Privacy Policy

1. Business Operator and Contact Information

Business Operator: eHalal Co., Ltd

Contact: ksaito@ehalal.co

2. Information Collected

The Company collects the following types of information:

• Account Information: name, nickname, email address, authentication tokens
• Device Information: OS, device ID, advertising ID (IDFA/AAID), language, time zone
• Location Information: GPS and Wi-Fi information based on permission, logs of arrival at spots
• Behavioral Logs: searches, views, saves (bookmarks), directions, ranking actions, scan history
• Billing Information: purchase history, subscription status (details of payment information are retained by the relevant app store or payment service provider)
• UGC (User-Generated Content): photos, reviews, comments
• Inquiry Information: support history

Note: The Company does not request Users to directly input their religion or beliefs. However, since a User's religious affiliation (which may constitute sensitive personal information) could potentially be inferred from browsing histories of spots and similar data, the Company will handle such information with due care in accordance with applicable laws and regulations (see Section 7 below).

3. Purposes of Use

The Company uses personal information for the following purposes:

• Provision, maintenance and improvement of the Service, and personalization of the Service
• Detection and prevention of fraud and abuse, and ensuring security
• Notifications and customer support
• Statistics and analytics (product improvement and feature evaluation)
• Delivery and measurement of advertisements (where use of sensitive information is based on explicit consent)
• Measurement of performance related to reservations and affiliate partnerships, and provision of tracking information to such partners

4. Provision to Third Parties, Entrustment and Joint Use

Except where permitted or required by laws and regulations, the Company may share, entrust or jointly use personal data as follows:

Entrustment (Data Processors)

Examples: cloud hosting providers, customer support providers, analytics platforms

Provision to Third Parties (Recipients Using Data for Their Own Purposes)

Examples: advertising networks, measurement providers (including provision of statistical data that does not identify individuals, based on consent where required)

Specific Recipients, Items and Purposes (Examples)

Examples of recipients, countries, data items, purposes and legal basis/consent include:

• Mixpanel (USA): event logs, device IDs – usage analytics – legitimate business necessity / performance of contract
• Google Analytics (GA4) (USA): events, advertising IDs – behavioral analytics – consent (for use of advertising IDs)
• CleverTap (USA): events and attributes – push notifications and re-engagement – consent
• Algolia (USA/EU): search queries – provision of search functionality – performance of contract
• Advertising SDKs (e.g., Google, Meta, etc.) (various countries): advertising IDs, events – behavioral targeting and ad delivery – consent

The Company may update the details of recipients, items and purposes from time to time in accordance with actual operations.

5. Cross-Border Transfers

The Company may provide or entrust personal data to recipients located outside Japan. In such cases, the Company will take necessary measures under the APPI, such as providing information on the legal systems of the relevant foreign countries and implementing appropriate contractual and other safeguards.

6. Cookies, Advertising IDs and Consent Management

The Company uses cookies and advertising IDs to perform behavioral measurement and deliver advertisements. Users can opt in or out by purpose category (e.g., analytics / advertising) through the consent management screen within the app. For resetting advertising IDs, Users should refer to the instructions provided by each OS.

7. Handling of Sensitive Information (Inference of Religion)

The Company does not directly obtain sensitive personal information such as religion. The Company also does not create or maintain attribute labels for individual Users such as "Muslim / non-Muslim".

Although a User's religious affiliation could potentially be inferred from viewing histories of content for Muslim users and similar data, the Company handles such data within a framework of:

• separating identifiers and aggregating data,
• minimizing access rights, and
• operating with short retention periods and deletion practices,

and does not use such data for automated decision-making that causes disadvantages to individuals or for discriminatory treatment.

If the Company uses or provides data that may include inferred religion for purposes such as advertisement delivery or data sales, the Company will obtain explicit opt-in consent in advance and will provide means for Users to withdraw such consent.

8. Retention Periods

• Account Information: retained for 1 year after account deletion (prioritizing compliance with laws and settlement of billing)
• Behavioral Logs: retained for 3 months from the date of last use

The Company may retain data for a longer period where required by laws and regulations.

9. Security Control Measures

The Company implements appropriate security control measures, including encryption during transmission and storage, minimization of access permissions, log audits, management of contractors and employee training.

10. Users' Rights

Users may request disclosure, correction, suspension of use, deletion, suspension of provision to third parties, and data portability (provision of copies) with respect to personal data held by the Company.

Requests can be made via the in-app menu [Settings → Privacy → Data Request] or by contacting the above contact point. Upon confirming the identity of the requester, the Company will respond in principle within 30 days.

11. Minors

Use of the Service by minors requires the consent of a parent or legal guardian. Regarding the collection of data from Users under 18 years of age, the Company may confirm such consent as necessary.

(Note: please select and fix the appropriate age threshold before final publication.)

12. Response to Incidents

If any leakage or other incident involving personal data is identified, the Company will investigate the facts, assess the impact and implement recurrence prevention measures. Where required by laws and regulations, the Company will notify the competent authorities and affected individuals.

13. Business Succession

In connection with a business transfer, company split, share transfer or other form of business succession, the Company may transfer personal data to the successor entity. The successor will manage the data at a level equivalent to that set forth in this Policy.

14. Amendments

If the Company amends this Policy, such amendments will be notified through in-app notifications or other appropriate means. If the amendments are material, the Company may obtain renewed consent from Users where necessary.

15. Contact

For inquiries regarding this Policy or the handling of personal information, please contact:

Email: ksaito@ehalal.co