Privacy Policy

English reference translation. If there is any discrepancy, the Korean version prevails.

사색서랍 (thinking.cabinet, the "Company") processes personal information lawfully and manages it securely in compliance with the Personal Information Protection Act and other applicable laws to protect individuals' freedoms and rights. Under Article 30 of the Personal Information Protection Act, the Company establishes and publishes this Privacy Policy to explain its procedures and standards for processing and protecting personal information and to resolve related concerns promptly and effectively. 1. Purposes of Processing and Information Collected (1) The Company collects and uses only the minimum personal information necessary to provide the Services and does not use it for other purposes. The purposes and categories are as follows: 1) Membership registration and management: confirming the intention to register, identifying and authenticating members, maintaining and managing membership, preventing misuse, and sending notices. • Required: email address, password (for email registration), name, nickname and mobile phone number. • Optional: gender, date of birth and address, including detailed address and postal code. • Automatically generated: the date and time of consent to the terms, the IP address at the time of consent, and service usage records. • Addresses will be used for product shipping and delivery of event prizes if the Company's own online store is operated in the future. Until then, addresses are retained only if entered by members. 2) Social login (Naver, Kakao and Google): registration, login and account linking using external accounts. • The Company receives the following information to the extent the individual has agreed to its provision through the external service: - Naver: email address, name, nickname, profile photo, mobile phone number, gender and date of birth. - Kakao: email address, nickname and profile photo. - Google: email address, name and profile photo. - All providers: the external service's user identifier and authentication tokens needed to link accounts. • Received information is prefilled on the registration screen and saved when the individual reviews or edits it and agrees to the terms. 3) Seat reservations, admission passes, multi-visit passes and payments: receiving and confirming reservations, assigning seats, processing payments and refunds, managing pass credits, and sending reservation notices. • Reservation information: visit date and time, seat, number of people, requests and products ordered with the reservation; multi-visit pass purchases and remaining credits. • Cancellation reasons entered when requesting cancellation or refund. • Payment information: payment identifier issued by the payment provider (Toss Payments), payment amount, and date and time of approval or cancellation. • Payment instrument details, such as card and bank account numbers, are processed by the payment provider and are not stored by the Company. 4) Management of reservations received offline, including by telephone: managing seat availability and contacting users about reservations. • Required: name. Optional: contact number and email address. This includes non-members. 5) Email verification and password resets: verifying email ownership and identity when a password is lost. • Email address. 6) Service improvement and statistics: analyzing service usage and developing new services. • Access logs, cookies, service usage records, favorite books, and de-identified gender and age-group statistics. 7) Live inquiries, when provided: receiving and answering inquiries, reviewing inquiry history and providing follow-up support. • Member identifier, message text, send and deletion timestamps, read status, and compressed copies of photos selected and sent by the member. • Original photos and original filenames are not stored. Metadata such as location information is removed from compressed photos. Avoid including unnecessary personal information or another person's personal information in inquiries or attachments. (2) Personal information of children under 14 To protect the personal information of children under 14, the Company allows registration only by persons aged 14 or older and does not collect children's personal information. 2. Processing and Retention Periods (1) The Company processes and retains personal information for the period prescribed by law or agreed to by the individual when the information is collected. (2) The retention periods for each category are as follows: 1) Membership registration and management: until account deletion. However, in the following cases, information is retained until the relevant circumstances are resolved: • If an investigation or inquiry concerning a violation of applicable law is ongoing: until it concludes. • If claims or debts arising from use of the Services remain outstanding: until they are settled. 2) Processing upon account deletion: • Email address, password, name, nickname, mobile phone number, address, profile photo, external account links and login sessions are destroyed immediately upon deletion through irreversible anonymization. • Gender and date of birth are retained for usage statistics in a form that cannot identify an individual. • Records of agreement to the Terms of Service and Privacy Policy and consent to marketing messages, including consent status and timestamps, are retained as evidence of consent and to address disputes after IP addresses have been removed. • Reasons for account deletion, if optionally provided, are retained anonymously to improve the Services. 