Privacy Policy

Last updated: October 3, 2025

This is KOTourLives policy on the collection and use of personal information.

Privacy Policy

Effective Date: February 25, 2026

YDATA Service Co. (the “Company”) establishes and discloses this Privacy Policy (the “Policy”) to protect the personal information of users of the Kotourlive service (the “Service”), in compliance with the Personal Information Protection Act and other applicable laws and regulations.

1. Purpose of Processing Personal Information

The Company processes personal information for the following purposes:

  1. Sign-up and login (including social login), and account and session management
  2. Providing and operating the Service (providing content, language settings, and features such as likes/reviews/comments)
  3. Responding to user inquiries and delivering notices
  4. Ensuring Service stability, security, prevention of fraudulent use, and managing error/access logs
  5. Generating Service usage statistics and improving quality (e.g., analysis based on Google Analytics)

2. Types of Personal Information Processed

2.1 When Signing Up/Logging In (Social Login)

  • Required (to the extent necessary to provide the Service): social login provider identifiers (e.g., provider, social_id)
  • If provided: email address, nickname/display name, profile image URL
  • User-provided (optional or as needed): information the user enters or edits on the profile screen (e.g., nickname, email address, etc.)
  • Authentication tokens, etc.: token information issued during the social login process (may be stored and renewed if necessary)

2.2 Information Automatically Collected During Service Use

  • Access logs (date/time of access, requested URL), IP address, (estimated) country code, User-Agent, Referer
  • Session identifiers (e.g., session cookies), language preference values (e.g., cookies)
  • Usage history (e.g., identifiers of menus/content viewed, and activity history such as likes/reviews/comments)

2.3 Collection via Google Analytics

  • The Service may use Google Analytics to collect and analyze information about users’ use of the Service through cookies and similar technologies.
  • Examples of information that may be collected: visits/pageviews, clicks/events, referral sources, browser/device information, approximate location (country/region level), cookie identifiers, etc.
  • Google Analytics data processing may vary depending on Google’s policies and settings (e.g., retention period).

3. Retention and Processing Period

The Company retains and uses personal information until the purposes of collection and use are fulfilled, and deletes it without delay once those purposes are achieved. However, if retention is required under applicable laws, the information may be kept for the required period.

  1. Member information: retained and used until account deletion (if the user does not delete their account, it may be retained until the Service is terminated, at which time it will be deleted in bulk)
  2. Member activity data such as reviews/comments/likes:
    • If the user deletes it via My Page, etc.: processed without delay upon deletion
    • Upon account deletion: deleted together with the account deletion process (however, it may remain in technical/operational backups, and backup data may be deleted sequentially within a certain period)
  3. Logs such as access records: retained for the period necessary to ensure Service security and stability, then deleted (e.g., 3 months or as set by the Company’s internal policy)
  4. Google Analytics data: retained for the period specified by Google Analytics settings and policies
  5. Inquiry records: if retention is necessary after the inquiry is resolved, retained for a certain period and then deleted

4. Provision of Personal Information to Third Parties

In principle, the Company does not provide users’ personal information to third parties. Exceptions apply in the following cases:

  1. When the user has given prior consent
  2. When required by law or in response to a lawful request from investigative authorities, etc.

5. Outsourcing of Personal Information Processing

The Company may outsource certain personal information processing tasks to provide the Service smoothly. In such cases, the Company will manage and supervise the service provider through contracts and other measures in accordance with applicable laws to ensure personal information is processed safely.

If disclosure of outsourcing details is required (e.g., infrastructure/hosting, email delivery, operational support, etc.), the Company will reflect the outsourced party and the scope of outsourced work in this Policy.

6. Cross-Border Transfer of Personal Information

  1. The Service may use services provided by overseas companies, such as social login providers and Google Analytics. Accordingly, personal information may be transferred abroad or processed outside the user’s country during use of the Service.
  2. If a cross-border transfer occurs, the Company will provide necessary information and apply appropriate safeguards in accordance with applicable laws.
  3. Google Analytics: Data may be processed on Google’s infrastructure (including outside Korea) by Google LLC, etc., and users should be aware that their personal information may be processed in accordance with Google’s policies.

7. Procedures and Methods for Destruction of Personal Information

  1. Destruction procedure: When the processing purpose is achieved or the retention period expires, the Company will destroy the information in accordance with internal policies and applicable laws.
  2. Destruction methods:
    • Electronic files: permanently deleted in a manner that prevents recovery
    • Printed materials: shredded or incinerated

8. Data Subject Rights and How to Exercise Them

Users may exercise the following rights at any time:

  1. Request access to personal information
  2. Request correction or deletion of personal information
  3. Request suspension of processing of personal information
  4. Withdraw consent and delete the account

In addition, where provided by the Service, users may directly delete posts such as reviews/comments from My Page. Users may also exercise their rights by contacting the “Contact” below, and the Company will take action without delay in accordance with applicable laws.

9. Installation/Operation of Cookies and Other Automatic Collection Devices and Refusal

The Company may use cookies to provide and analyze the Service.

  • Essential cookies: to keep you logged in and for security (e.g., session cookies)
  • Functional cookies: to store language preferences
  • Analytics cookies: to analyze usage behavior via Google Analytics

Users can refuse or delete cookies through their browser settings. However, refusing cookies may limit certain features, such as staying logged in.

For Google Analytics, you can opt out in the following ways:

  • Block/delete cookies in your browser
  • Use the Google Analytics opt-out browser add-on (provided by Google)

10. Measures to Ensure the Security of Personal Information

The Company may implement the following measures to ensure the secure processing of personal information:

  1. Managing access permissions and applying the principle of least privilege
  2. Protecting session/authentication information and applying security settings
  3. Log management and monitoring of personal information processing systems
  4. Encrypting (hashing) and securely verifying authentication information such as passwords
  5. Security updates and vulnerability 대응

11. Changes to This Policy

The Company may revise this Policy due to changes in laws, the Service, or internal policies. If changes are made, the Company will notify users through reasonable means, such as announcements within the Service.

Contact

  • Company: YDATA Service Co.
  • Address: 34, Seolleung-ro 100-gil, Gangnam-gu, Seoul, 06161, Republic of Korea
  • Email: [email protected]

Chief Privacy Officer (Optional: Recommended)