Privacy Policy

Optional place-page completion email: when you select the notification option while requesting a new place page, we use your signed-in account email and the public place-page link to send a service notification through Resend after successful preparation, even if you leave the page. Opening an existing page does not trigger this email. We do not track whether you left the page or add email-open tracking pixels. The option is kept only in this browser tab for sign-in continuation. No separate completion-email contact list is created; account and provider retention periods described below apply. Page creation is not a reservation.

Map-link journey measurement: we count fixed stages for searches, candidate confirmation, booking-product checks, sign-in continuation, page preparation and arrival at the foreign-language place screen. Only a fixed stage and time are stored in the existing Supabase experiment-event table for up to six months under the existing cleanup. We do not store search text, map links, Place IDs, account or session IDs in these events or join events into individual journeys. Local and preview environments, signed-in master accounts, Do Not Track and Global Privacy Control are excluded. An optional tab-only destination-path and timestamp marker expires after two minutes and is consumed on arrival; it is never sent with the event. These aggregate counts cannot measure individual drop-off or conversion rates.

Account: Google account identifier, email, name, age-14-or-older confirmation, Terms version, consent timestamps, initial use intent (store owner or traveler), and an optional self-reported discovery channel.

Reservation: visitor name, phone number, confirmation email, optional messenger contact, optional requests and venue-required additional answers (including a name or agreement confirmation when requested), selected store and service, party size, date, time, selected interface language, status, and Naver reservation identifier.

Visit feedback: whether the visit occurred, whether the store found the reservation, optional reason for a missed visit, NOpenBook and store ratings, optional service and store comments, an optional traveler-selected country code, submission time, and optional consent time and version for featuring the NOpenBook comment and selected country flag as an anonymous testimonial.

Feedback invitation measurement: invitation identifier, assigned email version, and first timestamps for sending, email-link requests, login requirements, authenticated form views, form starts, submission, and unavailable-link reasons. No additional contact details, IP addresses, device identifiers, or feedback text are stored in these measurements. The same customer receives the same version; only aggregate counts are shown in the experiment report. We do not add email-open tracking pixels.

Public store content: store details, business photos, and up to 20 recent Naver visitor-review excerpts may be stored for the public store page. Reviewer names, profile identifiers, and profile images are not imported; email addresses, phone numbers, and messenger identifiers found in review text are masked before storage.

Payment and service records: payment identifier, product, amount, status, Credit balance and ledger. Manual booking requests record the selected service, preferred date and time, party size, sharing consent and request status; authorized support staff use the account email to respond and send a quote. Request details are deleted six months after the preferred visit date. Manual reservation quotes also include item names, unit prices, quantities, venue payments, service fees, onsite balances, cancellation terms, expiry, acceptance time, and verified payment/refund status. Complete card numbers are handled by payment providers and are not stored by NOpenBook.

Public discovery measurement: to improve language support, we count the first Home or public Explore visit per browser tab and explicit language-menu changes. Vercel derives an approximate connection country or region from the network request; this is not nationality and may reflect a VPN or travel location. We store only the country code (or unknown), interface-language code, fixed event type and event time in the existing Supabase database for up to six months, using the existing event cleanup. We do not store IP addresses, precise location, account or session identifiers, visited URLs, referrers, contacts or reservation details in these events, or link them to accounts or bookings. A boolean session-storage marker prevents repeat first-visit counts in the same tab; it is not sent to the server. Signed-in master accounts, local and preview environments, and Do Not Track or Global Privacy Control requests are excluded. Browser storage restrictions or failed requests may cause missing counts. Only administrators can see aggregate reports.

Owner pricing measurement: we count predefined entry positions, registration-page views, visible pricing tables, selected plans, checkout-page views and payment-window attempts to improve the owner journey. Only the fixed event label and time are stored for up to six months in the existing database. No account or session identifier, contact details, full URL, referrer, IP address or device identifier is added to these event records. Signed-in master accounts, local previews and Do Not Track requests are excluded. We separately report aggregate verified payment records without linking them to browsing events.

