Zaksimi Privacy Policy

In providing the Zaksimi service (the "Service"), BTiwoom Co., Ltd. (the "Company") complies with the Personal Information Protection Act and other applicable laws, and establishes this Privacy Policy to protect the personal information and rights of data subjects.

1. Purposes, Items and Retention Periods

The Company processes only the minimum personal information needed for the purposes below. Personal information necessary to perform the service agreement is processed without separate consent under Article 15(1)(4) of the Personal Information Protection Act.

Category	Purpose	Items	Retention
Sign-up and account management	Identifying members, confirming intent to join, confirming age 14+, account management	Required: email, name (nickname), birth year, password (email sign-up; stored encrypted), external account identifier (Google, Apple or Kakao sign-up) Optional: gender, profile photo If you were born in the year in which you turn 14 this year, we ask for your birth month and day, use them only to confirm your age, and do not store them.	Until account deletion
Providing the Service	Plans and actions, supporter and crew activity, cheers, chat, boards, stats, Grit and levels	Plans (title, reason, notes, schedule), action records (notes, numbers, photos, places, QR content, etc.), cheer messages, chat messages and attachments, posts and reviews, life goal and action slogan entered by the member; language, country and time zone; app settings	Until account deletion. See "On account deletion" in Section 2 below
Location records	Recording action places and locations at the member's request	Latitude/longitude, place name, address, time measured	Until the action record is deleted or the account is deleted (see the Location-Based Service Terms)
AI features	Writing advice, check-ups, look-backs and group-plan reports the member requests	The items listed in the Anthropic row of Section 5	AI results until account deletion. Transmitted information is deleted under the processor's policy after processing
Subscriptions	Confirming store payments, applying subscription tiers, handling refunds and disputes	Store transaction identifier, product, payment/renewal/expiry/refund status and times, price and currency, a random identifier that points to the member	5 years after the last change (records of payment and supply of goods under the E-Commerce Act). Kept even after account deletion
Cheer gifts	Delivering gifts a member bought from an outside seller; handling reports	Receiving member, gift message and sticker, the gift link the member pasted (stored encrypted)	Until account deletion. For reported gifts, the message is kept for 90 days after the report
Notifications	Sending app notifications	Push token, notification settings, time zone	Until logout or account deletion
Customer inquiries	Reviewing and answering inquiries; guiding inquiries containing crisis expressions to counseling	Inquiry category and content, language, app version, device type, model and OS version	3 years after the last change (consumer complaint and dispute records under the E-Commerce Act). Kept even after account deletion
Service stability and abuse prevention	Security, incident response, abuse prevention	IP address, access times, device info (model, manufacturer, OS, app version, device name), usage records	See Section 2

Automatically collected information: The app automatically generates and collects device information, access records, IP addresses and push tokens as you use it. The Company does not collect advertising identifiers (IDFA/ADID) and does not use behavioral advertising or analytics SDKs.

Photos: The app re-encodes photos before uploading them, so additional information in photos (EXIF), such as where they were taken, does not remain on the server.

Payment methods: Payment method information such as card numbers is processed by the App Store and Google Play; the Company does not receive it.

Sensitive information: The Company does not collect sensitive information. We recommend not entering sensitive details such as health information in free-text action fields.

2. Retention and Destruction

1. The Company destroys personal information without delay once its retention period has passed or its purpose has been achieved.
2. On account deletion
   • Deleted immediately: email, name, gender, birth year, life goal, action slogan, settings, time zone, password, external account identifiers, profile photo, photos and files the member uploaded, AI results, notification inbox, login sessions and push tokens.
   • Deleted within one day: plan titles, reasons and notes; action notes and records (including locations); cheer messages; chat messages; and the content of posts and reviews. Records left on other members' plans remain, without content, as from a "Deleted member," and to preserve other members' stats (action rate, cheers received, etc.) only the fact that a record existed, its date and counts are kept.
3. Retention required by law, etc.
   • Subscription records: 5 years after the last change
   • Customer inquiries and answers: 3 years after the last change
   • Service usage records and access logs under the Protection of Communications Secrets Act: 3 months
   • Security audit records (passwords and authentication information are masked): 1 year
   • AI call records (feature type, model and usage; the content sent and the results are not kept): 6 months. On account deletion, the member identifier is erased.
4. Periods set within the Service
   • Login sessions: end after 30 days of non-use or after 1 year, and are deleted 30 days after ending
   • Email verification codes: valid for 5 minutes, deleted 7 days after expiry
   • Deleted photos and files: those deleted by another member (such as a group-plan admin) or moved because storage was full are kept in the trash for 30 days, then deleted
   • Received AI tickets: deleted 1 year after they expire or are used
5. Method of destruction
   • Electronic files are deleted by methods that make recovery impossible.
   • Information deleted from storage is also removed from backups within at most [backup retention period], according to the backup cycle.

3. Provision to Third Parties

The Company does not provide personal information to third parties without the data subject's consent, except:

• Information the data subject chose to make public: other members can see your name, profile photo, life goal, action slogan and level. A plan and its action records (notes, photos, places, etc.) are visible to the plan's supporters and to the crew and admin of the same group plan, and public plans are visible to all members. You can hide records and reasons in the plan settings. Your email, gender and age are not visible to other members.
• Where required by law.

