Privacy & security policy

How A-Charge (I-S3 Co., Ltd.) handles personal data, payments, and communications.

Where a contract requires formal notices, that contract and this page (latest version) prevail.

We generally do not register users' names, phone numbers, or email addresses.
Card numbers are handled only on the payment provider's (e.g. Stripe) pages; A-Charge does not store them. We keep operational records such as payment IDs, usage time, amounts, and bay IDs.
Queues use anonymous digital tickets with no identity registration.
Location is used only for an arrival radius check and is not stored.
We use Google Analytics (cookies and similar technologies) on public pages to understand site usage. We do not use it to identify individuals.
Even when a charger (OCPP) provides a vehicle identifier, we do not bind it to a user account. We do not keep raw identifiers; we use an HMAC matching token only together with an active paid bay session.

HTTPS (TLS), plus HSTS, X-Content-Type-Options, Referrer-Policy and related headers.
API and encryption keys are managed in Google Cloud Secret Manager.
Sensitive owner fields such as bank account numbers are encrypted at the application layer before storage.
Admin tools are limited to authenticated users on our corporate domain (i-s3.com).
Cookies use Secure / HttpOnly / SameSite as appropriate.
Session start remains bay QR payment. A vehicle token is only a matching key to reduce mix-ups or aid reconnects; a token alone never starts charging.

Images may be captured for bay occupancy. Retention is limited (typically 24 hours; representative images up to about 30 days) with automatic deletion.
Where plates are processed, site signage and terms apply. Image analysis may use external AI (e.g. Google Vertex AI).
Camera images are used only to tell whether a bay is free or occupied. We do not use them to profile individuals for marketing.
Example on-site notice: "Cameras here check whether a bay is free. Images are used only for occupancy and are deleted after about 24 hours (representative images up to about 30 days). Contact: s_masuda@i-s3.com"
At sites in Taiwan, purpose, retention, and a contact point are posted on site under the Personal Data Protection Act. Where consent is required, signage and terms are used together.

Privacy inquiries: I-S3 Co., Ltd. · Mail: s_masuda@i-s3.com · TEL: +81-27-384-4646