Privacy Policy | Stellog

Tayco (hereinafter referred to as the "Company") establishes and discloses this Privacy Policy in accordance with Article 30 of the Personal Information Protection Act to protect the personal information of Stellog service users and promptly and smoothly handle related complaints.

1. Purpose of Collection and Use of Personal Information

The Company processes collected personal information for the following purposes. Processed personal information is not used for purposes other than the following, and if the purpose of use changes, necessary measures such as obtaining separate consent in accordance with Article 18 of the Personal Information Protection Act will be implemented:

Member registration and management
Service provision (astrological destiny analysis, Report generation, Cosmos, and provision of benefits such as Membership and Report Vouchers)
Payment and refund processing
Customer inquiry response and customer support
Sending app push notifications (if notifications are allowed)
Sending service notice emails (usage guidance right after sign-up; transaction notices such as for payments, Subscriptions, refunds, Membership, and Report Vouchers; service usage notifications such as Report completion; and service announcements)
Sending promotional messages such as discount and event news (if you have opted in)
Sending Star news emails, informational emails about changes in your chart and the sky (only if you have turned them on; you can turn them off at any time)
Granting referral (invitation) and attendance check-in rewards
Preventing misuse of referral (invitation) rewards
Receiving and posting service reviews
Usage statistics analysis, service improvement, and new service development

2. Personal Information Items Collected

Required Information (Email Sign-up):

Email address
Password (encrypted storage)
Name

Information Received via Social Login:

Kakao: Kakao member ID, nickname, email address, profile photo (items the user agreed to share on Kakao)
Google: Email address, name, profile photo
Apple: Email address (or the relay email address provided by Apple, if the user chooses it), name

Service Usage Information:

Traveler information (name, gender, date of birth (solar or lunar calendar), time of birth, place of birth and its coordinates, current city of residence)
Relationship information between travelers (relationship type, romantic relationship status, etc., when using Synastry)
Content entered by the user (journal entries, questions, previous questions and answers, etc.)
Star Flakes transaction history
Membership usage records (history of joining, renewal, cancellation, and benefit use)
History of the granting and use of Report Vouchers, Cosmos Tickets, and Top-up Bonuses
Generated Reports
Customer inquiry content (including email address and name when inquiring)
Service reviews (rating, content, author name, email address)
Referral (invitation) codes and referral records, attendance check-in records

Payment Information:

Payment amount, payment date and time
Order number (processed through payment gateway, the Company does not directly store sensitive information such as card numbers)
Transaction information received from Apple or Google for in-app payments (transaction ID, product, payment date and time)
If you use Recurring Payment (Membership Subscription), the recurring payment identifier (billing key) issued by the payment gateway — payment method information such as card numbers is kept by the payment gateway
Refund account information (bank name, account number, account holder) if a refund cannot be made to the original payment method
Payment method identification hash value for preventing misuse of referral (invitation) rewards (a value created from the card issuer code and the partially masked card number provided by the payment gateway; the card number itself is not stored)

Consent and Settings Records:

Terms consent records (the version agreed to, and the date and channel of consent)
Whether you have opted in to promotional messages, the dates of opting in and out, and an identifier for the unsubscribe link
Whether you allow usage analytics, and the country you connect from (used to decide whether to show the consent prompt)
Star news email setting (whether it is on, and when it was turned on or off)

Automatically Collected Information:

IP address, cookies, visit date and time
Service usage records
Device time zone (including change history) and language settings, app push notification token (if notifications are allowed)
App usage information (app instance ID, device and OS information, usage records)
Email sending records (the type of email sent, the date, time, and result of sending, and whether it bounced or was reported as spam — email addresses are recorded as a hashed value and in a partially masked form)
Device identifier for preventing misuse of referral (invitation) rewards (a random ID created by the app or browser and stored on the device)

※ You can refuse cookies in your browser settings, and you can turn off usage analytics cookies in My Page > Settings > Usage analytics.

3. Retention and Use Period of Personal Information

The Company processes and retains personal information within the retention and use period of personal information in accordance with laws and regulations or the retention and use period of personal information agreed upon when collecting personal information from users.

