Privacy Policy

This English version is a translation provided for reference. If it differs from the Simplified Chinese version, the Simplified Chinese version prevails.

HAICO (the “Service”) respects your privacy. This policy explains what information we collect when you use the Service, how we use and store it, and what rights you have over your data. This policy forms part of the Terms of Service.

1. Information we collect

• Account information: the email address you provide when you sign up. If you sign in with a Google account, this is the email address and basic account identifier that Google provides to the Service. We never receive your Google password.
• Business data: the dispatch schedules, booking details, vehicle and driver lists, revenue and mileage records, team members, sharing settings and other data you enter while using the Service. You enter this content yourself, and it stays under your control.
• Payment information: when you subscribe to a paid plan, your card details are collected and processed directly by Stripe. The Service never handles or stores your full card number. We keep only the related information we need, such as subscription status and billing period.
• Inquiries: the content and attachments (such as screenshots) you send when you contact us by email. Screenshots may show customer names and amounts you have entered, so please check them before sending.
• Technical logs: to keep the Service secure and to troubleshoot problems, our infrastructure may record technical information such as access times, IP addresses and browser type.

2. How we use information

• To provide, maintain and improve the features of the Service;
• To identify your account and control access to data;
• To process payments and manage renewals for paid plans;
• To send you necessary service notices (such as verification emails, password resets and notices of important changes);
• To prevent abuse, fraud and security incidents, and to meet our legal obligations.

For operations and technical support, the Service’s system administrators can view the list of accounts, members’ email addresses and plan status in an admin screen. This access is used only for operations, troubleshooting and meeting legal obligations.

We do not sell your information, and we do not use the business data you enter for advertising or provide it to unrelated third parties.

3. Third-party services

We use the following third-party services to run the Service. Each one handles information only as far as needed to provide its own service, and is governed by its own privacy policy:

• Supabase: account authentication and database hosting (stores account information and business data).
• Stripe: payments and subscription billing.
• Google: optional third-party sign-in (only if you choose to use it).
• Cloudflare: hosting and delivery of pages (handles connection information such as your IP address when you visit).
• zipcloud: postal code lookup. When you enter a postal code in a booking, only that postal code is sent to this service to get the matching address. The postal code itself is not stored.
• Geospatial Information Authority of Japan: when you use “Pick on map” in a booking, the map is displayed, and the coordinates of the location you pick, the search terms you enter, or the address already filled in the address field are sent to this service to get the location and address.
• OpenStreetMap (Nominatim): when you search the map for places such as stations or hotels, or when the address field already contains text as you open the map, only that text is sent to this service to get the location.
• Google Maps: when you click “View route” in a booking or click an address on a shared page, that address is sent to Google Maps and opened there.

These services may process data on servers outside Japan. By using the Service, you consent to these necessary cross-border transfers.

4. Cookies and local storage

• The Service uses your browser’s local storage (such as localStorage) to keep you signed in and to remember interface preferences such as language, current account, view and whether banners are shown.
• In demo mode, which is not connected to the backend, sample data and the list of share links are also stored only locally.
• This data is stored only in your browser. The Service does not use advertising or tracking cookies.
• You can clear this data in your browser at any time. After clearing it, you will need to sign in again, and your interface preferences will return to their defaults.

5. Data storage and security

• Data is stored on cloud infrastructure with access controls, and is encrypted in transit over HTTPS.
• We separate each account’s data with account-level access permissions, so team members can access only what they are authorized to see.
• Anyone who has an external share link you create can view it without signing in, so the link itself works like a password. Share it with care, and delete it as soon as you no longer need it. Shared views do not include customer names or amounts. A link for a customer shows only the bookings you select. A link for drivers shows bookings that have not yet ended, along with their booking notes and flight numbers (all drivers’ bookings if you choose “All drivers”), so please do not put anything in notes that drivers should not see. Every share link shows each booking’s type (airport pickup, airport drop-off and so on), number of passengers, number of bags, and the type and number of child seats needed. Links for drivers and customers can also show pickup and drop-off locations: you choose whether to show them when you create the link (and can switch this later), and you can also hide them for individual bookings (for example, when the pickup location is a customer’s home). An expiry must be set when you create a link (30 minutes by default, and up to 30 days from the time you set it, each time you set it). Once a link expires or is revoked, it can no longer be viewed. You can set a new expiry at any time: an expired link can be viewed again once you re-enable it, but a revoked link cannot be restored.
• Data is kept for as long as your account exists. After you delete your account, we will delete or anonymize data relating to you within a reasonable period, except for billing records we are required by law to keep.
• Although we take reasonable security measures, we recommend that you also keep your own backups of important business data.

6. Your rights

• You can view, correct or delete the business data you have entered in the Service at any time. Data you delete in the Service is first hidden and kept for a period (you can see it in Trash), and is then permanently erased. Vehicle and driver records are kept with a deleted flag and are permanently erased when you delete your account.
• You can delete your account in account settings. When you do, your subscription is cancelled immediately and the remaining period is not refunded. If you are the only admin of a team that still has other members, you must first hand over admin rights or remove the members; otherwise, account deletion will be stopped.
• To get a copy of your data, restrict processing, or ask questions about this policy, please contact us as described below.

7. Children’s privacy

The Service is intended for business use by companies, sole proprietors and the like. It is not offered to children, and we do not knowingly collect children’s personal information.

8. Changes to this policy

We may revise this policy from time to time and will publish the latest version on this page. For significant changes, we will make reasonable efforts to notify you through an in-app notice or by email.

9. Contact us

If you have any questions about this Privacy Policy, or wish to exercise the rights above, please get in touch through our Contact us page.

Last updated: September 2026