Privacy Policy
Last modified: 2026-08-14
Fuzzyline Studio (hereinafter "the Company") values users' personal information and complies with the Personal Information Protection Act and other applicable laws. This policy describes how personal information collected through the reservation service (hereinafter "the Service") is processed.
1. Personal Information We Process
The Company processes the following information during registration, reservations, payments, and operation of the Service.
- Registration: email address, password, and nickname (display name)
- New reservation: booker name, verified phone number, date/time, venue, theme, party size, and reservation status. A phone number is optional for registration and browsing but required for both member and guest reservations.
- Payment/refund: order ID, amount, method/status, payment key, last four card digits, and refund records
- Guest reservation: guest name and phone number, phone-verification token, and guest reservation access token
- Guest email address (used as a secondary notification channel when provided)
- IP address or its hash, request time/count, User-Agent, and device/browser information
- Authentication cookies and session identifiers, URL/path, referring domain, and UTM data
- Service, reservation, and payment usage; error/performance data; and error-replay data configured to mask text, inputs, and media
- A daily visitor hash, path, acquisition channel, and device type (the first-party traffic table does not store raw IP addresses)
- Google, Kakao, or Naver account identifier and the email, name, or display name supplied by the provider
2. Purposes of Processing
- Account identification, registration, login, account linking, and performance of the service contract
- Reservation intake, confirmation, changes, cancellation, payment, refund, and revenue settlement
- Reservation and service notices by KakaoTalk, SMS, and email
- Identity verification, prevention of abuse or duplicate requests, security, and incident response
- Complaint and dispute handling and customer support
- Traffic and usage statistics and performance/error improvement
- AI chatbot responses, conversation quality improvement, and support-history review
3. Retention Period
The Company generally destroys personal information without delay when its purpose has been fulfilled. Information required by law or reasonably needed for dispute handling is segregated and retained only to the extent necessary.
- Member data: retained during the 7-day restoration grace period after a deletion request, after which account-profile anonymization and Auth-account deletion procedures are carried out.
- Direct guest/non-member contact data: deleted or anonymized 30 days after the applicable reservation cancellation date or service completion date.
- The fact of a reservation, payment/refund records, and revenue/usage statistics may be retained after direct identifiers such as name and contact details are separated or removed, for the statutory period or until the statistical purpose is fulfilled.
- Chatbot messages, session identifiers, and IP hashes: retained while the Service operates or until a user's deletion request is processed for support, quality, and abuse analysis.
- Contract or cancellation records: 5 years
- Payment and supply-of-goods/services records: 5 years
- Consumer complaint or dispute records: 3 years
- Website access records: 3 months where the Protection of Communications Secrets Act applies
4. Disclosure to Third Parties
The Company generally does not disclose personal information to third parties. When a user requests payment in the hosted payment window, the following information is disclosed as necessary to perform the payment contract.
- TossPayments Co., Ltd.: order ID/name, amount, payment method, and, when entered, name and email (payment authorization, settlement, cancellation, refund, and disputes; retained for TossPayments' statutory or contractual period)
5. Processing Entrusted to Service Providers
- Vercel, Inc.: application/serverless hosting, web analytics, and performance measurement
- Supabase, Inc.: database, authentication, and session management
- NURIGO Co., Ltd. (Solapi): KakaoTalk and SMS delivery
- Plus Five Five, Inc. (Resend): transactional email delivery
- Upstash, Inc.: temporary data processing for rate limiting and abuse prevention
- Functional Software, Inc. (Sentry): error/performance monitoring and masked session replay
- Anthropic, PBC: generation of AI chatbot responses
- NAVER Corporation: search-ad traffic and conversion analytics (Naver WCS)
6. Rights of Users and Legal Representatives
A user or legal representative may request access, correction, deletion, suspension of processing, or withdrawal of consent. The Company verifies the requester or authorized representative and responds under applicable procedures and deadlines.
