Privacy Policy

1. General (Purposes of Processing and Legal Bases)

The Service collects and uses only the minimum personal information necessary for the following purposes. Personal information processed will not be used for purposes other than those listed below, and if the purposes change, the Service will take necessary measures such as obtaining separate consent in accordance with Article 18 of the Personal Information Protection Act.

• Providing the meeting time coordination service and identifying users
• Identifying and inviting meeting participants and tallying time votes
• Sending email notifications (meeting confirmations, voting/preference reminders, AI recommendations, etc.). Notification emails may include affiliate advertising (Coupang Partners, Zoom, etc.) and are sent only after consent to receive them.
• Providing optimal meeting time recommendations and AI seating arrangements
• Paid Pro subscription payment, subscription status verification, and refund processing
• Responding to inquiries related to service use, and improving usage statistics and service quality

Legal bases: Article 15(1)(1) (consent of the data subject) and Article 15(1)(4) (necessary for the conclusion and performance of a contract) of the Personal Information Protection Act. Email advertising and personalized advertising are used only where separate consent has been obtained.

2. Personal Information Items Processed and Retention/Use Periods

The Service processes the following personal information according to the collection channel.

Google sign-in (meeting hosts/members)

• Email address
• Name (display name)
• Profile picture (optional)

Link participation (anonymous sign-in, no separate registration)

• Display name (entered directly by the participant)
• Time selections and preference rankings

Information generated and stored in the course of using the Service

• Meeting information (meeting name, candidate period, deadline)
• Time selection and preference information
• Service usage records (including anonymous identifier (UID))
• Seating event information and the profile an attendee enters (name and optional items the host turned on)

For paid payments, only the email address and subscription status are stored in the Service; payment method details such as card numbers are collected and processed directly by the payment processor (Lemon Squeezy) and are not stored on the Service's servers.

Information collected through automatic collection devices such as cookies and local storage is described in Section 7 (Automatic Collection Devices and Personalized Advertising).

Processing purposes, retention/use periods, and legal bases by item

3. Provision of Personal Information to Third Parties

In principle, the Service does not provide users' personal information to third parties. However, the following cases are exceptions in accordance with Articles 17 and 18 of the Personal Information Protection Act.

• Where the user has consented in advance (Article 17(1)(1))
• Where there is a basis in other laws, or where a request for investigation purposes is made in accordance with the procedures and methods prescribed by law (Article 17(1)(2), Article 18(2))
• When a user proceeds with a paid subscription payment, the minimum information necessary for payment (such as email) is provided to Lemon Squeezy for payment processing (Merchant of Record) (consent under Article 17(1)(1)). Payment method details such as card information are not stored on the Service's servers; they are collected and processed directly by Lemon Squeezy and are handled in accordance with the company's policies after the payment purpose has been fulfilled.

4. Entrustment of Personal Information Processing

To provide the Service smoothly, we entrust personal information processing tasks as follows, and when concluding entrustment contracts we manage and supervise compliance with personal information protection matters pursuant to Article 26 of the Personal Information Protection Act.

Transfers of personal information to overseas contractors are made pursuant to Article 28-8(1)(3) of the Personal Information Protection Act (overseas entrustment/storage for contract performance); details are provided in Section 8 (Overseas Transfer of Personal Information).

5. Destruction Procedure and Methods of Personal Information

When personal information becomes unnecessary, the Service destroys the relevant personal information without delay.

• When the retention/use period has elapsed (e.g., 90 days after the meeting ends)
• When the purpose of processing has been achieved (e.g., completion of payment/refund processing)
• When a member deletes the account or the user requests deletion

Where personal information must be retained under other laws, the relevant personal information is stored and managed separately from other personal information, and is destroyed without delay after the retention period prescribed by the relevant law has elapsed.

Destruction method: Personal information stored in electronic file form is permanently deleted by methods that technically make the records unrecoverable and unregenerable. Meeting information is automatically deleted 90 days after the meeting ends, and is deleted immediately upon account withdrawal. The Service does not print or store personal information in paper document form.

