Privacy policy
LLAYOS Institute of Sapientia ("we") sets out below how personal information is handled in "Suki", the service we operate (the "Service").
Effective date: 2026-09-27
1. Who we are
- Name: LLAYOS Institute of Sapientia
- Corporate number: 5010403036924
- Address: 〒105-0013 東京都港区浜松町２丁目２番１５号 浜松町ダイヤビル２Ｆ
- Representative: 代表社員 上﨑 大輔
2. What we collect and why
When you register for the Service, we collect the following.
| Item | Purpose | Required? |
|---|---|---|
| Identifying your account; sending account notices such as sign-up confirmation and password reset | Required | |
| Password | Signing you in (stored in a non-reversible form, never in plain text) | Required |
| Full name | Verifying who you are; addressing you when we contact you | Required |
| The company or organisation you work for | The library is open only to the travel trade, so we use it to verify your business identity | Required |
| Type of business | Helping us verify your business identity; tailoring what we tell you | Optional |
| Company website | Helping us verify your business identity | Optional |
| Country / region | Taking your language and time zone into account | Optional |
| Phone | Only used if you ask us to call you (we will not make sales calls) | Optional |
| A line for us | Understanding what you need | Optional |
| Consent to marketing emails | Recording whether you agreed to receive updates and event news (stored with the time you agreed) | Optional |
To prevent unauthorised access and keep the Service secure, we also record actions such as sign-in and registration (time, IP address, type of action). If you use the paid "Studio" feature, we process what you enter (for example, trip requirements) in order to prepare proposals.
3. If you do not provide a required item
- Email: Without it we cannot create an account or contact you.
- Password: Without it you cannot sign in, so the account cannot be created.
- Full name: Without it we cannot verify who you are, and the account will not be opened.
- The company or organisation you work for: Without it we cannot verify your business identity, and the account will not be opened.
4. Legal basis (where the EU GDPR applies)
- Opening and managing your account and contacting you: performance of the contract for use of the Service
- Verifying business identity and preventing unauthorised access: legitimate interests (the library is open only to the travel trade)
- Updates and event news: your consent
5. How long we keep it
We keep it for as long as your account is active and for 3 months after it is closed, and then delete it.
6. Marketing consent and withdrawal
We send updates and event news only to people who tick the optional box on the registration form. The box is unticked by default, and you can register without ticking it. You can withdraw consent at any time (contact us at section 12).
Emails needed to use your account, such as sign-up confirmation and password reset, are not marketing and are sent regardless of consent.
7. Outsourcing
We may outsource all or part of the handling of personal information to the extent needed for these purposes. We select such contractors after appropriate checks and supervise them through contracts and other means.
8. Provision to third parties
We do not provide personal data to third parties without your prior consent, except:
- where required by law
- where necessary to protect a person’s life, body or property and it is difficult to obtain your consent
- where especially necessary for public health or the healthy development of children and it is difficult to obtain your consent
- where we need to cooperate with a government body performing duties prescribed by law and obtaining your consent could hinder those duties
9. Provision to third parties outside Japan
To provide the Service and run our business, we may outsource the handling of personal data to, or provide it to, third parties outside Japan. The countries and purposes are currently as follows.
- USA: processing by AI models and online search (Anthropic PBC, OpenAI, L.P., Google LLC, Tavily Inc., Exa Labs Inc.)
- USA: email infrastructure (Google LLC)
- USA: storage of enquiry and application records (Google LLC)
- USA: internal notifications (Slack Technologies, LLC)
- Czech Republic: web data acquisition infrastructure (Apify Technologies s.r.o.)
- Malaysia: storage of website and enquiry data (Hostinger International Limited)
Information about the personal-information protection regime in those countries and the measures those third parties take is available on request from the contact in section 12.
10. Security measures
- Basic policy: we have established this policy and internal rules to ensure personal information is handled properly.
- Organisational measures: we appoint a person responsible for handling personal information, define which staff and which information are involved, maintain means of checking how it is handled, and have a reporting line for any breach of law or internal rules.
- Human measures: we train staff regularly on handling personal information and set out confidentiality obligations in work rules and written pledges.
- Physical measures: we control entry to areas where personal information is handled, restrict devices brought in, and prevent viewing by unauthorised persons.
- Technical measures: we control access to systems handling personal data, limit who handles which databases, and use protections against unauthorised external access and malicious software.
- Understanding the external environment: we handle personal data using cloud services in the USA, the Czech Republic and Malaysia, and take necessary and appropriate security measures based on an understanding of each country’s personal-information protection regime.
11. Cookies and data sent to external services
We use the Service’s own cookie to keep you signed in (used only for sign-in and not sent to third parties). We do not use any analytics or advertising services.
To display text, we load fonts from "Google Fonts", provided by Google LLC (USA). Your device sends information such as your IP address and browser type to that company.
Resource pages shown after sign-in embed a map from Google LLC (USA) to show the location. When you open such a page, your device sends information to that company.
12. Requests and contact
You or your agent may ask us to notify you of the purposes of use, disclose, correct, add to or delete, stop using or erase, or stop providing to third parties the personal data we hold about you, or to disclose records of provision to third parties. Notification of purposes and disclosure are free of charge. Where the EU GDPR applies, you also have the rights to data portability, to object to processing, to withdraw consent, and to lodge a complaint with a supervisory authority.
- LLAYOS Institute of Sapientia — Suki privacy contact
- Address: 〒105-0013 東京都港区浜松町２丁目２番１５号 浜松町ダイヤビル２Ｆ
- Email: aoi@llayos.com
13. Changes to this policy
We may change this policy in response to changes in law or other circumstances. The changed policy takes effect when it is posted on the Service’s website.