Privacy Policy

Article 1 (Purpose of Processing Personal Information)

The Company processes personal information for the following purposes. Personal information being processed is not used for any other purpose, and where the purpose of use changes, the Company will take the necessary measures, such as obtaining separate consent, in accordance with the Personal Information Protection Act.

1. Member sign-up and management: confirming the intention to sign up, verifying age in order to restrict sign-up by persons under 14, maintaining and managing membership for the provision of a membership-based service, preventing fraudulent use of the Service, giving notices and notifications, identifying and authenticating Members, handling complaints (Leave Feedback), and the like
2. Provision of the Service: providing Service functions such as the calendar, monthly report and collage using the text entries, photos, videos, voice recordings, music information and the like that Members create
3. Provision of Shared Viewing: displaying the calendar and Entry contents of a Diary to Shared Friends invited by the Member, and enabling the exchange of comments and reactions
4. Provision of Paid Items: confirming purchase records, applying and restoring purchased Paid Items, and handling refund and payment inquiries
5. Sending promotional information: informing Members who have consented to receive marketing information about events, benefits and the like
6. Handling complaints (Leave Feedback): identifying the Member, confirming the complaint, contacting and notifying the Member for fact-finding, and informing the Member of the outcome
7. Improving existing services and developing new and customized services
8. Statistics and service improvement: producing statistics by age group and gender and improving the Service using the date of birth and gender entered by Members who have consented to the collection and use of optional information
9. Use of information processed so that individuals cannot be identified: pseudonymization and use of pseudonymized information for statistics, scientific research, archiving in the public interest and the like

Article 2 (Items of Personal Information Processed)

1. The Company collects and processes the following items of personal information about Members.
   1. Collected by default at sign-up (required): social login identifier (user identifier provided by Apple, Google, Kakao or LINE), email address, device identifier (non-identifying device information provided by the operating system)
   2. Collected by default after sign-up (optional): nickname, profile photo, whether the Member has consented to receive marketing information and the date and time of consent or withdrawal
   3. Where the Member consents to the collection and use of optional information (optional): date of birth (year, month and day), gender (chosen from male, female or prefer not to say), and whether the Member has given that consent and the date and time of consent or withdrawal. Declining the consent or leaving this information blank does not restrict use of the Service.
   4. Entered by the Member while using the Service
      1. Optional: text entries, photo images, voice recording files, music information, comments and reactions
   5. Collected automatically while using the Service: service use records, the time and frequency of Entry creation, Shared Viewing invitations and history, app usage records (screens viewed, buttons tapped, whether features are used), device information (operating system, device model, app version, language, country), app installation identifier
   6. When handling complaints (Leave Feedback): email address
2. The Company does not accept sign-ups from children under 14 and does not collect the personal information of children under 14.

Article 3 (Processing and Retention Period of Personal Information)

1. Where a Member withdraws from the Service or loses eligibility to use it, the Company deletes and destroys the collected user information without delay, even without a separate request. However, notwithstanding withdrawal or loss of eligibility, the following information is retained for the reason stated.
   1. Where an investigation or inquiry into a violation of the relevant laws is in progress: until that investigation or inquiry ends
2. Notwithstanding the preceding paragraph, the Company retains information until the end of the relevant period in the following cases.
   1. Records on contracts or withdrawal of offers: 5 years, the retention period under the Act on the Consumer Protection in Electronic Commerce
   2. Records on payment and the supply of goods and the like: 5 years, the retention period under the Act on the Consumer Protection in Electronic Commerce
   3. Personal information related to use of the Service (log records): 3 months, the retention period under the Protection of Communications Secrets Act
   4. Records on consumer complaints or dispute handling: 3 years, the retention period under the Act on the Consumer Protection in Electronic Commerce
3. Information processed on the basis of consent to receive marketing information is retained until the Member withdraws consent or withdraws from the Service.
4. Optional information (date of birth and gender) is retained until the Member withdraws consent to its collection and use or withdraws from the Service, and is destroyed without delay when consent is withdrawn.
5. When a Member ends Shared Viewing or withdraws from the Service, the other person can no longer view that Member's Diary.

