Privacy Policy

Preamble

Gaia (the “Company”; service name: BaRam) complies with the Personal Information Protection Act of the Republic of Korea and related laws to protect the freedom and rights of data subjects, and processes and manages personal information lawfully and securely. Under Article 30 of the Act, the Company establishes and publishes this Privacy Policy to explain its procedures and standards for processing personal information and to handle related complaints promptly and smoothly.

1. Purposes of processing and personal information processed

2. Processing and retention periods

• Member information: until the member withdraws
• Statutory retention (e-commerce and related laws): contracts and withdrawal of offers 5 years, payment and supply of goods 5 years, consumer complaints and dispute resolution 3 years, labeling and advertising 6 months, electronic financial transactions 5 years
• Service logs: 1 year, for security and incident analysis
• Analytics data: 2 years for statistics and improvement, or anonymized immediately upon withdrawal

Where data is retained instead of deleted under other laws, the basis, items and period of retention are stated, and the data is stored separately.

3. Procedure and method of destruction

• When a reason for destruction arises, the data to be destroyed is selected and destroyed with the approval of the Chief Privacy Officer
• Electronic files: permanently deleted in a way that cannot be recovered
• Documents: shredded or incinerated

Where there is a statutory reason for retention, Section 2 applies, and this section refers to it.

4. Provision of personal information to third parties

None at present (outsourcing for performing the service, such as payment, is disclosed in Section 5). If personal information is provided to a third party in the future, the recipient, purpose, items, retention and use period, and legal basis will be disclosed in detail.

5. Outsourcing of personal information processing

Processors and outsourced tasks

• Toss Payments: payment processing and refunds
• Supabase, Inc.: authentication and database hosting, email verification
• Vercel Inc.: web deployment and log monitoring
• OpenAI OpCo, LLC / Google LLC / Perplexity AI, Inc.: LLM analysis
• Resend, Inc.: sending email (welcome emails, notifications, etc.)

6. Collection and transfer of personal information outside Korea

In connection with the tasks below, personal information may be transferred to, or collected directly in, the United States (cloud and LLM). The Company discloses the matters required by Article 28-8 of the Act and each item of paragraph 2 of that Article.

• Legal basis for the transfer: consent (Art. 28-8(1)1), outsourcing and storage (Art. 28-8(1)3, Art. 26)
• Country of transfer (collection): United States
• Timing and method: from time to time when the service is used, sent over encrypted connections (HTTPS/TLS)
• Recipients: Supabase, Inc. / OpenAI OpCo, LLC / Google LLC / Perplexity AI, Inc. / Vercel Inc. / Resend, Inc.
• Items: member and account information, service usage records and logs, analysis inputs (prompts, keywords, etc.), system metadata
• Purpose: authentication, hosting, log monitoring, AI analysis
• Retention and use period: until the contract ends, the member withdraws, or consent is withdrawn (except statutory retention)
• How to refuse, and the effect: you can refuse by withdrawing consent to the transfer or by withdrawing your membership. Because the core infrastructure and LLMs are located outside Korea, refusing may limit or prevent use of the service (withdraw on the website or app, or ask customer support).

Note: transfers in the form of provision to third parties and outsourcing or storage are disclosed together in this section, while meeting all items each system requires.

7. Measures to keep personal information secure

• Administrative: establishing and implementing an internal management plan
• Technical: encryption, keeping and reviewing access records, security programs
• Physical: document security

8. Possible disclosure of sensitive information and how to keep it private

The service does not currently collect or disclose sensitive information. If sensitive information could be disclosed, for example through information users enter voluntarily, a disclosure warning and a way to keep it private will be provided.

9. Processing of pseudonymized information

The Company does not currently process pseudonymized information. If it processes pseudonymized information for statistics, research or archiving in the public interest, it will disclose the purpose, period, items, third-party provision or outsourcing (if any), and safety measures in detail.

10. Automatic collection devices (cookies, etc.) and how to refuse them

Purpose: keeping you logged in, saving your settings, traffic analysis, security. How to refuse: you can allow or block cookies in your browser or mobile settings (for example, Chrome or Edge incognito or InPrivate windows, or blocking cookies in Safari).

11. Collection of behavioral information by third parties

The Company does not currently allow third parties (such as advertisers) to collect behavioral information through cookies or SDKs. If this is introduced, the name and type of the collection device, the collecting business, the behavioral information items, the purpose and how to refuse will be published in a table.

12. Rights and obligations of data subjects and legal representatives, and how to exercise them

Data subjects may at any time request access, transfer, correction, deletion, suspension of processing or withdrawal of consent (“exercise of rights”); for children under 14, a legal representative exercises these rights. Requests can be made in writing, by phone, email, fax or online, and the Company acts on them without delay. You can request access through the contact page.

13. Automated decisions

BaRam uses automated processing such as AI/LLM-based keyword and brand analysis and 8-axis evaluation. Data subjects may refuse an automated decision, request an explanation, or request a review by submitting an opinion. Unless there is a legitimate reason, the Company replies with its decision within 10 days of a refusal request and, where action is needed, with the result within 30 days. (Exception: where there was prior consent, notice in the contract, or a provision of law, refusal is not accepted and only explanation or review is available.) How to submit: send a written request or email to customer support.

14. Criteria for continued additional use or provision

Where additional use or provision without consent continues within a scope reasonably related to the original purpose of collection, the Company discloses the recipient, items, purpose and retention and use period, together with the criteria used: (1) relevance to the purpose, (2) predictability, (3) whether the data subject’s interests are harmed, and (4) safety measures.

15. Chief Privacy Officer (CPO)

17. Remedies for infringement of rights

• Personal Information Dispute Mediation Committee: 1833-6972 (www.kopico.go.kr)
• Personal Information Infringement Report Center: 118 (privacy.kisa.or.kr)
• Korean National Police Agency: 182 (ecrm.police.go.kr)

18. Personal information of children

The service may not be used by anyone under 14. (Policy: no recruitment or use by children under 14.)

19. How this policy is published and notified

This policy is posted continuously so that it can be found easily from the first screen of the website or app, whether or not you are logged in. When it changes, the changed policy is posted continuously and announced separately. It follows the recommended order of title, preamble, table of contents and body, and provides hyperlinks.