GTGO Privacy Policy

Version: 1.0.0
Effective Date: April 28, 2026

CarOwnersClub Inc. ("we," "us," or "our") provides the mobile application "GTGO" (the "App") and processes the Personal Information of its Users in accordance with this Privacy Policy (the "Policy"). This Policy explains what information we collect, how we use it, with whom we share it, the rights you have, and how to exercise those rights.

Article 1 (Personal Information)

"Personal Information" has the meaning given to it under the Act on the Protection of Personal Information of Japan (the "APPI"). It refers to information about a living individual that can identify that individual through the name, date of birth, address, telephone number, email address, or other descriptions contained in the information, including personal identifiers (kojin shikibetsu fugo). For purposes of users in the European Economic Area (EEA) or the United Kingdom, "Personal Information" is treated as equivalent to "personal data" under the General Data Protection Regulation (GDPR). For purposes of California residents, it is treated as equivalent to "personal information" under the California Consumer Privacy Act (CCPA).

Article 2 (How We Collect Personal Information)

We collect Personal Information through the following means:

Information provided directly by the User when registering an account, configuring profile settings, registering a vehicle, creating Touring Sessions, or setting base locations.
Information collected automatically while the User uses the App, including location data, device information, App usage information, and network information.
Information regarding payment status from our payment service provider, Stripe, Inc. We do not retain sensitive payment data such as credit card numbers.

Categories of Information We Collect

Information You Provide Directly

Account information: email address, password (hashed).
Profile information: display name, profile image, cover image, self-introduction text, profile-search ID.
Sign-up information: country of residence, prefecture/state, year of birth (4-digit year).
Vehicle information: vehicle name, model, vehicle image, vehicle inspection certificate information (vehicle registration number, chassis number, model designation number, classification number, vehicle body shape, displacement, fuel type, etc.).
Touring Session information: title, memo, photographs.
Base location information: coordinates of home or workplace, mask radius.

Information Collected Automatically

Location data: GPS coordinates, speed, bearing, altitude.
Device information: OS type, OS version, device model.
App usage information: App version, time of use.
Network information: IP address.

Article 3 (Purposes of Collection and Use)

We collect and use Personal Information for the following purposes:

To provide the services of the App, including account management, real-time location sharing, friend and Club functionality, and recording and display of Touring Sessions.
To verify vehicle ownership based on vehicle inspection certificate information.
To perform automatic location-data masking based on base-location settings.
To analyze usage, optimize functionality, and resolve defects, in order to improve the service.
To detect and prevent fraudulent use, and to respond to violations of the Terms of Use, in order to ensure safety.
To send service-related important notices and notices of changes to the Terms of Use.
To process payments for paid plans and to manage subscriptions.
To send marketing information about new features, campaigns, events, and similar matters.
To fulfill legal obligations and to manage consent records.
To verify, based on the year of birth provided at sign-up, that the User meets the minimum age requirement for using the App (including age verification for restricting use by individuals under 13 years of age).
To perform statistical and cohort analysis based on country of residence, prefecture/state, and year of birth, in order to improve the service and tailor regional functionality.

Article 4 (Changes to Purpose of Use)

We may change the purposes of use of Personal Information only where the changed purposes can reasonably be regarded as having a relationship to the original purposes.
If we change the purpose of use, we will notify Users of the changed purposes through notices within the App.

Article 5 (Disclosure to Third Parties)

We will not disclose Personal Information to third parties without the User's prior consent, except in the following cases:

Where required or permitted by law;
Where disclosure is necessary to protect the life, body, or property of a person and obtaining the consent of the person concerned is difficult;
Where disclosure is particularly necessary for improving public health or for the sound development of children, and obtaining the consent of the person concerned is difficult;
Where disclosure is necessary to cooperate with a national agency, a local government, or a person commissioned by them to perform statutory duties, and obtaining the consent of the person concerned is likely to impede the performance of those duties.

Notwithstanding the above, the recipients in the following cases shall not be deemed third parties:

Where we entrust all or part of the handling of Personal Information within the scope necessary to achieve the purposes of use;
Where Personal Information is provided in connection with succession of business as a result of merger or other reasons.

Article 6 (Disclosure of Personal Information)

We will disclose Personal Information that we hold about an individual upon proper request, in accordance with applicable law. However, we may decline to disclose all or part of such information in any of the following cases:
1. Disclosure would risk harming the rights or legitimate interests of a third party;
2. Disclosure would significantly impede the proper conduct of our business;
3. The identity of the requesting party as the individual concerned cannot be confirmed;
4. Disclosure is otherwise not legally required.
Requests for disclosure shall be made through procedures we designate (including submission of identity verification documents). Details of the procedures will be provided through methods we designate separately.

