the Personal Information Protection Commission and other relevant authorities, and notify the affected individuals.
3. If an incident occurs at a listed operator, the Company and the listed operator will confirm the facts, the status of information held, the cause of the incident, and other circumstances, and each will respond in accordance with their respective responsibilities and situations.

16Changes to This Policy

1. The Company may change this Policy as necessary in response to changes in laws and regulations, the content of this Site, the systems used, the information collected, the purposes of use, or other matters.
2. When changing this Policy, the Company will post the revised content and effective date on this Site.
3. For changes that legally require re-obtaining the user's consent, the Company will obtain consent by the method prescribed by the Company.
4. The effective date of this Policy is treated as the version of this Policy applicable at that time.
5. The version of this Policy applicable to each Google Form is displayed on the respective form.

17Language

1. This Policy is displayed in both Japanese and English.
2. In the event of any conflict or discrepancy between the English version and the Japanese version, the Japanese version shall be the authoritative text and shall prevail.

18Contact

For inquiries, complaints, or consultations regarding this Policy, the Company's handling of personal information, or requests regarding retained personal data, please contact the following inquiry email address.

Business Name: AIRSTAY Co., Ltd.

Service Name: AIRSTAY DISCOVER

Representative: Representative Director, Shunichi Kajiya

Address: 3-29-43 Oizumimachi, Nerima-ku, Tokyo 178-0062

Contact: discover@airstay.jp

Established and Effective Date: July 26, 2026