Article 4 (Provision of Personal Information to Third Parties)

1. The Company processes the personal information of data subjects only within the scope stated in the purposes of processing, and provides personal information to third parties only in the cases falling under Articles 17 and 18 of the Personal Information Protection Act, such as with the data subject's consent or under a special provision of law. It does not otherwise provide the personal information of data subjects to third parties.
2. The Company does not provide personal information to third parties, and will obtain the Member's consent if it comes to do so.
3. When a Member begins Shared Viewing, the Member's nickname and profile photo, the calendar and Entry contents of the disclosed Diary, and the comments and reactions the Member has left are displayed to the Shared Friend. Entries written before Shared Viewing began are also displayed, and Entries that the Member has set to “Private” are not displayed. This disclosure takes place because the Member personally sent or accepted an invitation, and the Member may end Shared Viewing at any time.

Article 5 (Entrustment of Personal Information Processing)

1. The Company entrusts the processing of personal information as follows for the smooth handling of personal information operations.

   Trustee	Entrusted Tasks
   Google LLC	Message transmission via Firebase FCM
   MAILPLUG Inc.	Member consultation, receipt and response of Send Feedback
   AWS Seoul region	Storage of Service data
   Anthropic, PBC	Keyword extraction for Monthly Reports (analysis of diary text using an AI language model)
   Amplitude, Inc.	Service usage analytics

2. To perform its contract with Members for the Service, the Company transfers personal information overseas and entrusts its processing as follows, and discloses this in this Privacy Policy pursuant to Article 28-8(1)(3) of the Personal Information Protection Act.

   Recipient (Contact)	Country	Items Transferred	Timing and Method	Purpose and Retention Period
   Anthropic, PBC (privacy@anthropic.com)	United States	Text of the diaries a Member wrote in the month (information that identifies the Member, such as email address or account identifier, is not sent)	When the Monthly Report is generated on the 1st of each month, over an encrypted connection (HTTPS)	Keyword extraction for Monthly Reports. Deleted within 30 days after processing (except where retention is required by law or policy, such as to review a possible usage policy violation), and not used to train AI models
   Google LLC (googlekrsupport@google.com)	United States	Device token for receiving push notifications, notification content	Each time a notification is sent, over an encrypted connection (HTTPS)	Sending push notifications. Until the entrustment ends or the Member withdraws
   Amplitude, Inc. (privacy@amplitude.com)	United States	App usage records (screens viewed, buttons tapped, whether features are used), Member ID (the Service's internal identifier), device information (operating system, device model, app version, language, country), an app installation identifier generated by Amplitude. Diary content, photos, Diary names, city or location derived from IP addresses, and advertising identifiers are not sent	While the app is in use, over an encrypted connection (HTTPS)	Analyzing and improving use of the Service. Until the entrustment ends

3. Members may refuse the overseas transfer of their personal information by emailing the Chief Privacy Officer (Article 10). If a Member refuses the transfer to Anthropic, PBC, keywords will not be provided in the Monthly Report, and the rest of the Monthly Report and the Service remain available. If a Member refuses the transfer to Google LLC, they will not receive push notifications. Members may refuse the transfer to Amplitude, Inc. by turning off “Send usage data” under My Page → App Settings in the app; after it is turned off, no data is sent and use of the Service is not restricted.
4. Where the content of an entrusted task or the entrusted party changes, the Company will disclose it through this Privacy Policy without delay.

