Privacy Policy
Last updated: July 27, 2026
1. Personal Data We Collect
We collect only the information needed to provide saju, compatibility, purchase, and support features.
- Analysis inputs: date and time of birth, birth city, gender, calendar type, MBTI, and Enneagram where provided.
- Social login data: email address and profile name provided by Google, Kakao, Facebook, or Apple. If you use Apple Hide My Email, Apple supplies a private relay address instead of your real one.
- Device-stored contacts: optional relationship records saved by the user in the browser localStorage.
- Notification data: if you opt in to web push, the push subscription (endpoint) issued by your browser.
2. Purposes of Processing
We do not use this data for third-party sale, unrelated marketing, or legally significant automated decision-making.
- Providing saju, MBTI, Enneagram, Zi Wei, and compatibility readings.
- Managing premium purchases and report access.
- Preventing duplicate purchases and handling customer support.
3. Retention and Deletion
- LocalStorage data remains on the user device until the user deletes it.
- SessionStorage cache is cleared when the browser tab is closed.
- Server-side purchase and report data is deleted within 30 days after account deletion or a valid erasure request, except where legal retention is required.
- Retention by category: contract/withdrawal records 5 years, payment and supply records 5 years, consumer complaint/dispute records 3 years (Korea E-Commerce Consumer Protection Act); non-identifying statistical data up to 5 years (see Section 6).
- Destruction procedure: on expiry of the retention period or fulfillment of the purpose, electronic files are deleted by irrecoverable technical means and printed materials are shredded or incinerated.
4. Security
- All server traffic uses TLS/HTTPS.
- Supabase Row Level Security and server-side access checks protect stored data.
- Payment details are processed by payment processors and are not stored on Super Match servers.
6. Non-Identifying Statistical Data Separated from Accounts
To improve the engine and produce statistical insights, Super Match may collect analysis inputs and generated outputs as non-identifying statistical data separated from user accounts.
This data is not linked to a user_id and does not include direct identifiers such as name, email, IP address, or device identifiers. Each record is separated by a random UUID. However, combinations such as birth date/time and birth city could theoretically create re-identification risk, so the data is managed under pseudonymized-data standards and used only for statistics and scientific research for engine improvement.
Retention: raw records are retained for up to five years, then deleted, further de-identified, or retained only as aggregate statistics.
7. Data Subject Rights
You may request access, rectification, erasure, portability, or restriction through the privacy request page or by email at supermatchbyhs@gmail.com. We may verify your identity before processing the request.
8. Children
Children under 14 should use the service only with a guardian’s consent. We do not knowingly collect personal data from children under 14.
For users in the EEA, Article 8 GDPR applies instead: the digital age of consent is set by each member state between 13 and 16, and a guardian’s consent is required below that age.
9. Privacy Contact
Data Protection Officer: Park Hyeongjin (Operator) · Email: supermatchbyhs@gmail.com
Operator: STUDIO Hwagok Super / Contact: supermatchbyhs@gmail.com
Korean users may also contact the Personal Information Dispute Mediation Committee (1833-6972) or the Privacy Infringement Report Center (118) for remedies.
10. Sub-processors and International Transfers
To provide the service we engage the sub-processors below (Korea PIPA Art 26). Where a sub-processor is established outside your country or stores data on overseas servers, your data is transferred internationally (Art 28-8), only as necessary to perform the service and payment contract.
Timing and method of transfer: data is transmitted over the network in encrypted form at the moment you use the relevant feature (generating an analysis, paying, receiving email). We do not perform offline or bulk transfers.
How to refuse a transfer: you may refuse the international transfer of your personal data by notifying us through the privacy request page or at supermatchbyhs@gmail.com. Because the sub-processors below are essential to the service, refusing means the corresponding features may be limited or unusable.
Contact details of each recipient's privacy function are published in that provider's own privacy policy; if you cannot locate them, write to supermatchbyhs@gmail.com and we will point you to them.
- OpenAI (US), Anthropic (US) — Data: birth date/time, birth city, MBTI/Enneagram, consultation questions / Purpose: AI essay and AI consultation generation / Retention: for the time needed to serve the request, plus each provider’s temporary abuse-monitoring retention under its API policy.
- Supabase (US company · server region Tokyo, Japan) — Data: account data, analysis inputs, reports and purchase records / Purpose: database and authentication hosting / Retention: until the processing agreement ends or the periods in Section 3 expire.
- Vercel (US company · server region Seoul, Korea) — Data: access logs, analytics events (where consented) / Purpose: application hosting and analytics / Retention: until the processing agreement ends.
- Resend (US) — Data: email address, delivery records / Purpose: service email delivery / Retention: until the processing agreement ends.
- PortOne (Korea), KG Inicis (Korea), Toss Payments (Korea) — Data: payment identifiers, amounts, payment method data / Purpose: payment processing and verification / Retention: statutory retention periods (see Section 3).
- Sentry (US) — Data: access logs and request metadata captured when an error occurs / Purpose: error monitoring / Retention: until the processing agreement ends.
11. GDPR Rights
Users in the EEA may exercise rights of access, rectification, erasure, portability, restriction, and objection. Non-essential cookies are blocked until opt-in consent.
Lawful bases: providing reports and payment relies on performance of a contract (Art 6(1)(b)); duplicate-purchase prevention, security, and support rely on legitimate interests (Art 6(1)(f)); non-essential cookies, analytics, and statistical-purpose data (Section 6) rely on consent (Art 6(1)(a)).
You may withdraw consent at any time (Art 7(3)) and lodge a complaint with your supervisory authority (Art 77). We respond to rights requests within one month (Art 12(3)).
12. CCPA/CPRA Notice
California residents have the rights to know, delete, and correct their personal information, to opt out of the sale or sharing (cross-context behavioral advertising) of personal information, to limit the use of sensitive personal information, and to non-discrimination for exercising these rights. Super Match does not sell personal information or share it for cross-context behavioral advertising.
Super Match is an entertainment-style saju reading service and is not affiliated with the official MBTI® assessment. It does not replace professional psychological, medical, legal, or financial advice.