한국어 / English
supaSAJU Privacy Policy
supaSAJU is a service in which you talk with an AI guide about Saju (Korean Four Pillars) by voice. Your voice and conversation during a consultation are processed on systems of providers such as OpenAI, outside the Republic of Korea. Our servers do not record or store the raw audio of the call, and we do not store the full transcript of an ordinary consultation.
1. Who processes your data
Suparain, Inc. (the "Company") processes personal data to provide supaSAJU. For service questions and to exercise your rights (customer support): help@supasaju.com
Person responsible for personal data protection: CEO 임호빈 (contact: help@suparain.com) — receives complaints and remedy requests about how personal data is handled. help@supasaju.com is the customer support address for the supaSAJU service; help@suparain.com is the contact for the company and its data protection officer.
2. What we process, why, and for how long
- Account and sign-in: email address, a one-way protected form of your password (if you signed up with email and password), the unique identifier and email provided by Google or Apple sign-in, and sign-in session records (only a hash of the session token is stored), and the send record of the one welcome email sent right after sign-up (only its language and send time; the email address and body are not stored) — to provide the account and prevent misuse, kept until you delete the account.
- Eligibility check: date of birth, country of residence, and whether you confirmed you are an adult where you live — to confirm adult use and supported regions, kept until you delete the account.
- Birth details (optional storage): date of birth (solar or lunar, leap month), time of birth (optional), sex (optional), birth city and time zone — to calculate your Saju chart and run consultations. We store them only if you agree, until you delete them, withdraw consent, or delete the account.
- Chart calculation results (optional consent): only if you separately agree to reuse of results — so the same birth details need not be recalculated, kept for up to 1 year. They are deleted when you edit or delete your birth details, withdraw consent, or delete the account.
- Consultation records: time of the consultation, the AI guide you chose, the language, the birth-detail input used for the consultation, and its status — to show your history and account for your passes, kept until you delete the account.
- Consultation summaries (optional, off by default): only if you turn on "Save consultation summaries", we keep an AI-written summary; only if you separately turn on "Let the same guide use earlier summaries" is it used in your next consultation with that guide. Turning saving off deletes existing summaries, and they are also deleted when you delete the account.
- Voice and conversation during a consultation: processed in real time only; the raw audio is not stored. We do not store the full transcript of an ordinary consultation. However, while an operator has turned on diagnostic capture to analyse problems, consultations in that period have their transcript, tool calls, and the reference material given to the model kept for up to 7 days, and technical metadata and usage for up to 30 days, readable only by administrators. This material is never reused as consultation memory or summaries.
- Purchase records: for web payments, the order (product, amount, status, payment-provider transaction number); for app store payments, the transaction (store order number, product, status — we do not keep the receipt or purchase token itself); and the record of passes granted and used — to fulfil purchases and handle refunds and disputes, kept while the account exists and for the period the law requires. After you delete your account, only the payment and refund records are kept for 5 years, apart from your account and without your email address or other direct identifiers (Act on Consumer Protection in Electronic Commerce; see section 5 of Deleting your account). Card numbers and other payment-method details are not stored on our servers.
- Support: the subject, message, and reply of in-app and web inquiries, and the content of emails you send us — to answer you, kept until you delete the account (in-app and web inquiry records are deleted with the account).
- Device and access information: a one-way protected form of IP address and user agent (to limit request rates), the country of access that Cloudflare reports (to check supported regions and to choose which emergency contacts to show in a crisis), and error and audit records — for security and incident response, kept for the minimum period per purpose.
- Hash of a device identifier (app only): to give the welcome pass only once per device when you first sign up in the app, the app sends a device identifier and the server stores only a one-way value (HMAC) made with a server secret, not the original. To stop the same device from signing up again and receiving it repeatedly, this hash remains, detached from any account, even after you delete your account.
- Consultation cost statistics: a per-consultation summary of estimated AI usage cost. It carries nothing that identifies you and is kept for cost accounting.
We do not store your password in the clear, any national identification number, your legal name, your card number, or the raw audio of the call.
