Privacy Policy

Article 1 (Purposes of Processing Personal Information)

The Company processes personal information for the following purposes. Personal information being processed will not be used for any purpose other than the following, and if the purpose of use changes, the Company will take the necessary measures, such as obtaining separate consent under Article 18 of the PIPA.

Article 2 (Personal Information We Process)

The Company processes the following items of personal information.

Article 3 (Processing and Retention Period of Personal Information)

① The Company processes and retains personal information within the retention and use period prescribed by law or agreed to by the data subject at the time of collection.

② The processing and retention periods for each category of personal information are as follows.

3. Mandatory retention under applicable laws

③ Re-registration policy

After withdrawing membership, you may re-register at any time with the same email address or Kakao account. However, because account information is destroyed upon withdrawal, and reviews, 1:1 questions, purchase records, and similar data are retained only after being anonymized so that the author cannot be identified (see Article 7 ④), your previous usage records will not be linked to the new account even if you re-register.

Article 4 (Provision of Personal Information to Third Parties)

① The Company processes data subjects' personal information only within the scope specified in Article 1 (Purposes of Processing Personal Information), and provides personal information to third parties only in cases falling under Articles 17 and 18 of the PIPA, such as with the data subject's consent or under special provisions of law.

② The Company does not currently provide data subjects' personal information to third parties. If provision to a third party becomes necessary in the future, the Company will notify data subjects of the recipient, the recipient's purpose of use, the items of personal information provided, and the recipient's retention and use period, and obtain prior consent before providing the information.

Article 5 (Outsourcing of Personal Information Processing)

① To provide services smoothly, the Company outsources personal information processing as follows.

② When entering into an outsourcing agreement, the Company specifies in the contract or other documents, in accordance with Article 26 of the PIPA, matters such as the prohibition on processing personal information for purposes other than the outsourced work, technical and administrative protection measures, restrictions on sub-outsourcing, management and supervision of the processor, and liability including damages, and supervises whether the processor handles personal information safely.

③ If the outsourced work or the processor changes, the Company will disclose the change without delay through this Privacy Policy.

Article 6 (Cross-Border Transfer of Personal Information)

① The Company transfers personal information abroad (outsourced processing and storage) as follows in order to enter into and perform its contracts with data subjects, and discloses the relevant matters under Article 28-8(1)(3)(a) and Article 28-8(2) of the PIPA.

② Under Articles 28-8 and 37 of the PIPA, data subjects have the right to refuse the cross-border transfer of their personal information. However, because the Service operates on the basis of the overseas outsourced processing described above, refusing the cross-border transfer may restrict membership registration and use of the Service. If you wish to refuse the cross-border transfer, you may contact the Privacy Officer listed in Article 11.

③ In connection with cross-border transfers, the Company implements the protective measures required under Article 28-8(4) of the PIPA and Article 29-10 of its Enforcement Decree (contractual safeguards, technical and administrative measures such as encryption, grievance handling procedures, etc.).

Article 7 (Procedures and Methods for Destroying Personal Information)

① When personal information becomes unnecessary, such as upon expiration of the retention period or achievement of the purpose of processing, the Company destroys it without delay.

② Where personal information must continue to be retained under other laws even though the retention period consented to by the data subject has expired or the purpose of processing has been achieved, the Company moves the personal information to a separate database (DB) or stores it in a different location.

③ The procedures and methods for destroying personal information are as follows.

④ Items retained in anonymized form after membership withdrawal

When a Member withdraws, account information is destroyed, but the records below, which have already been disclosed to other users or are needed for service operation and settlement, are retained after being anonymized so that the author cannot be identified. Once anonymized, the records cannot identify a specific individual and therefore do not constitute personal information under the PIPA.

⑤ Even if you re-register with the same email or Kakao account after withdrawal, the anonymized records above will not be linked to the new account.

Article 8 (Rights and Obligations of Data Subjects and Legal Guardians, and How to Exercise Them)

① Data subjects may exercise the following rights against the Company at any time.

1. Request access to personal information
2. Request correction of errors
3. Request deletion
4. Request suspension of processing
5. Withdraw consent

② The rights under Paragraph 1 may be exercised against the Company in writing, by email, by fax, or by other means under Article 41(1) of the Enforcement Decree of the PIPA, and the Company will take action without delay (within 10 days).

③ The rights under Paragraph 1 may be exercised through an agent, such as the data subject's legal guardian or a person delegated by the data subject. In this case, a power of attorney in the form of Annex Form No. 11 of the Notice on Methods of Processing Personal Information must be submitted.

④ Requests for access to, and suspension of processing of, personal information may be restricted under Articles 35(4) and 37(2) of the PIPA.

⑤ Correction or deletion of personal information may not be requested where the personal information is specified as subject to collection under other laws.

⑥ When a request for access, correction or deletion, or suspension of processing is made, the Company verifies whether the person making the request is the data subject or a legitimate agent.

⑦ Right to refuse automated decisions and request an explanation: The Company does not currently process personal information through fully automated decision-making about data subjects (Article 37-2 of the PIPA). If such processing is introduced in the future, the Company will reflect it in this Policy, notify data subjects, and establish procedures for refusing such decisions and requesting an explanation as prescribed by law.

