Privacy Policy

1. Purpose of Processing Personal Information

Nontick Co., Ltd. (the "Company"), which provides the Pluck service, processes personal information for the following purposes and does not use it for purposes other than those listed below.

• Member registration and management
• Provision and improvement of the Service
• Tarot card interpretation and personalized service provision
• AI-based interpretation generation and service quality improvement
• Provision of personalized and non-personalized advertisements, measurement of advertising performance, management of ad frequency, and prevention of abuse

2. Processing and Retention Period of Personal Information

1. The Company processes and retains personal information within the personal information retention and use period prescribed by law or within the period consented to by the data subject when the personal information is collected.

2. The processing and retention periods for each type of personal information are as follows.

• Member registration and management: Until membership withdrawal
• Service usage records: Until termination of the Service
• Report, inquiry, and dispute handling records: 3 years after completion of handling

3. Reasons for retaining personal information under applicable laws
If it is necessary to retain information under applicable laws, the Company keeps the information for the period prescribed by the relevant laws.

• Protection of Communications Secrets Act
• Service visit records (logs) and access IP: 3 months
• Act on Consumer Protection in Electronic Commerce
• Records on consumer complaints or dispute handling: 3 years

3. Provision of Personal Information to Third Parties

1. In principle, the Company does not provide personal information to external parties. However, the Company may provide personal information where the data subject has given prior consent or where there is a special provision of law.

2. When providing personal information to a third party, the Company informs users of the recipient, purpose of provision, items provided, and retention and use period, and obtains any required consent.

3. Information that Google and advertising technology providers may process while providing advertising services and users' choices are described in Article 9.

4. Entrustment of Personal Information Processing

1. The Company entrusts personal information processing work to overseas corporations as follows for service improvement and smooth handling of personal information-related work.

• Entrusted party (processor): Google LLC (Firebase, Vertex AI, reCAPTCHA v3)
• Entrusted work: Member registration and identity authentication (including Google/Apple login integration), database storage and management, server operation, service error analysis (Crashlytics), service usage statistics analysis (Analytics), AI-based tarot interpretation generation, protection of Firebase resources, and prevention of abuse (App Check and reCAPTCHA v3)
• Personal information transferred: Email address, login identifier, nickname, service usage records, service error information, questions entered by users, selected card information, profile information entered by users for personalized interpretation, IP address, browser and device information, and security signals relating to user interactions
• Country of transfer: United States and other regions where Google LLC provides its services
• Timing and method of transfer: Transmitted over the network when the user uses the Service
• Entrustment period: Until membership withdrawal or termination of the entrustment agreement

• Entrusted party (processor): Cloudflare, Inc. (Cloudflare Pages)
• Entrusted work: Website hosting, content delivery, and caching
• Personal information transferred: IP address, request URLs and headers, access logs, and browser and device information
• Country of transfer: United States and other regions where Cloudflare, Inc. provides its global services
• Timing and method of transfer: Transmitted over the network when the user accesses the website
• Entrustment period: Until termination of the entrustment agreement or achievement of the processing purpose

2. The Company uses Firebase App Check and Google reCAPTCHA v3 to prevent abuse of the web service and protect Firebase resources. During this process, Google may process essential cookies, IP addresses, browser and device information, and security signals relating to user interactions.

• Google Privacy Policy: https://policies.google.com/privacy
• Google Terms of Service: https://policies.google.com/terms

5. Rights and Obligations of Data Subjects and Legal Representatives, and How to Exercise Them

1. Data subjects may exercise rights against the Company at any time, including requests to access, correct, delete, or suspend processing of personal information.

2. The rights under Paragraph 1 may be exercised against the Company in writing, by email, or by other methods in accordance with Article 41, Paragraph 1 of the Enforcement Decree of the Personal Information Protection Act, and the Company will take action without delay.

3. Data subjects may withdraw consent to the collection and use of personal information at any time through the "Delete Account" feature provided in the app or on the website, or by contacting the privacy officer by email.

