1. Privacy Policy Overview
TastyLog ('Company') values users' personal information and complies with relevant laws including the Personal Information Protection Act, the Act on Promotion of Information and Communications Network Utilization and Information Protection, and the Act on the Protection and Use of Location Information.
This Privacy Policy explains the items, purposes, and retention periods of personal information collected and used when you use the services provided by the Company (restaurant posts, TastySnap, TastyGallery, TastyCrew, TastyMeetup, TastyRoute, Pin Maps, restaurant pages and reviews, travel information, community, AI search, Berry store, business partnerships, etc.).
2. Personal Information Collected and Collection Methods
2.1 Information Collected During Registration
- Required: Email address, password, nickname
- Optional: Profile picture, bio
- Social Login: Social account information (email, profile)
2.2 Automatically Collected Information During Service Use
- Access logs, IP address, cookies, device information
- Country of access estimated from IP address (for service operation and statistics — only the country code is stored; the raw IP address is not separately stored)
- Anonymous visitor identifier (a random ID for visit statistics — not linked to personally identifiable information such as name or contact details)
- Service usage records, search history
- Location information (with user consent)
- Real-time location information when using TastyCrew (GPS coordinates, location accuracy)
- App push notification token (if you allow notifications in the mobile app — a random string identifying the device, deleted upon logout or withdrawal)
- Mobile advertising identifier (AAID/IDFA — processed by the in-app advertising SDK to serve ads and confirm completion of rewarded ads; can be reset or limited in device settings)
- Login history (date/time, IP address, success/failure, browser and device information — for account security and detection of unauthorized access; viewable by the user in Settings)
2.3 Information Collected When Creating Posts
- Post content, photos, videos
- Restaurant location information (latitude, longitude)
- Creation date and time, view count
- When issuing a share link for private content: the link token and expiry time (deleted when the link is revoked or expires)
- ※ Post titles, bodies, tags, and place names are sent to the external translation service (Google Translate) listed in Section 7 for multilingual display.
2.4 Information Collected When Using TastyCrew Service
- Crew participation information (participation date/time, crew member list)
- Real-time location information (GPS coordinates, location sharing start/end time)
- In-crew chat messages (optional)
2.5 Information Collected When Using TastySnap Service
- Uploaded video and image files
- Thumbnail images (auto-generated for videos)
- Content metadata (upload date/time, view count, like count)
- Content moderation analysis results (AWS Rekognition — inappropriate content detection)
2.6 Information Collected When Using TastyGallery Service
- Gallery title, description, and country information
- Collection and post data included in the gallery
- Gallery view count and bookmark records
2.7 Information Collected When Using TastyMeetup Service
- Club membership and management information (role, join date, activity records)
- Schedule participation records (attendance status, date/time)
- Club posts, comments, and attached images
- Schedule chat messages (optional)
- Schedule location information (meeting place coordinates)
2.8 AI Search/Recommendation and Content Moderation
- Search queries and search patterns (for AI recommendation service)
- AI chat messages and conversation history (when using the AI conversation feature)
- Location-based recommendation context (when generating AI chat/recommendation results)
- Post titles and partial post content (when analyzing AI recommendation/search reasoning)
- Clicks and interactions with AI-recommended content
- Content moderation violation warning records (for service safety management)
- * When you use AI search, recommendation, or chat features, the search queries and conversation content you enter, along with related context such as location and post information, are transmitted to and processed by the third-party generative AI services specified in Section 7 below (Google Gemini, and Anthropic Claude where applicable). Uploaded images are also transmitted to AWS Rekognition for analysis of inappropriate content.
