Privacy Policy

Article 1 (Purposes of Processing)

The Company processes personal information for the following purposes. Personal information is not used for any purpose other than the following, and if a purpose changes, the Company takes the necessary measures, such as obtaining separate consent under Article 18 of the Personal Information Protection Act.

1. Member identification and login: to identify Members by email address and send verification codes

2. Provision of the Service: to organize the guide a Member has uploaded into a guide page, show it to Guests, answer Guests' questions and translate the guide text

3. Member communications: to inform Members by weekly email of unanswered Guest questions and view counts, to reply to Members' feedback, and to notify changes to the Terms and this Policy

4. Service improvement: to improve the accuracy of how sentences entered when editing a guide are handled, and to review feedback sent by Members

5. Prevention of abuse: to count usage in order to block automated bulk calls

6. Advertising performance measurement: to measure whether a visit arriving through online advertising placed by the Company led to the creation of a guide page, registration or publication

7. Service usage analysis: to understand at which step Members encounter difficulty on the Member screens and to improve those screens and their wording

Article 2 (Personal Information Processed)

The Company processes the following items of personal information.

(1) Members (accommodation operators)

1. On registration and login: email address and the display language of the Member screens at the time of login (Korean or English). Name, phone number, photo and other information are not collected.

2. Information a Member enters or uploads while using the Service: the original guide text, organized guide items and notices, accommodation photos, accommodation name and address, Wi-Fi details, door codes, contact numbers and other values the Member chooses to place on the Guide Page

3. Sentences entered in the input field when editing a guide, and how they were handled (saved or cancelled)

4. The content of feedback a Member sends through the feedback box and, when reporting a problem, the screen name, browser, screen size and time that the Member reviewed and sent

5. The rating a Member leaves immediately after publication

6. Login verification codes are not stored in plain text. Only a hash is kept, and it is deleted immediately once ten minutes have passed since sending or once verification succeeds.

(2) Guests (viewers of a Guide Page)

1. Guests do not register. Each browser is given an anonymous identifier used only to separate that Guest's conversation, and no name, phone number or email address is collected.

2. Questions sent by the Guest and the AI's answers, the number and time of day of views of the Guide Page, and the language the Guest selected or the browser reported

3. The original text of a Guest's question is shown on the screen of the Member operating that accommodation. Parts that appear to be phone numbers are masked, but Guests are advised not to include personal information in questions.

(3) Automatically generated information: usage counts (AI calls, publications, verification code sends and similar) and usage counts keyed to the connecting IP address. Access logs and usage counts are processed only for the prevention of abuse.

(4) Advertising performance measurement information: the connecting IP address, the address of the page viewed, browser information, the advertising click identifier (gclid) and advertising parameters (utm) collected by the Google Ads tag installed on the Member screens (home, editor and console), and conversion events at the time of guide page creation, registration and publication. This information is not collected on Guide Pages viewed by Guests.

(5) Service usage analysis information: the connecting IP address, the address of the page viewed, browser and device information, screen size, the country and city of access, interaction records such as mouse movement, clicks and scrolling, and the content displayed on the screen at the time of the interaction, collected by the Microsoft Clarity tag installed on the Member screens (home, editor and console) and on the sample Guide Pages. The content displayed may include the original guide text and organized guide items uploaded by a Member, the accommodation name and address, the Member's email address, and the original text of questions sent by Guests. Text being typed into input fields and the values of dropdown menus are not collected. This tag is not installed on Guide Pages viewed by Guests; it is installed only on the Company-owned sample Guide Pages shown as examples on the home screen.

Article 3 (Processing and Retention Period)

(1) The Company processes and retains personal information within the retention and use period prescribed by law or agreed to by the data subject at the time of collection.

(2) The retention period for each item is as follows.

1. A Member's email address, Member Content, and Guests' conversations and view records: until the Member deletes the relevant Guide Page or requests deletion of the account

2. Sentences entered when editing a guide and how they were handled: 90 days. They are deleted automatically after that period and are deleted together with the Guide Page if it is deleted.

