Effective Date: November 3, 2026
Article 1 (Purposes of Processing, Items Collected, and Retention Periods)
① In accordance with Article 31 of the Personal Information Protection Act, Baerae Co., Ltd. (hereinafter the "Company") informs users of its procedures and standards for processing personal information, and collects and processes users' personal information for the following purposes.
② Users' personal information will not be used for any purpose other than those set forth below. If the purposes or items of use change, the Company will take necessary measures, such as obtaining separate prior consent from users in accordance with Article 18 of the Personal Information Protection Act.
③ The Company processes and retains personal information within the processing and retention period prescribed by law or the period consented to by the user at the time of collection.
1. Personal information processed with the consent of the data subject
| Category | Purpose | Items | Retention and Use Period |
|---|---|---|---|
| Member registration and management | Identity verification, conclusion and performance of the service agreement, prevention of fraudulent use, customer support | Email address, social login identifier (Kakao, Google, Apple, etc.), phone number, passkey credentials, records of misuse, information generated during customer support | Until account deletion or withdrawal of consent (or for the period required by applicable law, if retention is required) |
| Digital asset inquiry service | Integration with digital asset exchanges and provision of asset status inquiry services | Digital asset exchange name, access token information (token issue time, validity period), exchange connection status (connected or not, scheduled expiry) | Until account deletion or withdrawal of consent (or for the period required by applicable law, if retention is required) |
| Marketing | Providing information on events and promotions and offering benefits | Marketing consent status, email address, social login identifier (Kakao, Google, Apple, etc.), phone number | 1 year from the end date of the event |
2. Methods of Collecting Personal Information
The Company collects users' personal information through the following methods to provide the service.
- Information entered directly by users for member registration and use of the service
- Social login identifiers and profile information received from third-party services consented to by the member
- Information collected or generated during consultations and complaint handling
- Collection through online and offline events, surveys, etc.
- Information automatically collected in the course of using the service
④ Information such as digital asset transaction histories retrieved or generated through the service is not transmitted to or stored on the Company's servers, and is stored only on the user's device (app). Such information is not transmitted to external servers and is deleted from the device immediately when the app is deleted.
⑤ Notwithstanding Paragraph 3, the Company may retain the relevant personal information until the following grounds cease to exist.
- Where an investigation, inquiry, or judicial proceeding regarding a violation of applicable law is in progress: until the proceeding is concluded
- Where claims, debts, or settlements arising from the use of the service remain outstanding: until such claims, debts, or settlements are resolved
- Where litigation or dispute proceedings are in progress: until such proceedings are finalized or concluded
- Where other laws require personal information to be retained for a certain period: for the period prescribed by such laws
Article 2 (Provision of Personal Information to Third Parties)
In principle, the Company does not provide users' personal information to third parties, except in the following cases.
- Where the user has given separate prior consent
- Where special provisions exist in law, or where there is a lawful request from a relevant authority such as an investigative or supervisory agency
- Where the data subject or their legal representative is unable to express their intention, or prior consent cannot be obtained due to an unknown address or similar reasons, and the provision is clearly deemed necessary to protect the imminent life, body, or property interests of the data subject or a third party
Article 3 (Entrustment of Personal Information Processing)
① The Company may entrust part of its personal information processing to external specialized companies for smooth service provision, and currently entrusts personal information processing as follows.
| Trustee | Entrusted Tasks |
|---|---|
| Google LLC | Operation of cloud servers and data storage for service provision |
| Google LLC | Analysis of service usage records and preparation of statistics |
② The Company transfers personal information collected from users overseas as follows, in accordance with Article 28-8(1)(3) of the Personal Information Protection Act (entrustment of processing and storage for the performance of a contract). To refuse the overseas transfer of personal information while using the service, you may download and install the browser add-on for your current web browser at tools.google.com/dlpage/gaoptout to opt out of Google's processing of information.
- Recipient and contact: Google LLC (https://analytics.google.com/)
- Destination country: United States
- Date, time, and method of transfer: Transmitted over the network when visitors use the service on the website
- Personal information transferred: Cookies, device and browser data, IP address, site/app activity (no personally identifiable information is transmitted)
- Recipient's purpose of use: Statistical measurement of user interactions, storage of user and event data
- Retention and use period: 14 months
③ When concluding an entrustment agreement, the Company specifies in the contract or other documents, in accordance with Article 26 of the Personal Information Protection Act, matters regarding the prohibition of processing personal information for purposes other than performing the entrusted tasks, technical and administrative safeguards, restrictions on re-entrustment, management and supervision of the trustee, and liability such as compensation for damages, and supervises whether the trustee processes personal information safely. If the trustee changes, the Company will post the name of the new trustee on the Privacy Policy page.
④ The entrusted tasks and trustees may change, and any changes will be announced through this Policy or a separate notice.
Article 4 (Procedures and Methods for Destroying Personal Information)
① The Company destroys personal information without delay when it is no longer needed, such as when the retention period has expired or the purpose of processing has been achieved.
② The Company selects the personal information for which grounds for destruction have arisen and destroys it with the approval of the Data Protection Officer.