3) Reservation and payment records: until the reserved visit is completed and payments and refunds are fully settled. Separate transaction evidence is saved automatically upon reservation confirmation or cancellation and payment approval or cancellation. It contains transaction identifiers, products, service dates, amounts, status, cancellation reasons, and the name, email and phone number needed to identify the transaction parties. It remains for its retention period after removal from the operational reservation list or account withdrawal. However, the following records are retained for the periods required by law: • Under the Act on the Consumer Protection in Electronic Commerce, Etc.: - Records of representations and advertising: 6 months. - Records of contracts or withdrawal of offers, payments, and supply of goods or services: 5 years. - Records of consumer complaints or dispute resolution: 3 years. • Service access records under the Protection of Communications Secrets Act: 3 months. 4) Authentication tokens for email verification, password resets and social-login registration: destroyed immediately upon use or expiry of the designated validity period, ranging from 5 minutes to 24 hours after issuance. 5) Login sessions: up to 7 days after login, followed by automatic logout. 6) Live inquiry messages and photos: retained during membership to review inquiry history and provide follow-up support. Upon account deletion, access is blocked and conversations are excluded from the regular administrator inquiry list. Records are deleted by scheduled cleanup after 90 days from account deletion. This is the service's general inquiry retention policy, not a statutory retention period. For messages deleted by their author within 5 minutes of sending, the text is removed immediately and photo access is blocked before the stored file is deleted. Failed photo deletions are retried while access remains blocked. Chats are received as general inquiries. When messages or photos necessary for a booking or cancellation transaction are linked to that booking, only the selected records are retained separately for 5 years from their original record dates. Later messages and the member’s entire conversation are not included automatically. Existing separately retained complaint/dispute records remain subject to their 3-year period, and transaction records to their 5-year period. General inquiries are not automatically classified as statutory records. These retained copies survive regular message deletion and account withdrawal. Only authorized administrators may access them, and access is logged. They are destroyed after their retention period. Transaction parties may request access or copies from the Privacy Officer following identity verification. 3. Procedures and Methods for Destruction (1) The Company destroys personal information without delay when it is no longer necessary, including when the retention period expires or the processing purpose has been achieved. (2) If another law requires continued retention after the agreed retention period has expired or the processing purpose has been achieved, the information is stored separately. (3) Destruction procedures and methods are as follows: 1) Procedure: the Company identifies information eligible for destruction and destroys it with the approval of the Privacy Officer. 2) Method: electronic records are deleted or anonymized so that they cannot be restored. Paper records are shredded or incinerated. 4. Outsourcing of Personal Information Processing (1) The Company outsources the following processing activities to support its operations: • Neon, Inc.: database operation and data storage. • Vercel Inc.: website hosting, image file storage and visitor statistics without personally identifying information. • Upstash: delivery of server-to-server change notifications for live inquiries (conversation identifiers and change sequence numbers, excluding message content and photos). • Resend, Inc.: delivery of notification emails, including email verification and password reset emails. • Toss Payments Co., Ltd.: Toss Payments payment processing and refunds, when online payments are offered. (2) In outsourcing contracts, the Company specifies in writing the prohibition on processing information for purposes other than the outsourced work, technical and organizational safeguards, restrictions on subcontracting, management and supervision of processors, compensation for losses, and other responsibilities under Article 26 of the Personal Information Protection Act. It supervises processors to ensure secure handling of personal information. (3) Changes to outsourced activities or processors will be disclosed through this Privacy Policy without delay. 4-1. Overseas Transfers of Personal Information Due to the nature of the cloud services used by the Company, personal information is stored and processed overseas as follows: • Recipients: Neon, Inc. / Vercel Inc. / Resend, Inc. Contact details are available through the privacy inquiry channels on their respective websites. • Destination country: United States. • Timing and method: transmitted and stored through encrypted communications (HTTPS) when the Services are used. • Information transferred: the categories in Section 1 needed for each outsourced activity. Database storage: all categories. Image storage: profile photos and uploaded images. Email delivery: email addresses and names. • Purpose and retention period: performance of the outsourced activities in Section 4 for the retention periods in Section 2. Individuals may refuse overseas transfers, but this may restrict their use of the Services. Server-to-server change notifications for live inquiries are processed in Upstash's Tokyo, Japan region. Conversation identifiers and change sequence numbers are transmitted over TLS when a notification occurs; message content and photos are not transmitted. These notifications are for real-time delivery and are not stored as conversation history in Upstash. Privacy inquiries may be submitted through the privacy contact channel on Upstash's website. 