6. Rights and Obligations of Data Subjects and Legal Representatives, and How to Exercise Them

Users may exercise the following rights regarding their personal information at any time.

• Request access to personal information
• Request correction where there are errors
• Request deletion
• Request suspension of processing and withdraw consent

To exercise these rights, send an email to the contact below (bodalbuddyaiai@gmail.com). The Service verifies your identity and processes the request within 10 days of receipt; if processing is delayed, the reason and the expected processing date will be notified.

The Service is not directed to children under 14. If we learn that information about a child under 14 has been collected, we delete it without delay. A legal representative may exercise the rights above on the child's behalf.

7. Installation, Operation, and Refusal of Automatic Collection Devices (Cookies and Personalized Advertising)

The Service uses 'cookies', local storage, and similar technologies to provide users with personalized advertising and access analytics. A cookie is a small piece of information that a website server sends to the user's browser and that is stored on the user's device.

• Google Analytics (cookies): for analyzing service usage statistics and improving quality
• Google AdSense (cookies): serving advertisements on the website and measuring ad performance. Google and its partners may display personalized ads based on users' interests.
• Kakao AdFit, Coupang Partners: affiliate advertising banners displayed on Korean pages

Behavioral information for personalized advertising (cookie-based information such as website visit and use history) is collected and processed through each advertising operator's automatic collection devices; the items collected and the retention/use periods follow each company's privacy policy. The Service does not separately store collected behavioral information and does not collect sensitive behavioral information that may infringe users' rights, interests, or privacy.

Users may refuse cookie storage and personalized advertising in the following ways. However, if you refuse, personalized ads may not be displayed and the use of some features, such as staying signed in, may be limited.

• Block cookies in the browser: You can refuse cookie storage in browser settings, e.g., Chrome (Settings → Privacy and security → Third-party cookies), Edge (Settings → Cookies and site permissions → Block third-party cookies), Safari (Settings → Advanced → Block all cookies).
• Google ad settings: You can disable personalized advertising at https://adssettings.google.com, and install the Google Analytics opt-out tool at https://tools.google.com/dlpage/gaoptout.
• Kakao AdFit·Coupang Partners ads: You can configure them according to the methods described on each advertising service's site (https://adfit.biz.daum.net, https://partners.coupang.com); blocking third-party cookies in your browser limits personalized collection by these ads.

8. Overseas Transfer of Personal Information

The Service transfers personal information collected from users overseas as follows, and provides the following information in accordance with Article 28-8(2) of the Personal Information Protection Act.

Legal basis: Article 28-8(1)(3) of the Personal Information Protection Act (overseas entrustment and storage of personal information necessary for the conclusion and performance of a contract)

For details on how each recipient handles personal information, please refer to each company's privacy policy. Google: https://policies.google.com/privacy / OpenAI: https://openai.com/policies/privacy-policy / Lemon Squeezy: https://www.lemonsqueezy.com/privacy

How to refuse overseas transfer and the effect of refusal

Users may refuse the overseas transfer of their personal information. If you wish to refuse, please request account withdrawal (deletion of your personal information) via email (bodalbuddyaiai@gmail.com) and we will process it for you; the overseas transfer of your personal information will cease once the withdrawal is processed. However, transfers to Google (Firebase) are essential for sign-in and data storage, so refusing them makes member-based use of the Service unavailable. Transfers to OpenAI occur only when you use AI recommendations, adjustment requests, or AI seating, so you may simply refrain from using those features; all other features remain available even in that case. If you do not use AI seating, attendee profiles and venue photos are not sent to OpenAI. Transfers to Lemon Squeezy occur only at the time of paid payment, so they do not apply if you do not proceed with a Pro payment.

For users in Japan, the Service obtains prior consent, when an account is created or at first sign-in, before entrusting personal information to businesses in the United States (such as Google and OpenAI), under Article 28 of the Act on the Protection of Personal Information. The United States is not designated as a country with a personal-information protection system equivalent to Japan's. The United States has no single nationwide privacy statute. State laws, including California's, and COPPA for children under 13 may apply separately. This Service is not directed to children under 13, and information we learn belongs to such a child is deleted. We do not sell personal information. You may request access, correction, or deletion by email at the address above.