2.9 Information collected when a business owner applies (B2B)
- Required: business name, country/address, contact person's name, contact phone
- Optional: business registration number, contact email, phone, hours, description, photos
- Purpose: verifying ownership, reviewing the listing, partnership consultation and contracting
- The business registration number and contact details are used for verification only and are never published on the service
- We do not accept scanned certificates or ID documents
2.10 Information Collected When Using Berry and the Store
- Berry earning and spending history (check-in times, rewarded ad completion records, item exchange history)
- Completion notices received from the ad provider (Google AdMob) to verify rewarded ad completion (based on the device advertising identifier)
- Items held and their validity periods
3. Purpose of Collection and Use of Personal Information
The Company uses collected personal information for the following purposes:
- Member registration and management: Providing membership services, identity verification, preventing unauthorized use
- Service provision: Restaurant information sharing, warning information provision, map services
- TastyCrew service: Companion matching and location sharing features (users are solely responsible for their own safety during meetups; the Company acts only as a platform provider)
- TastySnap service: Short-form content upload, feed provision, content moderation
- TastyGallery service: Publishing and exploring restaurant collection galleries
- TastyMeetup service: Club creation and management, schedule management, member management
- Community service: Post creation and exploration, user interaction
- AI search and recommendation: Personalized content recommendations and search services
- Content moderation: Automatic inappropriate content detection and service safety management
- Marketing and advertising: Event and promotion information (with optional consent)
- Service improvement: Statistical analysis, service quality enhancement
- Notifications: activity notifications such as comments, likes, and meetups, and service operation notices (app push, email)
- Multilingual service: automatic translation of user content and language-specific display
- Berry store: management of point earning and spending, verification of rewarded ad completion, prevention of fraudulent earning
- Business registration and partnerships: verification of business ownership, registration review, partnership consultation and contract performance
- Account security: login history management, detection of unauthorized access, two-factor authentication
4. Personal Information Retention and Use Period
In principle, the Company deletes personal information without delay after the purpose of collection and use is achieved.
However, information is retained for the specified periods in the following cases:
4.1 Internal Company Policy
- Records of unauthorized use: 1 year
- Service usage records: 3 months
- Real-time location information (TastyCrew schedules and TastyMeetup): automatically deleted within 24 hours after the meetup ends (daily purge batch, plus immediate deletion upon meetup cancellation or leaving)
- TastyCrew chat records: 30 days after crew ends (minimum period for report processing)
- TastySnap content: Deleted immediately upon account withdrawal (retained up to 30 days for report processing)
- TastyMeetup club data: 30 days after club dissolution
- TastyMeetup schedule chat: 30 days after schedule ends
- Content moderation violation records: 6 months (for repeat violation detection and account management)
- Login history: 1 year
- Current visitor heartbeat: 2 days / daily unique visitor statistics (anonymous identifier): 90 days
- App push notification token: deleted immediately upon logout, disabling notifications, or withdrawal
- Private share link tokens: deleted upon expiry or revocation (daily cleanup batch)
- Berry earning and spending history: until withdrawal (minimal records retained for 1 year after withdrawal to handle fraud disputes)
- Business registration and partnership inquiry records (business owners): 3 years after the inquiry is closed (dispute handling and detection of repeat applications)
4.2 Retention According to Relevant Laws
- Records of contracts or withdrawal of subscriptions: 5 years (E-Commerce Act)
- Records of payment and supply of goods: 5 years (E-Commerce Act)
- Records of consumer complaints or dispute resolution: 3 years (E-Commerce Act)
- Records of labeling and advertising: 6 months (E-Commerce Act)
- Website visit records: 3 months (Protection of Communications Secrets Act)
- Location information use/provision confirmation data: 6 months (Location Information Act)
5. Personal Information Destruction Procedures and Methods
The Company destroys personal information without delay when the retention period has expired or the processing purpose has been achieved.
5.1 Destruction Procedures
- Users' personal information is transferred to a separate database after achieving its purpose and is destroyed after being stored according to internal policies and laws.
- TastyCrew location information is automatically destroyed within 24 hours after meetup ends.
5.2 Destruction Methods
- Electronic files: Permanently deleted in an unrecoverable manner
- Paper documents: Shredded with a shredder or incinerated
6. Provision of Personal Information to Third Parties
In principle, the Company does not provide users' personal information to third parties.
