ENDO

Privacy policy

Last updated: 29 October 2026

This policy explains what personal information ENDO collects when you visit en-do.net, contact us or book a tour, how we use it and the choices you have. It applies wherever you live, and includes extra details for visitors from the EU and UK, the United States and Australia.

Who we are

ENDO is run by 合同会社縁道 (ENDO LLC), 3-1-12 Higashikanmaki, Takatsuki, Osaka, Japan. We decide how your information is used (under the GDPR we are the “controller”). For anything about your privacy, email info@en-do.net.

What we collect and why

When you book a tour: your name, email address, phone number, the tour and date, and how many adults, children and infants are in your group. We use this to confirm and run your tour, contact you about it, and keep the records Japanese tax law requires. Payments are handled by Stripe on its own secure page. We never see or store your full card details.

When you contact us: your name, email address, the tour you ask about and your message. We use it to reply and, if you go ahead, to arrange your booking.

When you browse the site: our hosting provider keeps short-lived technical logs (IP address, browser type, pages requested) to keep the site running and secure. If you accept analytics cookies, we also collect information about how you use the site (see Cookies below).

We don't ask for sensitive information such as health details. If you tell us about a medical condition or accessibility need so we can plan your tour, we use it only for that.

Our legal bases under the GDPR are:

Cookies and similar storage

Always on (strictly necessary): your browser's local storage remembers the currency you chose to see prices in (endo-currency) and your cookie choice (endo-consent-2). Neither is sent to us or used to track you. When you start a booking, a cookie (endo-hold) stores a random number, so that starting another booking releases the date you were holding before. It expires after a day and isn't used to track you.

Only if you accept (analytics): we use PostHog to understand which pages people visit and how they use the site, so we can improve it. PostHog sets cookies whose names begin with ph_. It records page views, clicks and general device and location information (country and city, worked out from your IP address). We don't use it for advertising, and we don't combine it with your booking details.

With the same consent, PostHog also makes recordings of visits (session replay): how the page moved, where you clicked and scrolled, as if replaying a video. We use them to find pages that are confusing or broken. Anything you type into a form is hidden in recordings, and so are the booking details shown after you pay.

Only if you accept (advertising): we use Google Ads conversion tracking to see which of our ads on Google led to a booking, so we know which ads are worth paying for. Google sets cookies whose names begin with _gcl, and when you book, we tell Google the amount, a booking reference and a hashed (scrambled) copy of your email address, which Google uses only to match the booking to an ad click. Google receives your IP address and device information and handles them under Google's privacy policy. We have turned off ad personalisation, so this isn't used to show you personalised ads.

You can change your mind at any time with the Cookie settings link at the bottom of every page. If your browser sends a Global Privacy Control signal, we treat it as a refusal.

When you pay, Stripe's checkout page uses its own cookies to process the payment and prevent fraud. Those are covered by Stripe's privacy policy.

Who we share it with

We share personal information only with these service providers, and only as far as they need to do their job:

We also give the guide leading your tour your name, group size and contact details. We may disclose information when Japanese law requires it, for example to the police after an accident.

We do not sell your personal information. Only if you accept advertising cookies, Google learns that a visit from one of our ads led to a booking; we don't use this for targeted or cross-context behavioural advertising, and a Global Privacy Control signal turns it off. We don't make decisions about you by automated means alone.

International transfers

We are based in Japan, and our service providers store data in other countries, including the United States and India. The European Commission has recognised Japan as giving personal data adequate protection. For transfers to providers in other countries, we rely on their contractual commitments to protect the data, including the EU Standard Contractual Clauses where they apply. As required by Japan's Act on the Protection of Personal Information (APPI), we make sure our providers handle data to standards equivalent to Japanese law. Contact us for details of the countries involved and the safeguards in place.

How long we keep it

Keeping it safe

Your information is sent over encrypted connections and stored with providers that encrypt data at rest. Only the people who need it to run your tour can access it. If a breach put you at risk, we would tell you and the relevant authorities as the law requires.

Your rights

Wherever you live, you can ask us what information we hold about you, and ask us to correct it, delete it or stop using it. Email info@en-do.net. We reply within 30 days and may ask you to confirm your identity first. Making a request is free and won't affect how we treat you.

EU and UK: you also have the right to restrict or object to our use of your data, to receive it in a portable format, and to withdraw consent at any time. You can complain to your local data protection authority.

United States: depending on your state (for example California, Colorado, Virginia or Texas), you have the right to know, access, correct and delete your personal information, and to opt out of its sale, sharing for targeted advertising or profiling. We don't do any of those, but Global Privacy Control signals are honoured. An authorised agent may make a request for you.

Australia: you can ask to access or correct your information under the Australian Privacy Principles. If you're not happy with our response, you can complain to the Office of the Australian Information Commissioner (OAIC).

Japan: you can request disclosure, correction, suspension of use or deletion under the APPI. If you're not satisfied, you can contact the Personal Information Protection Commission (個人情報保護委員会).

Children

Our site is not aimed at children under 16, and we don't knowingly collect their information. When an adult books a tour, we only record how many children and infants are in the group, not their names.

Changes

If we change this policy, we'll update the date at the top. If the change is significant, we'll point it out on the site or by email.

Contact

合同会社縁道 (ENDO LLC), 3-1-12 Higashikanmaki, Takatsuki, Osaka, Japan. Email info@en-do.net, or use our contact form.