Article 7 (Correction, Deletion, and Suspension of Use)

The User may request that we correct, delete, or suspend the use of the User's own Personal Information. We will confirm the contents of the request and respond within a reasonable scope.
However, we may decline to respond to a deletion or suspension-of-use request based on legal or operational necessity in the following cases:
1. Where retention for a certain period is required by law;
2. Where it is necessary to retain records related to transactions or contracts prior to withdrawal (for example, unresolved disputes or claim handling);
3. Where retention for a certain period is necessary for system security or fraud prevention;
4. Where deletion or suspension is difficult to implement due to operational or technical constraints of our service.

Article 8 (Voluntary Provision of Personal Information)

The provision of Personal Information requested by us is voluntary; however, if the User does not provide certain Personal Information, all or part of our services may be unavailable to the User.

However, year of birth is collected as a mandatory item for use of the App. In accordance with the United States Children's Online Privacy Protection Act (COPPA, 15 USC §6501) and Article 8 of the European General Data Protection Regulation (GDPR), individuals under the age of 13 may not use the App.

Article 9 (Changes to this Policy)

The contents of this Policy may be changed without notice to Users, except where required by law or where this Policy provides otherwise.
Where there is a material change, we will provide notice through in-App notifications and a consent dialog.
Except where we provide otherwise, the modified Privacy Policy shall take effect from the time it is posted within the App.

Article 10 (Contact)

Inquiries regarding this Policy may be directed to the contact below.

CarOwnersClub Inc.
General Inquiry Desk
Email: contact@car-owners-club.net

Article 11 (Legal Bases for Processing — GDPR)

For Users located in the European Economic Area (EEA) or the United Kingdom, we rely on the following legal bases under Article 6 of the General Data Protection Regulation (GDPR) to process Personal Information:

Consent (Art. 6(1)(a)): for marketing communications, optional analytics, and location sharing with friends and Clubs. The User may withdraw consent at any time without affecting the lawfulness of prior processing.
Contract (Art. 6(1)(b)): for providing the core App services the User signs up for, including account management, vehicle registration, real-time location sharing among confirmed friends, and subscription billing.
Legitimate Interest (Art. 6(1)(f)): for fraud prevention, security monitoring, abuse detection, and service improvement, balanced against the User's privacy rights.
Legal Obligation (Art. 6(1)(c)): for retaining records required by Japanese tax law, the APPI, court orders, or applicable foreign law.

For sensitive Personal Information (such as precise geolocation), we rely on the User's explicit consent under Article 9 GDPR where applicable.

Article 12 (Your Rights Under GDPR)

If the User is located in the EEA or the United Kingdom, the User has the following rights regarding Personal Information:

Right of Access (Art. 15): the right to obtain a copy of Personal Information we hold about the User and information about how we process it.
Right to Rectification (Art. 16): the right to request correction of inaccurate or incomplete Personal Information.
Right to Erasure (Art. 17, "Right to be Forgotten"): the right to request deletion of Personal Information when no longer necessary, when consent is withdrawn, or when processing is unlawful. The User may use the "Delete Account and Data" option in App Settings or submit a request via https://gtgo.app/en/erasure-request. Once requested, we delete data from production systems immediately, from BigQuery analytics replicas within 30 days, and from backup snapshots within 35 days (see Article 14 for full retention details).
Right to Restriction of Processing (Art. 18): the right to request that we limit processing in certain circumstances, such as while a rectification request is being assessed.
Right to Data Portability (Art. 20): the right to receive Personal Information the User has provided in a structured, commonly used, machine-readable format. The User may use the "Export My Data" option in App Settings or submit a request via https://gtgo.app/en/export-request.
Right to Object (Art. 21): the right to object to processing based on legitimate interest, including any profiling.
Right to Withdraw Consent (Art. 7(3)): the right to withdraw any consent previously given at any time, without affecting the lawfulness of prior processing.
Right not to be Subject to Automated Decision-Making (Art. 22): the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects. We do not currently perform such automated decision-making.
Right to Lodge a Complaint: the right to lodge a complaint with the User's local Data Protection Authority (for example, the CNIL in France, the Information Commissioner's Office (ICO) in the United Kingdom, or the Personal Information Protection Commission (PPC) in Japan).

To exercise any of these rights, contact the Data Protection Officer (see Article 16). We will respond within one month of receipt of a verifiable request, or notify the User if an extension is required.

Article 13 (CCPA — Notice at Collection and California Privacy Rights)

This section applies to California residents under the California Consumer Privacy Act of 2018 (CCPA), as amended by the California Privacy Rights Act (CPRA).

Notice at Collection

At or before the point of collection, we inform California residents of the following:

The categories of Personal Information collected (see Article 2 above): Identifiers (email, account ID), Customer Records (display name, profile information), Commercial Information (subscription status), Geolocation Data (precise GPS coordinates), Internet or Network Activity (IP address, App usage), and Inferences drawn from the foregoing (preferences, vehicle interests).
The purposes for which the Personal Information is used (see Article 3 above).
Whether such Personal Information is sold or shared (we do not sell or share Personal Information for cross-context behavioral advertising — see "Do Not Sell or Share" below).
The retention period for each category of Personal Information (see Article 14 below).