However, exceptions are made in the following cases:
- When users have given prior consent
- When using TastyCrew schedules or TastyMeetup: Nickname, profile picture, and real-time location information are shared with other users participating in the same schedule or meetup (requires explicit user consent)
- When required by law or by legal procedures for investigative purposes
7. Outsourcing of Personal Information Processing
The Company outsources personal information processing as follows for smooth service provision:
| Provider | Purpose | Retention Period |
|---|---|---|
| Amazon Web Services (AWS) | Server operation and data storage (US Ohio region), AI analysis and moderation of uploaded images for inappropriate content (Amazon Rekognition), email delivery (Amazon SES — verification codes, password resets, notification emails) | Until membership withdrawal or contract termination |
| Google (Maps / Login / Ads) | Map services, social login, ad serving (AdSense) | Service usage period |
| Google (Gemini / Generative AI API) | Analysis of search queries, conversation content, and location-based results to provide AI search, recommendation, and chat features (Data transferred: search queries, AI chat messages and conversation history, location-based recommendation context, post titles and partial post content) | One-time processing at the point of AI feature use (subject to Google's policy) |
| Anthropic (Claude API) | AI search/conversation analysis (alternative provider — used where applicable) | One-time processing at the point of AI feature use (subject to Anthropic's policy) |
| ip-api.com (IP geolocation) | Estimating the country of access from the IP address (for service operation and statistics; the IP address is transmitted momentarily at the time of lookup) | One-time processing at the point of lookup (not separately retained) |
| Google (Cloud Translation API) | Automatic multilingual translation of user content (post titles, bodies, tags, place names, routes, pin maps, reviews) | One-time processing at translation time (only the translated result is stored on Company servers) |
| Google (Firebase Cloud Messaging) | Delivery of mobile app push notifications (push token, notification title and body) | One-time processing at delivery time |
| Google (AdMob) | Serving mobile app ads and confirming rewarded ad completion (advertising identifier) | At time of ad serving (per Google policy) |
| Kakao (AdFit) | Serving web ads (cookies and advertising identifiers, per Kakao policy) | At time of ad serving (per Kakao policy) |
| NAVER (Maps API) | Map display for locations in Korea (browser IP and request URL are sent to NAVER when the map loads) | One-time processing at map display time |
| Apple (Sign in with Apple) | Social login (Apple account identifier, email — relay address if Hide My Email is selected) | Duration of service use |
The Company manages outsourcing through contracts to ensure compliance with personal information protection laws. Data transmitted to the generative AI services above is used only to the extent necessary to provide AI search, recommendation, and chat features, and is processed in accordance with each provider's privacy policy.
8. Cross-Border Transfer of Personal Information
To provide the service, the Company transfers personal information overseas (for storage and processing) as described below. In accordance with Article 28-8 of the Personal Information Protection Act of Korea, we disclose the recipient, country, timing and method, items, purpose, and retention period.
You may refuse the cross-border transfer; however, because all of the Company's servers are located overseas, refusal makes it impossible to use the service (including registration). Requests to refuse or stop a transfer may be sent to privacy@tastylog.net.
