TRIGGER SOFT CO., LTD. (“the Company”) complies with the Personal Information Protection Act, the Act on Promotion of Information and Communications Network Utilization, the Act on the Protection and Use of Location Information, and other applicable laws. This Privacy Policy explains how we collect, use, and protect your personal information.
| Category | Items |
|---|---|
| Sign-up (required) | Email address, password (stored encrypted), date of birth, country/region of residence (to check the minimum sign-up age) |
| Sign-up (optional) | Mobile phone number (to find your account email) |
| Social login | Identifier and email provided by the provider (Kakao, Naver, Google, Apple, Meta (Facebook)); date of birth and country/region of residence entered on first use (to check the minimum sign-up age) |
| Profile (optional) | Nickname, profile image |
| Merchant (store owner) sign-up | Business name, business registration number, representative’s name, business commencement date, manager name/contact/email, settlement payment details |
| Collected automatically during use | Device info (OS, model), IP address, access/usage logs, push token, location data (GPS coordinates and identifiers of nearby access points when store proximity is determined) |
| 1:1 store chat | Message content you enter (including automatic translation) |
| Website contact form (pathwave.link) | Name, email address, message, IP address (abuse prevention) |
| Launch notification sign-up | Email address, preferred platform (iOS/Android), sign-up page |
Collection method: entered directly by the user during sign-up and service use, or generated/collected automatically during use.
In principle, personal information is destroyed without delay once its purpose is achieved, and within 30 days after you delete your account. The following are retained as required by law or as stated below.
| Item | Period | Legal basis |
|---|---|---|
| Contracts, withdrawal of subscription, payment & supply records | 5 years | E-Commerce Act |
| Consumer complaint/dispute records | 3 years | E-Commerce Act |
| Advertising/display records | 6 months | E-Commerce Act |
| Login (access) records | 3 months | Protection of Communications Secrets Act |
| Abuse report handling records | 6 months | Network Act |
| Age-check refusal records (device identifier and time) | 24 hours (destroyed when the re-entry lock ends) | Internal policy (prevents re-entering a different date of birth) |
| Sign-up information left incomplete after social login (social login identifier, email, etc.) — country/region and date of birth not entered | 72 hours (then destroyed; excludes accounts that already have usage records — see Section 10) | Internal policy (minimal retention of unfinished sign-ups) |
| Irreversibly transformed values of the email address and social login identifier, and the date on which the required age is reached, of a member who deleted the account while it was suspended for being below the required age (date of birth and country/region of residence are deleted at deletion) | Until the member reaches the required age | Internal policy (prevents avoiding the age limit by deleting the account and signing up again) |
| Website inquiries | 1 year after reply | Internal policy |
| Chat messages | 3 years from when they were written (then deleted) | Internal policy (handling disputes and reports) |
| Launch notifications | Upon unsubscribe, or within 90 days after the launch email | Internal policy |
When you delete your account, your member information such as nickname, date of birth and contact details is deleted after 30 days, after which your remaining chat messages can no longer be linked to you. Chat message text is kept for 3 years from when it was written to handle disputes and reports, and then deleted; records that the law requires us to keep are kept for the periods in the table above. A deleted account cannot be restored.
The Company does not provide personal information beyond the scope stated in this policy, except: (i) when you give explicit prior consent, or (ii) when required by law or by lawful request of investigative authorities.
Merchant business verification — at merchant sign-up, when applying for the free trial, and when business details are changed, we check as follows.
| Recipient | Items | Purpose | Retention |
|---|---|---|---|
| National Tax Service of Korea (Public Data Portal “Business Registration Authenticity and Status” service) | Business registration number, representative’s name, business commencement date | To confirm the registration is genuine and the business status (active, suspended or closed) | We keep only a summary of the result (match and business status) with the member’s account |
The Company consigns the following processing tasks. The consignment contracts stipulate the matters necessary for safe processing under applicable laws. Automatic translation is first processed on translation servers that the Company operates itself in Korea; text is sent to the translation providers below only for languages those servers do not support or when they cannot process it.
| Consignee | Task |
|---|---|
| NAVER Cloud Corp. | Server and database operation, data storage |
| Google LLC (Firebase) | Push notifications, Google and Apple sign-in |
| Google LLC (Google Cloud Translation) | Automatic translation of chat/content |
| DeepL SE | Automatic translation of chat/content |
| Google LLC (Google Workspace) | Sending verification codes and notice emails |
| Toss Payments Co., Ltd. | Store (merchant) fee payments, settlement, and refunds |
In short
To provide the service (performance of our contract with you), the Company consigns or stores personal information with the overseas providers below (Personal Information Protection Act, Article 28-8(1)(iii)).
