This English version is a courtesy translation. If there is any difference from the Korean version, the Korean version prevails.
In accordance with Article 30 of the Personal Information Protection Act, Flow Studio (the "Company") establishes and publishes this Privacy Policy to protect the personal information of data subjects and to handle related complaints promptly and smoothly.
Article 1 (Purposes of Processing Personal Information)
- Receiving and answering inquiries: checking the inquiry, contacting you with an answer, and notifying you of the result
- Receiving and confirming reservation requests: checking your preferred schedule, contacting you, and notifying you of confirmation or cancellation
- Member registration and management: confirming sign-up for users who log in with a Kakao or Google account or sign up by email (including email verification), providing member services, preventing misuse, and handling withdrawal
- Spam prevention: limiting the number of inquiries, reservations, sign-up requests and AI guide questions sent repeatedly in a short time
Article 2 (Personal Information Processed)
- Inquiries (inquiry form): name, contact number and the inquiry. The time you consented to the collection and use of personal information, the version of the consent text, and an encrypted value (hash) of your connection address (the original is not stored and is used only to limit repeated submissions) are also stored.
- Reservations (reservation request): name, contact number, preferred date and time, and requests (optional). The time you consented to the collection and use of personal information, the version of the consent text, and an encrypted value (hash) of your connection address are also stored.
- Member registration (Kakao and Google login): the name provided by the login provider, email (if provided and verified), profile photo (if set), the provider-specific member ID, the times you agreed to the Terms of Service, the collection and use of personal information and being at least 14 years old, and whether and when you chose to receive marketing messages (optional). We do not collect a site-specific password and do not store the provider's login tokens.
- Member registration (email): email, password (stored irreversibly encrypted; the original is never stored), the times you agreed to the Terms of Service, the collection and use of personal information and being at least 14 years old, and whether and when you chose to receive marketing messages (optional). Sign-up information before email verification is completed is kept only for the validity period of the verification link (24 hours).
- Keeping you logged in: a random session ID (cookie) and the creation and expiry times of the session
- AI guide chatbot: the questions you enter are sent to an AI service to generate answers, and the Company does not store questions or answers. To limit usage, only an encrypted value (hash) of your connection address and the daily usage count are stored. Please do not enter personal information.
- Information generated automatically while using the service: IP address, access time, browser type, and cookies (where used)
Article 3 (Processing and Retention Period)
The Company destroys personal information without delay once the purpose of collection has been achieved. However, the following are retained for the periods stated.
- Inquiry records: 1 year (365 days) from the day the inquiry was received
- Reservation records: 1 year (365 days) from the day the reservation request was received
- Member information: until withdrawal (or, where retention is required by law, for that period)
- Login sessions: 30 days from login (deleted immediately on logout or withdrawal)
- Rate-limit records (connection address hash): one day; AI guide usage records: 7 days
- Website access records (logs) under the Protection of Communications Secrets Act: 3 months
Article 4 (Provision of Personal Information to Third Parties)
The Company provides personal information to third parties only in cases covered by Articles 17 and 18 of the Personal Information Protection Act, such as the data subject's consent or special provisions of law. At present, no personal information is provided to third parties.
Article 5 (Outsourcing of Personal Information Processing)
| Processor | Outsourced task |
|---|---|
| Cloudflare, Inc. | Website hosting and storage of inquiry, reservation and member information (Cloudflare D1 database, R2 photo storage) |
| Resend, Inc. | Sending email verification and notification emails |
| Anthropic, PBC | Generating answers for the AI guide chatbot (questions entered by users are passed on) |
In accordance with Article 26 of the Personal Information Protection Act, outsourcing contracts set out in writing the prohibition of processing beyond the outsourced task, security measures, restrictions on re-outsourcing and liability for damages, and the Company supervises whether processors handle information safely.
Article 6 (Transfer of Personal Information Overseas)
To provide the service, the Company uses services that process personal information overseas, as follows.
| Recipient | Country | Items transferred | Time and method | Purpose and retention period |
|---|---|---|---|---|
| Cloudflare, Inc. | Overseas (server location depends on service settings) | Inquiries (name, contact number, inquiry), reservations (name, contact number, preferred date and time, requests), member information (name, email, profile photo, provider-specific ID, consent records), login sessions | Transmitted over the network when the service is used | Site hosting and storage of inquiry, reservation and member information / retention periods in Article 3 (inquiries and reservations: 1 year; members: until withdrawal) |
| Resend, Inc. | Overseas (server location depends on service settings) | Recipient email, verification email content, new inquiry and new reservation notification content (name, contact number, inquiry, etc.) | Transmitted over the network when an email is sent | Sending verification and notification emails / the period needed to process delivery |
| Anthropic, PBC | Overseas (server location depends on service settings) | Questions entered into the AI guide chatbot | Transmitted over the network when a question is sent | Generating answers / not stored by the Company |
If you do not want your information transferred overseas, you can refuse by not using the inquiry form, reservation requests or the AI guide chatbot and by not registering as a member. If you refuse, you cannot use the inquiry form, reservation requests, the AI guide or member services. In that case, you can contact us by phone or email.
Article 7 (Procedures and Methods of Destruction)
Personal information whose retention period has expired or whose purpose has been achieved is destroyed without delay. Electronic files are deleted in a way that cannot be recovered, and paper documents are shredded or incinerated. Information retained under law is stored separately from other information.
Inquiry and reservation records are deleted when a new inquiry or reservation is received after the retention period (1 year from receipt) has passed, and immediately when an administrator deletes them. Member information and login records are deleted immediately upon withdrawal.
Article 8 (Rights and Obligations of Data Subjects and Legal Representatives, and How to Exercise Them)
Data subjects may at any time request access to, correction of, deletion of or suspension of processing of their personal information, and withdraw their consent. Requests can be made in writing, by phone (010-3656-2455) or by email (dltjsdn1125@naver.com), and the Company will act without delay. The legal representative of a child under 14 may exercise the same rights. Members can withdraw by themselves at [My account > Withdraw membership].
Article 9 (Security Measures)
- Administrative measures: minimizing the number of people who handle personal information, and regular checks
- Technical measures: access control (inquiry, reservation and member lists and statistics can be viewed only with the administrator password), encryption in transit (HTTPS), one-way encrypted storage of email sign-up passwords (PBKDF2 with a per-member salt), keeping the login state in a secure cookie that JavaScript cannot read, not storing provider login tokens, and security updates
- Physical measures: access control for servers and data storage locations (including the cloud provider's security system)
Article 10 (Automatic Collection Devices and Refusal)
The Company uses only a session cookie (valid for 30 days) to keep you logged in and does not use cookies for advertising or analytics. You can refuse cookies in your browser settings, but you will not be able to log in if you do.
The Company uses Cloudflare Web Analytics to check visit statistics. This service does not use cookies and only aggregates visit statistics that do not identify individuals (pages visited, browser and device type, country, referral path, etc.).
Article 11 (Data Protection Officer)
- Name: Seonwoo Lee
- Contact: dltjsdn1125@naver.com
Data subjects can report or seek advice on personal information infringement from the following organizations.
- Personal Information Dispute Mediation Committee: 1833-6972 (no area code) (www.kopico.go.kr)
- Personal Information Infringement Report Center: 118 (no area code) (privacy.kisa.or.kr)
- Supreme Prosecutors' Office: 1301 (no area code) (www.spo.go.kr)
- National Police Agency: 182 (no area code) (ecrm.police.go.kr)
Article 12 (Changes to this Privacy Policy)
This Privacy Policy applies from October 18, 2026. If its contents change, we will announce it on the website at least 7 days before it takes effect.