1. Controller

Operator: 별내림(Byeolnaerim) / Representative and Privacy Officer: 김주형 / Address: 경기도 안성시 서인동 13-21 코워크시티 안성서인1호점 2층 S10호, Republic of Korea / Email: [email protected] / Phone: 010-9273-7837. 별내림(Byeolnaerim) is the controller, or equivalent responsible entity under applicable law, for the CookPagoda processing described here.

2. Personal data we process

• Account and profile data: account name, securely hashed password, nickname, email, and optional date of birth, gender, country, and profile information.
• Social sign-in data: identifiers and permitted profile/email information received from the provider you select.
• Service activity: bookmarks, public posts and comments, reports, settings, and other activity required to provide requested features.
• AI data: messages and food, ingredient, theme, exclusion and other recommendation conditions you submit, AI responses, conversation state, and recommendation presentation snapshots.
• Security and technical data: IP address, user agent, login logs, security events, request identifiers, and records of terms/privacy acknowledgements.
• Advertising data: when advertisements are displayed, advertising partners may process IP addresses, user agents, cookies or similar identifiers, ad impression and click information, approximate location, and information necessary for ad delivery, frequency management, fraud prevention, and performance measurement.

3. Purposes and legal bases

We do not rely on one blanket consent for every processing activity. Depending on the purpose and your location, we rely on performance of a contract, compliance with law, legitimate interests such as service security and abuse prevention, or consent where a specific activity requires it.

• Create and secure accounts and provide requested features.
• Generate food recommendations and AI conversations.
• Operate communities, handle reports, prevent fraud or abuse, and respond to incidents.
• Deliver advertising used to support operation of the Services, manage ad frequency, prevent advertising fraud, measure advertising performance, and personalize advertising where required consent has been obtained.
• Comply with legal obligations, respond to rights requests, and establish, exercise or defend legal claims.

4. Retention and deletion

We delete or de-identify personal data when the purpose is fulfilled or the stated retention period ends. Records that must be retained under applicable law are separated from ordinary service data and kept only for the required period.

• Core account data: while the account remains open; generally deleted when the account is closed.
• Login logs: 180 days from creation.
• Account security events: 365 days from the event.
• Administrator/personal-data access audit logs: 730 days from the event.
• Minimal deleted-account archive: 30 days after deletion for integrity verification and recovery, then deleted.
• Terms/privacy acknowledgement evidence: while the account remains open and for 1,095 days after account deletion for compliance evidence and dispute handling, then deleted.
• AI conversation state: 180 days after last activity. Raw AI messages and recommendation presentation snapshots: 180 days from creation. AI conversation data linked to a signed-in account is deleted as part of account deletion.
• Public posts/comments: may remain after the direct account link is removed, as described in the Terms. Personal data contained in the content may be subject to a separate deletion request.

5. AI processing and OpenAI

When you use AI recommendation or conversation features, prompts, normalized recommendation conditions, and relevant context may be sent to the OpenAI API to generate a response. We configure the service on the basis of OpenAI's standard business/API data terms. OpenAI states that API customer data is not used to train models by default unless the customer opts in; under standard API settings, abuse-monitoring logs may be retained for up to 30 days. OpenAI's subprocessors and processing locations can change.

We do not require sensitive health information as a standard AI input. Ingredient exclusions are treated as preference/recommendation conditions and not as a medical allergy diagnosis.

6. Service providers and international processing

Because CookPagoda is a global service, personal data may be processed outside the Republic of Korea. OpenAI API data may be processed in the United States and other countries in which OpenAI and its published subprocessors operate. Transfer occurs over encrypted network connections when you invoke an AI feature for response generation and service security.

Our primary service database uses MongoDB Atlas and is currently deployed in the AWS Frankfurt region (eu-central-1, Germany). Account, service activity, AI conversation, and other data stored in MongoDB may be processed and retained in that operating region.

Image and object storage uses Cloudflare R2. The current production bucket uses the Western Europe (WEUR) Location Hint. WEUR is a best-effort placement hint for performance and is not a jurisdictional restriction that guarantees EU-only storage. Where applicable law requires additional cross-border-transfer disclosures, we provide the required information based on the actual production configuration.

If you choose a third-party sign-in provider such as Google, Naver, or Kakao, that provider's own privacy terms also apply to its processing, and CookPagoda receives only the sign-in data you authorize or that is necessary for the integration. Google's Gmail SMTP infrastructure may be used for account verification and service emails; in that case, the recipient email address and message information needed for delivery are transmitted for that purpose.

Advertisements may be provided through Google AdSense and other third-party advertising partners. Advertising partners may use cookies or similar technologies and process advertising-related information for ad delivery, frequency management, fraud prevention, performance measurement, and, where the user has consented, advertising personalization. Processing performed independently by an advertising partner is subject to that partner's privacy policy. Information about advertising partners actually enabled on the Services may be provided through advertising, consent, or related settings and notices.

7. Cookies and local storage

We may use cookies or browser storage for sign-in, security, language and theme preferences. When advertisements are provided, advertising partners may also use cookies, local storage, or similar technologies for ad delivery, frequency management, fraud prevention, performance measurement, and, where the user has consented, advertising personalization. Non-essential storage that requires consent under applicable law is handled through the applicable consent process. See the Cookie & Local Storage Policy for details and controls.

8. Security

We apply reasonable technical and organizational safeguards, including access controls, authentication and authorization checks, protected transport, one-way password hashing, security/audit logging, data minimization, and retention controls. No system can guarantee absolute security.

9. Your rights

Depending on applicable law, you may have rights to access, correct, delete, restrict or object to processing, withdraw consent, obtain portability, or complain to a supervisory authority. Contact the Privacy Officer when the request cannot be completed through your account. We may reasonably verify identity and protect the rights of others before acting.

10. Children

The Services are generally intended for users aged 16 or older and are not designed to actively collect sensitive data from children. A higher local minimum age or parental-authorization requirement applies where required by law.

11. Regional rights

• Republic of Korea: rights available under the Personal Information Protection Act, including access, correction, deletion and suspension of processing.
• EEA: account registration and sign-in are currently unavailable to users accessing from the EEA until the required privacy-representative and operational arrangements are completed. Public content remains available, and GDPR rights are respected where GDPR applies to a specific processing activity.
• United Kingdom: account registration and sign-in are temporarily restricted for the same reason. UK GDPR and Data Protection Act rights are respected where they apply to a specific processing activity.
• United States: where a state privacy law applies to us and to your request, we provide the rights that law requires, which may include access, deletion, correction, portability, and the right to opt out of the sale or sharing of personal data or targeted advertising. We do not operate the Services for the purpose of selling personal data for monetary consideration. However, some state laws may define certain processing of identifiers with advertising partners for personalized or targeted advertising as a ‘sale’ or ‘sharing,’ in which case applicable opt-out rights will be provided.
• Other regions: additional non-waivable local rights are honored where applicable.

12. Contact and changes

Privacy requests: 김주형, [email protected], 010-9273-7837. Material changes will be communicated reasonably before they take effect, and the current version/effective date is shown on this page.