iipuda Personal Information Processing Policy (261012)
Kiip Corp. (hereinafter, the “Company”) establishes and discloses the following iipuda Privacy Policy in order to protect the personal information of users of the iipuda Service (including both the application and website; hereinafter, the “Service”) and to promptly and smoothly handle grievances related thereto while operating the Service.
The Company is the controller of information provided or collected through the use of the website on which this Policy is posted and the Company’s application on third-party websites or platforms. The Company considers Users’ personal information important and, through this Privacy Policy, informs Users of the purposes and methods for which the Company uses the personal information provided by Users and the measures the Company takes to protect personal information.
This Privacy Policy contains the following:
1. Purposes of Collecting and Processing Personal Information
The Company processes the minimum amount of personal information necessary for the following purposes. The personal information being processed shall not be used for purposes other than those specified herein, and if the purpose of use changes, the Company shall take necessary measures, such as obtaining separate consent in accordance with applicable laws and regulations.
① Membership registration and management: Confirming the intent to register as a Member, identifying and authenticating the Member, maintaining and managing eligibility, preventing fraudulent use, and delivering notices.
② Provision of the Service and improvement of functions: Brokering reservations and payments with affiliated Partners, sending notification messages/text messages, creating and storing content (reviews), providing points/coupons, providing customized information based on AI analysis, and providing location-based shop search results.
③ Marketing and advertising: Developing and specializing new services, providing promotional information and customized advertisements through app push notifications, SMS, and email, and measuring advertising performance and conducting attribution analysis.
④ Artificial Intelligence (AI) Model Development and Service Enhancement: The contents of conversations collected during customer consultations (chat) shall be used for the purpose of developing and enhancing AI-based automatic message response generation and recommendation functions. Personal information shall be processed for this purpose only where separate consent has been obtained from the User, and the details are set forth in Article 1-2 (Processing of Personal Information for AI Training Purposes).
⑤ The processing of personal information pursuant to subparagraph 4 shall be carried out as follows.
- Categories of information processed: Consultation chat contents (inquiries, response history, etc.). However, identifiable information, such as payment information and sensitive information related to procedures or health, shall be pseudonymized or masked before use or excluded from the training data.
- Processing method: A training dataset shall be created after pseudonymization, whereby information that can identify the User, such as names and contact information, is deleted or replaced in the original chat contents.
- Retention and use period: Until the User withdraws consent
- The processing of personal information under this subparagraph is subject to the User’s separate consent, and even if the User does not consent, there shall be no restriction on the use of basic services, such as customer consultations.
- The User may withdraw consent to this item at any time through the customer service center, and upon withdrawal, the relevant User’s data shall be deleted from the training dataset or converted to a pseudonymized state.
- Where the Company outsources the processing of personal information for AI training purposes, the Company shall disclose the details of such outsourcing pursuant to Article 4 (Outsourcing of Personal Information Processing and Cross-Border Transfers).
2. Categories of Personal Information Collected and Retention Period
① The Company shall process and retain personal information within the retention and use period prescribed by applicable laws and regulations or the retention and use period for which consent has been obtained from the data subject when collecting personal information.
