Privacy Policy
Effective Date and Time: September 14, 2026, 00:39:54 UTC
Truein Tech Co., Ltd. (the “Company”) operates CSSP EasyPhone (the “Service”) and complies with the Personal Information Protection Act and other applicable personal information protection laws.
This Privacy Policy explains the categories of personal information the Company processes in the course of providing the Service, the purposes of use, retention periods, provision to third parties, outsourcing of processing, cross-border transfers, and the rights of data subjects and how to exercise them.
Article 1 (Definitions)
Terms used in this Policy have the following meanings.
- “Member” means a guardian who creates an account with their own email address, enters into a Service use agreement, and pays for paid services.
- “Smartphone User (Protected Person)” means a person who uses a smartphone on which the Simple Phone app is installed under an account managed by a Member.
- “Guardian” means a Member who, with the Smartphone User (Protected Person)’s consent, checks smartphone usage status and uses the Service’s management features.
- “Service Message” means a text message sent by a guardian to a Smartphone User (Protected Person) through the Service website (or a screen provided by the Service) as a feature of this Service.
- “Ordinary Message” means an existing text message received on the Smartphone User (Protected Person)’s phone through a carrier or the system messaging inbox, and not originated by this Service. References in this Policy to a message matching whitelist and to whitelist-matched message mean Ordinary Messages.
- A Member logs in to the web administrator with their account, and also logs in with the same Member account when installing the app on the Smartphone User (Protected Person)’s device. Smartphone Users (Protected persons) do not create a separate account.
- When the app is installed on the Smartphone User (Protected Person)’s device and the user logs in for the first time, the Company informs the Smartphone User (Protected Person) of the information collected, the purposes of use, the information the guardian may view, and other matters regarding personal information processing, and obtains consent.
Article 2 (Purposes, Categories, and Retention Periods of Personal Information)
The Company processes personal information within the scope necessary to provide the Service as follows.
1. Categories collected for general Service use and device registration
| Category | Purpose of Collection and Use | Retention and Use Period |
|---|---|---|
| Email address (ID) | Membership registration, login, identity verification, account management, essential Service notices, customer support, and, with consent when using the how-to inquiry (live chat) feature, provision to Crisp (Articles 5 and 7) | Destroyed immediately upon membership withdrawal. However, if the Member separately opts in during withdrawal to temporary retention for account recovery, retained for 30 days from the withdrawal date and then destroyed |
| One-way encrypted value (hash) of the email address | Preventing abuse of the Service, including duplicate use of free trials and repeated refunds within 14 days | Retained for 6 months after membership withdrawal (destroyed immediately upon expiry). See Article 8-2 for details |
| Password (one-way hash) | Login authentication and account security | Destroyed immediately upon membership withdrawal. However, if the Member separately opts in during withdrawal to temporary retention for account recovery, retained for 30 days from the withdrawal date and then destroyed |
| Transaction ID, purchased product, payment amount, payment/refund status and date/time, recurring billing status, payment process logs | Confirmation of paid Service payments, subscription management, settlement, cancellation/refund, and dispute handling | Retained for the period prescribed by applicable law and then destroyed (stored separately for 5 years as required under the Electronic Commerce Act) |
| Connected device ID (UUID, etc.), device model | Linking a Member account with a smartphone device, identifying web/app access devices, preventing unauthorized access, optimizing UI by device, and securing Service stability | Destroyed immediately upon membership withdrawal. However, if the Member separately opts in during withdrawal to temporary retention for account recovery, retained for 30 days from the withdrawal date and then destroyed |
| Photos and videos uploaded by the Member (Guardian) or Smartphone User (Protected Person) | Providing Service features that register and store multimedia content in the app/web and display it on designated screens | Destroyed when the Member deletes them on the photo/video management screen, or destroyed immediately upon membership withdrawal. However, if the Member separately opts in during withdrawal to temporary retention for account recovery, retained for 30 days from the withdrawal date and then destroyed |
| Schedules registered by the Member (Guardian) or Smartphone User (Protected Person) | App/web calendar and schedule management, schedule display, and notifications | Destroyed when the Member deletes them on the schedule management screen, or destroyed immediately upon membership withdrawal. However, if the Member separately opts in during withdrawal to temporary retention for account recovery, retained for 30 days from the withdrawal date and then destroyed |
| App UI usage history: records of Service feature clicks and interactions within the most recent 1 month | Detecting prolonged non-use and providing guardian status-check alerts; providing guardians with smartphone usage pattern inquiry features | Automatically destroyed 1 month after collection; upon membership withdrawal, all remaining records are destroyed immediately |
