Privacy Policy

Article 1 (Purpose of Processing Personal Information)

The Company processes personal information for the following purposes only, and the personal information processed will not be used for any purposes other than those listed below.

1. Responding to customer inquiries and providing consultation
2. Discussion of B2B business partnerships
3. Service improvement and statistical analysis
4. Dispute resolution in accordance with applicable laws and Company policy
5. Member registration and account management (identity verification, service provision, account administration)
6. Storage and management of AI analysis history (Members only)
7. Pet profile registration, management, and multi-device synchronization (Members only)
8. Provision of marketing and event information (only to Members who have consented)

Article 2 (Items of Personal Information Collected)

The Company collects and processes the following personal information items.

① Customer Inquiry / Business Inquiry

• Required: Name, email, phone number, inquiry content
• Optional: Company name, job title, country/region

② Member Registration

• Email registration: Email address, password (stored encrypted), year of birth
• External authentication (OAuth) registration: Basic information provided by Google, Facebook, Kakao, Naver, or X (Twitter), such as email address and nickname
• Optional: Nickname, marketing consent preference
• Automatically generated: Unique member identifier (UUID), registration date, consent records (Terms of Service, Privacy Policy, age confirmation, marketing consent — including timestamps)

③ AI Analysis Service Usage (Members only)

• Stored items: Analysis results (JSON), meal records, analysis date/time, service type (Dog Nutrition / Cat Nutrition / Gut Health), associated pet information, and pet photos used for analysis or meal records (stored in the Health Book for record-keeping and change tracking; embedded in the analysis data in Base64 format).
• External processing: For AI analysis, photos are transmitted to the Google Gemini AI API and processed under Google's policies. Google does not separately retain the photos.
• Retention period: Until the member withdraws their account or directly deletes the analysis/meal record.
• Daily photos (Album): Daily photos added directly by the member are stored only in the member's own browser local storage (IndexedDB) and are not transmitted to or stored on Company servers.

④ Pet Profile Registration (Members only)

• Pet name, species (dog/cat), breed, date of birth, weight, allergy and health condition information

⑤ Community Board Use (Members only)

• Posts (title, body, category: review/request)
• Rating (1–5 stars, review category only)
• Author display name (pet name or member nickname)
• Member identifier (Supabase user ID)
• Posting timestamp

⑥ Automatically Collected Items

• Access IP, cookies, access logs, service usage records, browser information, device information

Article 3 (Processing and Retention Period of Personal Information)

The Company processes and retains personal information within the period stipulated by laws, or within the retention and use period agreed upon when collecting personal information from data subjects.

• Customer inquiry response: Retained for 3 months after inquiry processing, then destroyed
• B2B partnership inquiry: Retained for 1 year after processing for potential follow-up discussions, then destroyed
• Member information: Immediately destroyed upon account deletion. However, a hash of the email address may be retained for 30 days to prevent abuse, then destroyed
• AI analysis history (Members): Immediately destroyed upon account deletion
• Pet profiles (Members): Immediately destroyed upon account deletion
• Community board posts (Members):
  • When the Member deletes their own post: immediately hidden (soft-deleted) and retained for 30 days, after which it is permanently deleted by an automated system
  • Upon account termination: all posts authored by the terminating Member are permanently deleted immediately (the 30-day retention period does not apply)
• Consent records: Retained for 3 years after account deletion in accordance with the Personal Information Protection Act
• Information retention under applicable laws:
  • Records on labeling and advertising under the Act on Consumer Protection in Electronic Commerce: 6 months
  • Records on contracts or withdrawal of subscriptions: 5 years
  • Records on payments and supply of goods: 5 years
  • Records on consumer complaints or dispute resolution: 3 years

Article 4 (Provision of Personal Information to Third Parties)

The Company processes personal information only within the scope specified in Article 1, and provides personal information to third parties only with the consent of the data subject, or as specifically permitted by law under Articles 17 and 18 of the Personal Information Protection Act.

The Company currently does not provide personal information of data subjects to any third parties.

Article 5 (Outsourcing of Personal Information Processing)

For smooth handling of personal information, the Company outsources the following processing tasks.

※ When concluding outsourcing contracts, the Company specifies in the contract — in accordance with Article 26 of the Personal Information Protection Act — the prohibition of processing personal information beyond the purpose of the outsourced task, as well as required technical and managerial protective measures.

※ AI analysis services are routed through cloud infrastructure (Cloudflare Workers) operated by the Company to Google's Gemini AI API for processing. Processing is governed by Google's privacy policy (view policy). The Company does not separately retain images on its own servers. Image data used during processing is discarded immediately after the analysis response is received.

※ Member data (account information, analysis history, pet profiles) is stored in encrypted form on AWS U.S. region servers operated by Supabase, Inc. This constitutes an international transfer of personal information under Article 28-8 of the Korean Personal Information Protection Act (PIPA), for which consent is obtained during registration. All such data is permanently deleted immediately upon account deletion.