8.1 Amazon Web Services, Inc. (United States)
- Items transferred: member information (email, nickname, profile), posts and media, location information, access records — all items in Section 2 of this Policy
- Country, timing and method: United States (Ohio region) — transmitted and stored over an encrypted (TLS) network connection at the time of service use
- Purpose: server operation, database and file storage, image moderation (Rekognition), email delivery (SES)
- Retention: until withdrawal or expiry of the retention periods in this Policy
8.2 Google LLC (United States)
- Items transferred: search queries, AI conversation content and location context (Gemini), post text (Translate), push tokens (Firebase), advertising identifiers and cookies (AdSense, AdMob), social login account information
- Country, timing and method: Google data centers including the United States — transmitted via API call when each feature is used
- Purpose: AI search and recommendations, automatic translation, push notifications, ad serving, social login, maps (outside Korea)
- Retention: one-time processing at time of use (per Google's Privacy Policy)
8.3 Anthropic, PBC (United States)
- Items transferred: search queries and AI conversation content (only when used as an alternative AI provider)
- Country, timing and method: United States — transmitted via API call when the AI feature is used
- Purpose: AI search and conversation analysis
- Retention: one-time processing (per Anthropic policy)
8.4 Apple Inc. (United States)
- Items transferred: Apple account identifier, email (Apple login users only)
- Country, timing and method: United States — transmitted at login
- Purpose: social login
- Retention: duration of service use
8.5 ip-api.com (United States)
- Items transferred: IP address
- Country, timing and method: United States — transmitted via API call at time of access
- Purpose: estimation of access country
- Retention: one-time processing (not stored separately)
9. Rights and Obligations of Data Subjects and Exercise Methods
Users can exercise the following rights at any time:
- Request access to personal information
- Request correction or deletion of personal information
- Request suspension of personal information processing
- Withdraw consent for location information collection/use/provision (stop TastyCrew location sharing)
- Membership withdrawal (consent withdrawal)
Rights can be exercised through the 'Settings' menu in the service or via email (support@tastylog.net).
The Company will take action on requests without delay and notify the results.
Rights regarding automated decisions:
The Company automatically analyzes uploaded images and videos with AWS Rekognition to detect inappropriate content, and an account is automatically suspended when five violation warnings accumulate. Because this is an automated decision made without human intervention, you may request an explanation of the decision or object to it and obtain human review, in accordance with Article 37-2 of the Personal Information Protection Act of Korea. Requests may be submitted to support@tastylog.net or through the in-service inquiry feature, and the Company will notify you of the review result within 30 days.
10. Personal Information of Children Under 14
The Company does not collect personal information from children under the age of 14, and children under 14 may not register as members.
When registering, users must confirm that they are 14 years of age or older. If the Company becomes aware that a child under 14 has registered, it will promptly delete the account and destroy the personal information collected.
A legal guardian who learns that a child's personal information has been collected may request deletion at privacy@tastylog.net, and the Company will act without delay after verifying identity.
Protection of children aged 8 or under in relation to location services is separately provided in Section 16.
11. Security Measures for Personal Information
The Company takes the following measures to ensure the security of personal information:
- Personal information encryption: Important information such as passwords is encrypted and stored
- Location information protection: Real-time location information is transmitted only over TLS-encrypted connections, is provided only to participants of the same meetup or schedule, and is automatically destroyed within 24 hours after the meetup ends
- Technical measures against hacking: Installation and periodic update/inspection of security programs
- Access control: Management of access rights to personal information processing systems
- Storage and prevention of tampering of access records: Storage of access records and regular backups
- Minimization of personal information processing and training: Minimizing staff and providing regular training
12. Use of Cookies
The Company may use cookies to provide services.
Cookies are small text files sent by the server operating the website to the user's browser.
Purpose of using cookies:
- Maintaining login status
- Providing personalized services to users
- Analyzing service usage statistics
How to refuse cookies:
You can refuse to store cookies in your browser settings, but some service usage may be restricted.
Third-party advertising and cookies:
- This service may display ads from third-party advertising vendors, including Google.
- Third-party vendors, including Google, use cookies to serve personalized ads based on a user's prior visits.
- Users can opt out of personalized advertising by visiting Google Ads Settings (https://www.google.com/settings/ads).
- On the web, Kakao AdFit ads may be served in addition to Google AdSense; Kakao also uses cookies and advertising identifiers to serve ads.
- In the mobile app, Google AdMob ads (including rewarded ads) are served using the device advertising identifier (AAID/IDFA). You can limit personalized ads or reset the identifier in your device settings.
- YouTube videos included in posts are played through the YouTube embedded player, and Google (YouTube) cookies may be set during playback.
13. Privacy Officer
The Company designates a Privacy Officer to oversee personal information processing and handle complaints and remedies for data subjects regarding personal information processing.
Privacy Officer:
Email: privacy@tastylog.net
Business Hours: Weekdays 09:00 ~ 18:00 (excluding weekends and holidays)
For other reports or consultations regarding personal information infringement:
Please contact the data protection supervisory authority in your country or region.
