Article 1 (Purpose of Processing Personal Information)
Coffee Ledger (hereinafter "Service") processes personal information for the following purposes. Personal information collected will not be used for purposes other than those stated below. If the purpose of use changes, necessary measures such as obtaining separate consent will be taken in accordance with Article 18 of the Personal Information Protection Act (PIPA). a. Member registration and management: Verification of intent to register, identification and authentication for membership services, maintenance and management of member status, prevention of unauthorized use, delivery of notices and notifications b. Service provision: Management of in-house coffee expenses, recording of orders, balance management, deposit management c. Notification service: Sending push notifications (FCM) with member consent
Article 2 (Personal Information Collected and Collection Methods)
The Service collects the following personal information for registration and service use. a. Required items: Email address, name (nickname), password (stored encrypted) b. Automatically collected items: Service usage records, access logs, cookies, IP address, device information c. Optional items: FCM token (when push notification consent is given) Collection methods: Direct input by users during registration, automatic generation and collection during service use
Article 3 (Retention and Processing Period)
The Service processes and retains personal information within the retention and usage period prescribed by law or agreed upon at the time of collection. a. Member information: Until membership withdrawal. However, information will be retained until the end of the applicable period in the following cases: - Under the Act on Consumer Protection in Electronic Commerce: Records of contracts or withdrawal of offers for 5 years, records of payment and supply of goods for 5 years, records of consumer complaints or dispute resolution for 3 years - Under the Protection of Communications Secrets Act: Website visit records for 3 months b. Service usage records (orders, deposit history, etc.): Until membership withdrawal or until the purpose of retention is achieved
Article 4 (Provision to Third Parties)
The Service processes personal information only within the scope of purposes specified in Article 1, and provides personal information to third parties only in cases falling under Articles 17 and 18 of the Personal Information Protection Act, such as with the consent of the data subject or under special provisions of law. Currently, the Service does not provide users' personal information to any third parties.
Article 5 (Outsourcing of Processing)
The Service outsources the processing of personal information as follows for smooth operations. a. Data storage and management: Supabase Inc. (cloud database and authentication services) b. Push notification delivery: Google LLC (Firebase Cloud Messaging) c. Web hosting: Vercel Inc. (web application hosting) If the content of outsourced work or the outsourced party changes, it will be disclosed through this Privacy Policy without delay.
Article 6 (Rights and Obligations of Data Subjects)
Data subjects may exercise the following rights regarding their personal information at any time. a. Request to access personal information b. Request for correction of errors c. Request for deletion d. Request to suspend processing These rights may be exercised through the settings menu within the Service, or by contacting the Service operator via email. The Service will take action without delay in response to such requests. If a data subject requests correction or deletion of personal information due to errors, the Service will not use or provide the relevant personal information until the correction or deletion is completed.
Article 7 (Destruction of Personal Information)
The Service destroys personal information without delay when it is no longer needed, such as when the retention period has expired or the purpose of processing has been achieved. a. Destruction procedure: Unnecessary personal information is destroyed with approval from the privacy officer. b. Destruction method: Information in electronic file format is deleted using technical methods that prevent the records from being reproduced.
Article 8 (Security Measures)
The Service takes the following measures to ensure the security of personal information. a. Password encryption: Member passwords are encrypted for storage and management, so only the member can know their password. b. Technical measures against hacking: Security programs are installed with regular updates and inspections, and systems are installed in access-controlled areas with technical and physical monitoring and blocking. c. Access restriction to personal information: Access rights to the database systems processing personal information are granted, modified, and revoked to implement necessary access control measures. d. Data transmission encryption: All data is encrypted and transmitted through SSL/TLS protocols. e. Row Level Security (RLS): Row-level security policies are applied at the database level to ensure access only to authorized data.
Article 9 (Cookies and Automatic Collection Devices)
The Service uses cookies to store and retrieve usage information for providing personalized services. a. Purpose of cookies: Maintaining login sessions, managing user authentication status b. Installation and rejection of cookies: You may refuse cookie storage through web browser settings. However, refusing cookies may cause difficulties in using services that require login. c. Push notifications: The Service provides push notification functionality through FCM (Firebase Cloud Messaging), which is sent only with separate member consent. Members may refuse to receive notifications at any time through browser settings or Service settings.
Article 10 (Privacy Officer)
The Service has designated a privacy officer as follows to oversee personal information processing and to handle complaints and damage relief related to personal information processing. Privacy Officer - Contact: Service operator - Email: dww7541@gmail.com Data subjects may direct all inquiries, complaints, and damage relief matters related to personal information protection arising from the use of the Service to the privacy officer. You may also reach us through Settings > Contact within the Service.
Article 11 (Cross-Border Transfer of Personal Information)
The Service stores personal information on servers outside Korea or outsources processing to overseas entities as follows. a. Supabase Inc. (United States): Database storage and authentication services b. Google LLC (United States): Push notification delivery via Firebase Cloud Messaging c. Vercel Inc. (United States): Web application hosting The items of personal information transferred, purpose of transfer, and retention period are as described in the relevant provisions of this Policy. These companies manage information securely in accordance with their respective privacy policies.
Article 12 (Changes to Privacy Policy)
This Privacy Policy takes effect from the effective date. When additions, deletions, or corrections are made due to changes in laws or policies, the changes will be announced through in-service notices at least 7 days before the effective date of the changes. This Policy is effective as of March 17, 2026.
Article 13 (Remedies for Rights Infringement)
Data subjects may apply for dispute resolution or consultation with the following organizations for relief from personal information infringement. a. Personal Information Dispute Mediation Committee: 1833-6972 (www.kopico.go.kr) b. Personal Information Infringement Report Center (KISA): 118 (privacy.kisa.or.kr) c. Supreme Prosecutors' Office: 1301 (www.spo.go.kr) d. National Police Agency: 182 (ecrm.cyber.go.kr)