Technical records may include IP address, browser, device, access time, security logs, and first-party cookies used for authentication, A/B assignment, and daily visitor counting. Daily counts use a random browser identifier that is converted to a one-way, date-specific hash before database storage; visited paths, account IDs, and the original identifier are not stored with the count.

Map-link matching: we process the Google Maps place link you submit and an optional place-name or branch search to suggest existing public NOpenBook stores. We read place-name hints from the link and may open the same public place in Korean using an unsigned-in search browser to read its name and address. We do not use the Google Places API or treat suggestions as verified venue identity. Short links are resolved by a server request to Google, which receives the short-link identifier and the server network/request metadata, not your account identifier, contact details or reservation data. Search text is processed only for the current request and is not saved. Links are not retained except for limited failure diagnostics described in Section 15. Only our existing public store catalog is cached for five minutes. You compare the name and address and choose a place before navigating. Searching does not create a reservation or a new store. When no existing candidate matches, or you choose Naver search, the business name, branch and area query are sent over HTTPS to NAVER Corporation through NAVER API HUB, operated by NAVER Cloud Corporation (both in the Republic of Korea), for Local and Web Search. We may also use a separate NOpenBook search process to read public Naver Maps search results and selected place and booking pages over HTTPS. This process receives a business query, a public Google place URL with share-tracking parameters removed, or the selected public Place ID, name and address. It does not receive your account, contact or reservation information. Google receives the public place URL and server/browser request metadata when the Korean place page is opened. The search process does not retain page contents or log submitted links. It uses an unsigned-in browser and does not share reservation-engine sessions. Public place identity and available booking products are checked before proceeding; a failed lookup is not proof that reservations are unsupported. NAVER and NAVER Cloud receive the query and server request metadata for search delivery and API operation, not your account, contact or reservation information, and process requests under their respective privacy policies. Search results are used transiently without a new NOpenBook search log or database record. Only after you confirm a location and sign in does the existing place-registration workflow run; the selected Naver link may be held in browser session storage for sign-in and removed after successful registration. After you choose to continue, a confirmation timestamp in this tab permits resuming registration once when you return from sign-in within 15 minutes; expired confirmation is discarded and the link remains available for manual retry. Optional Google location previews or map links send the public venue coordinates or address and browser request metadata to Google when opened, under the Google processing terms in Section 6. Opening a Naver Map search link sends the public business name and address and browser request metadata to NAVER to display search results; this does not register a place or make a booking.

We use information to create and secure accounts, route new users to the relevant first-use flow, understand aggregate acquisition channels, submit and manage reservations, localize reservation notices and public store content including review excerpts, present public store information, send reservation confirmations, pre-visit reminders, post-visit feedback requests, and subscription-expiry service notices with aggregate booking-language counts, improve reservation and store-discovery experiences from feedback, feature a founder-reviewed NOpenBook comment and optional selected-country flag as an anonymous testimonial only with optional consent, prepare manual reservation quotes, process Credits and payments, prevent fraud, support customers, resolve disputes, comply with law, maintain service security, measure daily service use, and compare landing-page messages and post-visit feedback invitation formats. We also link newly submitted feedback to its reservation and account to award one Booking Credit per booking and prevent duplicate rewards; the reward does not depend on ratings or testimonial consent. We link successful traveler-submitted place registrations to the submitting account and a service Credit ledger entry to award one Booking Credit per new place and prevent duplicate rewards.

Manual booking inquiries connect your account to the selected store and service, preferred date and time, party size, sharing-consent timestamp and request ID. We use your existing account email to reply. Inquiry details are deleted six months after the preferred visit date or when you delete your account. Master test inquiries are marked separately and excluded from customer inquiry lists by default. Submitting an inquiry does not create a booking or payment.

Account identifiers and profile data are kept until account deletion. When an account is deleted, sign-in identifiers and profile data are removed or irreversibly replaced so the account can no longer be accessed.