9. Measures to Ensure the Security of Personal Information

Pursuant to Article 29 of the Personal Information Protection Act, the Service takes the following measures necessary to ensure security.

• Encryption in transit: communications between the user's device and the Service are encrypted with TLS (HTTPS).
• Access rights management: Firebase security rules apply. Meeting information is visible only to that meeting's participants. The host sees the full seating roster. Other attendees see names and only the items each person agreed to share. Until the plan is confirmed, only the host can see the arrangement.
• Data minimization and internal management: only the minimum personal information necessary to provide the Service is collected and retained, and the number of persons with access to personal information is minimized.

10. Chief Privacy Officer and Responsible Department

The Service designates and operates a department responsible for personal information protection to oversee personal information processing and to handle data subjects' complaints and damage relief related to personal information processing.

• Department responsible for personal information protection: Customer Support Team
• Email: bodalbuddyaiai@gmail.com
• Phone: 02-955-8199

For other reports or consultations regarding personal information infringement, you may contact the Personal Information Infringement Report Center (privacy.kisa.or.kr, 118) or the Personal Information Dispute Mediation Committee (www.kopico.go.kr).

Business information

The operator of the Service is as follows.

11. Notice on the Use of AI (Artificial Intelligence)

In accordance with Article 31 of the Framework Act on the Development of Artificial Intelligence and Establishment of Trust, the Service provides the following notice.

• The Service provides an optimal meeting time recommendation feature using third-party generative artificial intelligence (OpenAI).
• In the AI recommendation process, meeting names, display names, and availability/preference slots (including email when sending adjustment requests) are transmitted to OpenAI.
• Recommendation results generated by AI are reference information that may contain errors, and the final confirmation of a meeting time is made at the user's own judgment.
• The same generative AI provides AI seating. When the host runs a placement, attendee names and the items the host chose to collect are sent to OpenAI. When the host runs venue-photo interpretation, that photo is sent. The result is a reference, and the host confirms the final seats.

12. Collection and Use of Personal Information for the AI Seating Arrangement Service

MeetTimeSync's AI seating arrangement service collects and uses the following information to operate seating events.

Information collected

• Name (required) — to identify attendees
• Age range (a 5-year band from 1–100, not an exact age), gender, MBTI, hobbies, skills, affiliation, relationship to the host, nationality, hometown, blood type, marital status, children, activity region, languages you can use, and event role (optional) — collected only when the organizer selects them. You can take part without choosing one. An event role is entered only when the attendee has one.
• A personal photo is not collected.
• Venue photos — sent to AI to read the table layout and not stored by the Service

Purpose of collection: to provide AI seating, to let the host run the event, and to show other attendees of the same seating the items an attendee agreed to share

Retention period: deleted when the host deletes the event, or within 10 days after a user requests deletion by email.

Special notes

• Languages you can use are the languages an attendee can speak. An event role is entered only when they have one. Venue photos are used only to read the table layout.
• A name is always visible to other attendees. For every other item, the attendee chooses whether other attendees can see it. Items left visible are shown to other attendees only after the attendee agrees, and only those values are sent to other attendees' devices. Age range, gender, blood type, marital status, children, and relationship to the host start as host-only. Information the host enters for someone else stays name-only for other attendees until that person agrees to share it. Until the plan is confirmed, only the host can see the arrangement.
• National ID numbers, phone numbers, addresses, bank accounts, salary, religion, political views, health or disability status, and sexual orientation are not collected. Blood type may be entered by the attendee only when the host turns that item on. It is used only as a seating reference, not for medical purposes, and may be left blank.

13. Changes to the Privacy Policy

This Privacy Policy may be revised in accordance with changes in laws, policies, or the Service; any changes will be announced through notices within the Service, specifying the changed content and effective date.