3. Hashes of login verification codes: until ten minutes after sending or until verification succeeds

4. Usage count records: they expire when the relevant counting period (one day or one hour) ends.

5. Feedback and ratings sent by a Member: until the Member requests deletion of the account

6. Service usage analysis information: 30 days for records in a form that allows an interaction to be replayed, and 9 months for records aggregated per page. After that period the data, including backups, is deleted from Microsoft's servers.

(3) The Service does not currently include a function to delete an account from the screen. A Member who wishes to delete the account and all data may request this through the contact in Article 10, and the Company deletes the data without delay from the date of the request and notifies the Member of the result.

(4) Where applicable laws require certain records to be preserved, they are preserved for the period prescribed by those laws.

Article 4 (Provision to Third Parties)

(1) The Company processes personal information only within the scope stated in Article 1 and does not provide it to third parties except with the data subject's separate consent, where specifically provided by law, or where an investigative agency requests it in accordance with the procedures and methods prescribed by law.

(2) The Company does not sell personal information to anyone. Except for the advertising performance measurement under Article 1 item 6, the Company does not use personal information for advertising purposes and does not serve targeted advertising to data subjects.

Article 5 (Outsourcing and Overseas Transfer)

(1) The Company outsources the processing of personal information as follows in order to provide the Service.

1. Google Cloud (Firebase), Google LLC: data storage and operation of computing systems. Data is stored in the Republic of Korea (Seoul region).

2. Google Cloud Vertex AI, Google LLC: organizing, reviewing and translating guides, and generating answers to Guests' questions. Member Content and Guests' questions are transmitted for this processing.

3. Google Workspace (Gmail), Google LLC: sending login verification codes and weekly emails

4. Google Ads, Google LLC: advertising performance measurement. The tag installed on the Member screens transmits the information in Article 2 paragraph (4) to Google LLC.

5. Microsoft Clarity, Microsoft Corporation: service usage analysis. The tag installed on the Member screens and the sample Guide Pages transmits the information in Article 2 paragraph (5) to Microsoft Corporation.

(2) The AI processing under paragraph (1) item 2 uses an endpoint that is not assigned to a specific region and may therefore be performed outside the Republic of Korea. The items transferred are Member Content and Guests' questions and answers, the transfer occurs at the time the relevant function is used, and the recipient is Google LLC (United States). The Company uses this service on the condition that transmitted data is not used to train AI models. The advertising performance measurement information under paragraph (1) item 4 is transferred to Google LLC (United States) when a Member screen is opened, and the service usage analysis information under paragraph (1) item 5 is transferred to Microsoft Corporation (United States) at the same time, which may include Member Content and Guests' questions displayed on that screen. This transfer is a transfer incidental to the outsourcing of processing under Article 28-8 paragraph (1) item 3 of the Personal Information Protection Act, and disclosure through this Policy takes the place of separate consent.

(3) When entering into an outsourcing agreement, the Company sets out the matters necessary for the secure processing of personal information and supervises whether the processor handles personal information securely. If the outsourced work or the processor changes, the Company discloses this without delay through this Policy.

Article 6 (Destruction of Personal Information)

(1) The Company destroys personal information without delay when it is no longer needed, such as when the retention period expires or the purpose of processing has been achieved.

(2) Personal information in electronic file form is deleted in a manner that prevents recovery. The Company does not keep personal information in paper form.

Article 7 (Rights and Obligations of Data Subjects and How to Exercise Them)

(1) A data subject may at any time request the Company to allow access to, correct, delete or suspend the processing of their personal information.

(2) The rights under paragraph (1) may be exercised by sending an email to the contact in Article 10, and the Company takes action within ten days of receiving the request and notifies the result.

(3) A Member can directly delete Guide Pages and their associated records on the Service.

(4) A Guest may also request deletion of their conversation records. Because the Company distinguishes Guests only by an anonymous identifier, it may ask the Guest for the minimum information needed to identify the conversation concerned.

(5) The Company verifies that a person requesting the exercise of rights is the data subject or a legitimate representative.

(6) Deletion cannot be requested where another law designates the personal information as subject to collection.

Article 8 (Installation, Operation and Refusal of Automatic Collection Devices)

(1) The Company uses the following cookies and browser storage.

