Privacy Policy

Article 1 (Purposes of Processing Personal Information)

The Company processes personal information only for the following purposes and does not use collected personal information for any other purpose.

• Membership and account management: identity verification, keeping you signed in, preventing misuse, notices, and dispute handling
• Providing the Service: calculating Saju and generating readings, showing results, handling payments and refunds, and responding to inquiries
• Mobile app services: text and voice conversations with AI characters, managing the people (“connections”) you register, sending push notifications, and confirming in-app purchases
• Improving the Service: checking errors and analyzing usage statistics

Article 2 (Personal Information We Process)

The items the Company collects are limited to the following.

Account information

• Email address and password (stored in a form that cannot be decrypted)
• If you sign up with a social login, the account identifier and email address that service provides
• A display nickname and avatar emoji that the Service creates automatically

Input for Saju readings

• The name (or the name you are called) shown in the result, gender, and date of birth (including solar/lunar calendar and leap month)
• Time of birth and city of birth (optional — you can proceed without them if you do not know)
• For products that need the other person’s information, the same items for that person
• Relationship status and any concerns you want reflected in the reading (optional)
• Your answers to the questions asked before a reading starts (yes/no) are kept and deleted together with the result.

Payment records

• The payment identifier issued by the payment provider, and the amount, currency, method, status and time of payment
• Payment method details such as card or account numbers are handled by the payment provider, and the Company does not store them.
• At payment, the buyer’s name, mobile number and email are passed to the payment provider. The Company does not store them.

Additional information processed in the mobile app

• Sign-in information: if you sign up with Apple or Google, the account identifier and email address that service provides (a hidden address if you use Apple’s hide-my-email); if you sign up with email, your email address and password
• A profile photo (optional), and the name, Saju input information and photo (optional) of people you register as connections
• Conversation content: text conversations with AI characters, the text transcribed from voice conversations, and photos you attach to a conversation
• Voice: the voice captured by the microphone during a voice conversation. It is captured only if you allow microphone access and only while you are in a voice conversation. The Company does not store the original voice; only the transcribed text is saved as conversation history.
• Memory of past conversations: a topic and summary note created for each day you chat in membership conversations (talk about crisis, health or pregnancy is not recorded), and the setting for sharing between characters
• Push notification token (Expo push token) and notification settings
• Device and usage information: device type, operating system, app usage events (screen views, button use, etc.), and app error and crash information
• In-app purchase information: the products you bought, subscription status and the store transaction identifier. Payment method details such as card numbers are handled by Apple and Google and are not known to the Company.
• Share card images: only when you share through KakaoTalk or similar, the share card image is uploaded temporarily.

Information generated automatically while you use the Service

• Access logs, country of access, device type, operating system, browser and language setting
• Cookies (used to keep you signed in and to remember language settings)

The Company does not collect mobile phone numbers, location information or interest information.

Article 3 (Retention and Use Period)

• When you leave the Service, the information you entered (date of birth, the other person’s information) and the results are deleted immediately.
• When you leave the mobile app, your account is deactivated immediately and your email is replaced with an irreversible value (you can no longer sign in, and social connections are removed). Together with this, conversation history, memory, connections, Saju results, voice conversation records, push tokens and notification records, and usage-limit records are deleted, and profile photos, connection photos, conversation attachment photos and share card files are removed from storage.
• Information kept after you leave: payment records (5 years under the Act on the Consumer Protection in Electronic Commerce); subscription and credit purchase and usage records (linked to the deleted account without name or email); and invitation records (the invite code and the identifiers and time of the inviter and invitee — kept to prevent duplicate rewards through re-registration). RevenueCat customer attributes (email, name, etc.) are deleted and purchase history is kept.
• Results that have not been paid for are automatically deleted one year after they were created.
• Paid results are kept until you leave the Service. However, the full reading can be viewed only for one year from the payment date.
• Payment records are kept for 5 years under the Act on the Consumer Protection in Electronic Commerce; the date of birth and the other person’s information are not included in payment records.

Article 4 (Provision to Third Parties)

The Company does not provide users’ personal information to third parties. The exceptions are as follows.

• When the user has consented in advance
• When the law specifically provides for it
• When an investigative agency requests it through lawful procedures

Article 5 (Outsourcing of Personal Information Processing)

The Company outsources the following tasks to provide the Service, and supervises the contractors in accordance with the law.

