Privacy Policy
0. General Principles: BJB luxury (비제이비럭셔리; CEO Bae Ho-ik, Business Registration No. 863-07-03203, the "Company") values users' personal information and complies with the Personal Information Protection Act and related laws. This Service is built and operated in accordance with the laws of the Republic of Korea, and as a matter of principle, the laws of the Republic of Korea apply with priority regardless of the user's nationality or location. This Service can be browsed (board/map/life-guide viewing, camera translation) without registering; even then, minimal information (access IP address, device and browser information) may be collected automatically to operate the Service. In the app, a push token (only if you allow notifications) and the advertising identifier used for in-app ads may also be collected; see the table in Section 2 for details. Interactive features such as posting are available only after signing up. Logging in as a guest creates an anonymous account without an email address; guests can browse the Service, use the AI Assistant, purchase paid services, file reports (up to 5 a day), contact customer support (up to 3 inquiries a day), and block members. Other member features such as posting, bookmarks, and writing comments require signing up with email or a social account.
1. Purposes of Processing: account registration and management, providing the Service (board/map/help-requests/jobs/translation), preventing fraudulent use, handling customer inquiries, processing payments for paid advertising products, displaying advertisements within the Service (including in-app ads), sending (push) notifications, statistics and service improvement (de-identified); provision and quality improvement of the AI Assistant service, personalized recommendations based on the user's own bookmarks and frequently viewed place types (AI Assistant records are not used), verifying in-app subscriptions (AI Membership) and providing their benefits, granting rewards for watching rewarded ads; business performance analysis (statistical purposes, in principle de-identified where feasible); saving and managing My Plans and sending/importing plans between devices with a single-use QR code.
2. Personal Information Items Processed
| Category | Items | Consent Required |
|---|---|---|
| Required (contract performance) | Email, nickname, social-login identifiers (Google/Kakao/Apple — for Sign in with Apple, the Apple account identifier and email address, or the relay email address created by Apple if the user chooses Hide My Email) | Not required (necessary to perform the service agreement) |
| Required (chosen at sign-up) | Nationality, display language, consent status for the Terms, personal-information collection, location information, etc., and when consent was given or changed | Not required (necessary to perform the service agreement and to record consent) |
| Guest | Anonymous account identifier (no email) | Not required (necessary to perform the service agreement) |
| Location | GPS-based location | Separate explicit consent required |
| Optional | Profile photo, bio | Not required (voluntary) |
| Marketing | Event/promotion notifications | Separate consent required (optional) |
| Marketing (app push) | Whether the user consents to receive promotional push notifications; whether the user consents to receive promotional information at night (9 p.m. to 8 a.m. the next day) | Separate consent required (optional) |
| Safety alerts | Whether the user consents to receive safety alerts such as weather warnings | Separate consent required (optional) |
| Push notifications (app) | Device push token, app version, display language | Optional (collected only if you allow notifications in the app) |
| Payment (advertisers) | Store purchase identifiers (the app store's transaction ID, order number and purchase token), purchase history, purchaser identifier (email, for accounts that have one), ad materials submitted by the advertiser (business name, photos, text, contact details, etc.) | Not required (necessary to perform the contract and to meet statutory retention obligations) |
| Payment (in-app subscription) | Store purchase identifiers (the app store's purchase token and original transaction ID), order number, product, subscription status and period | Not required (when you subscribe in the app; necessary to perform the contract and to meet statutory retention obligations) |
| Created during use | Posts, comments and photos; likes and bookmarks; inquiries and reports; list of blocked members | Written or chosen by the user to use the Service (deleted upon withdrawal, except records that must be kept by law) |
| Created during use (My Plans) | Plan title, date and display language; plan items (order, day, time, place (place ID and name), means of transport, notes); source (AI Assistant, entered by hand, etc.); time created and updated | Saved by the user (members other than guests only; visible only to the member; deleted upon withdrawal) |