| Service Category | Items Collected | Purpose | Retention and Use Period |
|---|---|---|---|
| General/SNS Membership Registration | Name, mobile phone number, email address (ID), password, gender, date of birth, country of residence, device information, IP address [For SNS registration] Linked account identifier and profile information | Member identification, confirmation of intent to register, and account management | Until membership withdrawal |
| Content and Review Writing | Names of procedures/services experienced, procedure areas, payment verification receipt data, before-and-after procedure photographs, procedure costs, and information concerning health, including physical/skin conditions contained in reviews and photographs | Verification of review credibility, provision of information to other Members, and improvement of Service functions | Until membership withdrawal |
| Reservations and Prepayment | Name, mobile phone number, payment method information (including card information), reservation date and time, procedure/service product information, and desired surgery/procedure information and areas of physical concern | Confirmation of reservations, payment and cancellation/refund processing, and transmission to affiliated businesses | Until membership withdrawal |
| Marketing and Personalization | Areas/categories of interest, device GPS location information | Recommendation of customized shops and placement of interest-based targeted advertisements | Until consent is withdrawn or membership withdrawal |
| Automatically Collected Information | Service usage records, access logs, cookies, advertising identifiers (ADID/IDFA), app installation, launch, and event logs, advertising click and installation referrer information, and campaign identifiers | Prevention of fraudulent use of the Service, statistical analysis, and system stabilization | Until membership withdrawal or for up to 2 years after collection |
| AI Training and Service Enhancement | Chat consultation contents (inquiries and response history). Payment information and sensitive information related to health shall be used after pseudonymization or excluded | Generation of AI-based automatic message responses and development and enhancement of recommendation functions | Until consent is withdrawn |
| Skin Analysis and Customized Recommendation Service | Photographs taken for questionnaires, skin condition analysis results, and areas of concern | Analysis of skin conditions, customized recommendations of hospitals/procedures, and provision of a history of changes in conditions | Until membership withdrawal or consent is withdrawn |
② The retention and use periods under the relevant laws and regulations referred to in paragraph 1 are as follows.
1) Records concerning transactions, including labeling and advertising, contract details, and performance, pursuant to the Act on the Consumer Protection in Electronic Commerce, etc.
- Records concerning labeling and advertising: 6 months
- Records concerning contracts or withdrawal of subscriptions, payment of consideration, and supply of goods, etc.: 5 years
- Records concerning consumer complaints or dispute resolution: 3 years
2) Retention of communication confirmation data pursuant to Article 41 of the Enforcement Decree of the Protection of Communications Secrets Act
- The date and time of telecommunications by the subscriber, start and end times, the other subscriber’s number, frequency of use, and location tracking data of the originating base station: 1 year
- Computer communications and Internet log records, and access-point tracking data: 3 months
3) Retention of commercial books, etc. pursuant to Article 33 of the Commercial Act
- Commercial books and important documents concerning business operations: 10 years
- Vouchers or similar documents: 5 years
3. Provision of Personal Information to Third Parties
The Company shall provide information to affiliated businesses only where the User has given prior consent, and only to the extent necessary for the performance of transactions and the processing of reservations.
| Recipients of Personal Information | Personal Information Provided | Purpose of Use by the Recipients | Retention and Use Period by the Recipients |
|---|---|---|---|
| All “affiliated businesses” with which the User has submitted a consultation request or made an advance payment through the Service | Name, gender, mobile phone number, date of birth, information on the requested event/product, preferred reservation date and time, and areas of physical concern | Confirmation of reservations for visits, and contacting the User to provide consultations and medical treatment/beauty services | 3 months after completion of service provision by the affiliated business |
4. Outsourcing of Personal Information Processing and Cross-Border Transfer
① The Company entrusts certain services to cooperating businesses for the provision of the Service.
List of Outsourced Personal Information Processing
| Entrusted Party (Entrustee) | Entrusted Tasks |
|---|---|
| Meta Platforms, Inc. | Advertising optimization based on app installation events (including app events, device identifiers, and hashed email addresses/phone numbers). App events may be transmitted through the Nachocode app SDK. |
| Google LLC | ① Cloud infrastructure hosting (Google Cloud Platform) ② Push notification delivery (Firebase Cloud Messaging) ③ Service usage statistics analysis (Google Analytics 4) ④ Social login (Google OAuth) ⑤ Social login on mobile apps (via the Nachocode app SDK) |
| Amazon Web Services, Inc. | Media file storage infrastructure (S3) |
| OpenAI, LLC | AI-based translation (personal identifying information is masked before transmission) |
| Airwallex (Hong Kong) Limited | International payment processing |
| SOLAPI Co., Ltd. (SOLAPI) | Delivery of SMS and Kakao AlimTalk messages (including reservation notifications; excluding personal identifying information) |
| Flipper Corporation Co., Ltd. (Nachocode) | Mobile app SDK and push token processing (based on internal server IDs) |
| AB180 Inc. (Airbridge) | Mobile app advertising performance measurement and attribution analysis (processing app events, advertising identifiers, campaign information, etc.) |
② The personal information collected by the Company is stored in databases located outside Korea for the purposes and within the scope specified below.