Principle Retention Period:

Member registration information: Until member withdrawal
Service provision information: Until service provision is completed
Email sending records: 400 days from the sending date (deleted without delay upon member withdrawal)
Recipient email addresses stored for scheduled sending: Deleted without delay once sending is completed (addresses in unsent drafts are deleted after 30 days)
Hash values of email addresses that bounced or were reported as spam: For as long as exclusion from sending is needed so that emails are not sent to those addresses again (the email addresses themselves are not kept)
Recurring payment identifier: Until use of the Recurring Payment ends (if cancelled, when the already-paid period ends) or until member withdrawal
Device identifier and payment method identification hash value (for preventing misuse of referral rewards): Until member withdrawal (deleted without delay upon withdrawal)
Upon member withdrawal: Information that can identify you, such as your name, email address, login identifiers (such as your Kakao member number), and profile photo, is deleted without delay. Other usage records may be pseudonymized so that no individual can be identified and kept for statistics and service improvement (Article 28-2 of the Personal Information Protection Act).

Retention According to Related Laws:

In the following cases, information is retained for the period specified by the relevant law:

Records related to contracts or withdrawal of orders: 5 years (E-Commerce Act)
Records related to payment and supply of goods: 5 years (E-Commerce Act)
Records related to consumer complaints or dispute resolution: 3 years (E-Commerce Act)
Records related to labeling and advertising: 6 months (E-Commerce Act)
Website visit records (access logs): 3 months (Protection of Communications Secrets Act)

4. Provision of Personal Information to Third Parties

The Company does not provide users' personal information to third parties in principle. However, the following cases are exceptions:

When the user has given prior consent
When required by investigative agencies in accordance with procedures and methods prescribed by law based on legal provisions or for investigative purposes

5. Personal Information Processing Entrustment and Overseas Transfer

Personal Information Processing Entrustment

The Company entrusts personal information processing as follows for service provision:

Toss Payments: Web payment processing
Google LLC: Data storage, authentication, and server operation (Firebase, Google Cloud Platform), sending authentication emails (Firebase Authentication), AI report generation (Gemini API), usage statistics (web: Google Analytics, app: Google Analytics for Firebase), app push notifications (Firebase Cloud Messaging)
OpenAI OpCo, LLC: AI report generation (OpenAI API)
Vercel Inc.: Website hosting, delivery of web pages and shared link pages
Plus Five Five, Inc. (Resend): Sending service notice emails, Star news emails (if you have turned them on), and promotional emails (if you have opted in)
Slack Technologies, LLC: Internal operational notifications such as payment and inquiry alerts

Overseas Transfer of Personal Information

For the entrusted tasks above, the Company transfers personal information overseas as follows under Article 28-8(1)(3) of the Personal Information Protection Act (overseas entrustment and storage for the performance of a contract). In all cases, the transfer takes place at the time of service use, by transmission over an encrypted network:

Recipient: Google LLC (Firebase, Google Cloud Platform, Gemini API, Google Analytics) / googlekrsupport@google.com

Transfer Country: United States and other countries where Google data centers are located

Transfer Items: Member information, traveler information, relationship information between travelers, content entered by the user, customer inquiry content, service reviews, referral and attendance check-in records, payment history, service usage records, app push notification token, web access information (IP address, etc.), app usage information (app instance ID, device and OS information, usage records)

Transfer Purpose: Data storage, backup, authentication, sending authentication emails, service stability, AI report generation, usage statistics analysis, push notification delivery

Retention and Use Period: Until member withdrawal or termination of the entrustment contract (information sent for AI report generation is kept by Google for up to 55 days for abuse monitoring and then deleted, and usage statistics are kept for the retention period set in Google Analytics)

Recipient: OpenAI OpCo, LLC / privacy@openai.com

Transfer Country: United States

Transfer Items: Traveler information, relationship information between travelers, content entered by the user

Transfer Purpose: AI report generation

Retention and Use Period: Kept by OpenAI for up to 30 days for abuse monitoring and then deleted (not used to train AI models)