Article 6 (Rights and Obligations of Data Subjects, and How to Exercise Them)

Data subjects may exercise the following rights regarding personal information protection at any time toward the Company.

1. Request to access personal information
2. Request to correct any errors
3. Request to delete personal information
4. Request to suspend processing
5. Request to transfer personal information (where applicable)
6. View and delete community board posts authored by the member (exercisable directly via the in-app [My Posts] and [Delete] features)

These rights may be exercised in writing, via email (contact@celltune.kr), or by other means, and the Company will respond without delay.

These rights may also be exercised through a legal representative or duly authorized agent of the data subject. In such cases, a power of attorney must be submitted.

Article 7 (Data Subject Rights Regarding Automated Decisions)

The Company guarantees the data subject's rights regarding automated decisions in accordance with Article 37-2 of the Personal Information Protection Act.

① Status of Automated Decisions

The Company operates the following AI-based automated analysis services.

• Dog Nutrition AI: Analyzes external traits based on user-uploaded photos of dogs and provides reference information for daily nutritional care
• Cat Nutrition AI: Analyzes external traits based on user-uploaded photos of cats and provides reference information for daily nutritional care
• Dog Gut Health AI: Analyzes color and shape based on user-uploaded stool photos and provides reference information for daily nutritional care

② Nature of Automated Decisions

These AI analysis services provide reference information only and do not replace veterinary diagnosis or treatment. The analysis results have no legal effect on the data subject and do not affect their rights or obligations.

③ Rights of the Data Subject

Data subjects may exercise the following rights regarding automated decisions.

• Right to refuse automated decisions
• Right to request an explanation of automated decisions
• Right to request a review of automated decisions

※ To exercise these rights, please contact the Privacy Officer specified in Article 11 of this policy.

Article 8 (Destruction of Personal Information)

When personal information becomes unnecessary due to the expiration of the retention period or the achievement of the processing purpose, the Company destroys the relevant personal information without delay.

① Destruction Procedure

Information entered by users is moved to a separate database after the purpose has been achieved, and is either stored for a certain period in accordance with internal policies and applicable laws or destroyed immediately.

② Destruction Method

• Electronic file format: Deleted using technical methods that prevent record restoration
• Paper documents: Shredded or incinerated

Article 9 (Measures to Ensure the Security of Personal Information)

The Company takes the following measures to ensure the security of personal information.

• Administrative measures: Establishment and implementation of internal management plans, regular employee training
• Technical measures: Access rights management for personal information processing systems, installation of access control systems, encryption of unique identification information, and installation of security programs
• Physical measures: Access control to server rooms, data storage rooms, and similar areas

Article 10 (Operation and Refusal of Cookies)

The Company may use cookies to provide personalized services to users.

• Purpose of cookies: Analysis of access frequency, site visit behavior, and service improvement
• How to refuse cookies: You can refuse cookie storage through your web browser's Tools → Internet Options → Privacy menu

※ If you refuse to store cookies, some services may have limited functionality.

Article 11 (Privacy Officer)

The Company designates the following Privacy Officer to protect personal information and handle complaints related to personal information.

Article 12 (Remedies for Infringement of Rights)

Data subjects may apply for dispute resolution or counseling to the Personal Information Dispute Mediation Committee, the Korea Internet & Security Agency Personal Information Infringement Report Center, and similar agencies for remedies relating to infringement of personal information.

• Personal Information Dispute Mediation Committee: 1833-6972 (www.kopico.go.kr)
• Personal Information Infringement Report Center: 118 (privacy.kisa.or.kr)
• Supreme Prosecutors' Office: 1301 (www.spo.go.kr)
• National Police Agency: 182 (ecrm.cyber.go.kr)

Article 13 (Changes to the Privacy Policy)

This Privacy Policy applies from the effective date below. In the event of any additions, deletions, or revisions due to changes in laws or policies, the Company will provide notice through announcements at least 7 days prior to the effective date of the changes.

Article 14 (Notice for California Residents — CCPA)

For California residents, under the California Consumer Privacy Act (CCPA), the Company recognizes the following rights:

1. Right to Know: You may request information about the categories and specific pieces of personal information collected about you, the sources from which the information was collected, the purposes for collecting it, and any third parties with whom it was shared.
2. Right to Delete: You may request the deletion of your personal information held by the Company, subject to certain legal exceptions (such as compliance with legal obligations).
3. Right to Opt-Out of Sale: The Company does not sell, rent, or trade your personal information to third parties for monetary or other valuable consideration.
4. Right to Non-Discrimination: You will not be discriminated against — in terms of services, prices, or quality — for exercising your CCPA rights.

※ To exercise these rights, please contact us at contact@celltune.kr with the subject line "CCPA Request". The Company will respond within 45 days as required by CCPA, with one possible 45-day extension if reasonably necessary.

※ The Company does not knowingly sell the personal information of minors under 16 years of age. Account registration is restricted to users aged 14 and older, with parental consent required where applicable.