1. Guest language cookie: used to remember for one year the language a Guest selected on a Guide Page so that the same language is shown on the next visit.

2. Member screen language cookie (rb:host-locale): used to remember for one year the display language of the Member screens (home, editor and console).

3. Login state storage: the login state of Members and Guests and the anonymous identifier are kept in browser storage and carried over on the next visit.

4. Advertising performance measurement cookies (_gcl_au, _gcl_aw and similar, Google Ads): set on the Member screens by the Google Ads tag to measure whether a visit arriving through advertising placed by the Company led to guide page creation, registration or publication. They are retained for up to 90 days.

5. Advertising parameter storage (sessionStorage rb:utm): the advertising click identifier and advertising parameters contained in the visited address are kept until the browser tab is closed and sent together with conversion events.

6. Service usage analysis cookies (_clck, _clsk, Microsoft Clarity): set on the Member screens and the sample Guide Pages to group the interactions that occur there into a single visit. _clck is retained for one year and _clsk for one day.

(2) Except for the advertising performance measurement and service usage analysis under paragraph (1) items 4 through 6, the Company does not collect behavioral information, and it does not use cookies for targeted advertising. These cookies are not set on Guide Pages viewed by Guests.

(3) A data subject can delete cookies and storage or refuse them in the browser settings. In that case the language selection may not be remembered or the login state may not persist. Advertising performance measurement cookies can be refused through the browser's ad-blocking features or Google's ad settings (adssettings.google.com), and service usage analysis cookies can be blocked in the browser settings; refusing them does not restrict use of the Service.

Article 9 (Measures to Ensure the Security of Personal Information)

The Company takes the following measures to ensure the security of personal information.

1. Encryption in transit: all communications with the Service are encrypted with HTTPS.

2. Access control: writes to the database and storage are made only through the Company's servers, and access rules prevent writing directly from the browser or reading another Member's data.

3. Hashed storage of verification codes: login verification codes are not stored in plain text and only a hash is kept.

4. Data protection: deletion protection, point-in-time recovery and daily backups are applied to the database.

5. Minimum collection: no personal information other than the email address and the display language is collected from Members.

Article 10 (Privacy Officer)

(1) The Company is responsible for overall management of personal information processing and designates the following privacy officer to handle complaints and remedies of data subjects relating to the processing of personal information.

Data controller: Code Sprint Co., Ltd. (Representative Director Sehun Jeong, Business Registration No. 251-86-03778)

Privacy officer: Sehun Jeong

Contact: support@sonnim.app

(2) A data subject may direct all inquiries, complaints and requests for remedy relating to personal information arising from the use of the Service to the privacy officer. The Company answers and handles such inquiries without delay.

Article 11 (Remedies for Infringement of Rights)

A data subject may apply for dispute resolution or consultation to the Personal Information Dispute Mediation Committee, the Personal Information Infringement Report Center of the Korea Internet & Security Agency, and other bodies in order to obtain relief from infringement of personal information.

1. Personal Information Dispute Mediation Committee: 1833-6972 (www.kopico.go.kr)

2. Personal Information Infringement Report Center: 118 (privacy.kisa.or.kr)

3. Supreme Prosecutors' Office: 1301 (www.spo.go.kr)

4. Korean National Police Agency: 182 (ecrm.cyber.go.kr)

Article 12 (Changes to this Privacy Policy)

(1) This Privacy Policy applies from its effective date.

(2) The Company may add, delete or amend the content of this Policy due to changes in law or the Service. When it does so, it announces the change and its effective date on the Service from seven days before it takes effect. Changes required by amendments to law or by urgent security needs may be announced at the same time they take effect. The Company may notify Members of changes by email where it considers this necessary.

(3) A data subject who continues to use the Service after the effective date of a changed Policy is deemed to have agreed to it. A data subject who does not agree to a changed Policy may stop using the Service and request deletion of their data under Article 3 paragraph (3) or Article 7.

Article 13 (Language)

The Korean version of this document is the governing text. The English version is provided as a reference translation only. In case of any discrepancy between the two, the Korean version prevails.

Addendum

This Privacy Policy takes effect on August 19, 2026.