Details of Cross-Border Transfer
| Entrusted Party | Purpose of Transfer | Country of Transfer | Items Transferred | Retention Period of Entrusted Party | Date and Method of Overseas Transfer |
|---|---|---|---|---|---|
| Google LLC | Operation of cloud server and DB infrastructure (GCP) | Hong Kong (asia-east2) | All personal information processed in the course of using the Service, including Member registration information, Service usage records, reservation and payment information, content (reviews), and location information | Until termination of the outsourcing agreement | At the time of using the Service, real-time transmission over the network |
| Google LLC | Transmission of push notifications (Firebase Cloud Messaging) | United States | Push tokens (device identifiers), notification event logs | Until termination of the outsourcing agreement | At the time of using the Service, real-time transmission over the network |
| Google LLC | Analysis of Service usage statistics (Google Analytics 4) | United States | Advertising identifiers (ADID/IDFA), usage records, IP addresses, device information, and event logs | Up to 14 months (GA4 default policy) | At the time of using the Service, real-time transmission over the network |
| Google LLC | Ancillary services, including maps, social login, and translation | United States | Location information (when viewing maps), account identifiers (OAuth), and text submitted for translation requests | Until termination of the outsourcing agreement | At the time of using the Service, real-time transmission over the network |
| OpenAI, LLC | AI-based translation (transmitted after masking personally identifiable information) | United States | Masked text submitted for translation requests | Up to 30 days (based on the OpenAI API policy) | At the time of using the Service, real-time transmission through API calls |
| Meta Platforms, Inc. | Advertising optimization based on app installation events | United States | App events, device identifiers (ADID/IDFA), and hashed email addresses and phone numbers | Until termination of the outsourcing agreement | At the time of using the Service, real-time transmission over the network |
| Airwallex (Hong Kong) Limited | International payment processing | Hong Kong | Order ID, payment amount and currency, card payment information (email if entered by the User) | Retention period for payment-related information under applicable laws | At the time of payment request, real-time transmission via API |
| Amazon Web Services, Inc. | Storage, conversion, and distribution of media files (S3) | Hong Kong (ap-east-1) | Metadata of image files uploaded by Users in reviews | Until the outsourcing agreement ends | At the time of using the Service, real-time transmission |
③ When entering into an outsourcing agreement, the Company specifies in the agreement or other documents, pursuant to Article 26 of the Personal Information Protection Act, matters concerning the prohibition of processing personal information for purposes other than performing the entrusted duties, technical and administrative safeguards, restrictions on re-entrustment, management and supervision of the entrusted party, liability for damages, and other responsibilities, and supervises whether the entrusted party safely processes personal information.
④ If the details of the entrusted duties, the entrusted party, or matters concerning overseas transfers change, the Company shall disclose such changes without delay through this Privacy Policy.
5. Rights of Users and Their Legal Representatives and How to Exercise Such Rights
① Users may exercise their rights against the Company at any time, including requesting access to, correction, deletion, or suspension of processing of their personal information.
② Personal information may be viewed or modified under “My Page” > “Edit My Information” in the application, and membership withdrawal is available through “Withdraw Membership” under “My Page” > “Edit My Information.”
③ The rights under paragraph 1 may be exercised against the Company in writing, by telephone, by email, or by other means, and the Company shall take action without delay.
