Privacy Policy

1. Purpose of Processing Personal Information

Season7 (the "Company") processes personal information for the following purposes. The personal information processed is not used for any purpose other than those below, and if the purpose of use changes, the Company will take necessary measures such as obtaining separate consent under Article 18 of the Personal Information Protection Act.

• Membership registration and management: identity verification, personal identification, and confirmation of intent to register for membership services
• Provision of goods or services: service provision, content delivery, customized services, payment and settlement
• Marketing and advertising: development of new services (products) and provision of customized services
• Service improvement and statistical analysis: improving service quality by analyzing usage and user flow (funnel)

2. Processing and Retention Period

The Company processes and retains personal information within the retention and use period required by law or consented to by the data subject at the time of collection.

• Membership registration information: until membership withdrawal (however, if an investigation for a violation of applicable law is underway, until such investigation concludes)
• Payment and supply of goods records: 5 years (Act on Consumer Protection in Electronic Commerce)
• Records on consumer complaints or dispute resolution: 3 years
• Service usage analytics records: 1 year from collection (upon account deletion, the member identifier is immediately detached and the record is de-identified)

3. Items of Personal Information Processed

The Company processes the following items of personal information.

• Required items: email, password, name (nickname), gender, age group
• Automatically generated during service use: IP address, cookies, service usage records, visit history
• At payment: card issuer name, partial card number, payment approval number (processed through the payment gateway and not stored on the Company's servers)
• Service usage analytics: an anonymous identifier generated in browser storage, access language and device type, page navigation and key click records (may be linked to the member identifier while signed in)

4. Provision to Third Parties

The Company processes personal information only within the scope specified in Article 1 (Purpose of Processing), and provides it to third parties only where it falls under Articles 17 and 18 of the Personal Information Protection Act, such as with the data subject's consent or a special provision of law.

5. Entrustment of Processing

For smooth processing of personal information, the Company entrusts processing tasks as follows.

6. Overseas Transfer of Personal Information

To provide the service, the Company transfers personal information overseas (entrustment/storage) as follows. The data subject may refuse the overseas transfer; refusal may restrict membership registration and use of the service.

• Supabase Inc. (United States) — Items transferred: account, test, and image data / Purpose: database and storage operation / Retention: until membership withdrawal or termination of the entrustment agreement
• OpenAI, L.L.C. (United States) — Items transferred: drawing images and survey responses / Purpose: AI psychological analysis / Retention: at the time of analysis (not separately stored)

7. Rights of the Data Subject and How to Exercise Them

The data subject may at any time request access to, correction, deletion, or suspension of processing of their personal information. Rights may be exercised through in-service features or via the privacy officer's contact below, and the Company will act without delay.

• Membership withdrawal (deletion of personal information): After logging in, you can do this directly under 'Account > Delete Account' at the bottom of the [My Test Results] page. Upon withdrawal, your account, test records, and uploaded images are immediately destroyed.
• Payment and transaction records: In accordance with applicable law (Act on Consumer Protection in Electronic Commerce), these are anonymized and retained for 5 years even after withdrawal.
• Deletion of individual test records: You can delete tests individually on the [My Test Results] page.

8. Privacy Officer

The Company designates a privacy officer as below to take overall responsibility for personal information processing and to handle data subjects' complaints and remedies.