4-2. Provision to Third Parties The Company processes personal information only within the scope specified in Section 1 and does not provide it to third parties unless the individual separately consents or a specific legal provision permits it. 5. Safeguards for Personal Information The Company implements the following safeguards: 1) Organizational measures: establishing and implementing an internal management plan, limiting the number of personnel handling personal information, and providing training. 2) Technical measures: one-way encryption of stored passwords, hashed storage of authentication tokens, encryption in transit (HTTPS), access control for personal information processing systems with separate administrator privileges, and retention of access logs. 3) Physical measures: access controls at cloud service providers' data centers. 6. Installation, Operation and Rejection of Automatic Collection Technologies (1) The Company uses cookies and automatic collection technologies as follows: • Login session cookies (required): maintain login status and are retained for up to 7 days after login. Blocking these cookies prevents use of login services. • Language preference cookie (optional): stores the user's explicit choice of Korean or English for the browser session. Without a saved choice, the display follows the browser language. It may be removed using the browser's site-data controls. • Visitor statistics (Vercel Analytics): aggregate usage information, such as page views, without identifying individuals. • Browser storage for inquiry recovery (sessionStorage and IndexedDB): pending or failed messages and compressed photos are stored for retry in the same browser. They are cleaned up after successful sending, manual discard, logout or account switching. Stored photos expire 24 hours after their last save and are cleaned up on the next site visit, return to the page, or retrieval. They may also be removed using the browser’s site-data controls. • Address search (Kakao Postcode Service): the script loads only when an address is searched during registration or profile editing. The searched address is stored only by the Company. (2) Cookies are small amounts of information sent by a website's server to a user's browser and stored on the user's computer or mobile device. (3) Individuals may allow or block cookies in their browser settings. Refusing cookie storage may make some services, including login, difficult to use. Desktop browser cookie settings: • Chrome: Settings > Privacy and security > Delete browsing data. • Edge: Settings > Cookies and site permissions > Manage and delete cookies and site data. Mobile browser cookie settings: • Chrome: Settings > Privacy and security > Delete browsing data. • Safari: Device Settings > Safari > Advanced > Block All Cookies. • Samsung Internet: Settings > Personal browsing data > Delete browsing data. 7. Rights and Obligations of Individuals and Legal Representatives (1) Individuals may exercise the following rights concerning their personal information at any time: 1) Request access. 2) Request correction of errors. 3) Request deletion. 4) Request suspension of processing. (2) Members may directly view and edit their profile, link or unlink social accounts, change marketing consent, and delete their account in My Page. (3) Rights under paragraph (1) may be exercised by contacting the Company in writing, by telephone, by email or through other means. The Company will act without delay. (4) When an individual requests correction or deletion of erroneous personal information, the Company will not use or provide that information until correction or deletion is completed. (5) Rights under paragraph (1) may also be exercised through a legal representative or authorized agent. A power of attorney using Form No. 11 attached to the Enforcement Rule of the Personal Information Protection Act must be submitted in such cases. (6) Individuals must not infringe their own or others' personal information or privacy handled by the Company in violation of the Personal Information Protection Act or other applicable laws. 8. Privacy Officer and Remedies The Company designates the following Privacy Officer to oversee personal information processing and address related complaints and requests for redress. Privacy Officer: • Name: 박수진 (Co-representative). • Contact: thinkingcabinet@gmail.com, 010-2944-4455. Business information: • Business name: 사색서랍 (thinking.cabinet). • Co-representatives: 구원준, 박수진. • Business address: 12-1, Songpa-daero 46-gil, Songpa-gu, Seoul, Republic of Korea. • Business registration number: 595-18-02006. • Mail-order business registration number: 2024-서울송파-1985. • Telephone: 010-2944-4455. • Email: thinkingcabinet@gmail.com. Organizations for privacy-related redress: • Personal Information Dispute Mediation Committee: 1833-6972, without an area code (www.kopico.go.kr). • Personal Information Infringement Report Center, operated by the Korea Internet & Security Agency: 118, without an area code (privacy.kisa.or.kr). • Supreme Prosecutors' Office Cybercrime Investigation Division: 1301, without an area code (www.spo.go.kr). • Korean National Police Agency Cyber Safety Bureau: 182, without an area code (ecrm.police.go.kr). 9. Changes to this Privacy Policy (1) This Privacy Policy may be added to, deleted from or amended due to changes in government policies, laws or Company policies. Changes will be announced on the Site. (2) This Privacy Policy first took effect on April 27, 2026, was amended on August 26, 2026, and was revised on September 28, 2026. This revision adds information about messages and photos collected when live inquiries are provided, retention and deletion after 90 days from account deletion, retention of inquiry records linked to transactions, separate transaction evidence, and browser storage used for sending recovery. On September 29, 2026, the processor for online payments and refunds was changed to Toss Payments Co., Ltd. (3) On October 6, 2026, information about the optional session cookie used for language selection was added.