Personal Information Collection and Use

1. Personal Information Collected

• Signup and login: email address, password hash, Google login identifier, Google account email verification status, confirmation that the user is at least 14 years old, required consent status, and consent timestamp
• Optional input: marketing consent status and referral code
• Information generated while using the service: questions, selected cards, reading answers, follow-up questions and answers, reading archive records, and reading ticket usage history
• Payment and refund processing information: order number, payment identifier, payment status, product name, payment amount, currency, payment provider, payment method, payment/cancellation/refund timestamps, and reading ticket grant and deduction ledger
• Operations and security information: access logs, IP address, browser and device information, country and language information, cookies and session identifiers, event logs, error logs, and abuse-prevention records
• Room78 does not directly store full card numbers, CVCs, account passwords, or other sensitive payment authentication data. Such information is processed by payment method providers or payment processors.

2. Purposes of Collection and Use

• Identifying members, enabling login, connecting Google login, resetting passwords, and managing accounts
• Issuing, using, paying for, cancelling, refunding, and settling reading tickets, and checking payment errors or duplicate payments
• Generating tarot readings, connecting follow-up questions, providing the reading archive, and processing reading deletion
• Responding to support inquiries, handling disputes, preventing abuse, and detecting duplicate signup or abnormal payments
• Checking service stability, analyzing errors, maintaining security, and reviewing statistics and operational metrics for administrators
• Sending event and service notices to users who have opted in

3. Retention and Use Period

• Member information is retained until account withdrawal or until the purpose of use has been fulfilled.
• Reading archive records may be retained until the user deletes them or account withdrawal is completed.
• E-commerce records may be retained under applicable laws for the following periods: records on display or advertising for 6 months, records on contracts or withdrawal of subscription for 5 years, records on payment and service supply for 5 years, and records on consumer complaints or dispute handling for 3 years.
• Records needed for abuse prevention, security, incident response, or legal dispute response may be retained separately for the period required under applicable laws and operating policies.
• Personal information is deleted without delay when the retention period ends or the processing purpose is fulfilled, or is stored separately from information that must be retained by law.

4. External Services and Processing Entrustment

• External services may be used for hosting, databases, email delivery, login, payments, LLM APIs, analytics, security, and other service operations.
• Room78 may use systems provided by external providers including Vercel, Neon, Resend, Google OAuth, Google Gemini, PortOne, and PayPal to provide the current service.
• External providers may process personal information within the scope necessary to provide the service, and some providers' servers or processing locations may be outside the user's country.
• For payment and refund processing, information needed to process orders and payments may be provided to payment processors, card issuers, local payment providers, PayPal, or other payment method providers.
• Room78 manages external provider use so that the scope of information processed does not exceed what is necessary to provide the service.

5. User Rights and Refusal of Consent

• Users may request access, correction, deletion, or suspension of processing of their personal information.
• Users have the right to refuse consent to required collection and use of personal information, but in that case required services such as signup, login, reading ticket payment, and the reading archive may be unavailable.
• Marketing consent is optional, and refusing or withdrawing it does not limit use of required services.
• Marketing consent may be withdrawn at any time.
• Inquiries and requests may be submitted through the account, usage guide, or support path shown in the service.

6. Sensitive Information Input Restrictions

• Users should not enter sensitive information that is not necessary to provide the service, such as national identification numbers, passport numbers, full card numbers, account passwords, medical records, legal case materials, financial secrets, or another person's personal information, in questions or follow-up questions.
• If a user enters such information directly, that content may be processed to generate readings, provide the archive, and respond to errors, so users should review their input carefully before submitting it.

7. Cookies and Security

• Room78 may use cookies or similar identifiers to maintain login sessions, prevent signup bonus abuse and other abuse, and check service stability.
• Room78 applies reasonable technical and administrative safeguards for personal information, such as access control, encryption, log management, and abnormal request limits.

8. Changes to This Privacy Notice

If the purposes, items, retention period, external provider scope, or user rights notice changes, Room78 may announce the changes through the service screen or other notice methods.