Privacy policy

Offbeat Buddy is operated by Maxime Lebail, a sole proprietor established in Japan. I am responsible for the personal information handled for this business and am the data controller where that term applies.

Postal address: エイブル創久, 455 Shimogojocho, Shimogyo-ku, Kyoto 600-8373, Japan
Email: hello@offbeatbuddy.com
Telephone: +81 70 2643 3048

You can use these details for privacy questions, requests or complaints. Please do not include sensitive information in an email subject line.

Most information comes directly from you:

• Enquiries and bookings: your name, email address, telephone number, age or age confirmation, dates, preferred activities, meeting arrangements and messages.
• Preferences and practical needs: interests, food preferences and, only where relevant and separately agreed, accessibility needs or allergies.
• Emergency contacts: the person's name, telephone number and relationship to you, if provided. Tell them and give them this policy. I use their details only for emergencies and provide any further notice required.
• Payments: transaction references, amounts, payment status, refunds and the billing details needed for records. Payment providers collect the financial information they need directly.
• Accounts and subscriptions: account details, subscription preferences, and records of your privacy choices.
• Reviews, photos and buddy applications: what you submit, your chosen public name, relevant experience and availability, and permission records where publication is involved.

The website and its providers also process technical information, such as IP addresses, browser and device details, requested pages, timestamps and security events. Optional analytics and advertising tools can collect identifiers, page activity and campaign interactions when permitted by your choices.

I also receive payment confirmations and reports from the providers involved. If an emergency contact's details come from a customer, that customer is the source. Information required for a particular form is marked; without essential contact, booking or payment details, I may be unable to respond or provide the requested service.

The table explains the purpose of each use. The legal-basis column applies where the EU or UK GDPR governs that processing; it does not replace the separate requirements of Japan's APPI.

Scroll sideways to see the full table ↔

If someone books for another adult who is not a party to the contract, I rely on the legitimate interest in coordinating that requested participation where appropriate, rather than treating the booker's contract as that participant's contract. The booker should share this policy with each participant; I provide any additional notice required. One person cannot give another adult's health-data consent merely by paying for the booking.

I assess legitimate interests against your rights; you can object as explained below. The proposed setup does not use solely automated decisions producing legal or similarly significant effects.

You do not need to tell me why you want company, disclose a diagnosis or provide medical records. General preferences often give me everything I need.

If an allergy or accessibility requirement reveals health information, I ask for separate, explicit permission before collecting or recording it for the relevant hangout. A photo or newsletter permission form does not cover this use. Please use the designated consent route rather than putting health information into an ordinary contact form.

You can withdraw that permission by contacting me. I will stop the consent-based use and remove the information unless a specific lawful reason requires limited retention. If a practical arrangement cannot be made safely without it, I will explain the options; refusing permission does not automatically prevent you from booking another suitable activity.

An age check may involve looking at a passport or other suitable identification on the day. I do not need a copy, photograph or document number for this check. The proposed record is limited to whether the relevant age requirement was verified and the date of the check.

I am currently the only person within Offbeat Buddy with routine access to customer information. That does not mean nobody else processes it: the following service providers support the business, and their authorised personnel may have access where necessary.

Scroll sideways to see the full table ↔

Payment services, banks and advertising platforms may also act as independent controllers for their own legal, fraud-prevention or other disclosed purposes. Their notices explain those uses: Cloudflare, Google, Stripe, Wise and Meta.

I do not routinely send customer details to cafés, venues, affiliate partners or a personal safety contact. If you request an introduction or another disclosure, I explain what needs to be shared first. I may disclose limited relevant information to emergency responders, authorities or professional advisers when a lawful emergency, legal duty or legal claim requires it. This is not permission for unrestricted sharing.

If another buddy will need your details to deliver a booking, I will tell you who is involved and what information is needed before that arrangement proceeds.

I operate in Japan. International providers may process information in other countries, whose privacy laws may differ from those where you live.

