What we collect, and what we never touch.

01Scope of this policy

This policy covers the JapanIDC Mac website, its waitlist and colocation registration forms, our sales and support correspondence, and the account and billing records we keep to deliver your service. JapanIDC is the controller of that data.

It does not cover the content you store or process on your rented or colocated Mac mini. You decide what runs there and what personal data it holds; for that processing you are the controller and we act only as an infrastructure provider. It also does not cover third-party sites, tools, or AI providers you choose to use, which have their own policies.

02Data we collect

We keep this deliberately small. Depending on how you interact with us, we collect:

• Registration data — the email address you submit, the configuration you asked about, whether you consented to availability updates, and the timestamp of the request. This is what a waitlist entry or colocation registration creates.
• Order and service data — your name or company, billing contact, confirmed configuration, price, term, machine identifier, allocated IP addresses, and activation and end dates.
• Correspondence — emails and support messages you send us, including anything you choose to attach.
• Payment records — invoice status and payment confirmation. Card or bank credentials are handled by the payment provider or bank, not stored on this website.
• Technical and security data — IP address, request path, timestamp, user agent, and outcome for requests to our application endpoints, plus administrator sign-in attempts. These exist to operate the service and to detect abuse.
• Facility records — physical access and hardware handling logs for the rack your machine occupies.

We do not run advertising trackers, ad networks, or third-party marketing pixels on this website.

03The data on your machine

A dedicated Mac mini is yours to operate. We do not monitor your files, shell history, prompts, model weights, build artifacts, or application traffic as part of providing the service, and we do not use any of it to train AI models or to build datasets.

There are narrow exceptions, and we would rather state them than hide them: we may access a machine to perform physical maintenance or diagnose a hardware fault, to contain an active security incident originating from it, or to comply with a binding legal order. Access is limited to what the task requires, performed by authorized engineers, and recorded. Where practical we tell you first.

Aggregate facility telemetry — power draw, temperature, port status, and total traffic volume — is infrastructure measurement, not inspection of your content.

04How we use it

• To answer your inquiry and tell you when the configuration you asked about becomes available.
• To confirm, activate, support, renew, and end your service, and to issue invoices.
• To operate, secure, and troubleshoot the website, the application endpoints, and the facility.
• To detect and stop abuse, fraud, attacks, and unauthorized administrator access.
• To meet legal, tax, accounting, and law-enforcement obligations that apply to us in Japan.

We do not sell personal data, and we do not share it with advertisers.

05Legal basis

Where a data-protection regime such as the GDPR or Japan’s APPI applies, we rely on: performance of a contract, for arranging and delivering your service; compliance with a legal obligation, for tax and lawful-request records; our legitimate interest in operating and securing the service, for technical and security logs; and your consent, for availability updates you asked to receive. You can withdraw consent at any time without affecting service you have already ordered.

06Cookies and local storage

This website uses one functional cookie: an administrator session cookie set only after a successful sign-in to the management area. It is HttpOnly, SameSite=Strict, marked Secure in production, scoped to the application endpoint path, and expires after eight hours. Its only purpose is to keep an administrator signed in.

Visitors who are not administrators are not tracked by cookies. We do not use analytics cookies, advertising cookies, fingerprinting, or cross-site identifiers, so there is no cookie banner to dismiss. If your browser blocks cookies, the public website and both registration forms still work; only administrator sign-in requires them.

07Who we share it with

We share personal data only where it is needed to run the service, and only the part that is needed:

• Infrastructure and platform providers that host this website, its application endpoints, and its database.
• Payment and banking providers that process a confirmed invoice.
• Carriers and customs agents, for shipping a colocated machine to or from Japan.
• Professional advisers and auditors, under confidentiality obligations.
• Authorities, where we are legally required to disclose, and only after checking that the request is valid and appropriately scoped.

We do not authorize any provider to use your data for its own purposes.

08Where data lives and international transfers

Your Mac mini is physically located in Japan, and we aim to keep service records within infrastructure we control. This website and its application backend may run on cloud infrastructure outside Japan, and our support correspondence may be read by engineers in other locations to provide round-the-clock multilingual coverage.

Where personal data is transferred across borders, we use appropriate safeguards — contractual protections, access controls, and provider commitments — and we limit what leaves Japan to what the task requires. You can ask us which providers process your data by emailing [email protected].

09How long we keep it

• Waitlist and colocation registrations — until the request is fulfilled, you ask us to remove it, or 24 months of inactivity, whichever comes first.
• Order, invoice, and tax records — for the period Japanese law requires, generally seven years.
• Support correspondence — up to 24 months after the case closes, longer where it documents an ongoing service or dispute.
• Technical and security logs — up to 12 months, then deleted or aggregated.
• Administrator session cookies — eight hours, or immediately on sign-out.
• Facility access records — up to 12 months.

Storage on your machine is not covered by these periods. When a rental ends, local storage is erased before the machine is reassigned. When colocation ends, your machine is returned to you with its storage intact.

10How we protect it

The management area is protected by an administrator password with no default value, rate-limited sign-in, timing-safe credential comparison, and short-lived signed HttpOnly session cookies. Database access is private to the application backend; the browser never receives database credentials. Application endpoints validate and bound every request, and physical access to the facility is controlled and logged.

No system is perfectly secure, and we will not claim otherwise. If a breach affects your personal data, we will investigate, contain it, notify you and the relevant authority where the law requires, and tell you what you can do about it.

11Your rights and choices

Depending on the law that applies to you, you may have the right to access, correct, delete, restrict, or port your personal data, to object to processing based on legitimate interest, and to withdraw consent. You may also have the right to complain to your local supervisory authority — in Japan, the Personal Information Protection Commission.

To exercise any of these, email [email protected] from the address you registered, and tell us what you want. We may need to verify that the request really comes from you. We respond within 30 days, and we will tell you if a legal retention obligation prevents deletion of a specific record.

You can unsubscribe from availability updates at any time by replying to one of those emails or by writing to us. Service messages about an active order — activation, maintenance, invoices, security — are part of the service and continue while it runs.

12Children

Our services are for adults in business and professional use, and are not directed at children. We do not knowingly collect personal data from anyone under 18. If you believe a child has registered with us, email [email protected] and we will delete the record.

13Third-party links and tools

This site names development tools, AI clients, and model runtimes to describe what our hardware can run, and may link to their documentation. Those services are independent of us. When you use them from your machine, your relationship is with that provider, and their privacy terms govern what they receive.

14Changes to this policy

We may update this policy as the service and the law evolve. The current version is always at this address with its effective date. For a material change we will give notice by email or a prominent site notice before it takes effect.

15Contact

Privacy questions and rights requests: [email protected]. Order and billing questions: [email protected]. JapanIDC is a Japan-based IT infrastructure provider operating data centers across Japan, with engineers on call 24 hours a day and multilingual support.