Privacy policy

Last updated 3 November 2026

My Plan Japan is an itinerary planning service run by a sole trader in Melbourne, Australia. This page explains what information we collect, why we collect it, who we share it with, and the choices you have. As a small business, My Plan Japan is not covered by the Australian Privacy Act 1988, but we follow the Australian Privacy Principles anyway.

What we collect

• Enquiries and planning requests: your name, email address, and the trip details you send us, such as travel dates and length, who is travelling, places you want to see or avoid, accommodation preferences, budget, anything already booked, and anything else you choose to share.
• Orders: your name, email address, chosen package, any extras and notes, and a record of which version of our Terms you agreed to and when. Payment is handled by Square (see below). We never see or store your card details.
• Trip questionnaire: the answers you give in the questionnaire we send once you have paid, which we use to plan your itinerary.
• Accounts: if you create an account, your name, email address, password (stored in hashed form), and any itineraries you save. If you share an itinerary using a share link, anyone who has that link can view it.
• Newsletter: your email address, if you subscribe.
• Emails: correspondence you send us, so we can plan your trip and answer your questions.

We collect information about children only from the adult booking the trip, for example ages for pacing and ticket prices. We collect health, dietary or mobility details only with your consent and only to plan your trip. If you tell us about people travelling with you, such as a partner's dietary needs, please check they are happy for you to share it and let them know about this policy.

We need your name, email address and trip details to plan and deliver your itinerary. Health, dietary and mobility details are optional. If you use the itinerary planner without an account, your itinerary stays in your browser and is not sent to us.

How we use it

We use your information to:

• answer your enquiries, and plan and deliver your itinerary
• process your order and payment, and send the emails that go with it, such as your order confirmation, invoice, questionnaire and itinerary
• run your account and the free planning tools, including any share links you create
• send our newsletter, only if you have subscribed
• keep records of orders, what you agreed to and our emails with you, for tax and in case of a dispute
• keep the site secure and stop spam and fake sign ups, for example by checking that an email domain can receive mail
• count visits to the site without identifying you (see Cookies and analytics)

We do not use your information for anything else without asking you first, unless the law requires it. We do not sell your personal information, we do not use it for advertising, and we do not make automated decisions about you.

Service providers we rely on

Like most small businesses, we use a small number of third party services to run the site. Your information passes through them only as needed to provide the service:

• Supabase: hosts accounts, saved itineraries, and newsletter signups. Its servers are in Singapore.
• Resend: delivers our newsletter and account emails.
• Make and Gmail: route enquiry and order form submissions to us by email.
• Cloudflare Turnstile: checks that our contact and order forms are sent by a person rather than a bot, using details about your browser and connection. Cloudflare says it uses these only to detect bots.
• Square: processes payments and issues invoices. Your card details go to Square directly and are governed by Square's privacy policy.
• PDFShift: turns an itinerary into a PDF when you export one. The itinerary's content is sent to PDFShift to make the file.
• Google Forms and Google Sheets: the trip questionnaire you fill in after ordering is a Google Form, and we keep our order records in Google Sheets.
• Google Maps: place searches, photos and ratings on the site come from Google Maps, so Google sees your IP address and anything you type into a search. Maps on our pages load only when you choose to show them. Some itineraries are delivered as Google My Maps links.
• Google Public DNS: when you create an account, we check that your email domain can receive mail. Only the domain (the part after the @) is sent to Google, not your full address.
• Content and rate services: parts of the site load from other services. jsDelivr supplies the code behind accounts and sign in, and ExchangeRate-API the day's exchange rates for prices shown in other currencies. Like any website your browser loads something from, they see your IP address.

Some of these providers store data outside Australia, mainly in Singapore, the United States, the European Union, Japan and South Africa. Google, Square, Cloudflare and the content and rate services also use data centres in other countries. We choose reputable providers with their own privacy and security commitments.

Links to other sites

Our pages link to other websites, such as official tourism sites, transport operators, booking partners and our social media pages. When you follow a link, you leave our site, and that site's own privacy policy applies to anything it collects or you enter there.

The hotel search forms on our pages open the booking site you choose with your destination, dates and number of guests filled in. We do not keep a copy of your search.

Some links are affiliate links. The partner can tell you came from us, which is how we earn a commission. See our affiliate disclosure for details.

Cookies and analytics

The site does not run advertising trackers. Any cookies or local storage used are functional, for example, keeping you signed in to your account or remembering an itinerary you are working on in your browser. Google Maps on our pages load only when you choose to show them.

To see how the site is used, we use Cloudflare Web Analytics. It counts page visits, the page or site a visitor came from, their country and the type of device and browser. It sets no cookies, does not track you across other sites, and does not identify you.

Server logs

Like every website, our hosting provider, Cloudflare, keeps standard server logs: IP address, browser type, pages requested, and timestamps. These are used for security and to keep the site running, not for advertising, and we do not combine them with the information above to identify you.

Keeping it safe

Your information is held by the service providers listed above, in our email and in our order records. Connections to the site are encrypted, passwords are stored in hashed form, and only we can see your details, along with our providers as needed to run their service. We take reasonable steps to protect your information from misuse, loss and unauthorised access.

How long we keep it

We keep enquiry and order information for as long as needed to deliver your itinerary and meet our record keeping obligations, then delete or de-identify it. Order and payment records are kept for five years, as Australian tax law requires. Enquiries that do not go ahead are deleted after 12 months. Account data is kept until you delete your account. Newsletter addresses are kept until you unsubscribe.

Your choices and rights

You can unsubscribe from the newsletter at any time using the link in any email. You can ask us to access, correct, or delete the personal information we hold about you by emailing [email protected]. There is no button on the site for deleting your account: to delete it, email us from the address on the account and we will remove the account, your saved itineraries, and any newsletter subscription within 30 days, then confirm by reply. We may retain minimal records where the law requires it (for example, tax records of paid orders). If you are in a region with additional privacy rights (such as the UK, EU, or California), we will honour those rights for your information too. Where UK or EU law applies, our legal bases for processing are performing our contract with you (delivering what you ordered), your consent (the newsletter), and our legitimate interests in running and securing the site. For any health, dietary or mobility details you give us, the basis is your explicit consent, which you can withdraw at any time by emailing us.

Complaints and data breaches

If you have a privacy complaint, email us and we will reply within 30 days. If you are in the UK or EU and are not satisfied with our reply, you can contact your local data protection authority.

If a data breach is likely to cause you serious harm, we will tell you, and any regulator we are required to tell, as soon as practicable.

Changes to this policy

If we change how we handle personal information, we will update this page and the date at the top.

Questions

Please email [email protected] if you have any questions.