3. Processors and transfers outside Korea
We entrust the minimum necessary processing to the providers below, and most of it happens outside the Republic of Korea. We do not sell personal data.
| Recipient | What is transferred | Country, when, how | Purpose and retention |
|---|---|---|---|
| OpenAI, L.P. | Your voice during the consultation, what is said (transcript), the chart and Saju calculation material for that consultation (including results calculated from your birth details), and the conversation when a summary is generated. | United States. Streamed in real time during the consultation (WebRTC) and over HTTPS during and after it. | Generating the AI voice reply and interpretation, and the summary. That we do not store raw audio describes our own servers; OpenAI's handling and retention follow OpenAI's own policies. |
| Suparain's own Saju calculation engine (api.supasaju.com) | Date and time of birth, sex, birth city. | Servers on Cloudflare. When a chart is calculated. | Calculating the chart and the evidence behind the reading. A system the Company operates; it is not passed on to a separate outside provider. |
| Cloudflare, Inc. | Everything listed in section 2 that we store, access logs, outgoing email, and the web pages, images, and video files. | United States and global edge locations. Whenever the service is used. | Servers, database, file storage, and email delivery (welcome, password reset, support replies). Retention follows section 2. |
| TypeSafe AI (third-party model provider on Cloudflare Workers AI) | Part of what the AI guide says (a sentence used to choose an expression and gesture). Your own speech is not sent. | Through Cloudflare Workers AI. In real time during the consultation. | Choosing the guide's on-screen expression and gesture. If this fails or is slow, it is skipped. |
| Google LLC / Apple Inc. | Provider identifiers and authentication tokens at sign-in; purchase information (order number, purchase token, etc.) for store payments. | United States. At sign-in and at payment verification. | Authentication, payment verification, and subscription renewal and refund notices, under each company's own policy. |
| NICE Payments Co., Ltd. | Order and approval details for web payments. | Republic of Korea (processed domestically). | Approving, cancelling, and refunding web payments, for the period the law requires. |
If you do not want these transfers, you cannot use the service: a consultation passing through AI processing is what the service is. To withdraw, delete your account.
4. Retention and destruction
When the retention period ends or the purpose is met, we delete the data in a way that makes recovery impractical. Diagnostic material is removed by an hourly cleanup once its period has passed. Records the law requires us to keep are stored separately by purpose and destroyed when that period ends. Payment and refund records kept apart after account deletion are destroyed by the same hourly cleanup once 5 years have passed from the payment date (or from the refund date, if there was a refund). See Deleting your account for what is deleted and what is kept.
5. Your rights
- You may ask to access, correct, delete, or stop the processing of your personal data, withdraw consent, and delete your account.
- Delete saved birth details: you can do this yourself in Settings in the app and on the web.
- Turn off summaries: turning off "Save consultation summaries" in Settings (on the web, "Summaries & memory") deletes existing summaries and stops saving new ones. You can also turn off only "Let the same guide use earlier summaries". It cannot instantly make a consultation already in progress forget what it was told.
- For anything you cannot do inside the service, write to help@supasaju.com; we verify who you are and then act without delay under applicable law.
6. When you delete your account
When you choose "Delete account" in Settings in the app or on the web, we delete your account, the links to your sign-in methods, birth details, chart results, consultation records and summaries, support inquiries, diagnostic material, and pass history. Payment and refund records the law requires us to keep (kept apart for 5 years without your email address or other direct identifiers, with your account identifier replaced by a one-way value), and statistics that cannot identify you, remain as described in Deleting your account.
7. Cookies and device storage
- Web sign-in cookie (
__Host-supasaju_session): an essential cookie that keeps you signed in across reloads and new tabs. It cannot be read by JavaScript, lasts up to 30 days, and is removed when you sign out or delete your account. - Browser storage (
supasaju.language): remembers the display language you chose. - App: the sign-in session token is kept in the device's secure storage (iOS Keychain / Android Keystore) for up to 30 days.
- We do not use advertising cookies or tracking tools.
8. How we protect it
We apply reasonable safeguards: least-privilege access, encrypted transport (HTTPS), one-way protection of passwords and session tokens, keeping secrets outside the code, audit logging, and security review.
9. Children
supaSAJU is an adult-only service and is not intended for anyone under 18. In the Republic of Korea you must be 19 or older, and elsewhere you must also meet the age of majority where you live. The age limit is applied through the 18+ rating on the app stores and the eligibility check at sign-up. If we learn that an account belongs to someone who is not eligible, we delete it and the related data without delay. Tell us at help@supasaju.com and we will check and act.
10. Changes
When this policy changes, we announce the effective date and the main changes in the service. Material changes follow the separate procedure applicable law requires. Once there are earlier versions, they are listed at the top of this document.
11. Language
This English text is provided for users outside Korea. If the Korean and English texts differ, the Korean text governs.