Major Data Protection Authorities by Country:
- South Korea: Personal Information Infringement Report Center (privacy.kisa.or.kr)
- Japan: Personal Information Protection Commission (ppc.go.jp)
- United States: Federal Trade Commission (ftc.gov)
- EU: Data protection authority in each member state
- Others: Local consumer protection authority or data protection supervisory authority
14. Handling of business listings (for partnership outreach)
We maintain an internal list of businesses compiled from public data released by government bodies (such as local licensing records).
This list contains only business operating information — trade name, category, business address, business phone number, licensing date and operating status. We do not store representatives' personal names or mobile numbers.
The list is never published on the service and is visible to administrators only.
We do not send advertising messages by SMS or email using this list, in line with Article 50 of the Network Act.
Business operators may contact support@tastylog.net to confirm the source of their information, or to request correction or deletion; we act on such requests without delay.
15. Changes to Privacy Policy
This Privacy Policy takes effect from the implementation date, and any additions, deletions, or corrections to changes according to laws and policies will be announced through notices at least 7 days before the implementation of changes.
However, in cases of significant changes to user rights, such as changes in the items of personal information collected or purposes of use, notice will be given at least 30 days in advance.
16. Location Information Services (TastyCrew and TastyMeetup)
The Company collects and uses users' location information in accordance with the Location Information Act of Korea to provide TastyCrew schedule and TastyMeetup services.
16.1 Collection and Use of Location Information
- Collection method: Real-time location positioning through GPS, Wi-Fi, and cell tower information
- Purpose of use: Real-time location sharing among crew members (users are solely responsible for their own safety; the Company provides only the location sharing feature)
- Retention period: Automatically deleted within 24 hours after meetup ends
- Collection frequency: updated periodically while the user has location sharing turned on (every few seconds to tens of seconds, adjusted according to screen state)
16.2 Provision and Sharing of Location Information
- Users' real-time location information is shared only with other users participating in the same TastyCrew
- Location sharing begins only after users' explicit consent and can be stopped at any time
- When location sharing is stopped, the location immediately stops being displayed to other users
- Location sharing automatically ends when the crew ends or when leaving the crew
16.3 Protection and Management of Location Information
- Location information is transmitted via TLS/SSL encrypted protocols
- Access to location information is restricted server-side to users participating in the same meetup or schedule and is not provided to other users or external parties
- Location information is automatically destroyed by a daily batch within 24 hours after the meetup ends, and is deleted immediately upon meetup cancellation, leaving, or removal
- Records of location information collection and use are retained for 6 months (in compliance with the Location Information Act)
16.4 Protection of Children Under 8 Years Old
- Legal guardian consent is obtained when collecting location information of children under 8 years old
- Legal guardians can withdraw consent for collection, use, and provision of children's location information at any time
- Collection records of children's location information are provided upon request by legal guardians
16.5 How Consent to Location Information Is Given
- Location sharing starts only when the user taps the 'Share location' button on the meetup or schedule screen; granting the device (browser/app) location permission at that time constitutes consent to the collection, use, and provision of location information
- Section 16 of this Policy also serves as the terms for location-based services. If you do not consent, only the location sharing feature is unavailable; use of other services is not restricted
16.6 Location Information Manager
- Name: Location Information Manager
- Email: location@tastylog.net
- Business Hours: Weekdays 09:00 ~ 18:00 (excluding weekends and holidays)
16.7 Location Information Dispute Resolution
- For complaints or consultations related to location information, please contact the Location Information Manager
- You can file complaints and request consultations with your country's data protection or location information supervisory authority
- Related Authorities by Country:
- - South Korea: Korea Internet & Security Agency (privacy.kisa.or.kr), Korea Communications Commission (kcc.go.kr)
- - Japan: Personal Information Protection Commission (ppc.go.jp)
- - EU: Data protection authority in each member state
- - Others: Local consumer protection authority or telecommunications regulatory authority