Recipient: Vercel Inc. / privacy@vercel.com, Plus Five Five, Inc. (Resend) / support@resend.com, Slack Technologies, LLC / privacy@slack.com

Transfer Country: United States

Transfer Items: Vercel: web access information (IP address, access logs), and member and traveler information and generated reports processed in delivering web pages and shared links / Resend: email address, notice email content / Slack: name, email address, order number (including the member identifier), purchased product, amount, payment method, payment date and time, number of purchases, and cumulative purchase amount, inquiry type, title, and content (up to 2,000 characters)

Transfer Purpose: Vercel: website hosting, delivery of web pages and shared link pages / Resend: sending service notice emails, Star news emails (if you have turned them on), and promotional emails (if you have opted in) / Slack: internal operational notifications such as payment and inquiry alerts

Retention and Use Period: Vercel and Resend: the record retention period under each company's service policy / Slack: until deleted under the workspace's message retention settings or by the Company

You can refuse the collection of usage statistics (web: Google Analytics; app: Google Analytics for Firebase) by turning off My Page > Settings > Usage analytics (in the app, from the latest version), and on the web also by installing the Google Analytics Opt-out Browser Add-on (tools.google.com/dlpage/gaoptout); refusing does not affect your use of the Service. Users connecting from the European Union (EU), the European Economic Area (EEA), the United Kingdom, or Switzerland are asked on their first visit and usage statistics are collected only if they allow it. Other overseas transfers are essential to providing the Service; if you do not want them, you may withdraw as a member (delete your account) or make a request by email (contact@tayco.kr), in which case you will not be able to use the Service.

6. Procedures and Methods for Destruction of Personal Information

The Company destroys personal information without delay when it becomes unnecessary due to the expiration of the retention period or achievement of the processing purpose.

Destruction Procedures:

Information entered by users is moved to a separate database (or separate documents in the case of paper) after the purpose is achieved, stored for a certain period according to internal policies and other related laws, and then destroyed.

Destruction Methods:

Electronic file format: Permanent deletion using technical methods that make recovery and regeneration impossible
Paper documents: Shredding with a shredder or incineration

7. Rights of Users and Legal Representatives and Methods of Exercise

Users may view or modify their registered personal information at any time, and if they do not agree to the processing of personal information, they may refuse consent or request member withdrawal (account deletion).

Rights Exercise Contents:

Request for access to personal information
Request for correction of personal information
Request for deletion of personal information
Request for suspension of personal information processing

Rights can be exercised via email (contact@tayco.kr), and the Company will take action without delay and notify you of the result within 10 days from the date of the request.

You can withdraw your consent to promotional messages at any time in My Page > Settings > Discounts & event news or via the unsubscribe link in any promotional email. When you opt in or out, we notify you of the result (date and details) by email, and we remind users who have opted in of their consent every two years.

The rights of a child under 14 must be exercised directly by the legal representative. A minor aged 14 or older may exercise their rights directly or through a legal representative.

Rights may also be exercised through an agent, such as a legal representative or a person delegated by you. In this case, a power of attorney in the form of Annex Form No. 11 of the Notice on Methods of Processing Personal Information must be submitted, and the Company will verify whether the person making the request is the data subject or a legitimate agent.

8. Personal Information Protection Officer

The Company is responsible for overseeing personal information processing tasks and has designated a Personal Information Protection Officer as follows to handle complaints and damage relief related to personal information processing.

Personal Information Protection Officer
Name: Han Tae-kyung
Email: contact@tayco.kr

※ If you need to report or consult about personal information infringement, you can contact the following agencies:
- Personal Information Infringement Report Center (privacy.kisa.or.kr / 118 without area code)
- Personal Information Dispute Mediation Committee (www.kopico.go.kr / 1833-6972 without area code)
- Korean National Police Agency (ecrm.police.go.kr / 182 without area code)

9. Measures to Ensure Safety of Personal Information

In accordance with Article 29 of the Personal Information Protection Act, the Company takes the following technical, administrative, and physical measures to ensure the safety of personal information:

Personal information encryption: Important information such as passwords is encrypted and stored and managed
Technical measures against hacking: Installation of security programs and periodic updates and inspections
Restriction of access to personal information: Granting, changing, and deleting access rights to personal information processing systems
Retention and prevention of tampering of access records: Retention and management for at least 1 year
Regular self-audits

10. Changes to Privacy Policy

This Privacy Policy will be notified through announcements from 7 days before the implementation of changes when there are additions, deletions, or modifications to the content due to changes in laws, policies, or security technology. However, if there are important changes to user rights, notification will be made at least 30 days in advance.