| Place photos (owners and staff) | Photos a verified business owner uploads for their own place (photo file, width, height and file size, upload time, uploader member identifier, time the photo rights were confirmed, approval, rejection and hiding records with reasons) — metadata inside the photo (EXIF) such as shooting location (GPS) and device information is removed before storage | Providing place information (only approved photos are shown) and handling review and reports (chosen by the uploading owner) |
| Job postings (recruiting posts) | Recruiting business name (trade name or personal name) and contact details (phone number or email) — shown publicly to other users on the first line of the post | Not required (entered by the user when writing a recruiting post; displayed as required by Article 28 of the Enforcement Decree of the Employment Security Act) |
| Automatically collected (translation usage) | Number of camera, job-posting and board-comment translations and characters translated; member identifier (for non-members, a value converted from the IP address so that it cannot be turned back into the IP) | Automatically collected to check the daily usage limit |
| Automatically collected (QR plan sharing) | Single-use QR token (only an irreversibly converted value is stored, never the original), times issued, expiring and used; the temporary plan moved to another device (title, date, places, times, means of transport — notes and the sender's personal information such as name or email address are not included); rate-limit records (an irreversibly converted value of the member identifier or IP address, and counts) | Created automatically when you send or import a plan by QR (deleted automatically after a short time; see Section 3) |
| Automatically collected | IP, device info, usage records | Automatically collected to operate the Service |
| Automatically collected (AI Assistant) | AI Assistant conversation content (questions/answers), search criteria (region, party size, duration, budget, travel style), history of saving/clicking recommended places | Automatically collected for service provision (when using the AI Assistant) |
| Automatically collected (usage analytics) | Screen visits and feature-usage history (for performance analytics, including as evidence for government grant programs, etc.) | Automatically collected for service provision |
| Automatically collected (in-app ads) | Advertising identifier (device advertising ID — not used in the iOS app), device information, ad impressions and clicks | Collected by Google AdMob when ads are shown in the app (personalized ads are shown only if you turn on the app's "Personalized ads" consent; the iOS app does not track users, does not request App Tracking Transparency (ATT) permission, and shows only non-personalized ads) |
| Automatically collected (rewarded ads) | Rewarded-ad records (member identifier, time, ad transaction ID, whether a question was granted instead because the ad could not be loaded), ad display failure records (time and stage of the failure, error code and message (the Google SDK error description), app version, tracking permission status (ATT; currently not requested on iOS), whether non-personalized ads were requested) | Generated automatically when you watch a rewarded ad in the app or when the ad could not be loaded (to confirm granting extra AI Assistant questions and to identify why ads failed to display) |
| Automatically collected (personalized recommendations) | Food and attraction types viewed often, with view counts and last-viewed time; personalized recommendation setting and when it was changed | Generated automatically during use (can be turned off in My Info) |
※ Note on location information: The GPS-based location information in the table above is processed solely on the user's device (browser) to calculate distance-based sorting for marts, restaurants, hospitals, banks, etc., and the coordinate values themselves are never transmitted to or stored on the Company's servers. For details, please refer to the Location Information Terms of Use (https://www.k-lifeon.com/legal/location). Additionally, when viewing the map, your browser connects directly to the Naver Map API server to display the map, so Naver may collect access information (such as IP address). This is governed by Naver's own privacy policy. When you tap the "My location" button on the map screen, the map moves to the area around your current location; your browser then requests map images for that area from Naver's servers, so Naver can learn your approximate location. The Company moves the map only when you tap this button yourself (it never moves automatically), and does not send the coordinates to or store them on its servers in this process. The map route in My Plans is drawn from the public-data coordinates of the saved places; your current location is not used and is not sent to the Company's servers.
