Privacy Policy

Effective date 2026-06-09 · Last updated 2026-10-25

Ioreum (“we”, “us”) respects your privacy. This policy explains what personal data we collect, why we collect it, who we share it with, and the rights you have. It is written with the EU General Data Protection Regulation (GDPR) in mind.

1. What we collect

Your calling name — the name you provide for your reading.
Date and time of birth — required to compute your saju chart. Your birth date and time constitute personal data and, in some jurisdictions, may be considered sensitive; we treat them with care. If you agree while signed in, we record when you agreed on your account and won’t ask again on later forms; you can withdraw from any form, and we ask again if what we collect here or why changes.
Gender — used as an input to the chart interpretation.
Email address — collected when you sign in with Google, to identify your account and contact you about your reports.
Usage and technical data — basic logs needed to operate the Service, prevent abuse, and resolve issues, and page-view and event analytics (see section 7).
How you found us — the campaign tag of the link that first brought you, or the website that first referred you and the section you landed on (see section 7).

2. Why we use it (lawful basis)

To compute your saju chart and generate and deliver your report. The lawful basis is performance of a contract with you and/or your consent.
To process payments and keep transaction records.
To respond to your requests and to maintain the security and integrity of the Service.
To understand which pages and channels bring people to the Service and lead to purchases, so we can improve it. The lawful basis is our legitimate interest in operating and improving the Service; where the law requires consent for analytics cookies, we rely on consent.

3. Third parties and sub-processors

We do not sell your personal data. To provide the Service we use a limited number of trusted sub-processors:

AI interpretation providers (accessed through OpenRouter; currently models from OpenAI and Google) — to generate the written interpretation of your chart from the values our engine has already computed.
Database hosting (Supabase) — to store your account and report data.
Website hosting and cookieless analytics (Vercel) — to serve the Service and count page visits in aggregate.
Web analytics (Google Analytics 4) — to measure page views and steps such as a preview being generated or a checkout being started (see section 7).
Transactional email (Brevo, France) — to send sign-in verification, password reset and payment emails to your email address.
Payment provider — to process payments securely. We do not store your card details.

4. International data transfers

The Service is operated from the Republic of Korea, and our sub-processors may be located in other countries. As a result, your personal data may be transferred to and processed outside your country of residence. Where required, we rely on appropriate safeguards for such transfers.

5. Data retention

Free previews made without signing in are deleted automatically after 30 days (unless a report or an order was created from them).
Previews made while signed in, and your generated reports, are kept in your account so you can re-open them until you delete your account. We erase them 7 days after you request account deletion.
We delete or anonymize personal data when it is no longer needed for the purposes above, subject to any legal obligation to retain certain records.

6. Your rights

Under the GDPR and similar laws, you may have the right to:

access the personal data we hold about you;
request rectification of inaccurate data;
request erasure of your data;
request restriction of processing;
data portability;
object to processing;
withdraw your consent at any time, without affecting prior lawful processing.

You may also have the right to lodge a complaint with your local data protection authority.

7. Cookies

We set a small number of our own cookies and use Google Analytics. We do not sell cookie data or share it with advertisers.

Strictly necessary — keeping you signed in; remembering your language (1 year); one random device identifier used solely to prevent abuse of our free-credit and referral features (we keep only a one-way hash of it); short-lived flags, lasting minutes, that complete a sign-up, account-linking or referral step; and a small flag that remembers whether you have saved birth profiles (1 year).
Referral (30 days) — if you arrive through a friend’s invite link, we remember the invite so the referral credit can be given.
How you found us (30 days) — the campaign tag (such as utm_source) of the link that first brought you or, if there was none, the website that first referred you and the section you landed on (for example, “a search engine → the hanja dictionary”). This is not set when you arrive directly or while you are signed in. It never contains your search terms or browsing history. If you make a purchase, this one line is stored with your order so we can see which channels lead to purchases.
Analytics — Google Analytics 4 measures page views and funnel steps. In the EEA, the UK and Switzerland it runs in Google Consent Mode with storage denied by default, so no Google Analytics cookies are set there. Elsewhere it sets Google Analytics cookies (such as _ga). We also use Vercel Web Analytics, which does not use cookies.

You can block or delete cookies in your browser settings. Blocking strictly necessary cookies will prevent you from signing in.

8. Children

The Service is not directed at children under the age of 16, and we do not knowingly collect personal data from them. If you believe a child has provided us with personal data, please contact us so we can remove it.

9. Contact

To exercise your rights or for any privacy question, contact us at support@ioreum.com.