Privacy Notice

1. Who we are

해피스마일 (Happy Smile), a sole proprietorship (representative 최선미, business registration no. 128-78-00383).

Address: 104-dong 1003-ho, 20 Gwangan-ro, Suyeong-gu, Busan, Republic of Korea

Privacy contact: kc2783@naver.com

2. What we collect and the purpose

Date of birth, time of birth, sex and city of birth — to calculate your chart and write your reading. On the free pages we do not store these on our servers; they stay in your browser while you use the site.

The name you want us to use, your question, what is on your mind, and the personality type you picked — to write a reading that fits you. These end up in the finished reading, which we keep.

Email address and password — to create an account and show your past consultations. Passwords are stored encrypted. If you attach readings to your email, we keep only an irreversible transformation of the address.

Payment records — only the transaction number, amount, currency, status and which reading it paid for. Card details go to Toss Payments, not us.

Usage data — how far through the flow you got (a random identifier, page type, language) and server logs (IP address, browser details), for security, troubleshooting and improving the service.

3. Legal basis

Performance of a contract for delivering readings and running accounts; legitimate interests in running the service safely and improving it; legal obligation for keeping payment records; and consent for any newsletter, which we only send if you opt in.

4. Who receives your data

SAZU (chart calculation provider) — your date, time, sex and city of birth, to calculate the chart. Never your name or email.

OpenAI (United States) — for paid readings only: the calculated chart (eight characters and luck periods), the name you want us to use, your question, what is on your mind and your personality type. This is not your raw date of birth.

Supabase (database; servers in Seoul, company in the United States) — stores readings, accounts, payment records and writing progress.

Vercel (web hosting; US company, running in the Seoul region) — runs the site and keeps server logs.

Toss Payments (Republic of Korea, payment processor) — processes payments and cancellations. Your card details go directly to Toss Payments.

Transfers to the United States happen when you use the relevant feature and are protected by each provider's contractual safeguards, such as standard contractual clauses. If you do not want this, you can choose not to buy a paid reading.

We may disclose data to authorities where the law requires. Otherwise we do not sell or hand over your personal data.

5. Retention

Readings: kept so you can reopen them, and deleted on request.

Accounts and consultation history: kept until you close the account or ask us to delete it.

Payment records: kept for 5 years as Korean law requires, then deleted.

Server logs: deleted when our host's standard retention period ends.

Data we no longer need is deleted or anonymised.

6. Your rights

You can ask to access, correct or delete your data, restrict or object to its use, move it, and withdraw consent at any time. Email kc2783@naver.com; we reply within 10 days, and within one month for users covered by the EU or UK GDPR.

You can also complain to Korea's Personal Information Protection Commission, the UK Information Commissioner's Office, or the data protection authority where you live.

7. Security

All traffic is encrypted with HTTPS. The database is locked at row level so browsers cannot read it — only our server can. Secret keys stay on the server, and access to personal data is kept to a minimum.

8. Cookies and browser storage

We use one essential cookie, gapja_session, which keeps you signed in for 30 days. We use no advertising or analytics cookies.

While you go through checkout, what you entered is held briefly in your browser tab (sessionStorage) and disappears when you close the tab. The checkout window is run by Toss Payments under its own policies. You can clear or block cookies in your browser; you will be signed out if you do.

9. Children

We do not knowingly collect data from children under 14, and delete it if we find we have.

10. Changes

We post changes here with their effective date and give notice before significant ones.