3. Retention and Use Period: Upon requesting account withdrawal, the account is immediately deactivated, and it is automatically and permanently deleted by the system after a 7-day grace period. Signing back in during the grace period restores the account. Upon withdrawal, posts and comments the member has written are also permanently deleted together with other personal data after the grace period. Pursuant to the retention obligations under the Act on Consumer Protection in Electronic Commerce, Etc. and related laws, the following records are retained separately for the periods below, regardless of membership withdrawal.
| Record | Retention Period | Legal Basis |
|---|---|---|
| Records of contracts or withdrawal of subscription | 5 years | Act on Consumer Protection in Electronic Commerce, Etc. |
| Records of payment and supply of goods, etc. | 5 years | Act on Consumer Protection in Electronic Commerce, Etc. |
| Records of labeling and advertising | 6 months | Act on Consumer Protection in Electronic Commerce, Etc. |
| Records of consumer complaints or dispute resolution | 3 years | Act on Consumer Protection in Electronic Commerce, Etc. |
The legally required records above are not deleted upon withdrawal; they are retained separately for the periods above, with their link to the member's account removed. Payment records also store the purchaser's identifier (email, for accounts that have one) at the time of payment for dispute handling, and are retained for the retention periods in the table above. For subscriptions purchased in the app (AI Membership), payment records (store purchase identifiers, order number, product, and period) are likewise retained for 5 years upon withdrawal, with their link to the member's account removed. A subscription purchased with a guest (anonymous) account is moved to the account you are signed in to when you tap [Restore purchases] with the same store account, and the transfer is recorded in the audit history. Records whose retention period has passed are deleted automatically. Ad materials submitted by advertisers are retained for 6 months from the day the ad stops running (records of labeling and advertising) and then deleted (materials of an application that closed without payment are deleted 7 days after it closes).
In addition, records of service usage statistics (screen visits and feature-usage history) are separately retained and destroyed as follows.
| Record | Retention Period | Basis |
|---|---|---|
| Records of service usage statistics (screen visits and feature-usage history) | 1 year from collection (destroyed together with account data upon permanent account deletion) | Internal policy (for service quality and performance analysis purposes) |
| AI Assistant operational records (request success/failure, response time, etc.) | 6 months from collection (destroyed with the account after the 7-day withdrawal grace period) | Internal policy (for service quality management) |
Records of the types you view often, kept for personalized recommendations, are automatically deleted 90 days after you last viewed them, immediately when you turn off personalized recommendations, and together with the account after the 7-day grace period when you withdraw your membership. Push tokens stop being used when you turn off app notifications or log out, and are deleted upon withdrawal; notification delivery records are automatically deleted after 90 days. Rewarded-ad records are automatically deleted 90 days after they are created, and together with the account after the 7-day grace period upon withdrawal. Translation usage records are automatically deleted 30 days after they are created. When a member deletes a comment, its content is removed immediately from the screen and the comment record; to handle reports and fraud, only the original content is kept separately for 30 days in storage that only administrators can access, and is then automatically destroyed (the same applies to comments deleted by an administrator when handling a report). If a comment is reported, a copy of the comment as it was at the time of the report is kept with the report record for 3 years and then destroyed. Comments hidden by an administrator under our operating policies or a temporary measure are not shown to users; if not restored within 30 days from the day they were hidden, they are deleted automatically and their original content is kept separately for 30 days and then destroyed, in the same way as deleted comments. Notifications shown in the in-app notification inbox are the same records as notification delivery logs and are automatically deleted after 90 days. Login records (login date and member identifier) are kept for 3 months to check for misuse and as required by the Protection of Communications Secrets Act, and are then automatically deleted. Sign-in attempt records used to block repeated failed sign-ins (values converted from the email address and IP address so that they cannot be turned back into the originals, whether the attempt succeeded, and the time) are also kept for 3 months and then automatically deleted. Usage restriction (sanction) records are kept for 1 year from the day the sanction ends to prevent repeated misuse and are then automatically deleted (permanent restrictions are kept until the account is deleted). Service error records (the path of the screen or feature where the error occurred and a short error message — email addresses and identifiers are masked and no personal information is included) are kept for 30 days to handle failures and are then automatically deleted. For place photos (photos of a place uploaded by its owner or by staff), metadata inside the photo (EXIF), such as the shooting location (GPS) and device information, is removed before storage; approved photos are kept while they are shown, and rejected photos after 30 days, hidden photos not restored within 30 days of being hidden, and photos whose owner verification was revoked after 30 days are deleted automatically (photos uploaded by a member who withdrew are deleted the day after permanent deletion). My Plans are deleted when the member deletes them, or together with the account when it is permanently deleted after the 7-day grace period following withdrawal. Single-use tokens and temporary plans for QR sharing are deleted as soon as the receiving phone imports the plan or the sender closes the QR screen; if unused, they expire 10 minutes after issue and are erased by an automatic deletion job that runs every 5 minutes. Rate-limit records for QR sharing are deleted automatically after one day.