③ Personal information recorded and stored in electronic files is deleted using methods that prevent the records from being recovered or reproduced, and personal information recorded and stored in paper documents is destroyed by shredding or incineration.
④ Where personal information must continue to be retained under other laws, it is stored and managed separately from other personal information. In this case, the legal basis, items, and period of retention are described in Article 1.
Article 5 (Rights of Users and How to Exercise Them)
① Users may at any time request access to, correction, deletion, or suspension of processing of their personal information, and may withdraw any consent they have given.
② Users may request to unlink their accounts, delete their accounts, or withdraw consent to receive marketing communications through the in-app settings, the customer center, or other methods provided by the Company.
③ The data subject's rights to request access and suspension of processing may be restricted under Article 35(4) and Article 37(2) of the Personal Information Protection Act.
④ Requests for correction or deletion of personal information cannot be made where other laws specify such personal information as subject to collection.
Article 6 (Measures to Ensure the Security of Personal Information)
① The Company takes the following administrative, technical, and physical measures to ensure the security of personal information.
- Administrative measures: Establishment and implementation of personal information protection guidelines, operation of a dedicated organization, regular employee training
- Technical measures: Management of access rights to personal information processing systems, installation of access control systems, encryption of personal information, installation and updating of security programs, access control through internal and cloud firewalls
- Physical measures: Operation of personal information processing systems through information security-certified cloud services, access control to office spaces, control over the removal and introduction of auxiliary storage media
② The Company implements measures such as access rights management, establishment of an internal management plan, retention of access records, encryption, operation of security programs, and minimum access control for authorized personnel.
Article 7 (Installation and Operation of Automatic Collection Devices such as Cookies)
The Company may use cookies or similar technologies to provide users with more convenient services. Users may refuse the storage of cookies through browser or device settings as described below, but in this case, the use of some services may be restricted.
▶ How to block cookies in web browsers
- Chrome: Select '⁝' at the top right of the web browser > New Incognito window (shortcut: Ctrl+Shift+N)
- Edge: Select '‧‧‧' at the top right of the web browser > New InPrivate window (shortcut: Ctrl+Shift+N)
▶ How to block cookies in mobile browsers
- Chrome: Select '⁝' at the top right of the mobile browser > New Incognito tab
- Safari: Device Settings > Apps > Safari > Advanced > Block All Cookies
- Samsung Internet: Select the 'Tabs' icon at the bottom of the mobile browser > Turn on Secret mode > Start
Article 8 (Collection, Use, and Refusal of Behavioral Information)
① The Company collects and uses behavioral information in the course of service use to provide data subjects with optimized personalized services and benefits, online personalized advertising, and the like.
② The Company collects behavioral information as follows.
| Behavioral Information Collected | Collection Method | Purpose of Collection | Retention Period and Subsequent Processing |
|---|---|---|---|
| Records of users' access to the web/app service and usage records such as clicks (app version, country, region, mobile carrier, device information, device operating system, device language setting, etc.) | Automatically collected and transmitted through a data collection tool for key actions performed within the user's web/app | Service quality improvement and statistical purposes | Retained until the purpose is achieved, then deleted |
③ The Company collects and uses advertising identifiers in its mobile app for online personalized advertising. Data subjects may block or allow personalized advertising in the app by changing the settings on their mobile device.
- Android: Settings → Privacy → Ads → Reset advertising ID or Delete advertising ID
- iPhone: Settings → Privacy → Tracking → Turn off 'Allow Apps to Request to Track'
※ Menus and methods may vary slightly depending on the mobile OS version.
Article 9 (Data Protection Officer and Contact Information)
① The Company has designated a Data Protection Officer to take overall responsibility for personal information processing and to handle user inquiries, complaints, and requests for remedies related to personal information.
② Inquiries, complaints, and requests for remedies related to personal information may be directed to the officer above.
Article 10 (Remedies for Infringement of Rights)
① The Company guarantees data subjects' right to self-determination over their personal information and strives to provide consultation and remedies for damages caused by personal information infringement. If you need to make a report or seek consultation, please contact the department below.
| Service | Privacy Department | Phone | |
|---|---|---|---|
| ZKAP | Information Security Team | 010-4306-0030 | privacy@baerae.com |
② If you require relief or consultation regarding personal information infringement, you may contact the following organizations.
Personal Information Infringement Report Center (operated by Korea Internet & Security Agency)
Website: privacy.kisa.or.kr · Phone: 118 (no area code)
Personal Information Dispute Mediation Committee
Website: www.kopico.go.kr · Phone: 1833-6972 (no area code)
Supreme Prosecutors' Office
Website: www.spo.go.kr · Phone: 1301 (no area code)
National Police Agency Cyber Investigation Bureau
Website: ecrm.cyber.go.kr · Phone: 182 (no area code)
Article 11 (Changes to the Privacy Policy)
When the Company amends this Privacy Policy, it will continuously disclose the timing of the changes and their effective date, as well as the amended content, and will publish a comparison of the before and after versions so that users can easily review the changes.
Addendum
This Privacy Policy is effective from November 3, 2026.