④ The rights under paragraph 1 may be exercised through a legal representative of the User or an agent, such as a person authorized by the User. In such case, a power of attorney in the form prescribed in Form No. 11 attached to the Notice on the Method of Processing Personal Information (Notice of the Personal Information Protection Commission) shall be submitted.
⑤ A User’s request for access to or suspension of processing of personal information may be restricted pursuant to paragraph 4 of Article 35 and paragraph 2 of Article 37 of the Personal Information Protection Act.
⑥ The deletion of personal information specified by other laws as subject to collection may not be requested.
⑦ Upon a request for access, correction or deletion, or suspension of processing pursuant to the rights of the data subject, the Company shall verify whether the person making the request is the data subject or a duly authorized agent.
6. Destruction of Personal Information
① The Company shall destroy the relevant personal information without delay when it is no longer necessary due to the expiration of the personal information retention period, achievement of the purpose of processing, or other reasons.
② Where the retention period for personal information consented to by the User has expired or the purpose of processing has been achieved, but the personal information must continue to be retained pursuant to other laws and regulations, the Company shall move the relevant personal information to a separate database (DB) or retain it in a different storage location.
③ The Company shall destroy the User’s personal information according to the following procedures and methods.
a. Destruction Procedure
Information entered by the User for membership registration or other purposes shall, after the purpose has been achieved, be moved to a separate DB, stored for a certain period pursuant to the Company’s internal policies and other applicable laws and regulations for information protection purposes, and then destroyed.
b. Destruction Method
Personal information printed on paper shall be destroyed by shredding it with a shredder or incinerating it, and personal information stored in the form of electronic files shall be deleted using a technical method that prevents the records from being reproduced.
7. Measures to Ensure the Security of Personal Information
① The Company is taking the following measures to ensure the security of personal information.
1) Administrative measures: Establishment and implementation of an internal management plan for the protection of personal information, minimization of the designation of personal information handlers, regular training, etc.
2) Technical measures: Management of access rights to personal information processing systems, etc., installation of access control systems, encryption of personal information, and installation and updating of security programs
3) Physical measures: Access control for computer rooms, document storage rooms, etc.
8. Installation, Operation, and Refusal of Devices for Automatically Collecting Personal Information
The Company operates “Cookies” and “Advertising Identifiers (ADID/IDFA)” to provide Users with customized services. Users may refuse them at any time through their device settings.
- Purpose of Using Cookies
Cookies are used to identify the webpages visited by the User, the User’s usage patterns, whether a secure connection is being used, etc.
- Matters Concerning Refusal to Use Cookies
The methods for refusing the use of Cookies are as follows. If the User refuses to store Cookies, there shall be no separate disadvantage; however, the User may experience difficulty using some of the services provided by the Company, such as personalized services.
- Web browser
Microsoft Edge: Menu > Settings > Cookies and site permissions > Manage and delete cookies and site data
Chrome: Menu > Settings > “Privacy and security”
Safari: Preferences > “Prevent cross-site tracking” and “Block all cookies”
In addition, major internet web browsers such as Firefox and Opera also provide a function for deleting cookies.
- Mobile
Android: Home > Settings > Google > Ads > Opt out of Ads Personalization (ON)
iPhone: Home > Settings > Privacy > Tracking > Allow Apps to Request to Track (OFF)
9. Personal Information Protection Officer and Grievance Handling
Users may contact the officer below regarding any personal information protection-related complaints arising during their use of the Service.
Personal Information Protection Officer
| Name | Kim Ye-chan |
| Position | CPO |
| yckim@kiipcorp.com | |
| Phone Number | +82 10 2642-5232 |
10. Changes to the Personal Information Processing Policy
If any content is added, deleted, or modified in this Personal Information Processing Policy, we will provide prior notice through the website.
11. Addenda
① This Personal Information Processing Policy shall take effect on October 12, 2026.
② The previous Personal Information Processing Policy may be found at the link below.
Previous Personal Information Processing Policy (~June 18, 2026)