For disaster recovery, our database provider (Supabase) automatically backs up the entire database every day, and these backups are kept for 7 days and then deleted automatically. In addition, backups the Company makes itself before major changes are kept only on devices managed by the Company and are deleted 14 days after they are made. Personal information a user has requested to delete may therefore remain in backups for up to 14 days. Backups are used solely for disaster recovery and are not separately accessed or used. Personal location information is never transmitted to or stored on the Company's servers, so no separate retention period arises for it (immediately not retained).
4. Provision of Personal Information to Third Parties
The Company does not, in principle, provide users' personal information to third parties, except in the following cases.
| Recipient | Purpose | Items Provided | Retention Period |
|---|---|---|---|
| Investigative authorities under applicable law | Compliance with legal obligations | Scope required by law | Until the purpose of the request is fulfilled |
Users have the right not to consent to third-party provision (except for requests under applicable law in the table above). All paid purchases in the Service (AI Membership subscription and ad products) are processed directly between the user and the app store operator (Google or Apple); the Company does not receive payment details such as card numbers and receives only the purchase confirmation information provided by the store (the "Payment (in-app subscription)" and "Payment (advertisers)" items in Section 2). When you sign in with Google, Kakao or Apple, login verification is handled by each company.
5. Outsourcing of Personal Information Processing
The Company outsources the following processing tasks to provide the Service smoothly.
| Processor | Outsourced Task | Period |
|---|---|---|
| Supabase, Inc. | Data storage/management (DB, authentication, file storage) — hosted on domestic (Seoul, South Korea) servers; not a cross-border transfer | Until membership withdrawal or the outsourcing contract ends |
| Vercel Inc. | Web service hosting and delivery, access log processing | Until membership withdrawal or termination of the outsourcing contract |
| Google LLC (Cloud Translation) | Text translation processing | No caching — processed fresh for each request and discarded immediately after processing (our servers do not store camera or comment translation results; only translations of public data such as job postings are stored, with no personal information) |
| Google LLC (Cloud Vision API) | Image text recognition (OCR) — the image is sent from our server to the Google Cloud Vision API for processing | Immediately upon processing completion (original image not retained) |
| Anthropic, PBC | AI Assistant conversation processing (Claude API) | Automatically deleted after processing (within 30 days; see Section 6, Cross-Border Transfer, below) |
| Google LLC (Firebase) | Push notification delivery | Until membership withdrawal or the outsourcing contract ends |
| Google LLC (AdMob) | Displaying in-app ads (banner and rewarded ads) and confirming rewarded-ad views | Until membership withdrawal or the outsourcing contract ends |
| Resend, Inc. | Sending authentication-related emails such as sign-up confirmation and password-reset emails, and ad review result and ad end notice emails | Until membership withdrawal or the outsourcing contract ends (retained for up to 30 days while the account is active; deleted within 90 days after contract termination) |
6. Cross-Border Transfer of Personal Information
| Recipient (Name/Contact) | Items Transferred | Country/Timing/Method | Purpose and Retention Period |
|---|---|---|---|
| Google LLC (1600 Amphitheatre Parkway, Mountain View, CA, USA) | Text submitted for translation, captured images (temporary), device push tokens and notification content (Firebase), in-app advertising identifiers, device information, and ad impressions/clicks (AdMob), member identifier (for rewarded-ad verification and in-app purchase verification) | USA / real-time at each use / encrypted transmission via API | For translation/OCR/push-notification processing and in-app ad display; translation/OCR requests are processed fresh for each request with no caching and destroyed immediately after processing (our servers do not store camera or comment translation results; only translations of public data such as job postings are stored, with no personal information; advertising identifiers are subject to Google's policies) |