I do not treat your use of the website as blanket consent to international transfers. Where a transfer requires your informed consent, the necessary information must be provided before you decide. You can contact me for information about the safeguards applying to your data, including the continuing measures used by a foreign recipient where the APPI provides that right.

Essential technologies support functions such as security, sign-in, transactions and remembering privacy choices. Optional technologies serve different purposes, including measuring readership and understanding advertising results.

The proposed launch policy is to keep optional analytics and advertising tracking off until you choose to enable the relevant category. Refusing them does not prevent you from reading the site or requesting a hangout. You can subsequently change your choices through the website's privacy settings.

The privacy settings must identify each active tracking recipient, the information transmitted, its purposes and storage duration. This includes relevant affiliate tracking and embedded content. A general affiliate-disclosure statement is not a substitute for those details.

I do not include health information, emergency-contact details or private messages in analytics or advertising events. Customer-list uploads, enhanced conversions and server-side advertising feeds are outside this draft's proposed setup and require a separate assessment and notice before introduction.

Some links can generate a commission, as explained in my affiliate disclosure. Following a link may send you to another website or through a tracking service, which can receive technical information and a referral identifier.

I do not send your booking contact details to a provider simply because you follow an affiliate link. Before an on-site affiliate tracker receives information, it must be identified in the privacy settings and handled according to the applicable choice requirements. The destination website's own privacy and cookie notices govern its subsequent collection.

Booking a hangout does not subscribe you to marketing. Newsletter subscription is a separate choice, and every marketing email includes an unsubscribe option. You can also email me to stop it. Necessary booking and payment messages are separate from marketing.

Permission to publish a review or identifiable photo is also separate from your booking and newsletter subscription. The permission request identifies the content, public name and publication channels. You can decline without affecting the service.

You may withdraw publication permission by contacting me. I will stop new uses and remove the material from channels I control where applicable. I cannot guarantee recovery of copies independently saved or shared by others, but that does not remove my responsibility to respond to your request.

Scroll sideways to see the full table ↔

Advertising and affiliate identifier lifetimes must be specified in the tracking schedule. Independent payment providers retain their own records under their notices. A specific legal duty, investigation or dispute may justify preserving relevant records longer; unrelated information is not kept for that reason.

The five-year core-record period is not a statement that every legal claim expires after five years. A particular injury, incident or dispute may require a separate, restricted file for the relevant legal period, with the reason and review date recorded.

The proposed launch safeguards are restricted access, strong authentication for administrative accounts, protected devices, secure transmission, controlled backups, secure storage of paper permissions and scheduled deletion. Their implementation must be verified before this description is published.

I remain responsible for selecting and overseeing providers appropriately. I will assess suspected personal-data incidents and notify affected people and the appropriate authority where required. You can request further information about relevant safeguards without disclosure of details that could compromise security.

Email hello@offbeatbuddy.com to ask about your information or exercise your rights. Describe the information or activity concerned. I may request proportionate verification; please do not send a passport copy by default.

Under the APPI, applicable rights include requesting notification of purposes, access to retained personal data and relevant third-party-provision records, correction, and cessation of use or provision where the legal conditions are met.

Where EU or UK GDPR applies, you may also have rights to erasure, restriction, portability, objection and withdrawal of consent. You can object to direct marketing at any time. Other rights depend on the basis and circumstances of the processing; required accounting or claim records may need to remain restricted rather than deleted.

Withdrawal does not make earlier lawful processing unlawful. Requests are normally free, and I respond within the applicable legal time limit; where GDPR applies, normally within one month, subject to permitted extensions and verification rules. If I cannot fulfil a request, I explain the reason and the available next steps.

You can also approach Japan's Personal Information Protection Commission, the relevant EEA supervisory authority, or the UK's Information Commissioner's Office where appropriate.

Buddy hangouts are for adults. The proposed newsletter age threshold is 16; younger readers must not subscribe unless a suitable parental-permission process is introduced. If you believe a child has provided information contrary to these arrangements, contact me so I can review and address it.

I update this policy when the service or its information practices change. The published version will show its effective date. Significant changes will be brought to your attention as appropriate, and a new consent will be requested where required.