- Access/correction: use "Account Settings" in the Service
- Account deletion: use "Delete Account" (anonymization procedure follows the 7-day grace period)
- Access, deletion, suspension, withdrawal of consent, or deletion of guest/chatbot data: contact contact@fuzzyline.io
- The Company may verify authorization or representation when a legal representative exercises rights.
- A user may ask the Privacy Officer to review a disputed response.
7. Privacy Officer
Name: Taegyeom Kim
Email: contact@fuzzyline.io
Service URL: https://play.fuzzyline.io
8. Security Measures
- Passwords: one-way hashing by Supabase Auth (the Company does not store plaintext)
- Phone numbers, names, and other key personal data: AES-256-GCM encryption at rest
- Phone lookup values: stored separately as HMAC-SHA256 hashes
- Sessions: Supabase Auth tokens are managed through cookie-based sessions with expiry, user verification, and HTTPS
- Access control: role-based authorization and PostgreSQL Row Level Security (RLS)
- Security operations: rate limiting, administrator multi-factor authentication, log review, and restrictions on logging sensitive data
9. Automatic Collection Technologies and Controls
The Company uses cookies, session storage, and analytics tools for login persistence, security, usage statistics, and service improvement.
- Essential authentication cookies/session identifiers: maintain login and verify access to accounts and reservations
- First-party acquisition analytics: processes a daily visitor hash, path, referring domain/campaign, and device type; raw IP is not stored in the analytics table
- External tools: Vercel Analytics/Speed Insights, Naver WCS, and Sentry process anonymous or pseudonymous visit, performance, and error data
- Users may restrict storage or tracking in browser cookie/site-data or advertising settings. Blocking essential authentication cookies may limit login and reservation functions, and security-required server request records may still be processed.
10. Destruction Procedure and Method
Information whose retention period has ended or whose purpose is fulfilled is destroyed so that recovery is impracticable. Statutorily retained data is segregated and access-restricted.
- Electronic files/database values: delete or replace direct identifiers with irreversible anonymous values, and remove encrypted contact data and lookup hashes
- Paper documents, if any: shred or incinerate
- Destroying guest contact data does not remove the reservation/payment/refund fact or revenue statistics; those records are kept without direct identifiers only for statutory or statistical needs.
11. Cross-Border Transfers
The Company uses overseas cloud and tooling necessary to perform the service contract. Data is transferred over encrypted networks when the Service or feature is used. Users may contact customer support about transfers or request discontinuation of an optional feature, but stopping essential hosting/authentication processing may limit the Service.
- Vercel, Inc. (United States and global infrastructure): IP, requests/URLs, browser/device, server error and performance data / hosting, analytics, and performance / real-time network transfer / until contract end or provider retention setting
- Supabase, Inc. (United States; primary data-storage region is Seoul, South Korea): account, profile, reservation, payment, and authentication-session data / database, Auth, and support / real-time network transfer / until contract end or the periods in Section 3
- Plus Five Five, Inc. (Resend, United States): recipient email/name, message, and delivery result / email delivery / transfer when sent / delivery/security logs and contractual retention
- Upstash, Inc. (United States and selected cloud region): limited identifiers derived from IP/user/session and request counts / rate limiting and abuse prevention / transfer on request / rate-window TTL or contractual retention
- Functional Software, Inc. (Sentry, U.S. region): errors, URL, browser/device, and masked replay data / incident and performance analysis / transfer when an error occurs / project retention setting or contract end
- Anthropic, PBC (United States): chatbot messages and minimum service context needed to respond / AI response generation / transfer when a message is sent / API inputs and outputs generally deleted after 30 days, subject to legal, safety-policy, and separate-contract exceptions
12. Changes to This Policy
This policy applies from August 14, 2026. Factual corrections and legally required disclosures that do not reduce user rights may be reflected upon posting. Material changes that expand processing or disadvantage users are generally announced 30 days in advance; other changes are announced 7 days in advance, and separate consent is obtained where required by law. Previous versions are available on request from customer support.