| Apple Inc. (One Apple Park Way, Cupertino, CA 95014, USA) | Member identifier (for in-app purchase verification) | USA / at the time of in-app purchase / encrypted transmission | To verify in-app purchases (AI membership subscription and ad products); retention follows Apple's policies |
| Anthropic, PBC (548 Market St, PMB 90375, San Francisco, CA 94104, USA) | Conversation content entered into the AI Assistant, search criteria (region, party size, duration, budget, travel style, etc.) | USA / in real time whenever the AI Assistant is used / encrypted transmission via API | For generating AI Assistant responses; automatically deleted within 30 days of receipt (not used for AI model training) |
| Resend, Inc. (2261 Market Street #4324, San Francisco, CA 94114, USA) | Recipient email address, email subject/body (authentication, password reset, ad review results, and ad end notices) | USA / real time at each email sent / encrypted transmission via API | For sending authentication-related emails and ad-related notice emails; retained for up to 30 days while the account is active, deleted within 90 days after contract termination |
| Vercel Inc. (440 N Barranca Ave #4133, Covina, CA 91723, USA) | Access IP, request information, and other access logs | USA / Real-time, each time the Service is used / Encrypted transmission via API | For providing the web service; automatically deleted after the period set by Vercel's own log retention policy |
Users have the right not to consent to the above cross-border transfers. To decline, contact the customer center; declining may restrict related features such as translation, OCR, or push notifications.
7. Data Subject Rights and How to Exercise Them: Users may at any time request access to, correction of, deletion of, or suspension of processing of their personal information, and may download, as a file, the data the Company holds about them (profile and consent records, posts, comments and other content they wrote, AI Assistant conversations, usage records, ad applications and payment confirmations, uploaded photos, block, report and notification records, sign-in records, My Plans, etc.) via "My Info > Download my data" in the app. Other records, such as device push tokens, usage-restriction records, and translation usage, can be checked by requesting access. Requests for access, correction, deletion, or suspension of processing can be made via the customer center (Contact us) or by email to the Personal Information Protection Officer; the Company will handle them within 10 days of receipt and notify you of the result. How to request deletion of your data only, while keeping your account, is explained at https://www.k-lifeon.com/account-deletion.
For reports or consultations regarding personal information breaches, you may contact the following organizations.
- Personal Information Infringement Report Center (Korea Internet & Security Agency): 118 (no area code), privacy.kisa.or.kr
- Personal Information Dispute Mediation Committee: 1833-6972, www.kopico.go.kr
8. Handling of Reported Posts: Reported posts and comments are reviewed by an administrator within 24 hours of receipt and hidden, deleted or otherwise handled; when you block a member, that member's posts are automatically reported to the operator. Posts and comments containing prohibited expressions such as severe profanity, hate or sexual content cannot be posted, and job posts suspected of containing prohibited expressions or offering less than the minimum wage are published only after administrator review. Actions against users, such as usage restrictions (sanctions), are taken only after an administrator has reviewed the case directly. Users may object to such actions.
9. Generative AI/Translation Service Matters
- Images captured with the camera are sent to Google Cloud Vision and processed temporarily for text recognition (OCR), and the original image is discarded immediately upon completion of processing without being stored.
- For camera translation, only the recognized text is translated; translation results are processed fresh for every request, with no caching or storage. Translations of public data such as job postings are stored on our servers for reuse and contain no personal information. The "Translate" button on board comments also processes each request fresh without storing the translation, within per-user and overall daily limits.
