Privacy & security policy

How A-Charge (I-S3 Co., Ltd.) handles personal data, payments, and communications.

Where a contract requires formal notices, that contract and this page (latest version) prevail.

We generally do not register users' names, phone numbers, or email addresses.
Card numbers are handled only on the payment provider's (e.g. Stripe) pages; A-Charge does not store them. We keep operational records such as payment IDs, usage time, amounts, and bay IDs.
Queues use anonymous digital tickets with no identity registration.
Location is used only for an arrival radius check and is not stored.
We use Google Analytics (cookies and similar technologies) on public pages to understand site usage. We do not use it to identify individuals.
Even when a charger (OCPP) provides a vehicle identifier, we do not bind it to a user account. We do not keep raw identifiers; we use an HMAC matching token only together with an active paid bay session.
To detect and record abusive access, the source IP address and requested path are kept in Google Cloud server logs for a limited period. They are not linked to any customer ledger or payment record.

HTTPS (TLS), plus HSTS, X-Content-Type-Options, Referrer-Policy and related headers.
API and encryption keys are managed in Google Cloud Secret Manager.
Sensitive owner fields such as bank account numbers are encrypted at the application layer before storage.
Admin tools are limited to authenticated users on our corporate domain (i-s3.com).
Cookies use Secure / HttpOnly / SameSite as appropriate.
Session start remains bay QR payment. A vehicle token is only a matching key to reduce mix-ups or aid reconnects; a token alone never starts charging.

Images may be captured for bay occupancy. Retention is limited (typically 24 hours; representative images up to about 30 days) with automatic deletion.
Where plates are processed, site signage and terms apply. Image analysis may use external AI (e.g. Google Vertex AI).
Camera images are used mainly to tell whether a bay is free or occupied. We do not use them to profile individuals for marketing.
If a paid bay is used without paying the parking fee, we may keep a representative image and plate number on the operator console to enforce site terms. We do not post them publicly, and we do not pursue every unpaid case.
Example on-site notice: "Cameras here check whether a bay is free and support enforcement of unpaid parking under site terms. Images are used by operators only and are deleted after about 24 hours (representative images up to about 30 days; egregious unpaid cases up to about 90 days). We do not post them publicly. Contact: s_masuda@i-s3.com"
At sites in Taiwan, purpose, retention, and a contact point are posted on site under the Personal Data Protection Act. Where consent is required, signage and terms are used together.

Privacy inquiries: I-S3 Co., Ltd. · Mail: s_masuda@i-s3.com · TEL: +81-27-384-4646