This Privacy Policy is written in Korean and English, and versions in other languages are translations provided for convenience. If the language versions differ, the Korean version prevails for users residing in the Republic of Korea, and the English version prevails for all other users. However, where the relevant laws provide rules more favorable to users, those rules apply.

11. Additional Information for Users in the EU, UK, and Similar Regions

If you are in the European Union (EU), the European Economic Area (EEA), the United Kingdom, or Switzerland, the following also applies under the General Data Protection Regulation (GDPR) and the UK GDPR.

Legal bases: We process data to perform our contract with you (GDPR Art. 6(1)(b)) for providing the Service, payments, customer support, and sending service notice emails; on the basis of your consent (Art. 6(1)(a)) for promotional messages, Star news emails, and usage analytics cookies; for our legitimate interests (Art. 6(1)(f)) in security, preventing misuse, and managing email sending records and the sending exclusion list (to prevent the same email from being sent more than once and to avoid sending again to addresses that bounced); and to comply with legal obligations (Art. 6(1)(c)) for keeping payment records.
Your rights: You can request access, rectification, erasure, restriction of processing, data portability (a copy of your data), and object to processing, and you can withdraw your consent at any time. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal. Send requests to contact@tayco.kr and we will respond within one month.
Complaints: You can lodge a complaint with the data protection supervisory authority in your country of residence.
International transfers: Your personal information is transferred to the Republic of Korea (which has an EU adequacy decision) and to the United States and other countries. Transfers to processors in the United States are covered by safeguards provided by each processor, such as the EU Standard Contractual Clauses (SCCs).
Age: In the EU, EEA, UK, and Switzerland, you must be 16 or older to sign up.
Automated decisions: Destiny Reports are AI-generated content for reference only, and the Company does not make automated decisions that produce legal effects or similarly significant effects on you.

First Effective Date: December 1, 2025
Latest Amendment Effective Date: October 19, 2026
Previous versions of this Privacy Policy are available on request by email (contact@tayco.kr).

1. Purpose of Collection and Use of Personal Information

Member registration and management
Service provision (astrological destiny analysis, Report generation, Cosmos, and provision of benefits such as Membership and Report Vouchers)
Payment and refund processing
Customer inquiry response and customer support
Sending app push notifications (if notifications are allowed)
Sending service notice emails (usage guidance right after sign-up; transaction notices such as for payments, Subscriptions, refunds, Membership, and Report Vouchers; service usage notifications such as Report completion; and service announcements)
Sending promotional messages such as discount and event news (if you have opted in)
Sending Star news emails, informational emails about changes in your chart and the sky (only if you have turned them on; you can turn them off at any time)
Granting referral (invitation) and attendance check-in rewards
Preventing misuse of referral (invitation) rewards
Receiving and posting service reviews
Usage statistics analysis, service improvement, and new service development

2. Personal Information Items Collected

Required Information (Email Sign-up):

Email address
Password (encrypted storage)
Name

Information Received via Social Login:

Kakao: Kakao member ID, nickname, email address, profile photo (items the user agreed to share on Kakao)
Google: Email address, name, profile photo
Apple: Email address (or the relay email address provided by Apple, if the user chooses it), name

Service Usage Information:

Traveler information (name, gender, date of birth (solar or lunar calendar), time of birth, place of birth and its coordinates, current city of residence)
Relationship information between travelers (relationship type, romantic relationship status, etc., when using Synastry)
Content entered by the user (journal entries, questions, previous questions and answers, etc.)
Star Flakes transaction history
Membership usage records (history of joining, renewal, cancellation, and benefit use)
History of the granting and use of Report Vouchers, Cosmos Tickets, and Top-up Bonuses
Generated Reports
Customer inquiry content (including email address and name when inquiring)
Service reviews (rating, content, author name, email address)
Referral (invitation) codes and referral records, attendance check-in records