| Recipient (contact) | Country | Items | Purpose | Timing and method | Retention |
|---|---|---|---|---|---|
| Google LLC — Google Cloud Translation (support.google.com/cloud/contact/dpo) | United States | Chat messages and store content to be translated | Automatic translation | Each time translation is needed, over an encrypted connection (HTTPS) | Processed only temporarily while translating and not stored (Google Cloud Translation data usage notice) |
| DeepL SE (privacy@deepl.com) | Germany | Chat messages and store content to be translated | Automatic translation | Each time translation is needed, over an encrypted connection (HTTPS) | Under the DeepL API Free terms that the Company uses, DeepL may store the translation request; the terms set no storage period |
| Google LLC — Firebase (support.google.com/cloud/contact/dpo) | United States | Push token and notification content; Google/Apple sign-in identifier, email, name, profile photo | Push notifications, sign-in | At sign-in and when a notification is sent, over an encrypted connection (HTTPS) | Push tokens are deleted immediately on account deletion; Google/Apple sign-in information is deleted 30 days after account deletion |
| Google LLC — Google Workspace (support.google.com/cloud/contact/dpo) | United States | Email address, verification code and notice email content | Sending emails | When an email is sent, over an encrypted connection (TLS) | 3 years from sending (then deleted automatically) |
| Meta Platforms, Inc. (contact route in Meta’s Privacy Policy — facebook.com/privacy/policy) | United States | Your Facebook access token (to confirm the login) when you sign in with Facebook, and the Facebook identifier, name, email and profile picture received with it | Confirming Facebook login and identifying the member | Sent over encrypted connections (HTTPS) when you sign in with Facebook | The Company does not store the token; retention by Meta follows Meta’s Privacy Policy |
| OpenStreetMap Foundation (privacy@osmfoundation.org) | United Kingdom (OSMF and the delivery networks it uses) | Your device’s IP address, app information (User-Agent), and the map-tile location around the store you are viewing (your own location is not sent) | Showing the map on a store’s detail screen | When you open a store’s detail screen, your device requests map tiles directly over an encrypted connection (HTTPS) | The Company does not keep it; retention by OSMF follows the OSMF Privacy Policy (osmfoundation.org/wiki/Privacy_Policy) |
If you do not want your information transferred overseas, do not use the feature concerned or contact the Privacy Officer (Section 11). In that case — automatic translation: store chat and menu translation will not be available; push notifications: if you turn off notification permission on your device, you will not receive notifications; Google/Apple sign-in: you can sign up by email or with another social login (Kakao, Naver, Facebook); email: you cannot sign up or verify by email and can sign up only with a social login; map: the map cannot be shown on a store’s detail screen (you can still see the address and open it in an external map app).
You may at any time request access, correction, deletion, or suspension of processing, or withdraw consent (account withdrawal). Use Settings > Account in the app, or contact the Privacy Officer below. For deletion without the app, see the Account Deletion page.
The service is not directed to children under 14. The minimum sign-up age follows the standard of the country/region of residence you enter, and no one under 14 may sign up in any country or region (residents of the Republic of Korea: 14 or older). For both email sign-up and social login, we check your date of birth and country/region of residence and do not allow sign-up below the required age. If sign-up is refused for this reason, the date of birth and country/region you entered are not stored, and any account being created through social login is deleted immediately. If you do not enter your country/region and date of birth after social login, the sign-up information being created is destroyed after 72 hours. However, a social login account that already has usage records (such as favorites or chats) from before sign-up was completed is not deleted immediately or destroyed after 72 hours; if it is found to be below the required age, it is suspended in the same way as an existing member's account, and the date of birth and country/region of residence entered are recorded. If an existing member is found to be below the required age, the account is suspended and can be used again once the member reaches that age. The member may still delete the account while it is suspended. If an account is deleted while suspended, we keep only irreversibly transformed values of the email address and social login identifier and the date on which the member reaches the required age, until that date, so that the age limit cannot be avoided by signing up again with the same account; the date of birth and country/region of residence are deleted when the account is deleted. The Company does not allow sign-up below the required age on the basis of parental or legal guardian consent. The app store content rating also helps restrict younger users.
For privacy-related complaints, you may contact Korea’s Personal Information Dispute Mediation Committee (kopico.go.kr, 1833-6972) or the Privacy Infringement Report Center (privacy.kisa.or.kr, 118).
Any additions, deletions, or modifications to this policy will be announced within the service at least 7 days before they take effect.