Reservation names, phone numbers, email addresses, messenger contacts, and requests are deleted or anonymized six months after the reservation date for completed, failed, or cancelled reservations. Masked name, phone suffix, and masked email may be retained for customer support and dispute matching for up to three years, after which those hints are also deleted.

Submitted visit feedback and testimonial-consent records are retained for up to three years after submission and deleted sooner when a valid deletion or consent-withdrawal request applies. Unsubmitted feedback invitations expire after 30 days and are automatically removed after an additional 30 days.

Feedback invitation assignment and linked measurement timestamps are cleared after 30 days from sending (or creation if unsent). Aggregate invitation counts contain no invitation or account identifiers and are retained for up to six months. Existing feedback and consent retention remains unchanged.

Imported review excerpts are replaced when store content is refreshed and are removed when the public store page is removed or a valid correction or deletion request is completed.

A/B assignment and anonymous visitor cookies remain for up to 30 days. Date-specific visitor hashes remain for up to three days, while anonymous daily counts and A/B event totals remain for up to six months.

Unaccepted and unpaid manual reservation quotes are deleted after six months. Accepted quote, payment, and refund records are retained for five years. Account sign-in/profile identifiers are removed or irreversibly replaced on deletion while required transaction records are retained separately.

Contract, payment, and service-supply records are retained for five years; customer complaint and dispute records for three years; and display or advertising records for six months where Korean e-commerce law applies.

Recipient: the store selected by the customer and Naver Booking. Purpose: submitting, confirming, changing, and supporting the requested reservation. Fields: visitor name, phone number, optional messenger contact, confirmation email, optional requests, selected service, party size, date, and time.

The selected store and Naver retain information under their own policies and legal obligations. Consent is requested before each reservation submission because the recipient store changes by reservation. Refusing consent prevents submission of that reservation. We do not sell personal information.

Google processes account authentication and Maps requests; Supabase hosts account, reservation, and transaction data; Vercel hosts and delivers the web service; ngrok relays the optional HTTPS place-discovery connection. During place matching, public candidate names and business addresses may also be sent to OpenAI for English display before page creation. These translations do not change the source place identity or booking data. OpenAI translates masked public store text and imported review excerpts and generates review summaries; Resend delivers reservation, store, and subscription-service notification email; PortOne and the selected payment provider process payments; Discord also delivers manual booking intake alerts containing only a request identifier and an authenticated administrator inbox link. Discord delivers restricted operational error alerts containing a reservation identifier, error details, and masked name, phone, and email. Store-configured notification providers may deliver reservation notices to that store.

Processors may use only the information necessary for their assigned service and retain it for the service term or applicable legal period. Messenger contacts, customer requests, and complete contact details are not included in Discord alerts. Complete card numbers are not stored by NOpenBook.

ngrok, Inc. (United States and global infrastructure/subprocessor locations): when the HTTPS discovery connection is enabled, public business names, branch and area search terms entered directly or read from map links, normalized Google place URLs/identifiers, candidate names and addresses, public booking-product details, service authentication headers and server connection metadata pass through ngrok to connect our web service to the search server. Visitor account identifiers, contact details, reservation requests and payment data are not sent through this search connection. NOpenBook disables local HTTP inspection and does not enable full request/response capture. ngrok may retain connection/security metadata for service operation, security and legal purposes under its policies; disabling inspection does not mean no provider metadata retention. Successful search candidates are reused only in search-server memory for up to 30 seconds (maximum 64 entries), then removed or lost on restart. Google place readings and booking-product results are shared only while the same lookup is running, without a completed-result cache or a new database search-history table.