4. Outsourcing of Processing

Processor	Outsourced work
Amazon Web Services, Inc.	Servers, database, file storage, verification email, real-time chat signals (Seoul region)
Google LLC (Firebase)	Google and Apple sign-in authentication; app push notifications
Anthropic, PBC	Generating AI feature results; detecting crisis expressions in customer inquiries and drafting and translating answers
Kakao Corp.	Kakao sign-in, place search, map display (Android)
Google LLC (Google Maps Platform)	Place search and address lookup for languages other than Korean
Apple Inc.	Apple sign-in, map display (iOS), App Store subscription payments and refunds
Google LLC (Google Play)	Google Play subscription payments and refunds

5. Transfer of Personal Information Overseas

The Company transfers personal information overseas as follows to provide the Service. These transfers are outsourcing necessary to perform the service agreement and are disclosed in this policy under Article 28-8(1)(3) of the Personal Information Protection Act.

Recipient (contact)	Country	Items	Purpose	Timing and method	Retention
Google LLC (privacy.google.com/contact)	USA	External account identification, push token, notification text, subscription transaction identifier	Sign-in authentication, push notifications, Google Play subscription confirmation	Sent over the network at sign-in, when notifications are sent and when subscriptions are confirmed	Until account deletion or end of the outsourcing contract
Apple Inc. (apple.com/legal/privacy/contact)	USA	External account identification, coordinates shown on the map, subscription transaction identifier	Apple sign-in, map display, App Store subscription confirmation	Sent over the network at sign-in, map display and subscription confirmation	Per Apple's policy
Anthropic, PBC (privacy@anthropic.com)	USA	Advice, check-ups and look-backs: age range, gender, language, plan details (title, reason, area, schedule), action stats, names and units of extra record fields and their numeric stats Life goal look-back: life goal; title, reason, area and action rate of plans (up to 20) Group-plan reports (requested by the group-plan admin): action stats for the group plan and each crew member, crew members' names (nicknames) Customer inquiries: inquiry content Email, member identifiers, action notes, photos and locations are not sent.	AI features, handling customer inquiries	Sent over the network when the member requests an AI feature or when an inquiry is received	Deleted under the processor's policy after processing [to be confirmed: retention days, no training use]
Google LLC (Google Maps Platform)	USA	Place search terms, latitude/longitude	Place search (languages other than Korean)	Sent over the network at search	Not stored

To refuse overseas transfer, don't use the related features: sign up with email instead of Google or Apple, and don't run AI features. Push notifications can be turned off in device settings, but you will then not receive notifications. Subscriptions are available only through store payment.

6. Rights of Data Subjects and How to Exercise Them

1. Data subjects may at any time request access to, correction, deletion or suspension of processing of their personal information, or withdraw consent.
2. You can view, edit and delete your information directly in [More > Member info] in the app, and download your original photos in [More > Storage]. You can also make a request through the in-app customer inquiry or to customer support (support@btiwoom.com), and the Company will act within 10 days of receiving the request.
3. Rights may also be exercised through an agent, who must submit a power of attorney.
4. Records kept as required by law (Section 2(3)) cannot be deleted during their retention period.

7. Children Under 14

The Service does not accept sign-ups from children under 14. If we learn that personal information of a child under 14 has been collected, we delete it without delay.

8. Automated Decisions

AI feature results are suggestions for reference only, and the Company does not make decisions affecting members' rights or obligations by AI alone. Crisis-expression detection in customer inquiries is used only to point the member to counseling services and to have staff review the inquiry first; answers are sent only after staff have reviewed them.

9. Security Measures

1. Administrative: We minimize and regularly train staff who handle personal information. Operators must state a purpose to view member information, and every access is logged.
2. Technical
   • Passwords are stored with one-way encryption (Argon2id).
   • Data in transit is encrypted with TLS.
   • Login tokens are short-lived and rotated on every use, and the app keeps them only in the device's secure storage (iOS Keychain, Android Keystore).
   • Gift links are stored encrypted.
   • Photos and files can be viewed only through signed URLs that are valid for a short time.
   • Operator accounts use multi-factor authentication and access control.
   • Personal information is masked on operator screens.
3. Physical: Data is stored in access-controlled cloud data centers (AWS Seoul region).

10. Automatic Collection Tools

The app does not use cookies or ad-tracking tools. The website (zaksimi.com) uses only the minimum storage needed to provide the Service.

11. Chief Privacy Officer

Item	Details
Chief Privacy Officer	Soonook Kwon (CEO)
Contact	support@btiwoom.com · +82-2-735-0533

12. Remedies for Infringement

For reports or consultation about personal information infringement, you may contact (Korea):

• Personal Information Dispute Mediation Committee: 1833-6972, www.kopico.go.kr
• Personal Information Infringement Report Center: 118, privacy.kisa.or.kr
• Supreme Prosecutors' Office: 1301, www.spo.go.kr
• Korean National Police Agency: 182, ecrm.police.go.kr

13. Changes to This Policy

This policy applies from [Effective Date]. Changes will be announced in the Service and on the website at least 7 days before they take effect, or at least 30 days for material changes. Previous versions are available at zaksimi.com/en/privacy.