Article 6 (Rights and Obligations of Data Subjects and Legal Representatives and Methods of Exercise)

1. A Member may at any time exercise rights against the Company such as requesting access to, correction of, deletion of, or suspension of processing of personal information.
2. The rights under Paragraph 1 may be exercised in writing, by email or by similar means, and the Company will act on the request without delay.
3. The rights under Paragraph 1 may be exercised through an agent, such as the Member's legal representative or a person authorized by the Member. In that case, a power of attorney confirming the authorization must be submitted.
4. The exercise of a Member's rights, such as requests for access to, correction of, deletion of, or suspension of processing of personal information, may be restricted as provided by the Personal Information Protection Act and other relevant laws. In addition, deletion cannot be requested where a law specifies that the personal information is to be collected.
5. A Member may withdraw consent to receive marketing information at any time in the notification settings in the Service, may withdraw consent to the collection and use of optional information (date of birth and gender) at any time in the settings in the Service, and may withdraw consent to the collection and use of personal information by withdrawing membership in the Service.

Article 7 (Destruction of Personal Information)

1. The Company destroys personal information without delay when it is no longer needed, such as when the retention period has expired or the purpose of processing has been achieved.
2. Where personal information must continue to be retained under the laws listed in Article 3, Paragraph 2 even though the retention period consented to by the Member has expired or the purpose of processing has been achieved, the Company moves that personal information to a separate database (DB) or stores it in a different location.
3. The procedure and method for destroying personal information are as follows.
   1. Procedure: the Company selects the personal information for which a ground for destruction has arisen, and destroys it with the approval of the Chief Privacy Officer.
   2. Method: personal information recorded and stored as electronic files is destroyed so that the records cannot be reproduced, and personal information recorded and stored on paper is destroyed by shredding or incineration.

Article 8 (Measures to Ensure the Security of Personal Information)

1. The Company takes the following measures to ensure the safety of personal information.
   1. Administrative Measures: Establishment and implementation of internal management plans, regular inspection of access records.
   2. Technical Measures: Management of access rights to personal information processing systems, encryption of personal information, installation and updating of security programs.

Article 9 (Installation, Operation, and Refusal of Automatic Personal Information Collection Devices)

The Company does not use web browser-based cookies. However, for service usage analytics, the app includes an analytics tool from Amplitude, Inc. that collects the app usage records and device information described in Article 2, and Members may refuse this at any time by turning off “Send usage data” under My Page → App Settings in the app.

Article 10 (Personal Information Protection Officer)

The Company has designated a Personal Information Protection Officer as follows to oversee all tasks related to the processing of personal information and to handle Members' complaints and remedies related to personal information processing.

1. Name: Jin-uk, Kang
2. Position: Operation Director
3. Contact: connect@novalink.co.kr

Members may contact the Personal Information Protection Officer regarding inquiries, complaints, and remedies related to personal information protection arising from the use of the Company's services.

Article 11 (Remedies for Infringement of Data Subjects' Rights)

The Company guarantees data subjects' right to self-determination over their personal information and works to provide consultation and remedies for damage caused by personal information infringement. Where a report or consultation is needed, please contact the responsible department.

1. Personal Information Infringement Report Center (privacy.kisa.or.kr / 118 without area code)
2. Personal Information Dispute Mediation Committee (www.kopico.go.kr / 1833-6972 without area code)
3. Supreme Prosecutors' Office (www.spo.go.kr / 1301 without area code)
4. Korean National Police Agency (cyberbureau.police.go.kr / 182 without area code)

Article 12 (Scope of Application of the Privacy Policy)

This Privacy Policy applies to the "DayPic" service provided by the Company, and a specialized Privacy Policy may apply for each service. This Privacy Policy does not apply if Members visit other companies' websites or services linked to the Service, or if personal information is collected from the visited website or service.

Article 13 (Changes to the Privacy Policy)

The Company may modify the Privacy Policy for the purpose of reflecting changes in laws or the Service. If the Privacy Policy is changed, the Company will notify Members in advance before the effective date.

Addendum

This Privacy Policy shall take effect from October 27, 2026.