- Text/images that users input or capture are not used to train the Company's or any third party's AI models.
- AI Assistant (chatbot) usage records: Questions a user submits to the AI Assistant, the AI's generated answers, search criteria the user specified or the system inferred (region, party size, duration, budget, travel style, etc.), and interaction history such as saving or viewing recommended places (including click-through actions such as viewing the map, getting directions, or calling) are used and stored only for (1) service provision (generating responses to queries), (2) ensuring service safety and preventing fraudulent use, and (3) statistical analysis to improve the Service, processed in a de-identified form that cannot identify an individual. This data is not used to train the Company's or any third party's AI models, and is deleted along with other personal information upon account withdrawal (the account is deactivated immediately upon a withdrawal request, and is automatically and permanently deleted by the system after the 7-day grace period). AI Assistant conversation content is transmitted to Anthropic, PBC (Claude API) to generate responses — see Section 6, Cross-Border Transfer of Personal Information, for details.
- AI Assistant data is used only as de-identified statistics to improve place recommendation rankings and answer quality; AI Assistant records (questions, answers, search criteria) are not used for personalized recommendations.
- Personalized recommendations: Personalized recommendations on the home screen and in the restaurant, attraction, and performance lists are calculated within the Company's database based on your bookmarks, the food and attraction types you view often (view counts and last-viewed time), your nationality (or display language if none), and the weather region saved on your device (only the province/city name is sent when calculating recommendations and it is not stored). Location coordinates and sensitive information such as religion or health are not used; the data is not used for advertising or provided to third parties, and is not used for AI model training. Personalized recommendations are on by default, and you can ask us to stop this processing at any time by turning it off in the personalized recommendation setting in the My Info menu. When you turn it off, the "frequently viewed types" records collected so far are deleted immediately and no longer collected, and lists are shown in general order such as popularity or newest. Turning off personalized recommendations does not restrict your use of any other part of the Service.
10. Children's Personal Information: The Service restricts registration by children under 14, so special provisions for children's personal information do not apply. If a user is later confirmed to be under 14 despite their self-declaration at sign-up, the Company will immediately restrict that account and destroy the related personal information without delay. A legal guardian may request access to, correction of, or deletion of their child's personal information.
11. Where This Privacy Policy Is Disclosed: Available on the sign-up screen, the "My Info > Terms & Policies" menu, and the app settings screen, as well as via a public webpage accessible without signing in (https://www.k-lifeon.com/legal/privacy).
12. Personal Information Protection Officer: Bae Ho-ik (CEO, BJB luxury), email soccer514514@gmail.com, phone 070-8098-5553
12-1. Location Information Manager: Bae Ho-ik (CEO, BJB luxury), phone 070-8098-5553 (the same person as the Personal Information Protection Officer above, separately designated and disclosed as required under the Act on the Protection, Use, Etc. of Location Information. Details on the processing of personal location information are governed by the Location Information Terms of Use, https://www.k-lifeon.com/legal/location.)
13. Measures to Ensure the Safety of Personal Information: Pursuant to Article 29 of the Personal Information Protection Act and Article 30 of its Enforcement Decree, the Company takes the following safety measures.
- Access authorization management: Row Level Security (RLS) is applied to the database so that, in principle, users can only access their own data; administrative functions are accessible only to users whose administrator role is verified server-side, and administrators must confirm both their password and a code from an authenticator app on their phone (two-step verification) to enter the admin screens. Email sign-in on the K-lifeon sign-in screen is locked for 30 minutes after 5 failed attempts with the same email. Sign-in is restricted for 15 minutes after 30 failed attempts from the same IP address within 15 minutes.
- Retention of access records: Administrator access to and processing of personal information is separately logged (admin access logs, audit history), kept for 2 years and then automatically destroyed (records of granting, changing or revoking administrator permissions are kept for 3 years and then automatically destroyed), and cannot be altered or deleted, even by the administrator who created the record. Administrator access records are reviewed once a month, and when an administrator downloads personal information as a file (such as Excel or PDF), a reason must be entered; who downloaded what, when and why is recorded and kept for 2 years.