Article 9 (Installation, Operation, and Refusal of Automatic Collection Devices)

① The Company uses ‘cookies,’ which store and retrieve user information from time to time, in order to provide personalized services to users.

② Purpose of cookies: maintaining login status, improving the Service through analysis of service usage records, and providing personalized services.

③ Installation, operation, and refusal of cookies: Users have the option to accept or refuse cookies. By configuring browser settings, users may allow all cookies, require confirmation each time a cookie is saved, or refuse all cookies.

• Example (Chrome): [Settings] menu at the top right of the browser → [Privacy and security] → [Cookies and other site data]
• However, if you refuse cookies, use of services that require login may be restricted.

④ External fonts (Google Fonts): Some of the Site's fonts are downloaded directly by the user's browser from Google Fonts (fonts.googleapis.com, fonts.gstatic.com), operated by Google LLC. In this process, the user's IP address and browser information may be transmitted to Google LLC (United States). The Company does not collect or store this information. You may block it using your browser's script or external request blocking features (in which case fonts will be displayed in the default typeface).

⑤ Collection and use of behavioral information and personalized advertising: The Company collects and uses behavioral information as described below only with the user's prior consent. Declining does not restrict use of the Service in any way.

⑥ How to refuse or withdraw: If you select [Do not agree] in the notice displayed on your first visit to the Site, behavioral information will not be collected. Even if you have already agreed, deleting your browser's site data (storage and cookies) resets your consent so you can choose again. You can also block personalized ads across the board in the advertising settings of the device you are using.

• Android: Settings → Privacy → Ads → Delete advertising ID
• iPhone and iPad: Settings → Privacy & Security → Tracking → turn off “Allow Apps to Request to Track”
• Web: each browser's cookie and site data blocking settings

Article 10 (Measures to Ensure the Security of Personal Information)

The Company takes the following measures to ensure the security of personal information under Article 29 of the PIPA and Article 30 of its Enforcement Decree.

Article 10-2 (Notification and Reporting of Personal Information Breaches)

Under Article 34 of the PIPA and Articles 39 and 40 of its Enforcement Decree, the Company takes the following measures in the event of loss, theft, or leakage of personal information (a “Breach”).

① When the Company becomes aware of a Breach, it will, absent justifiable cause, notify the affected data subjects of the following within 72 hours in writing, by telephone, text message, email, or similar means.

• The items of personal information affected by the Breach
• When and how the Breach occurred
• Information on what data subjects can do to minimize potential harm from the Breach
• The Company's response measures and remedy procedures
• The department and contact information for reporting any harm suffered by data subjects

② If confirmation of the affected personal information is delayed and not all of the above can be specified, the Company will first notify what has been confirmed and provide the remaining information without delay as it is confirmed.

③ In any of the following cases, in addition to the notification above, the Company will report the fact and the results of its measures to the Personal Information Protection Commission or the Korea Internet & Security Agency (KISA) within 72 hours.

• Personal information of 1,000 or more data subjects is affected by the Breach
• Sensitive information or unique identification information is affected by the Breach
• Personal information is leaked from a personal information processing system due to unlawful access from outside

④ Where individual notification is impossible, such as when the data subject's contact information is unknown, the Company substitutes notification by posting the above information on the main screen of the Site or the Privacy Policy screen for 30 days or more.

⑤ Immediately upon becoming aware of a Breach, the Company first implements measures to minimize harm, such as blocking the leakage path, guiding password resets, and revoking access rights, and the Privacy Officer under Article 11 manages and supervises the progress.

Article 11 (Privacy Officer)

① The Company designates a Privacy Officer as follows, who has overall responsibility for personal information processing and handles data subjects' complaints and remedies related to personal information processing.

② Data subjects may direct all inquiries, complaints, and requests for remedies related to personal information protection arising from their use of the Company's services to the Privacy Officer. The Company will respond to and handle data subjects' inquiries without delay.

Article 12 (Remedies for Infringement of Data Subjects' Rights)

Data subjects may apply for dispute resolution or counseling to the Personal Information Dispute Mediation Committee, the KISA Personal Information Infringement Report Center, and other bodies in order to obtain remedies for infringement of their personal information.

A person whose rights or interests have been infringed by a disposition or omission of the head of a public institution in response to a request under Article 35 (Access to Personal Information), Article 36 (Correction and Deletion of Personal Information), or Article 37 (Suspension of Processing of Personal Information, etc.) of the PIPA may file for administrative appeal as prescribed by the Administrative Appeals Act.

Article 13 (Processing of Personal Information of Children Under 14)

① As a rule, the Company does not allow children under 14 to register as members and does not collect personal information from children under 14.

② Where it is unavoidably necessary to collect personal information from a child under 14, the Company collects and uses it after obtaining the consent of the child's legal guardian under Article 22-2 of the PIPA, and may collect the minimum information from the child, such as the legal guardian's name and contact information, in order to obtain that consent.

Article 14 (Changes to This Privacy Policy)

① This Privacy Policy applies from its effective date. If there are additions, deletions, or corrections in accordance with laws or policies, the Company will announce the changes through the Site's notice board at least 7 days before they take effect.

② However, for changes that materially affect data subjects' rights, such as changes to the items of personal information collected or the purposes of use, the Company will give notice at least 30 days in advance and, where necessary, obtain the data subject's consent again.

③ Revision history