Privacy policy

Section 1Who we are

This policy explains how the company that operates OmniPM (“we”) handles personal information under Japan’s Act on the Protection of Personal Information (個人情報保護法, the “APPI”).

• Business name: Pacific Business KK (パシフィックビジネス株式会社)
• Address: Mukai Building 5F, 1-13-14 Sekiguchi, Bunkyo-ku, Tokyo 112-0014, Japan
• Representative: Paul Feinberg
• Contact: info@omnipm.app

Section 2What this policy covers

It covers the personal information we handle for our own purposes: visitors to omnipm.app, people who apply for the beta or contact us, and the people who use OmniPM accounts for our customers.

Section 4 explains how we handle the personal information that our customers — rental operators — put into OmniPM about their guests, residents, owners and others. For that information, the operator is the responsible business; please read the operator’s own privacy policy as well.

Section 3What we collect

• Website visitors. This website sets no analytics or advertising cookies and uses no tracking tools. Our hosting provider’s servers record technical data — such as IP address, browser type, the pages requested and the time — to deliver the site and protect it from abuse. If you switch language, one cookie remembers your choice (Section 8).
• Beta applicants and people who contact us. What you give us: your name, work email, company, how many units you run and which kinds of stay, your message and your language.
• Account users. Name, email address, role and the operator you work for; sign-in records (passwords and one-time codes are stored only as hashes); records of certain actions in OmniPM — for example, every AI lookup of resident data is logged; and the messages you send to our support.
• Billing contacts. The names, email addresses and company details we need to bill the subscription.

Section 4Information we handle for operators (entrustment)

Operators use OmniPM to manage guests, residents, owners, contractors and prospects. That can include names and contact details, passports and other IDs, reservation and contract details, payment records and proofs, messages and photos.

For this information, the operator is the business handling personal information, and we handle it on the operator’s behalf as an entrusted party (委託先) under Article 27(5)(i) of the APPI. We use it only to provide OmniPM to that operator and following the operator’s instructions — never for our own marketing.

If you are a guest or resident and want to see, correct or delete your information, please contact the operator you stay with. If you contact us, we will pass your request to the operator and help them respond.

We keep each operator’s data apart and protect it as described on our security page.

Section 5Purposes of use

We use personal information to:

1. provide, operate and maintain OmniPM and this website;
2. create and manage accounts and verify who is signing in;
3. review beta applications, answer inquiries and arrange calls;
4. bill for subscriptions and manage our contracts with customers;
5. provide support and send service messages — sign-in codes, notifications, changes to our terms, maintenance notices;
6. keep OmniPM secure, prevent abuse and fraud, and investigate incidents;
7. improve OmniPM and develop new features;
8. comply with the law and respond to lawful requests from public authorities.

We do not use personal information beyond these purposes without consent, except where the law allows it.

Section 6Sharing and service providers

We do not sell personal information. We do not provide it to third parties except with consent, where the law requires or permits it — for example, a lawful request from a court or the police — or as described below.

We entrust handling to service providers that help us run OmniPM — the same services listed on our security page:

• Railway — application hosting and the PostgreSQL database
• Cloudflare R2 — private file storage: IDs, photos, contracts
• Anthropic — AI: ID and payment checks, drafts, translation
• Resend — sign-in codes, notification email and beta application email

Payments (Square, PayPal, Wise), messaging (LINE, WhatsApp), Google and freee are connected by operators on their own accounts, and handle information under the operator’s own agreements with them.

We choose providers carefully and supervise how they handle the information we entrust to them.

Section 7Information handled outside Japan

Some of the providers above are based in the United States and may handle information there or in other countries. OmniPM’s application and database run in the United States (Railway, US East region); uploaded files are stored with Cloudflare R2.

When we entrust personal information to providers abroad, we use providers that maintain systems equivalent to those the APPI requires, and we take the measures the APPI requires to keep it that way. On request, we will tell you the countries involved, how personal information is protected there, and the measures those providers take.

Section 8Cookies

• This website sets one cookie, omnipm-locale, and only when you switch language. It remembers English or Japanese for one year and holds nothing else.
• We use no analytics, advertising or social-media tracking on this website. If that changes, we will update this policy first.
• The OmniPM dashboard uses essential cookies to keep you signed in. They are httpOnly and Secure and expire on their own — see our security page.

Section 9How long we keep it

• Beta applications and inquiries: as long as we need them for the purposes in Section 5, then deleted.
• Account and customer data: for the length of the subscription, then for the export period in our terms of service, after which it is deleted — except where the law requires us to keep it.
• Server logs: for the limited period needed for security and troubleshooting.

A published retention schedule for ID photos is on our security roadmap.

Section 10Security measures

We take the organisational, human, physical and technical measures the APPI requires, including:

• Policy: we handle personal information only for the purposes in this policy, and review this policy as OmniPM changes.
• Organisation: access to personal data is limited to those who need it for their work. If a leak occurs, we respond and report as the APPI requires, including to the Personal Information Protection Commission and to the people affected.
• People: everyone who handles personal data for us is bound by confidentiality.
• Physical: OmniPM runs in our hosting providers’ data centres; we protect the devices we use to work on it.
• Technical: HTTPS only; operator secrets encrypted with AES-256-GCM; passwords and codes stored only as hashes; IDs and payment proofs in private storage, opened by links that expire within an hour; each operator’s data kept apart down to the database row; access by role.
• Outside Japan: where information is handled abroad, we check the personal-information rules of the countries involved (Section 7).

More detail is on our security page.

Section 11Your requests

As the APPI provides, you can ask us to disclose the personal information we hold about you or the records of its provision to third parties, to correct, add to or delete it, or to stop using it or providing it to third parties.

Write to info@omnipm.app. We confirm your identity before acting and reply without undue delay. We may charge a reasonable fee for disclosure requests as the law permits; if so, we tell you the amount first.

For information we handle on behalf of an operator, see Section 4.

Section 12Changes to this policy

We may update this policy. We post the new version on this page with its date, and tell customers by email or in the dashboard when a change is significant.

Section 13Contact

Questions and complaints about how we handle personal information: info@omnipm.app. Postal address: Pacific Business KK, Mukai Building 5F, 1-13-14 Sekiguchi, Bunkyo-ku, Tokyo 112-0014, Japan.