Privacy Policy

1. Our role

• For the accounts of organizers who use the Service to run stamp rallies ("Organizers"), we decide how personal information is used and act as the controller.
• For information about participants collected in a stamp rally, the Organizer running the rally is the controller. We process that information on the Organizer's behalf as a processor (service provider). If you are a participant, please contact the Organizer of the rally first. We will help the Organizer respond to your request.

2. Information we collect

Organizers:

• Name, email address, password (stored hashed), organization name if provided, account settings, and the content of your projects
• Billing information we receive from Paddle, such as your name, email address, country, plan, and transaction and subscription status. Paddle collects your payment card details; we do not receive or store your full card number.
• Messages you send us, and your instructions to AI features

Participants (depending on the settings chosen by the Organizer):

• Nickname; name and phone number; or email address (with email verification). Participants can also join anonymously if the Organizer chooses that mode.
• Photos uploaded, survey answers, stamps collected, check-in times, and prize draw or roulette results
• Location: if the Organizer turns on the GPS check, the device location is used only to check whether the participant is within the radius of a spot. We do not store coordinates; we keep only the check result and distance.

Everyone: IP address, browser type, language setting, access times, and cookies (see section 11).

3. How we use information

• To provide and operate the Service, including sign-in, email verification and running stamp rallies
• To manage subscriptions and payments together with Paddle
• To respond to inquiries and send service notices
• To keep the Service secure and prevent fraud and abuse
• To improve the Service using aggregated usage information
• To comply with legal obligations

We do not sell personal information and do not use it for targeted advertising. Where the EU or UK GDPR applies, we rely on performance of a contract, our legitimate interests (security and service improvement), legal obligations, and consent where required.

4. AI features

When you use AI features, your instructions and project content are sent to OpenAI to generate screens, text and images. Under OpenAI's API terms, data sent through the API is not used to train its models. Please do not include participants' personal information in AI instructions.

5. Service providers (subprocessors)

Amazon Web Services

Hosting, database, file storage and email delivery. Region: Seoul, Republic of Korea.

OpenAI

AI generation of screens, text and images. Location: United States.

Google

Map display and place search. Location: United States.

Paddle

Payment processing, billing, tax and refunds as Merchant of Record. Paddle.com Market Limited (United Kingdom) and Paddle.com Inc. (United States). Paddle processes payment information as an independent controller under its own privacy notice.

We may also disclose information when required by law, to protect rights and safety, or in connection with a merger or acquisition, subject to this Policy.

6. International transfers

Data is stored on servers in Seoul, Republic of Korea. Some information is transferred to the United States (OpenAI, Google) and the United Kingdom or United States (Paddle) for the purposes above. We use contractual safeguards with these providers to protect transferred information.

7. Retention

• Organizer account information: while the account is active. When you delete your account, we delete it without delay, except records we must keep by law (for example, transaction records).
• Participant information: until the end of the retention period set by the Organizer, until the Organizer deletes it (Organizers can delete participant personal data for each project at any time), or until the Organizer's account is deleted.
• Access logs: for a limited period needed for security and legal compliance.

8. Security

We use encryption in transit (HTTPS), hashed passwords, access controls with least privilege, and access logging to protect personal information.

9. Your rights

Depending on where you live, you may have the right to access, correct, delete or receive a copy of your personal information, to object to or restrict its processing, and to withdraw consent. Organizers can update most account information in the dashboard or contact us. Participants should contact the Organizer of the rally. We will verify your identity before responding. You may also complain to your local data protection authority.

10. Notice for US residents

• In the past 12 months we collected the categories described in section 2: identifiers (name, email, phone number, IP address), commercial information (plans and purchases), internet activity (usage and access logs), audio-visual information (photos uploaded by participants), and limited location information (the result of a spot radius check, not stored coordinates).
• We do not sell personal information or share it for cross-context behavioral advertising, and we do not use sensitive personal information to infer characteristics about you.
• Residents of California and other states with privacy laws may request to know, access, correct or delete their personal information, and may use an authorized agent. We will not discriminate against you for exercising these rights. Send requests to ceo@momscoach.co.kr; we will respond within 45 days.
• For participant information, we act as a service provider to the Organizer and will forward requests to the Organizer.

11. Children

The Service is not directed to children under 13, and organizer accounts are for adults. Organizers who run stamp rallies for children must obtain verifiable parental consent where required by law (for example, under COPPA in the United States), or use the anonymous participation mode. If we learn that we have collected personal information from a child under 13 without required consent, we will delete it.

12. Cookies

We use only cookies needed for the Service to work: a session cookie that keeps organizers signed in, and a cookie that keeps a participant's progress in a rally. We do not use advertising or third-party analytics cookies. When a map is shown, Google may set its own cookies. You can block cookies in your browser, but parts of the Service may not work.

13. Changes

We may update this Policy. We will notify Organizers of material changes by email or in the Service before they take effect.

14. Contact

MOMSCOACH Co., Ltd. (Representative: Kim Jinhan)

Privacy inquiries: ceo@momscoach.co.kr