Your California Privacy Rights

Right to Know: the right to request the categories and specific pieces of Personal Information we collected about the User in the preceding 12 months, including sources, business purposes, and third parties to whom such Personal Information was disclosed.
Right to Delete: the right to request deletion of Personal Information we collected from the User, subject to legal exceptions enumerated in Cal. Civ. Code § 1798.105(d).
Right to Correct: the right to request correction of inaccurate Personal Information that we maintain about the User.
Right to Opt-Out of Sale or Sharing: we currently do not sell or share Personal Information; if this changes, the User may opt out via the "Do Not Sell or Share My Personal Information" link on our website footer or in App Settings > Privacy.
Right to Limit Use of Sensitive Personal Information: the right to request that we limit the use of sensitive Personal Information (such as precise geolocation) to what is necessary to provide the App.
Right to Non-Discrimination: we will not deny services, charge different prices, or provide a different level of service because the User exercised any of the rights described above.

Do Not Sell or Share My Personal Information

We do not sell Personal Information for monetary consideration, and we do not share Personal Information for cross-context behavioral advertising as defined under CCPA/CPRA. To submit an opt-out request preemptively (in case future processing involves sale or sharing), visit https://gtgo.app/en/do-not-sell or use the toggle in App Settings > Privacy.

Article 14 (Data Retention)

We retain Personal Information only as long as necessary to fulfill the purposes outlined in this Policy, unless a longer retention period is required by law. The retention periods below apply:

Data Category	Retention Period	Reason
Account information (email, password hash)	Until account deletion + 30 days	Allows account recovery; complies with security best practices
Profile information (display name, image, intro)	Until account deletion	Tied to account lifecycle
Vehicle information + vehicle inspection certificate	Until vehicle deletion or account deletion	Required for vehicle ownership verification
Touring Session records (routes, photos, memos)	Until the User deletes the session or until account deletion	User-controlled history
Real-time location data (GPS coordinates)	90 days for active sessions; 30 days for inactive cache	Limited to operational need; sensitive data minimization
Consent history records	7 years from acceptance	Required for legal compliance audit (GDPR Art. 7(1) accountability)
Payment records (Stripe-side; we do not store card numbers)	7 years	Required by Japanese tax law and Stripe's PCI obligations
Server logs, IP addresses, device identifiers	90 days	Security monitoring and abuse prevention
Backup snapshots (DynamoDB Point-in-Time Recovery)	35 days rolling window	Disaster recovery
Analytics aggregates (BigQuery, anonymized)	Indefinite (anonymized)	Aggregate data; no Personal Information after anonymization

When the User exercises the Right to Erasure, we delete Personal Information from production systems immediately upon receiving the request, from BigQuery analytics replicas within 30 days, and from backup snapshots within 35 days (when the backup window rolls over). The 30-day BigQuery deletion window satisfies the "without undue delay" requirement of GDPR Art. 17(1). Anonymized analytics aggregates that contain no identifying information are retained indefinitely.

Article 15 (International Data Transfers)

We are headquartered in Japan, and our primary data infrastructure runs in the AWS Asia Pacific (Tokyo) region (ap-northeast-1). Japan benefits from an Adequacy Decision issued by the European Commission, recognizing that Japan provides an adequate level of data protection equivalent to GDPR standards. As a result, transfers of Personal Information from the EEA or the United Kingdom to Japan are permitted under Article 45 GDPR without additional safeguards (such as Standard Contractual Clauses).

For onward transfers from Japan to other jurisdictions (for example, the United States, where some of our subprocessors operate), we apply additional safeguards including Standard Contractual Clauses (SCCs) and supplementary technical measures, as appropriate.

Article 16 (Children's Privacy)

The App is not directed at children under the age of 13, and we do not knowingly collect Personal Information from children under 13. If a parent or guardian becomes aware that a child has provided us with Personal Information, please contact us using the addresses in Article 10 or Article 17 and we will take steps to delete such information. For Users in the EEA, the relevant minimum age may be higher (16 in some Member States); the User shall be of the age of digital consent applicable in the User's country of residence.

Article 17 (Data Protection Officer)

For privacy-related inquiries, including the exercise of GDPR or CCPA rights, please contact:

Data Protection Officer (DPO)
CarOwnersClub Inc.
DPO Email: dpo@car-owners-club.net
General privacy inquiries: contact@car-owners-club.net

Note: Formal appointment of a designated Data Protection Officer is in progress. Until that appointment is finalized, privacy inquiries will be handled by the General Privacy Inquiries address above.

Article 18 (Quebec Bill 96 — French Language Notice)

For Users residing in the Province of Quebec, Canada, a French version of this Privacy Policy is available at https://gtgo.app/fr/privacy-policy, in compliance with the Charter of the French Language (Bill 96). The User may exercise any right described in this Policy in French, by writing to the contact addresses above in either English or French. Users in France are also referred to the French version where applicable, in line with the Loi Toubon (Loi n° 94-665).

End
Established: April 28, 2026

Version 1.0.0 - Effective April 28, 2026