Privacy Policy

Article 1 (Items of Personal Information Collected and Methods of Collection)

The Service collects the following personal information.

Article 2 (Purposes of Collection and Use of Personal Information)

The personal information collected is used only for the following purposes.

• Member identification, Kakao OAuth authentication, and service provision
• Receiving requests and delivering reports
• Delivering notices related to the Service, report completion notifications, and other communications (via email)
• Receiving feedback and providing responses
• Issuing cash receipts (upon request)
• Service improvement and statistical analysis (after de-identification)
• Preventing illegal or fraudulent use and handling violations of the terms of service

Article 3 (Retention and Use Period of Personal Information)

Personal information is destroyed promptly once the purpose of its collection and use has been achieved. However, it is retained for the following periods where required by applicable law.

• Member information: destroyed promptly upon membership withdrawal or service termination (provided that, where necessary for dispute resolution, it is retained until the dispute is resolved)
• Service usage records (request history): 6 months after withdrawal
• Waitlist application information: destroyed promptly upon completion of registration or withdrawal of the application
• E-commerce records (contracts, withdrawal of subscription, payment): 5 years (Act on Consumer Protection in Electronic Commerce)
• Records of consumer complaints and dispute handling: 3 years (Act on Consumer Protection in Electronic Commerce)
• Access logs: 3 months (Protection of Communications Secrets Act)

Article 4 (Provision of Personal Information to Third Parties)

As a rule, the Service does not provide users' personal information to third parties. The following cases are exceptions.

• Where the user has consented in advance
• Where investigative authorities or others request it pursuant to law

Article 5 (Outsourcing of Personal Information Processing)

The Service outsources the following tasks to external providers.

Vercel, Supabase, Resend, and Anthropic maintain their servers in the United States, so personal information may be transferred overseas. Each provider holds internationally recognized security certifications (such as SOC 2). Anthropic processes the Scripture passages and request content submitted by members in order to generate AI reports, and such data is not used to train AI models. Kakao maintains its servers in the Republic of Korea.

Article 6 (Rights and Obligations of Data Subjects and How to Exercise Them)

Users may exercise the following rights. (Articles 35 through 37 of the Personal Information Protection Act)

• Right of access: the right to request access to one's own personal information processed by the Service
• Right to correction and deletion: the right to request correction or deletion of personal information that is inaccurate or no longer necessary
• Right to suspension of processing: the right to request that the processing of personal information be suspended
• Withdrawal of consent: the right to withdraw consent to the collection and use of personal information at any time

To exercise these rights, please send an email request to didymus@didymuslab.com, and we will act on it. We will notify you of the outcome within 10 days of receiving the request.

Article 7 (Destruction of Personal Information)

1. Personal information whose retention period has elapsed or whose processing purpose has been achieved is destroyed without delay.
2. Electronic files: permanently deleted in a manner that renders recovery impossible
3. Paper documents: shredded or incinerated

Article 8 (Technical and Administrative Measures for the Protection of Personal Information)

• Authentication security: Kakao OAuth 2.0 authentication is supported, and for email registration, passwords are stored only as bcrypt one-way hashes (no plaintext is retained)
• Session management: session IDs are issued from cryptographically secure random values
• Data encryption: request content on the Standard plan and above is stored encrypted with AES-256-GCM
• Communication encryption: HTTPS (TLS) is applied
• Access control: direct database access is blocked for anyone other than the operator
• Regular security reviews and vulnerability checks

Article 9 (Use of Cookies)

1. The Service uses session cookies to maintain login status.
2. Session cookies are deleted upon logout. When "keep me logged in" is enabled, they are retained for up to 7 days.
3. The Service does not use cookies for advertising or tracking purposes.
4. Users may refuse cookies through their browser settings, but login will not be possible if they do.

Article 10 (Personal Information Protection Officer)

For inquiries, complaints, and remedies related to the processing of personal information, please use the contact below.

To report or seek advice regarding infringement of personal information, you may contact the Personal Information Protection Commission (privacy.go.kr, dial 182 without an area code).