Privacy Policy

1. Who we are

CapyClimb is a climbing gym in Nakano, Tokyo, operated by TheCapybaraCompany (Corporate Registry Number: 1200-03-031084), registered at B1, 5-61-4 Nakano, Nakano-ku, Tokyo 164-0001, Japan. In this policy, “CapyClimb”, “we”, “us”, and “our” refer to that entity. We are the data controller for the information described below.

If you have any questions about this policy or how we handle your information, please contact us at privacy@capyclimb.com.

2. What we collect

We collect only the information we need to give you safe access to the gym and to fulfill the memberships and passes you purchase from us.

Account info

• Email address
• Name
• Date of birth
• Gender
• A unique account identifier issued by Amazon Cognito (our authentication provider)

Profile preferences

• Home gym preference
• Weight (optional)
• Location string (city or region you enter as free text in your profile)

Usage data

• Gym check-ins and door scans (date, time, location)
• Pass redemptions and bookings

Purchase data

• Passes you have purchased
• Orders and order history
• Payment confirmation records

Payment card numbers are processed by [payment provider TBD] and are not stored on our systems. We only receive a confirmation that the charge succeeded, the amount, and a tokenised reference we can use to issue a refund.

We do not use third-party tracking SDKs, we do not collect advertising identifiers (such as IDFA), we do not perform cross-app or cross-site tracking, and we do not collect precise device location.

3. How we use it

We use your information to:

• Provide gym access and verify your right to enter
• Manage your membership, including renewals and account changes
• Fulfill purchases and issue receipts
• Send transactional notifications (e.g. order confirmations, membership reminders, security alerts)
• Investigate safety incidents and abuse of our service, where necessary
• Improve the CapyClimb service in aggregate (for example, understanding peak usage hours)

We do not use your information for advertising, we do not run third-party analytics SDKs in the app, and we do not sell your personal information to anyone, for any purpose.

4. Sharing

We share personal information only with service providers we rely on to run CapyClimb. Each of these is contractually bound to use your data only on our behalf. The categories are:

• Cloud hosting — Amazon Web Services (AWS), Tokyo (ap-northeast-1) region
• Authentication — Amazon Cognito
• Payment processing — [payment provider TBD]
• Email delivery — [email delivery vendor TBD]

We do not share your information with marketing partners, advertising networks, or data brokers. We may disclose information when required by Japanese law, a valid court order, or to protect the safety of our members and staff.

5. Retention

We keep your account and profile information for as long as your account is active. When you delete your account, we delete your profile from our active systems promptly.

• Encrypted operational backups may retain your data for up to 35 days after deletion before they are rotated out.
• Access logs (door scans and check-ins) are retained for [18 months — TBD] for security audit purposes, then deleted.
• Records we are legally required to keep (for example, tax and accounting records relating to purchases) are retained for the period required by applicable Japanese law.

6. Your rights

Under APPI and, where applicable, GDPR, you have the right to:

• Access the personal information we hold about you
• Correct information that is inaccurate or incomplete
• Delete your personal information
• Receive a copy of your data in a portable format
• Withdraw consent you have previously given (without affecting processing before the withdrawal)
• Object to or restrict certain processing

You can delete your account yourself from inside the CapyClimb app: open Profile → Delete account. For any other request, email privacy@capyclimb.com from the email address on your account. We will respond within a reasonable time, and in any case within the period required by applicable law.

7. Children

CapyClimb is not directed at children under the age of 13, and we do not knowingly collect personal information from children under that age. Users between 13 and 18 must have the consent of a parent or legal guardian to hold a membership. If you believe a child has provided us with personal information without proper consent, please contact us and we will delete it.

8. International transfers

Your personal information is stored in AWS’s Tokyo (ap-northeast-1) region. Some operational processing — for example email delivery or fraud screening at our payment processor — may transit other AWS regions or third-party data centres operated by our service providers. If you are outside Japan, by using the service you consent to your information being processed in Japan, which may have data protection rules different from those of your home country.

9. Security

We apply industry-standard safeguards to protect your information. These include encryption in transit (TLS) and at rest, role-based access controls, audit logging, and the principle of least privilege for our staff. No system is perfectly secure; if we ever experience a breach that affects your information, we will notify affected users as required by applicable law.

10. Changes to this policy

We may update this policy from time to time. When we make material changes, we will post the updated policy on this page with a new “Last updated” date and, where the change is material, notify you inside the app. Please review this page periodically.

11. Contact

For any privacy-related question or request, contact us at:

• Email: privacy@capyclimb.com
• Postal: TheCapybaraCompany, B1, 5-61-4 Nakano, Nakano-ku, Tokyo 164-0001, Japan

See also our Terms of Use.