Back to Home

Privacy Policy

Effective Date: May 6, 2026 | Last Updated: April 29, 2026

1. Information We Collect

Mystic Universe collects the following information to provide our services:

▸ Guest Saju Analysis

Required: Date/Time of birth, Birth city, Gender
Optional: Blood type, Personality type

▸ Social Login Members (Kakao / Google)

Unique ID (UUID): User identification (auto-generated by Supabase Auth)
Email: Provided by social provider (Kakao may not provide)
Nickname: Name from social provider (for UI display)
Profile picture URL: Provided by social provider (for UI display)
Login provider: kakao / google (for account management)

▸ Payment Information (Members only)

Order ID / Payment amount / Payment method type (card brand): Payment processing and refund handling
Payment timestamp / Refund reason: Compliance with statutory record retention
Sensitive payment details (card number, CVC, expiration): Handled directly by Toss Payments and never stored on Mystic Universe servers.

▸ Chemistry Room Participation Records

A non-identifiable snapshot of room participation history (was_member) is preserved. This is the minimum information needed for room continuity, may persist after withdrawal, and contains no personally identifying data (see MEMBER_POLICY §14).

Note: For guest analyses, only anonymous, non-identifiable statistical data is stored on our servers:
Birth year, gender, country code; Saju day pillar, zodiac, shinsal (values derived from birth data); blood type & personality type (if entered); AI tier, language setting.
Name, phone number, exact birth date, birth time, and city name are never stored on the server.

Note: No separate registration form — membership is via social login only. When members save a Saju to their vault, the full birth date (year, month, day), birth time, and city are stored. This information is used to calculate Daeun (Major Fortune Cycles) and Seun (Annual Fortune) cycles, and is permanently deleted upon account withdrawal.

2. Purpose of Collection

Collected data is used only for the following purposes:

Generating AI-fused Saju/Astrology analysis results
Calculating Daeun (Major Fortune) & Seun (Annual Fortune) cycles (using birth date/time stored by members)
Processing paid content payments and refunds (payment information)
Anonymous statistical analysis for service improvement

3. Data Retention and Deletion

Saju analysis data (birth date, time, etc.) entered by guests is held only in browser session memory and is immediately erased when the page is closed or refreshed. It is never sent to our servers.

App settings such as language and theme are stored in the browser's (localStorage).

Anonymous statistical data (birth year, country code, gender, and Saju information) is stored on our server (Supabase) for service improvement. This data does not contain any personally identifiable information.

▸ Social Login Member Data

Member profiles and saved Saju are retained for the duration of account use.
Upon account deletion, all personal data (profile, saved Saju) is permanently deleted immediately.
After 12 months of inactivity, personal data is stored separately per applicable law, with 30-day advance notice by email.
After 24 months of inactivity, the account and personal data are permanently deleted.

▸ Statutory Retention of Payment Records (Korean E-Commerce Act Article 6)

Payment & goods supply records: 5 years
Contract & withdrawal-of-offer records: 5 years
Consumer complaints & dispute resolution records: 3 years
Display & advertising records: 6 months

Note: During the statutory retention period, payment information (order ID, amount, payment method type, timestamp) may be retained even after account withdrawal. Records are automatically destroyed after the retention period elapses.

▸ Non-Identifiable Data Retained After Withdrawal

To prevent re-registration abuse and fraudulent use, an irreversible cryptographic hash of the sign-up email, the sign-up route (provider), and the withdrawal timestamp are retained. The hash cannot be reverted to the original email and does not identify an individual.
A non-identifiable snapshot of Chemistry Room participation (was_member) is preserved for room continuity and contains no personally identifying data (MEMBER_POLICY §14).

4. Third-Party Disclosure & Data Processors

We transmit data to or entrust processing with the following services for service provision, operation, and improvement. Transmitted data is used only for the stated purposes and never for marketing.

