Privacy
Privacy
We state clearly what Sumilca stores and the scope of information obtained through Google login.
What data we store
| Data item | Purpose | Retention period | Deletion method |
|---|---|---|---|
| Search conditions (commute destination address, commute/school conditions, priorities) | Computing property comparison scores and reproducing the search experience | While the account is active. Erased on deletion request | Deletion request link in My Page or a deletion request email |
| Summary of evaluation results (comparison scores, memos, display order) | Re-displaying saved comparison results | While the account is active. Erased on deletion request | Deletion request link in My Page or a deletion request email |
| Favorite property identifiers | Showing the favorites list and streamlining comparison | While the account is active. Erased on deletion request | Deletion request link in My Page or a deletion request email |
| PDF reports you create while logged in | Letting you download a report again without re-creating it (shown as already created) | 30 days from creation (re-creating one for the same property replaces it) | Deleted automatically when it expires, or by a deletion request email |
| Session information (cookie for keeping you logged in) | Maintaining login state and deterring unauthorized access | Up to 30 days (auto-expires when inactive) | Logging out, deleting the cookie in your browser, or expiry |
| AI assistant connections (connected app name, connection tokens, tool usage log) | Letting the AI assistants you authorize use Sumilca on your behalf, and preventing misuse | Access tokens 1 hour; refresh tokens up to 30 days (rotated on every use). Only cryptographic hashes of tokens are stored | Disconnect on the Settings page "AI assistant connections" (revoked immediately), or a deletion request |
Inputs such as addresses are used only for comparison, and for free features we do not collect personal information such as your name, phone number, or workplace. However, if you use paid features, we handle information such as your name, email address, and payment details through our payment processor Stripe in order to process billing (see “Use of external services (third parties)”).
How we handle transmission and storage
- Communications are encrypted with TLS to prevent eavesdropping or tampering by third parties.
- Stored data is limited to the minimum needed for comparison and display, and is not used for any other purpose.
- Analytics and quality improvement are based on statistical aggregation; we do not handle personally identifiable information.
Use of external services (third parties)
- We use Google (Google OAuth) for login authentication. The information obtained is limited to the scope described in “Information obtained via Google login” on this page.
- Inquiry form submissions are relayed via the external service Web3Forms for email notification. The details you enter (email address, message body, etc.) pass through that service.
- If you use paid features, we use Stripe (Stripe Payments Japan G.K. and Stripe, Inc. in the United States) to process payments. The information required for payment (name, email address, payment details, etc.) is processed through Stripe, and your card number is never stored on our servers.
- We may use Google Analytics (GA4) to analyze site usage. Information collected via cookies and similar technologies is handled under Google's privacy policy, and is not sold to third parties for advertising purposes.
- To operate the service, we may use providers such as hosting. In every case, data is handled only within the scope of the intended purpose.
- When you purchase a PDF report without logging in, we handle the email address you enter at checkout in order to send you the report's download link (payment is processed via Stripe, above).
- If you connect an AI assistant (such as Claude), we provide the app you authorized with search results, property assessments, saved conditions and similar data, only to the extent the app requests them. The AI assistant provider handles that data under its own privacy policy. Sumilca does not receive your conversation with the AI assistant; we only receive the parameters included in each tool call. You can disconnect at any time.
We do not provide data to third parties for advertising purposes, nor sell data without your consent.
Provision to third parties overseas (cross-border transfer)
To process payments for paid features, personal data such as your name, email address, and payment details may be handled outside Japan (primarily in the United States, where Stripe, Inc. is located) through Stripe above. This may constitute a “provision to a third party in a foreign country” under Japan's Act on the Protection of Personal Information. For the categories of information transferred, the purpose of use, and details of how Stripe handles it, please see Stripe's privacy policy. Stripe Privacy Policy
Information obtained via Google login
The Google OAuth scope is limited to the following.
- User ID (the identifier issued by Google)
- Name (the display name registered in your profile)
- Email address
- Profile image URL
The information obtained is used only for identity verification, login display, and sending the email alerts you turn on yourself (new-listing alerts). It is not used for advertising or provided to third parties. You can stop email alerts at any time from the alert settings.
Data retention and deletion
To delete your account, you can launch a preset deletion request email from the in-app settings page (deletion request).
If you request by email, please use the deletion request template and contact our inquiry desk. We will delete your saved search conditions and favorites.
- Sessions/cookies are retained for up to 30 days and automatically expire when inactive.
- We aim to handle deletion requests within 7 business days of receipt.
Where there is an exceptional legal obligation to retain data, the retention period is extended only to that extent.
Last revised date, operator information, and inquiry desk
- Last revised
- October 7, 2026
- Operator
- Hoshimono Design
- Address
- Hamamatsucho Daiya Bldg. 2F, 2-2-15 Hamamatsucho, Minato-ku, Tokyo 105-0013, Japan
- Business information
- Act on Specified Commercial Transactions (Legal notice) and business information
- Contact
- Inquiry page
Revision history (summary of changes) and past version archive
We record important revisions together with a summary of what changed. Past versions can be checked from the archive below.
| Revision date | Summary of changes | Past version archive |
|---|---|---|
| October 7, 2026 | Added saving of the PDF reports you create while logged in (30 days from creation) to the scope of stored data, with the new feature that lets you download a report again without re-creating it. | — |
| October 5, 2026 | Added sending the alert emails you turn on yourself to the purposes for which the email address obtained at login is used, following the launch of new-listing alerts by email. | — |
| October 4, 2026 | Added the data stored for AI assistant (MCP) connections (connected apps, tokens, usage log) and the scope of data provided to the apps you authorize, following the launch of AI assistant connections. | — |
| July 14, 2026 | Changed the payment processor to Stripe and documented Stripe's third-party handling and the cross-border transfer of data associated with paid-feature payments. Also documented the use of Google Analytics (GA4) for site usage analysis, and reconciled the statement that free features collect no personal information with how data is handled when paid features are used. | — |
| June 2, 2026 | Unified operator information to Hoshimono Design and stated the use of external services (Google login and the Web3Forms relay for the inquiry form). Added a link to the Act on Specified Commercial Transactions notice (/legal). | — |
| February 14, 2026 | Added a summary of changes and links to the past version archive, strengthening transparency as a legal page. | — |
| March 8, 2025 | Documented the scope of stored data, information obtained via Google login, and the data retention/deletion flow. | — |
| January 15, 2025 | Initial release (basic policy, inquiry desk, revision date stated). | — |