Payment Information:

Payment amount, payment date and time
Order number (processed through payment gateway, the Company does not directly store sensitive information such as card numbers)
Transaction information received from Apple or Google for in-app payments (transaction ID, product, payment date and time)
If you use Recurring Payment (Membership Subscription), the recurring payment identifier (billing key) issued by the payment gateway — payment method information such as card numbers is kept by the payment gateway
Refund account information (bank name, account number, account holder) if a refund cannot be made to the original payment method
Payment method identification hash value for preventing misuse of referral (invitation) rewards (a value created from the card issuer code and the partially masked card number provided by the payment gateway; the card number itself is not stored)

Consent and Settings Records:

Terms consent records (the version agreed to, and the date and channel of consent)
Whether you have opted in to promotional messages, the dates of opting in and out, and an identifier for the unsubscribe link
Whether you allow usage analytics, and the country you connect from (used to decide whether to show the consent prompt)
Star news email setting (whether it is on, and when it was turned on or off)

Automatically Collected Information:

IP address, cookies, visit date and time
Service usage records
Device time zone (including change history) and language settings, app push notification token (if notifications are allowed)
App usage information (app instance ID, device and OS information, usage records)
Email sending records (the type of email sent, the date, time, and result of sending, and whether it bounced or was reported as spam — email addresses are recorded as a hashed value and in a partially masked form)
Device identifier for preventing misuse of referral (invitation) rewards (a random ID created by the app or browser and stored on the device)

※ You can refuse cookies in your browser settings, and you can turn off usage analytics cookies in My Page > Settings > Usage analytics.

3. Retention and Use Period of Personal Information

Principle Retention Period:

Member registration information: Until member withdrawal
Service provision information: Until service provision is completed
Email sending records: 400 days from the sending date (deleted without delay upon member withdrawal)
Recipient email addresses stored for scheduled sending: Deleted without delay once sending is completed (addresses in unsent drafts are deleted after 30 days)
Hash values of email addresses that bounced or were reported as spam: For as long as exclusion from sending is needed so that emails are not sent to those addresses again (the email addresses themselves are not kept)
Recurring payment identifier: Until use of the Recurring Payment ends (if cancelled, when the already-paid period ends) or until member withdrawal
Device identifier and payment method identification hash value (for preventing misuse of referral rewards): Until member withdrawal (deleted without delay upon withdrawal)
Upon member withdrawal: Information that can identify you, such as your name, email address, login identifiers (such as your Kakao member number), and profile photo, is deleted without delay. Other usage records may be pseudonymized so that no individual can be identified and kept for statistics and service improvement (Article 28-2 of the Personal Information Protection Act).

Retention According to Related Laws:

In the following cases, information is retained for the period specified by the relevant law:

Records related to contracts or withdrawal of orders: 5 years (E-Commerce Act)
Records related to payment and supply of goods: 5 years (E-Commerce Act)
Records related to consumer complaints or dispute resolution: 3 years (E-Commerce Act)
Records related to labeling and advertising: 6 months (E-Commerce Act)
Website visit records (access logs): 3 months (Protection of Communications Secrets Act)

4. Provision of Personal Information to Third Parties

The Company does not provide users' personal information to third parties in principle. However, the following cases are exceptions:

When the user has given prior consent
When required by investigative agencies in accordance with procedures and methods prescribed by law based on legal provisions or for investigative purposes

5. Personal Information Processing Entrustment and Overseas Transfer

Personal Information Processing Entrustment

The Company entrusts personal information processing as follows for service provision:

Toss Payments: Web payment processing
Google LLC: Data storage, authentication, and server operation (Firebase, Google Cloud Platform), sending authentication emails (Firebase Authentication), AI report generation (Gemini API), usage statistics (web: Google Analytics, app: Google Analytics for Firebase), app push notifications (Firebase Cloud Messaging)
OpenAI OpCo, LLC: AI report generation (OpenAI API)
Vercel Inc.: Website hosting, delivery of web pages and shared link pages
Plus Five Five, Inc. (Resend): Sending service notice emails, Star news emails (if you have turned them on), and promotional emails (if you have opted in)
Slack Technologies, LLC: Internal operational notifications such as payment and inquiry alerts