Public business websites: after a place is selected, our server may read a limited number of public pages to locate and verify its Naver place or booking link. Website operators receive the public page URL and our server connection metadata when fetched; operator locations and metadata retention vary by website. We do not forward visitor cookies, account identifiers, contact details, or reservation requests. Source pages are processed transiently without a new search-history database. Google LLC (United States and Google's global server locations): Google account identifier, email, name, and Maps request data such as IP address, browser, and device information are transferred over an encrypted network when you sign in or load a store map, for authentication and map delivery. Google also receives the submitted short-link identifier and server request/network metadata when our server resolves a Google Maps short link for place matching. For Korean place lookup, Google also receives the public place URL without share-tracking parameters and request metadata from an unsigned-in search browser during the current lookup. Google retains this information under its privacy policy and account controls.

Supabase, Inc. (the AWS region selected for the NOpenBook project) and Vercel Inc. (United States and locations used by its infrastructure and subprocessors): account, reservation, payment-record, IP, browser, and service-log data are transferred over encrypted networks while the service is used, for database hosting, authentication, web delivery, security, and support. For public discovery measurement, Vercel provides the approximate connection country code; this code, interface language, event type and time are transferred to Supabase at the measured visit or language change for aggregate language-support analysis, with the same processor locations and up-to-six-month event retention. NOpenBook applies the retention periods in Section 3; providers may retain service records for the service term or a legally required period.

OpenAI, L.L.C. (United States and authorized processor locations): masked public store text and imported review excerpts are transferred over an encrypted network when translations or review summaries are generated, for machine translation and summary generation. The Chat Completions API does not retain application state; by default, abuse-monitoring logs may retain prompts and responses for up to 30 days, unless longer retention is legally required or reasonably necessary to prevent harm.

Plus Five Five, Inc., operating Resend (United States): recipient email, name, email metadata, and confirmation or notification content are transferred over an encrypted network when a service email is sent. Resend processes the data to deliver email during the service agreement and states that customer data is deleted within 90 days after account termination, unless law requires longer retention.

Discord Inc. (United States and other countries where Discord operates): reservation identifier, error details, and masked name, phone, and email are transferred over an encrypted network when an operational error alert is sent; for manual booking intake alerts, only the request identifier and administrator inbox link are transferred at intake or delivery retry. The information is retained under Discord's data-retention policy or until the restricted alert is deleted. Full contact details, messenger contacts, and customer requests are not transferred to Discord.

PortOne SG Pte. Ltd. (Singapore and authorized processor locations) and the selected payment provider: payment identifier, product, amount, status, and information entered in the payment window are transferred over an encrypted network when payment is requested or verified, for payment processing, reconciliation, refunds, fraud prevention, and legal compliance. They retain information for the service term or applicable payment and transaction retention period. NOpenBook does not store complete card numbers.

You may decline optional features, but refusing a transfer required for sign-in, reservation email, operational processing, or payment can make that feature unavailable. Contact support@weallfine.com to exercise applicable rights or ask about the current processor location.

Store pages may load Google Maps automatically. When loaded, Google may receive IP address, browser, device, and request information under Google's own privacy policy.

You may request access, correction, deletion, suspension, withdrawal of consent, or account closure through the Account page or customer support. Store-owner accounts require support review so store ownership and active service records can be transferred or closed first. Legally retained transaction records are separated and used only for the required purpose.

NOpenBook account registration is not available to children under 14. We do not intentionally collect their account or reservation information without a verified legal-representative consent process.

We use access controls, service-role separation, encryption in transit, restricted administration, and logging appropriate to the information handled. Operational error alerts use reservation identifiers, error details, and masked contact information; full contact details, messenger contacts, and customer requests are excluded. Material Policy changes will be announced before taking effect.

Controller: Weallfine Inc. / Privacy contact: Yoongeon Kim / support@weallfine.com / +82 10-3075-8205 / 505-U237, 66 Gimpo Hangang 9-ro 75beon-gil, Gimpo-si, Gyeonggi-do, Republic of Korea

Reservation routing: an internal operating-account alias and submission-start time are linked to the reservation to use the same account for booking and cancellation and prevent duplicate submissions. This server-only service record is deleted with the reservation under the existing five-year service-record lifecycle, except applicable legal holds. Account display names and enabled status are held in the restricted operating-account registry for its registration term. Naver login cookies and a one-way account-identity fingerprint remain on the operating Mac until replaced or the account is retired; they are not included in customer-facing responses, analytics, or alerts. Supabase stores the routing and registry data in the location described in Section 6; no new recipient of visitor contact data is introduced.