6. Protection of Children's Personal Information

This Service restricts membership registration by children under the age of 14. The Company may perform age verification during the sign-up process or verify age information through social login. If the Company becomes aware that it has collected personal information from a child under the age of 14, it will delete such information without delay.

7. Items of Personal Information Processed

Pluck processes the following personal information items.

1. When registering as a member and using the Service

• Required items: Email address, login identifier (Social ID), nickname, tarot consultation question content
• Optional items: Date of birth, gender, occupation, and other information directly entered by the user in the profile or input fields for personalized interpretation
• When using email sign-up: Password (stored in encrypted form)

2. Information that may be automatically generated or collected while using the Service

• Android Advertising ID
• Cookies, local storage, IndexedDB, and similar storage technologies
• IP address, device and browser information, and operating system information
• Access logs, visited pages, and service usage records
• Advertising interaction records, including ad impressions and clicks
• reCAPTCHA security signals used to prevent abuse
• Service error and crash records (Crashlytics)

Some information may be collected or processed directly by external service providers used by the Company, including Firebase, Google AdMob, and Google AdSense, rather than directly by the Company.

8. Destruction of Personal Information

In principle, when the purpose of processing personal information has been achieved, the Company destroys the relevant personal information without delay.

9. Advertising Services and User Choices

1. The Company may use Google AdMob in the Android app and Google AdSense on the website to operate the Service.

2. While providing advertisements, Google and advertising technology providers may process cookies, advertising identifiers, IP addresses, device and browser information, visited pages, service usage records, and advertising interaction information to provide personalized and non-personalized advertisements, measure advertising performance, manage ad frequency, and prevent abuse.

3. Depending on the user's region, applicable laws, and advertising privacy settings, personalized, non-personalized, or limited advertisements may be provided, and in some cases no advertisements may be provided.

4. Where consent is required by applicable laws, the Company confirms the user's choice through a consent management platform provided by Google before requesting advertisements.

5. Users may manage personalized advertisements and the use of advertising identifiers through Google Ads Settings, browser settings, or Android device settings. If the Company provides an advertising privacy settings feature within the Service, users may also change their choices through that feature.

• Google Ads Settings: https://adssettings.google.com/
• How Google uses data from partner sites and apps: https://policies.google.com/technologies/partner-sites

10. Advertising Privacy for Users Outside Korea

For users in regions where applicable laws require consent, the Company provides choices regarding the processing of personal information for advertising through a consent management platform provided by Google.

Users who do not consent may receive limited advertisements or no advertisements. Advertising consent choices do not affect access to the core features of the Service.

11. Privacy Choices for United States Residents

The Company does not sell users' personal information for monetary consideration. However, processing that may be considered sharing of personal information under applicable laws may occur while providing personalized advertisements.

Users to whom applicable laws apply may exercise choices regarding the processing of personal information for advertising through Google's consent management screen, Google Ads Settings, browser settings, or by contacting the privacy officer by email.

The Company does not unfairly discriminate against users for exercising privacy-related rights.

12. Privacy Officer

1. The Company designates a privacy officer as follows to take overall responsibility for personal information processing and to handle complaints and remedies for data subjects in connection with personal information processing.

Privacy Officer

• Name: David Jung
• Position: Privacy Officer
• Contact: support@pluck.nontick.com

2. Data subjects may contact the privacy officer for all privacy-related inquiries, complaints, and remedies that arise while using the Company's Service. The Company will respond to and process inquiries from data subjects without delay.

13. Changes to this Privacy Policy

This Privacy Policy applies from its effective date. If any additions, deletions, or corrections are made due to changes in laws or policies, the Company will notify users through notices or pop-ups in the app or on the website from seven days before the changes take effect.

14. Language

This Privacy Policy is written in Korean, and translations in other languages may be provided for users' convenience. If there is any discrepancy in meaning or interpretation between a translated version and the Korean original, the Korean original will prevail.