Overseas Transfer of Personal Information

Recipient: Google LLC (Firebase, Google Cloud Platform, Gemini API, Google Analytics) / googlekrsupport@google.com

Transfer Country: United States and other countries where Google data centers are located

Transfer Purpose: Data storage, backup, authentication, sending authentication emails, service stability, AI report generation, usage statistics analysis, push notification delivery

Recipient: OpenAI OpCo, LLC / privacy@openai.com

Transfer Country: United States

Transfer Items: Traveler information, relationship information between travelers, content entered by the user

Transfer Purpose: AI report generation

Retention and Use Period: Kept by OpenAI for up to 30 days for abuse monitoring and then deleted (not used to train AI models)

Recipient: Vercel Inc. / privacy@vercel.com, Plus Five Five, Inc. (Resend) / support@resend.com, Slack Technologies, LLC / privacy@slack.com

Transfer Country: United States

6. Procedures and Methods for Destruction of Personal Information

The Company destroys personal information without delay when it becomes unnecessary due to the expiration of the retention period or achievement of the processing purpose.

Destruction Procedures:

Destruction Methods:

Electronic file format: Permanent deletion using technical methods that make recovery and regeneration impossible
Paper documents: Shredding with a shredder or incineration

7. Rights of Users and Legal Representatives and Methods of Exercise

Rights Exercise Contents:

Request for access to personal information
Request for correction of personal information
Request for deletion of personal information
Request for suspension of personal information processing

Rights can be exercised via email (contact@tayco.kr), and the Company will take action without delay and notify you of the result within 10 days from the date of the request.

The rights of a child under 14 must be exercised directly by the legal representative. A minor aged 14 or older may exercise their rights directly or through a legal representative.

8. Personal Information Protection Officer

Personal Information Protection Officer
Name: Han Tae-kyung
Email: contact@tayco.kr

9. Measures to Ensure Safety of Personal Information

Personal information encryption: Important information such as passwords is encrypted and stored and managed
Technical measures against hacking: Installation of security programs and periodic updates and inspections
Restriction of access to personal information: Granting, changing, and deleting access rights to personal information processing systems
Retention and prevention of tampering of access records: Retention and management for at least 1 year
Regular self-audits

10. Changes to Privacy Policy

11. Additional Information for Users in the EU, UK, and Similar Regions

Legal bases: We process data to perform our contract with you (GDPR Art. 6(1)(b)) for providing the Service, payments, customer support, and sending service notice emails; on the basis of your consent (Art. 6(1)(a)) for promotional messages, Star news emails, and usage analytics cookies; for our legitimate interests (Art. 6(1)(f)) in security, preventing misuse, and managing email sending records and the sending exclusion list (to prevent the same email from being sent more than once and to avoid sending again to addresses that bounced); and to comply with legal obligations (Art. 6(1)(c)) for keeping payment records.
Your rights: You can request access, rectification, erasure, restriction of processing, data portability (a copy of your data), and object to processing, and you can withdraw your consent at any time. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal. Send requests to contact@tayco.kr and we will respond within one month.
Complaints: You can lodge a complaint with the data protection supervisory authority in your country of residence.
International transfers: Your personal information is transferred to the Republic of Korea (which has an EU adequacy decision) and to the United States and other countries. Transfers to processors in the United States are covered by safeguards provided by each processor, such as the EU Standard Contractual Clauses (SCCs).
Age: In the EU, EEA, UK, and Switzerland, you must be 16 or older to sign up.
Automated decisions: Destiny Reports are AI-generated content for reference only, and the Company does not make automated decisions that produce legal effects or similarly significant effects on you.

First Effective Date: December 1, 2025
Latest Amendment Effective Date: October 19, 2026
Previous versions of this Privacy Policy are available on request by email (contact@tayco.kr).