Guest Privacy Notice
Version 2026-10-26 · Last updated 26 October 2026
In short
- Your accommodation uses Banto for its stay page, online check-in, front-desk tablet and guest messages. The accommodation decides how your data is used (it is the "controller"); Banto handles the data on its behalf.
- For stays in Japan, the law requires the accommodation to keep a guest register and, for guests without an address in Japan, a passport copy. Both are deleted automatically 3 years after check-out.
- Some accommodations use an AI check of passport photos. The stay page tells you when it is on. Some messages are drafted or translated with AI; staff check them before they are sent.
- Data is stored on Google Cloud in the United States.
1. Who is responsible
The accommodation you booked is responsible for your personal data (the controller). It uses Banto, a system operated by Studio Hedera (a sole proprietorship in 5081-1 Toyoda, Iiyama-shi, Nagano, Japan), to run the stay page, online check-in, the front-desk tablet and guest messages. Studio Hedera ("we") processes the data on the accommodation's instructions and does not use it for its own purposes.
2. What is collected
| Information | Where it comes from |
|---|---|
| Booking details: your name, email address, phone number, stay dates, number of guests, the booking site, payment status | The accommodation's booking system or the site you booked on |
| Guest register: full name, address, phone or email, nationality, and — for guests without an address in Japan — passport number; the other guests in your party; arrival time and transport | You, on the stay page or the front-desk tablet |
| Passport copy (a photo), for guests without an address in Japan | You |
| What the AI passport check reads from the photo: name, passport number, nationality and expiry date (only where the accommodation has turned the check on) | The passport photo |
| Requests, answers to the accommodation's own questions, add-on orders, acceptance of the accommodation's terms | You |
| Messages between you and the accommodation (stay page, email, and messages on the booking site that the accommodation's booking system passes on) | You and the accommodation's staff |
| A handwritten guestbook entry, if you choose to write one on the accommodation's tablet | You |
| Technical records for security, such as the time of access and IP address | Your device |
We do not ask for your occupation (no longer part of the Japanese guest register since the 2023 amendment of the Hotel Business Act). We do not use face recognition or any other biometric matching.
3. Why it is used
- To keep the guest register the law requires (in Japan: Article 6 of the Hotel Business Act and its regulations, including the passport copy). This is a legal obligation of the accommodation.
- To check you in and show you how to get in (for example a door code, after a check with the last digits of the phone number on your booking).
- To prepare your stay: cleaning, bedding, cots, parking, pick-up and the add-ons you order.
- To let you and the accommodation's staff write to each other.
- For the accommodation's lodging-tax records, where a lodging tax applies.
- To keep the system secure and to find and fix problems.
4. AI
- AI passport check — only where the accommodation has turned it on. The passport photo is sent to Anthropic (USA), which reads the name, passport number, nationality and expiry date and checks that the photo is readable and matches the name you entered. What it reads is stored with the document, and the passport number can be filled into the register so you do not have to type it. While the photo is being read you may have to wait a little, and if the number cannot be read you are asked to type it. If something looks wrong, the accommodation's staff are alerted and look at it themselves. The AI makes no decision about you on its own.
- Reply drafts and automatic replies. When staff answer your messages, AI may draft the reply — mainly Google Gemini, sometimes Anthropic Claude. Staff read and edit drafts before sending. Where the accommodation has switched it on, simple questions may get an automatic reply, which is marked as automatic.
- Requests and translation. Anthropic Claude may list the requests in your messages (for example a cot or a late arrival) for the staff, and messages may be translated with Google Gemini or Anthropic Claude.
- Name readings. Names written in Japanese, Chinese or Korean script may be sent to Anthropic Claude to show staff a reading in Latin letters.
We use these providers' business (API) services. Under Anthropic's commercial terms and Google's terms for the paid Gemini API, the content we send is not used to train their models.
5. Who receives it
- The accommodation and its staff.
- Service providers that run Banto for us: Google Cloud / Firebase (hosting, database, file storage, sign-in), Anthropic and Google (AI, as above), Resend (sending email), Cloudflare (receiving email).
- Services the accommodation itself connects: its booking system and the booking sites (for example Beds24, Hostfully, Airbnb), smart-lock services (they receive the door code and when it is valid; some lock types also show the booking name as the code's label) and cleaning or operations services.
- Public authorities, where the law requires it (for example a police request under the Hotel Business Act).
Your data is not sold and not used for advertising.
6. Where it is stored, and transfers abroad
Banto stores data on Google Cloud in the United States (database in the US multi-region, files in us-central1). Email is sent through Resend (USA) and received through Cloudflare's global network. The AI providers process data in the United States; Google may process Gemini requests in other countries.
The United States has no general federal data protection law like Japan's or the EU's; these providers are bound by data processing terms with us, which include the EU Standard Contractual Clauses for transfers from the EU, the United Kingdom and Switzerland. Japan and the EU recognise each other's level of protection.
7. How long it is kept
| Information | Kept for |
|---|---|
| Guest register and passport copy (with what the AI check read) | 3 years after check-out (or after the check-in was completed, if later), then deleted automatically. A register sent but never completed: 3 years after check-out. A register never sent, or for a cancelled booking: 90 days after check-out. |
| The words of your messages, every copy of them, and the notes from the booking system | 13 months after check-out; after that only the date and direction of each message remain |
| Your name, email and phone on Banto's copy of the booking | 3 years after check-out |
| AI reply drafts | Usable for 48 hours, deleted 7 days after that |
| Notices to staff about your stay | 60 days |
| Lodging-tax records | As long as the tax law requires the accommodation to keep them; deleted on request after that |
| Backups | Deleted data can stay in backups for up to 60 days, and deleted files can be restored for 7 days |
| Providers' own logs | Email sending log (Resend): 30 days. AI providers: up to 30 days (Anthropic may keep content flagged for a safety review longer). |
If there is a dispute, the accommodation can keep a stay's data longer than this until it is settled (a legal hold).
8. Your rights
You can ask for a copy of your data, for corrections, for deletion, or for its use to be limited or stopped, and — in the EU and the UK — object or ask for portability. Please ask the accommodation first; it decides on the request and Banto carries it out. During your stay you can correct your own details on the stay page. If you write to us, we pass your request to the accommodation.
When your data is erased, Banto deletes the register, passport copies, the words of your messages and every copy of them, the notes from the booking system, AI drafts and your contact details on its copy of the booking. Data the law requires the accommodation to keep (the guest register for 3 years in Japan, lodging-tax records) may be kept until that period ends. The accommodation's booking system and the booking site keep their own records; ask them too.
You can also complain to a data protection authority, for example the Personal Information Protection Commission in Japan or the authority in your EU country.
9. If you booked on Airbnb
You do not need to create an account or sign in anywhere to use the stay page. If you prefer not to use online check-in, tell the accommodation: you can give the details the law requires at the front desk or in the way the accommodation arranges with you. For Airbnb bookings, Airbnb's terms and the house rules on the listing apply.
10. Security
Data is encrypted in transit and at rest; passport copies are encrypted a second time with Banto's own key. Your stay page link is unique to your booking — please do not forward it outside your group. Staff see only what their role allows, and each time a passport copy is opened it is recorded.
11. Changes
When this notice changes, the new version is published here with a new version number. The stay page records which version was shown to you when you sent the register.
12. Contact
Please contact the accommodation first. You can also write to us at support@bantohq.com.