• Supabase — member authentication and database storage
• Google Cloud Platform — service hosting
• Google Analytics — usage statistics
• Korea PortOne — payment processing and payment method integration
• KG Inicis — approval and cancellation of card and easy-pay payments
• Dodo Payments — overseas payment processing for users outside Korea (Merchant of Record)
• Apple Inc. and Google LLC — processing of in-app purchases, Sign in with Apple and Google sign-in
• RevenueCat, Inc. — confirming and managing in-app purchases and subscription status
• Google Firebase (Analytics and Crashlytics) — app usage statistics and error and crash collection
• Expo (Expo Push service) — delivering push notifications
• OpenAI — generating conversation and reading text, processing voice conversations (speech recognition and generating spoken replies), understanding the content of attached photos and checking for inappropriate images
• Anthropic — may be used, depending on service settings, to generate readings (as a substitute when OpenAI is unavailable)
• xAI — may be used for conversation generation and voice conversation depending on service settings
• KIE.ai — may be used for AI image generation depending on service settings

Only the input needed to generate readings and conversations (Saju input, conversation content, voice and attached photos) is passed to AI providers, and the Company does not use it for any purpose other than providing the Service.

Article 5-2 (Overseas Transfer of Personal Information)

Some contractors process personal information on servers outside the Republic of Korea (Article 28-8 of the Personal Information Protection Act). The recipients, countries, items and purposes, and contacts are as follows.

• Timing and method: the items needed are transmitted over the information and communications network whenever you use the relevant feature.
• Recipients’ purpose and retention period: limited to the purposes in the table above and the outsourced tasks in Article 5, until the relevant outsourcing contract ends or you leave the Service (payment records for the period required by law).
• How to refuse, procedure and effect: if you do not want your information transferred overseas, you can stop using the relevant feature (AI readings, conversation, voice conversation, push notifications, overseas payment, usage statistics and sign-in), delete your information by account withdrawal in the settings screen, or ask the Privacy Officer (Article 10) by email. If you refuse, you cannot use the relevant feature. Member authentication and data storage (Supabase) and service hosting (Google Cloud) are the basis of the Service, so you cannot use the Service if you refuse them.

Article 6 (User Rights and How to Exercise Them)

As a data subject, you may exercise the following rights.

• Request access to personal information
• Request correction if there are errors
• Request deletion (you can do this yourself with account withdrawal in the settings screen)
• Request suspension of processing

Some rights may be restricted by law, and the Company acts without delay when a request is made.

Article 7 (Procedure and Method of Destroying Personal Information)

• When the retention period has passed or the purpose of processing has been achieved, information is destroyed without delay.
• Electronic files are permanently deleted by a technical method that cannot be recovered.

Article 8 (Measures to Ensure Safety)

In accordance with Article 29 of the Personal Information Protection Act, the Company takes the following measures.

• Administrative measures: establishing and implementing an internal management plan, and minimizing access rights
• Technical measures: encryption in transit, one-way storage of passwords, and access control

Article 9 (Cookies: Installation, Operation and Refusal)

The following applies to the website. App usage statistics are collected through Firebase in Article 2.

• The Company uses cookies to keep you signed in and for usage statistics.
• You can refuse to store cookies in your browser settings.
• If you refuse cookies, some use of the Service may be limited, for example you may not stay signed in.

Article 10 (Privacy Officer and Contact)

• Privacy officer: Haejung Ko
• Email: privacy@arclair.com
• Address: 5086, 5F, Namgyeong Bldg, 35, Irwon-ro, Gangnam-gu, Seoul, Republic of Korea

For reports of privacy infringement or consultation, you can contact the following bodies.

• Personal Information Infringement Report Center (privacy.kisa.or.kr / dial 118 in Korea)
• Supreme Prosecutors’ Office Cyber Crime Division (spo.go.kr / dial 1301 in Korea)
• National Police Agency Cyber Bureau (cyberbureau.police.go.kr / dial 182 in Korea)

Article 11 (Changes to This Policy)

This policy may be amended in line with changes in law, policy or security technology, and changes are announced in the Service at least 7 days in advance.

Addendum (Revision History)

• Announced October 21, 2026 · effective November 20, 2026: added mobile app items collected, outsourcing, overseas transfer (table in Article 5-2), and handling upon withdrawal. Because this is a significant change to how personal information is processed, it is announced 30 days in advance, longer than the 7 days in Article 11.
• Effective September 21, 2026: previous policy (applies until November 19, 2026)