This feature concerns NOpenBook operating accounts, not customer passwords. The administrator can add an operating account by entering its ID and password together. The browser encrypts both for the registered Worker, binding each encrypted setting to its account alias. The server receives no plaintext ID or password. Account-specific login requests, their latest result, masked ID hints, and saved-session status/check times are visible only to master administrators. The same restricted console shows linked reservation identifiers, stores, reservation times, and statuses without customer contact details. At a master administrator’s request, the browser encrypts the Naver login credentials for the registered worker. Vercel and Supabase, in the locations described in Section 6, transmit and store the encrypted ID/password pair, masked account hint, public key, setting revision, latest login-request/result metadata, and session-check status/time over encrypted networks for remote login maintenance. The private decryption key stays on the worker Mac. The Worker also decrypts the existing setting locally to generate an account-display hint consisting of up to the first five ID characters and **; only the masked hint is sent to the restricted registry, independently of login success. New settings generate the same hint in the administrator browser. The paired ID and password are decrypted there for login and sent to Naver; after a successful login, only a one-way ID fingerprint is newly persisted locally. Previously configured local account IDs remain until separately retired.

The current encrypted server setting remains until replaced or removed. Legacy password-only settings may retain the last successfully authenticated encrypted password as an outage fallback. Moving an account to paired ID/password management removes its legacy server ciphertext and clears that legacy local cache when the Worker receives the change. Paired credentials are not cached locally; existing login cookies may remain usable during an outage. Removing saved login information preserves the login session and reservation/account linkage until separately retired. Latest request/result and session-status records are replaced by later checks and retained only while the account is registered. An offline worker cannot receive removal until it reconnects. The latest status metadata and registered public key remain while the worker is registered; decommissioning removes them and local keys/copies. Provider backup copies follow the project’s configured backup lifecycle. Passwords and private keys are excluded from application logs and notifications. Before changing login settings, the master administrator confirms the same Google account again. An encrypted HttpOnly intent cookie containing the existing account identifiers expires after five minutes and is consumed on the OAuth callback. The authenticated session holds a confirmation deadline that permits changes for five minutes; refreshing the session does not extend it. This uses the existing Google authentication processor and does not send the Naver password to Google.

To improve the signup and booking flow, we may record the first time you reach each step with your account ID for up to 30 days after signup. We compare these steps with your booking records. No contact details, map links or form text are included. Do Not Track and Global Privacy Control are respected.

Only measured traveler signups are included. Records are excluded from reports after 30 days and deleted by the next daily cleanup (normally within 25 additional hours, allowing for the scheduler’s one-hour execution window), or immediately on account deletion. This measurement is separate from anonymous country/language counts and uses the existing Supabase database and Vercel hosting described in Section 6. Administrators see aggregate counts only.

If you open a registered ad link, its fixed ad code and local capture time may stay in session storage in that tab for up to seven days, or until signup succeeds. No click ID or device identifier is created. The most recent registered ad link is used; a shared link may carry the same code, so this is not proof of a paid ad click.

Only if a new traveler explicitly agrees at signup, we connect that ad code to the account ID, consent version and time, signup connection country, and Japan prefecture code where available. Vercel derives approximate region codes from the network request. They are not nationality, residence or precise location and can reflect a VPN or travel. We compare the account's measured steps and automatic booking records for up to 30 days after signup. No IP address, precise location, contact details, full URLs, referrers, map links, form text or platform click identifiers are added to this measurement. We do not send these records to Meta.

