Privacy Policy

Jongyong Lim, the operator of Alice Tarot (the “Operator”), processes personal information only to the minimum extent necessary to provide the Service. This Policy applies to the web service at alicetarot.net.

• Sign-up and login: email address, user identifier, login type, and nickname
• Profile settings: optionally entered display name, gender, date of birth, country of birth, current situation, and personalization settings
• Readings and counseling: questions and conversation content entered by the user, selected cards and orientations, reading results and responses, and creation time
• Service use: IP address, access time, browser and device information, and error and security records
• Payment and Service status: order identifier, purchased product, payment amount, status and time, payment identifier, Key balance, and usage history
• Email inquiries: sender email address, inquiry content, and order information provided by the user

Do not enter unnecessary sensitive information, government identifiers, financial information, health information, or another person's personal information in a question.

• sign-up, login, account identification, and account security;
• providing AI tarot readings and counseling, and storing and synchronizing reading and conversation history;
• processing payments, reviewing purchase history, handling cancellations and refunds, managing Key balances and usage history, and recovering from errors;
• preventing abuse, responding to failures, and improving Service stability;
• handling email inquiries and rights requests, and retaining transaction and tax records as required by law; and
• collection through information entered directly by the user, account information the user permits during social login, and records automatically generated while using the Service.

Personal information kept to provide the Service, such as account and profile data and reading and conversation history, is destroyed when a member withdraws. The retained records below are segregated so that only the necessary items are kept, are not used for any other purpose, and are destroyed when the retention period ends.

• Account and profile information: until account deletion or termination of the service agreement
• Readings, conversations, and Key history stored with an account: until a deletion request or member withdrawal, except that Key records needed as transaction evidence are included in the contract and payment records below
• Contract, withdrawal of subscription, and payment and supply records: 5 years (Act on Consumer Protection in Electronic Commerce), including order identifiers, purchased products, payment amount, date and status, and supply, cancellation, and refund history needed as transaction evidence
• Consumer complaint and dispute records: 3 years after handling is completed (Act on Consumer Protection in Electronic Commerce), including the inquirer's contact, the inquiry, and the result
• Tax evidence: 5 years from the day after the statutory filing deadline for the relevant national tax (Framework Act on National Taxes), including transaction amounts and dates needed as tax evidence; where a law prescribes a longer period, that period applies
• Access, error, and security records: 3 months from creation, keeping the minimum records needed for security and abuse response; where access logs are subject to a retention obligation under the Protection of Communications Secrets Act, they are retained under that law

On a withdrawal or deletion request, or when the retention period expires, the Operator identifies the records subject to statutory retention and then destroys information not subject to retention without undue delay. Electronic records are deleted so that they cannot be recovered.

Records retained under the law are stored separately with restricted access and are destroyed in the same manner when the retention period expires.

The Operator does not provide or sell personal information to third parties unless the user has separately consented or disclosure is permitted by law.

The following task is outsourced to operate the Service. Changes to the provider or task will be announced through this Policy.

• Provider: Supabase, Inc. / Task: user authentication and storage and processing of account and Service-use records
• Provider: Toss Payments Co., Ltd. / Task: payment processing, payment verification, and cancellation and refund processing
• Provider: OpenAI OpCo, LLC / Task: generating AI readings and responses based on the questions, conversations, and reading context entered

Account and reading records are stored in a domestic database. Information needed to provide AI readings and counseling is transferred to OpenAI as an overseas entrustment of processing for the performance of a contract under Article 28-8(1)3 of the Personal Information Protection Act.

• Recipient: OpenAI OpCo, LLC / Contact: privacy@openai.com
• Countries of processing: the United States and other countries where OpenAI's processing infrastructure is located. Sub-processors and processing locations by country are available on OpenAI's public list (https://openai.com/policies/sub-processor-list/).
• Items and purpose transferred: the questions and conversation content entered, selected cards, and reading context and generated responses, processed to the extent necessary to provide AI readings and counseling
• Timing and method: transmitted over encrypted communications when an AI reading or response is requested
• Retention and use period: the processing period necessary to generate a response; however, under OpenAI's default policy, abuse-prevention logs may be retained for up to 30 days, and where a retention obligation exists under the law, that period applies
• Refusing the transfer: you may decline to use the AI reading and counseling features, or request suspension of processing at info@alicetarot.net. If you refuse the transfer, the relevant AI features will be limited.

The Service uses cookies for login sessions and language preferences and may use browser storage for theme and language choices and recent signed-out readings.

Users can delete or block these through browser settings. Blocking essential cookies may prevent login or other features from working.

You can apply for member withdrawal through the account withdrawal feature in My Page. On withdrawal, account and profile data and reading and conversation history are destroyed, except for records retained under the law and this Policy, and deleted records are not recovered even if you sign up again.

A user or an authorized representative may request access, correction, deletion, suspension of processing, withdrawal of consent, or member withdrawal using the inquiry email below. The Operator processes the request under applicable law after verifying the identity of the user or representative.

If a request cannot be fulfilled in whole or in part due to a statutory retention obligation or another reason, the Operator will explain the reason, and an objection to the outcome may be submitted to the same email.

• encryption in transit and authentication-based access controls;
• minimized access privileges and separation of data by account;
• security updates, error review, and response to abnormal use; and
• secure deletion when the retention purpose ends.

Registration is available only to users aged 14 or older. If the Operator learns that personal information of a child under 14 was collected, it will be deleted in accordance with applicable law.

Chief Privacy Officer: Jongyong Lim (Operator)

Requests for access, correction, deletion, suspension of processing, withdrawal of consent, and account deletion may be submitted to the email below.

Privacy inquiry email: info@alicetarot.net

Changes will be announced with the effective date and key details. Changes materially affecting user rights will be announced within a reasonable advance period.

This Policy was originally prepared in Korean. English and Japanese translations are provided for convenience. If there is any inconsistency or difference in interpretation, the Korean version controls.