- Encryption: User passwords are hashed and stored via the authentication service (Supabase Auth) and are never stored in plain text. Communication between the Service and user devices is encrypted via HTTPS (TLS), and data stored in the database is encrypted at the infrastructure level (Supabase/AWS).
- Access control: Service-role (administrator-level) database access keys are used only in the server environment and are never exposed to the browser or other client-side code.
- Protection against malware and physical safeguards: Antivirus software with real-time protection and automatic updates is installed on the computers used for administration; their screens lock after 30 minutes of inactivity (the admin screens also sign out automatically after 30 minutes of inactivity); and removable storage media containing personal information are kept in a locked place. These safeguards are checked every year (or at the interval set by law for items the law specifies), and the check records are kept for 3 years.
- Location information management: Pursuant to the Act on the Protection, Use, Etc. of Location Information and the Korea Media and Communications Commission Notice on Administrative and Technical Safeguards for Location Information, the Company operates a location-information handling ledger, separately designates and manages access rights for location-information handlers, and conducts periodic self-inspections, among other administrative and technical safeguards.
14. Personal Information Destruction Procedures and Methods ① The Company destroys personal information without delay once it becomes unnecessary, such as upon expiration of the retention period or achievement of the processing purpose. ② Destruction procedure: Information subject to immediate destruction is deleted as soon as its purpose is fulfilled. Records subject to statutory retention have their link to the member's account removed and are kept separately within the same database until the retention period expires, at which point they are destroyed. ③ Destruction method: Personal information stored in electronic file form is deleted using technical methods that make the records unrecoverable; personal information printed on paper is destroyed by shredding or incineration. ④ Destruction records: Each time an automatic deletion job deletes personal information, the date, type of record and number of records deleted are recorded (the content of the deleted personal information is not kept), and these destruction records are kept for 3 years and then automatically destroyed.
15. Cookies and Other Automatic Data Collection Devices: Details regarding cookies and other automatic data collection devices are governed by the separate Cookie Policy (https://www.k-lifeon.com/legal/cookie).
16. Collection, Use, Provision, and Opt-Out of Behavioral Information: The Company uses Google LLC (Google AdSense) to display advertising. AdSense may collect behavioral information such as visit history via cookies and use it for personalized ads. The Company itself does not use your service usage records for ad personalization. You may opt out of personalized ads at Google's Ad Settings page (adssettings.google.com), or block cookies in your browser settings to refuse behavioral information collection. Users accessing the Service from the European Economic Area (EEA), the United Kingdom, or Switzerland are asked, through a Google-certified Consent Management Platform (CMP), to choose whether to consent to personalized ads (Consent, Do not consent, or Manage options). The app uses Google AdMob (banner and rewarded ads). Personalized ads are shown only if you turn on the "Personalized ads" consent in My Info > Notification settings, and the iOS app does not track users: it does not request App Tracking Transparency (ATT) permission and shows only non-personalized ads that do not use the advertising identifier. If you do not consent, non-personalized ads are shown, the number of ads is the same, and you receive the same rewarded-ad reward (an extra AI Assistant question). How to opt out: turn off the "Personalized ads" consent in My Info > Notification settings; reset or delete your advertising ID in your device's ad settings. Members with an in-app subscription (AI Membership) do not see banner ads in the app.
17. Changes to This Privacy Policy: If this Privacy Policy changes, we will announce the changes and their effective date in a service notice and on this page at least 7 days before they take effect (at least 30 days before for changes unfavorable to users).
Effective date: October 25, 2026 (amended on October 25, 2026: the "My Plans and QR sharing" parts of Sections 1, 2, 3 and 7, and Section 17, take effect on November 1, 2026; for users who agree to the amendment before then (members who sign up agreeing after the amendment, members who agree on the amendment notice screen, and non-members or guest members who agree on the notice screen before using the feature), they apply from the time of agreement)