Participation is optional and does not affect signup or booking. We respect Do Not Track and Global Privacy Control, and exclude existing accounts, master accounts, local and preview environments. Storage restrictions, a new tab or device, refusal or failed measurement can prevent attribution. Administrators see aggregate ad and region counts; small counts do not establish performance differences.

The optional data is processed by the existing Vercel and Supabase providers in the regions described in Section 6, transmitted over encrypted connections at signup for ad-effectiveness measurement. No new provider is introduced. Records are excluded after 30 days and deleted by the next daily cleanup, normally within 25 additional hours. Withdraw on the Account page to delete this attribution and remove it from reports, or contact support@weallfine.com. Account deletion also removes it. Existing account, booking, payment and other journey-record retention is unchanged.

When a submitted map link cannot be opened or registered, we may store a limited map reference, a fixed failure category and the time to diagnose the issue. We retain only a supported place identifier or short share link, removing search text, coordinates, tracking parameters and fragments. A short link may still resolve to a location chosen by the sender; share business places only. Unsupported links are omitted. We do not attach account IDs, IP addresses, contact details, pasted text or raw error responses to these records. This is separate from signup journey and ad measurement.

Only authorized master administrators can view these records. They are processed through the existing Vercel hosting and Supabase database in the regions described in Section 6, over encrypted connections when a failure occurs, solely for service troubleshooting. No new provider is added. Records expire after 30 days and are removed by the next daily cleanup (normally up to 25 additional hours). You can contact support@weallfine.com with a link and approximate failure time to request removal; do not send personal details in a map link.

To troubleshoot schedule loading and booking submission, we may record the stage, fixed reason code, server or browser source, HTTP status, event time and a store reference verified against our catalog. A random diagnostic record ID identifies the event, not the customer. Browser reports are unverified observations and may be missing. We do not store account IDs, IP addresses, contact details, booking dates or times, party size, form answers, request bodies, raw URLs or original errors in this log. These records are separate from signup journey and ad attribution and do not reconstruct an individual's full path. Do Not Track and Global Privacy Control are respected.

Only authorized master administrators can view these records. At the time of failure, diagnostic fields are transmitted over encrypted connections to the existing Vercel and Supabase providers in the regions described in Section 6 for service troubleshooting. No new provider is added. Records are excluded from reports after 30 days and deleted by the next daily cleanup (normally within 25 additional hours). For a deletion inquiry, contact support@weallfine.com with the diagnostic ID or store and approximate failure time. Existing account, booking and payment retention periods are unchanged.

When a signed-in member opens a store or uses its booking flow, we may record the account ID, verified store reference, random attempt ID, stage, sequence, fixed error code, server receipt time and whether the account is the master test account. Existing members are included regardless of signup date. A successfully created booking or manual booking inquiry may be linked to the attempt to show its current status. Manual inquiry receipt is not a confirmed booking. No selected dates, times, party sizes, contact details, form text, map links, IPs or device identifiers are added. We honor Do Not Track and Global Privacy Control; public browsing remains available without login.

A tab-only attempt marker is scoped to the account and store. After 30 minutes without a tracked action, after 24 hours, or after a successful response, a later action starts a new attempt. The marker is ignored when expired and removed when the tab closes; storage restrictions may use temporary memory instead. We do not retrospectively reconstruct unmeasured steps. Existing registration reward records are used to separate master tests from customer registrations. Limited existing journey and same-store failure timestamps may corroborate an earlier blocked registration, labeled as historical evidence.

For booking troubleshooting, the listed fields are sent over encrypted connections at the relevant step to the existing Vercel and Supabase providers in the regions in Section 6. No new provider is added. Authorized master administrators can see per-attempt stages, store, time, fixed reason and booking status without account IDs or contact details. Test attempts are excluded from customer views. Attempt records expire 30 days after their first recorded event and are removed by the next daily cleanup, normally within 25 additional hours; account deletion also deletes them. Later events do not extend retention. Existing signup measurement, advertising attribution and legally retained payment/booking records keep their own retention periods. Contact support@weallfine.com for an access or deletion inquiry.