▸ AI Processing

Recipient: Google (Gemini AI API)

Items: Saju data, zodiac, personality traits (no identifying information) — for analysis result generation

Recipient: OpenAI (GPT Image 2)

Items: Character generation prompts based on Saju persona (no identifying information) — discarded immediately after image generation

Recipient: fal.ai (Bria RMBG 2.0)

Items: AI-generated character images for background removal (no identifying information; discarded after processing)

▸ Payment Processing

Recipient: Toss Payments

Items: Card information, amount, order ID — for payment and refund processing. Sensitive payment details are held by Toss Payments only, never by Mystic Universe

▸ Infrastructure & Hosting

Recipient: Supabase Inc. (Database & Authentication)

Items: Member profiles, saved Saju, anonymous analytics — for database hosting and authentication

Recipient: Vercel Inc. (Hosting)

Items: Server logs, request headers (no identifying information) — for web application hosting

Recipient: Cloudflare Inc. (CDN & Images)

Items: Traffic routing, image transformation, CDN cache (no identifying information) — for infrastructure processing

▸ Analytics & Monitoring

Recipient: Google (Google Analytics 4)

Items: Page views, service usage events (no personally identifying information) — for usage statistics

Recipient: Microsoft (Clarity)

Items: Anonymized recordings of clicks, scrolls, and partial input (session replay) — for UX analysis. Console input masking enabled

Recipient: Sentry (Functional Software, Inc.)

Items: JavaScript error messages, URL, session ID, browser environment (no input values) — for error monitoring

▸ Sharing Features

Recipient: Kakao Corp. (Share SDK)

Items: Page URL, image, and title at the moment the share button is clicked — to execute KakaoTalk sharing (transmitted only on explicit user action)

5. User Rights

Users can delete their data at any time by clearing their browser cache and have the right to stop using the service.

▸ Additional Rights for Members

Right to Access: View your saved Saju in "My Saju Vault" at any time.
Right to Deletion: Delete individual saved Saju, or delete all data by closing your account.
Right to Withdraw: Delete your account at any time; all personal data is immediately erased.

For other privacy inquiries, contact getsaju.mu@gmail.com.

6. Account Deletion

When you delete your account, all personal data including saved Saju and analysis records will be permanently deleted. However, payment records (per Korean E-Commerce Act Article 6) and the non-identifiable Chemistry Room participation snapshot (was_member) are preserved per §3 and MEMBER_POLICY §14.

▸ Deletion Process

Open the top menu → Settings → Click 'Delete Account'
Click 'Delete' in the confirmation dialog
All saved Saju, profile, and personal data are immediately and permanently deleted
You are automatically signed out upon completion

※ You may re-register immediately after deletion, but previous data cannot be recovered.

To withdraw now, go to the Account Deletion screen. For deleted/retained items and retention periods, see the Data & Account Deletion page.

7. Dormant Account Policy

We protect personal data of long-inactive accounts in accordance with applicable privacy laws.

11 months inactive: Advance notice sent by email (30 days before data separation)

12 months inactive: Personal data stored separately (service access restricted)

24 months inactive: Account and personal data permanently deleted

Dormant status is automatically lifted upon re-login. Separated data is restored after sign-in.

8. Personal Information Protection Officer

The officer responsible for overseeing personal data processing and for handling data subjects' inquiries, complaints, and remedies is as follows:

Name: Byungyong Yu
Title: CEO (Data Protection Officer)
Contact: +82-42-542-7050 / getsaju.mu@gmail.com

9. Remedies for Rights Infringement

Data subjects may apply to the following Korean authorities for dispute resolution or consultation regarding personal data infringement, including where they are not satisfied with the Company's handling of a request:

Personal Information Dispute Mediation Committee: +82-1833-6972 (www.kopico.go.kr)
Korea Internet & Security Agency (KISA) Privacy Center: 118 (privacy.kisa.or.kr)
Supreme Prosecutors' Office Cybercrime Division: 1301 (www.spo.go.kr)
National Police Agency Cyber Bureau: 182 (ecrm.police.go.kr)