Draft — details still being filled in
Privacy Policy
Effective date: [EFFECTIVE DATE]
1. Who is responsible
[BUSINESS NAME], [ADDRESS] ("we") is responsible for your personal information on joseonsaju.kr. Contact: [EMAIL].
For payments, Dodo Payments [to confirm] is the merchant of record and handles your payment details under its own privacy policy. We never see your full card number.
2. What we collect
| What | Why |
|---|---|
| Birth date, birth time (optional), time zone, gender | To calculate your chart and write your reading |
| Name or nickname | To address you in the reading |
| Email address | To send your saved-card link, your reading, answers, and (if you agreed) the morning note |
| Your worry text, follow-up questions, feedback | To write and check your reading and reply to you |
| Order details from Dodo (order ID, product, amount, country, payment status — not card numbers) | To deliver your order, handle refunds, keep accounting records |
| Device and usage data (pages viewed, rough location from IP, browser, referring link) | To keep the site working, prevent abuse, and measure which links bring visitors |
We don't ask for your birth city. We don't sell your information.
3. Legal bases (EU/UK)
- Contract — calculating your chart, sending your card link and your reading, answering follow-ups.
- Consent — the morning note for visitors in the EU, UK, Canada and Australia (opt-in box); optional analytics/ad cookies where consent is required.
- Legitimate interests — the morning note for visitors elsewhere (you can opt out anytime), security, fraud prevention, basic site analytics.
- Legal obligation — keeping transaction records.
4. Emails we send
- Transactional emails — your saved-card link, payment and delivery emails, answers to your questions, refund replies. These go out because you asked for them. They don't carry marketing.
- Morning note — a short daily note for your chart, sent around 7 am your local time.
- In the EU, UK, Canada and Australia, you only get it if you tick the box.
- Elsewhere, we tell you clearly before you enter your email that giving it signs you up.
- Every morning note has a one-click unsubscribe link. Unsubscribing stops all marketing email. You'll still get transactional emails for an order you placed.
- "Your month is 3 days away" — for paying customers, a reminder before a month marked in their reading. Unsubscribe link in each one.
5. Who we share it with (processors)
We use these service providers to run the site. They process data only on our instructions.
| Processor | What for | [confirm] |
|---|---|---|
| Dodo Payments | Payment, tax, invoicing (merchant of record — its own controller for payment data) | [to confirm] |
| Vercel | Website hosting | [confirm] |
| Supabase | Database (orders, saved cards) | [confirm] |
| Amazon SES (and Resend as backup) | Sending email | [confirm] |
| OpenAI / Anthropic / Google (AI model providers) | Writing and checking reading text from your chart values, name and worry text | [confirm which are used for English] |
| Google Analytics, Microsoft Clarity, Meta Pixel | Site analytics and ad measurement | [confirm; cookie consent needed in EU/UK] |
AI providers receive your chart values, nickname and question text — not your email or payment details [confirm]. We use their API terms under which submitted data is not used to train their models [confirm per provider].
We may also disclose information if the law requires it, or to protect our rights or someone's safety.
6. International transfers
We are based in Korea and our providers are mostly in the US. Your data may be processed outside your country. Where EU/UK law requires, we rely on Standard Contractual Clauses or the provider's equivalent safeguards [confirm].
7. How long we keep it
| Data | Kept for |
|---|---|
| Free visitors who left an email (birthday, name, worry, answer card) | Until you unsubscribe and ask us to delete, or 24 months after your last open or visit [confirm] |
| Free visitors who didn't leave an email | We don't store your chart or worry |
| Orders and the readings we sent | 5 years, for tax and dispute records [confirm] |
| Unsubscribe list (email only) | Kept so we don't email you again |
| Analytics data | Per each tool's settings, up to 14 months [confirm] |
8. Your rights
You can ask us to:
- show you the data we hold about you,
- correct it,
- delete it,
- send it to you in a portable format,
- stop or limit using it, or
- withdraw consent (for example, unsubscribe).
Email [EMAIL] from the address you used. We'll reply within 30 days. We may need to confirm it's you.
EU/UK: you can also complain to your local data protection authority.
9. California residents (CCPA/CPRA)
- Categories collected (last 12 months): identifiers (name, email); characteristics (gender, birth date); commercial information (orders); internet activity (site usage); approximate location (from IP); "sensitive" information is not collected beyond what you choose to write in your question.
- Sources: you, your device, Dodo Payments.
- Purposes: as in section 2.
- We do not sell personal information. If we use ad pixels that count as "sharing" for cross-context behavioral advertising, you can opt out via the "Do Not Sell or Share My Personal Information" link in the footer, and we honor Global Privacy Control signals [confirm whether pixels run on the English site].
- Your rights: know, delete, correct, opt out of sale/sharing, limit use of sensitive data, and not be treated differently for using these rights. Email [EMAIL]. You may use an authorized agent.
10. Children
The site is not for children under 13. We don't knowingly collect their data. If we learn we have, we delete it. Contact [EMAIL].
11. Security
We use encrypted connections, access controls, and server-side key management. No system is perfectly secure; if a breach affects you, we'll tell you as the law requires.
12. Changes
We'll update the date at the top when this policy changes. Big changes will be shown on the site or emailed.
13. Contact
[BUSINESS NAME] · [ADDRESS] · [EMAIL]