Policies & Procedures

Pass-through architecture (POL-01.1)

Live MEISAI rows we pull on your behalf are validated, attached to your report, delivered, and then discarded. We do not retain them on the dashboard or in the database. The cycle is: pull → validate → deliver → forget.

Accuracy is non-negotiable (POL-01.2)

You bill your clients off our reports. A wrong number ruins trust forever. Every report must pass a 31-check deterministic validator AND an independent LLM accuracy guard before delivery. When in doubt, we quarantine instead of send. Quality beats quantity.

Three-files-required (POL-01.3)

Every report email contains exactly: (1) the official Toll Certificate PDF, (2) the Detail PDF, and (3) the Detail CSV. CSV-only deliveries are forbidden.

Zero-PII in logs (POL-01.4)

Passwords, confirmation links, verification codes, full ETC card numbers, and full OBU numbers are never written to audit logs, analytics, or changelogs. Masked references only.

When the free trial begins (POL-02.1)

Your 1-year premium free trial begins only after you (a) connect MEISAI, (b) we validate your ETC card, and (c) your first report containing actual toll usage (≥1 trip) is delivered. Limited to the first 100,000 sign-ups or until Jan 1, 2029, whichever comes first.

Politeness rules — NoJo (POL-03.1)

• Minimum 30 seconds between logins for the same account
• Maximum 4 logins per minute across all accounts
• At least 2 seconds between PDF downloads
• If MEISAI signals a block, back off for 1 hour
• Always log out after every session

Propagation window (POL-03.2)

For roughly 4 hours after MEISAI registration completes, MEISAI itself has a sync lag and reports may be empty. We hold off on the first Phase A pull during this window.

What we never persist (POL-03.3)

Raw toll rows and per-gantry detail are never persisted on the dashboard. We only store your encrypted credentials, decrypted in-memory each time we generate a report.

Procedure (POL-04.1)

1. Dashboard → Settings → click "Change email"
2. Enter the new email address and your current password
3. A 6-digit code is sent to the new email (valid 30 minutes)
4. Enter the code on the Settings page → your login email is updated
5. The previous email receives a security notice + a revert link valid for 7 days

Limits & security (POL-04.2)

• One change per 24 hours per account
• Cannot switch to an email already in use by another account
• After 5 wrong code attempts, a new request is required
• The revert link is single-use and valid 7 days

Pause vs close (POL-05.1)

Closure mode: hard-delete vs tombstone (POL-05.2)

• Hard-delete — If you've never had a paid subscription, the user record itself is removed.
• Tombstone — If you have any paid history, we keep the row for Stripe / invoice continuity but anonymize email, name, password hash, phone, and address. Email becomes tombstone-xxxx@deleted.japantollreceipts.jp.

Re-registering with the same email (POL-05.3)

You can create a brand new account with the same email after closure. On re-registration, any prior unsubscribe flag for that email is automatically cleared and the verification email is delivered. Re-registering counts as an explicit opt-in.

• ETC card number: 14 to 19 digits
• OBU Management Number: 19 digits in 5-8-6 format
• License plate last digits: 1 to 4 digits

Full guide: /guides/etc-card-number-formats

1. If MEISAI emailed you a fresh confirmation link, paste the URL or your JTRM user-id into the recovery input. We accept 4 input shapes: JTRM ID, full URL, `?k=` fragment, or bare 32-char hex token
2. Retry with same data: re-spawns the Playwright runner against your current inputs
3. Start over from Step 2: re-enter ETC card / OBU / plate. Your MEISAI account itself is not touched
4. Settings → Reset MEISAI connection: wipe the link entirely at any time

Every report runs through a 31-check deterministic validator. An independent LLM accuracy guard then double-checks math, column drift, and row gaps. If either fails, the report is held in a quarantine queue for host review before delivery. CSV-only sends are never allowed.

Subscriptions run until the end of the billing period in which you cancel. We do not pro-rate refunds. This is because we may have already generated and delivered multiple reports during that period.

Full refund policy: /legal/refund-policy

What we keep (POL-10.1)

• Account profile: name, email, language, JTR ID, subscription state
• Encrypted MEISAI credentials, decrypted only at report-generation time
• Email delivery logs: template type, hashed recipient, delivery state (we do not keep the email body)
• Audit log: auth events, configuration changes (PII-free)

What we never keep (POL-10.2)

• Per-row toll details pulled from MEISAI
• Plaintext passwords (bcrypt hashes only)
• Full ETC card numbers or OBU numbers
• Full MEISAI confirmation URLs or verification codes

Data deletion requests (POL-10.3)

Use Dashboard → Settings → Close Account at any time. Where law requires us to retain accounting data (e.g. Stripe invoice continuity), the record is anonymized into a tombstone instead of being deleted.