Privacy Policy

1. Personal Data We Collect

The Company collects the following personal data in order to provide the service.

a. At sign-up

• Required: email address, password, name (nickname)
• Optional: date of birth, gender, time of birth

b. When using the Saju analysis service

• Required: date of birth (solar or lunar), time of birth, gender
• Optional: name, place of birth

c. When paying for a paid service

• Card payment: card number, expiry date, CVC (processed through the payment gateway; the Company does not store card details directly)
• Bank transfer: bank name, account number
• Payment records: date and time, amount, payment method

d. Collected automatically while using the service

• IP address, access date and time, browser type, operating system
• Service usage records, cookies

e. When using the mobile app

• Push token: stored only if you consent to notifications, and deleted when you turn notifications off.
• Crash diagnostics: if the app terminates abnormally, the device model, OS version and the location of the error are sent automatically. Identifying information such as email or name is not included.

2. Purposes of Use

Personal data we collect is used for the following purposes.

• Providing the Saju analysis service: computing Four Pillars charts, chart comparison and daily readings from date of birth, time of birth and gender
• Account management: sign-up, identity verification, user identification, and management of service usage history
• Paid services: payment processing, refund processing, and purchase history
• Service improvement and statistics: usage statistics, quality improvement, and development of new services
• Customer support: responding to inquiries, delivering notices, and handling complaints
• Marketing and advertising: event information and personalized recommendations (only where you have consented)

3. Retention and Use Periods

Once the purpose of collection and use has been achieved, the Company destroys the relevant data without delay. Where retention is required by applicable law, data is kept for the periods below.

4. Disclosure to Third Parties

As a rule, the Company does not provide your personal data to third parties. The following are exceptions.

• Where you have given prior consent
• Where required under applicable law, or where an investigative authority makes a request for investigative purposes following the procedures and methods prescribed by law
• Where necessary for statistical or academic research purposes and provided in a form in which no individual can be identified

5. Processors

The Company entrusts the following processing activities in order to provide the service.

6. Destruction of Personal Data

1. Procedure: information you entered for sign-up and similar purposes is moved to a separate database once its purpose has been achieved, and is destroyed after the retention period required by internal policy and applicable law has elapsed.
2. Method:
   • Electronic files: permanently deleted by means that make recovery impossible
   • Paper documents: shredded or incinerated

7. Your Rights and How to Exercise Them

You (or your legal representative) may exercise the following rights.

• Right of access: you may view the personal data the Company holds about you.
• Right to rectification and erasure: you may request correction or deletion of inaccurate personal data.
• Right to restriction: you may request that processing of your personal data be suspended.
• Withdrawal of consent: you may withdraw consent to the collection and use of your personal data.

Account deletion (destruction of all personal data) can be requested from "Request account deletion" at the bottom of My Page. The operations team destroys all data within 30 days of receiving the request and notifies you of the result by email. For other requests — access, rectification, restriction or withdrawal of consent — contact us at contact@pantheonstudio.co.kr and the Company will take the necessary measures without delay.

8. Cookies and How to Refuse Them

1. The Company uses cookies in order to provide individually tailored services.
2. Vercel Analytics and Vercel Speed Insights are used to improve service quality and measure performance. These tools do not use cookies and collect only aggregated data that cannot identify an individual (page views, core web vitals and similar). IP addresses are hashed immediately and are not stored.
3. Google Analytics and Google Ads (enhanced conversions) are used to measure advertising performance. At a conversion event such as a completed payment, your email address hashed with SHA-256 in the browser may be transmitted to Google; the plaintext email address is not transmitted. That value is used only to measure and match advertising conversions and for no other purpose. You can refuse this through your browser's cookie and tracking settings.
4. A cookie is a small text file that the server operating the service sends to your browser and which is stored on your computer.
5. You have a choice regarding cookies and can allow or refuse them through your browser settings.
6. If you refuse cookies, some parts of the service may be limited.

9. Technical and Administrative Safeguards

• Encryption: your password is stored and managed in encrypted form and is known only to you.
• Intrusion prevention: firewalls and intrusion detection systems are operated to prevent leaks of personal data through hacking and similar attacks.
• Access control: the number of staff who handle personal data is kept to a minimum, and regular security training is provided.
• SSL: the SSL (Secure Socket Layer) protocol is applied for secure transmission of personal data.

10. Data Protection Officer

The Company has designated the following person to take overall responsibility for personal data processing and to handle complaints and remedies relating to your personal data.

11. Remedies for Infringement of Rights

If you need to report or seek advice regarding an infringement of your personal data rights, you may contact the following Korean authorities.

• Privacy Infringement Report Center (Korea Internet & Security Agency): privacy.kisa.or.kr / 118
• Personal Information Dispute Mediation Committee: www.kopico.go.kr / 1833-6972
• Supreme Prosecutors' Office, Cyber Investigation Division: www.spo.go.kr / 1301
• National Police Agency, Cyber Bureau: ecrm.police.go.kr / 182

12. Changes to This Policy

This Privacy Policy may be amended in line with changes in law, policy or the Company's internal rules. Any change will be announced through notices within the service. This policy takes effect on June 1, 2026.