| IP address, access date/time, browser type, operating system, cookie/local storage information, security and error logs | Maintaining login sessions, detecting security threats, preventing misuse, incident response, and securing Service stability | Retained for 3 months from collection and then destroyed. However, if a security incident or dispute occurs, may be retained to the extent necessary until the matter is resolved |
| Advertising landing visit identifier (visit_id), landing URL, ad-click identifier (such as fbclid), UTM parameters, document referrer, landing-page usage events (slide views, CTA clicks, plan details, FAQ identifiers, etc.), and, if the visitor registers after consent, the Member identifier (user_id) linked to that visit | Identifying visitor traffic sources on the web landing page and using conversion data to measure advertising performance (including whether an ad visit leads to registration or payment). If the user consents to cookie use, conversion data may be provided to Meta Platforms, Inc. (Articles 5 and 7) | Retained for 6 months from collection and then destroyed |
| FCM push token | Sending notification messages (FCM push) and identifying devices | Until logout or until the token is refreshed or expires |
| Ordinary Message matching whitelist registered by the Member (Guardian) (matching conditions such as sender and text string). Registered by the guardian on the web and stored on the server; when the guardian applies it to the phone, it is downloaded to and stored on the Smartphone User (Protected Person)’s device for matching | So that the guardian can specify whitelist conditions for Ordinary Message that the guardian must review among messages received on the user’s smartphone, and so that those conditions can be applied and used for matching on the device | Until the Member deletes the relevant items, or destroyed immediately upon membership withdrawal. However, if the Member separately opts in during withdrawal to temporary retention for account recovery, retained for 30 days from the withdrawal date and then destroyed |
| Among Ordinary Messages received by the Smartphone User (Protected Person), messages that match the whitelist (such as sender, message body, and received time). Primarily stored on the device; when the user runs the guardian-sharing feature, transmitted to and stored on the server so the guardian can view it | To forward to the guardian, for review, Ordinary Messages that match the whitelist conditions and that the smartphone user has difficulty understanding | Until the Member deletes the relevant items, or destroyed immediately upon membership withdrawal. However, if the Member separately opts in during withdrawal to temporary retention for account recovery, retained for 30 days from the withdrawal date and then destroyed |
| Customer support (1:1 inquiry) title, body, replies, follow-up questions, attached images, created/processed times, and status | Receiving, answering, and keeping a history of inquiries. After automatically masking (de-identifying) personal information such as email addresses, phone numbers, names, and device unique identifiers, the Company may also use the records to improve Service quality and advance the technology | Destroyed when the Member deletes the inquiry, or destroyed immediately upon membership withdrawal. However, if the Member separately opts in during withdrawal to temporary retention for account recovery, retained for 30 days from the withdrawal date and then destroyed. If applicable law requires retention of consumer complaint or dispute records, retained separately for that period |
| Email address when using the how-to inquiry (live chat) feature | Provided to Crisp IM SAS to respond to the inquiry if the Member consents to using the how-to inquiry feature | Provision stops when consent is withdrawn or membership is withdrawn. The period set out in Crisp’s privacy policy |
- The Company does not store passwords in plain text; passwords are stored using irreversible one-way hashing.
- App UI usage history includes in-Service feature click and interaction records. The Company does not use such records for advertising, user profiling, or marketing.
- Unlike the app UI usage history above, traffic-source and event information collected only when the user consents to cookie use on the web advertising landing page is processed to identify visitor traffic sources and to use conversion data to measure advertising performance. In that case, the Company may provide to Meta Platforms, Inc. the ad-click identifier (fbclid), the conversion event type (such as registration or payment), the time of the conversion, and, where applicable, the payment amount. Email addresses and Member identifiers (user_id) are not provided to Meta.
- The Company does not use photos/videos, schedules, or app UI usage history that users upload for display on Service screens for advertising or AI model training.
- Before using customer-support (1:1 inquiry) conversations or attached screenshots for quality analysis or AI training, the Company automatically masks (de-identifies) personal information such as email addresses, phone numbers, names, and device unique identifiers. De-identified support records may be used to improve Service quality and advance the technology. Original support records that still contain identifying information are used only for customer support and for retention required by applicable law.
- Service Message is a message sent by a guardian through a Service feature and is distinct from the Ordinary Message whitelist and matching collection described above.
- The body of an Ordinary Message may be stored on the server only when it matches the whitelist and the Smartphone User (Protected Person) runs the guardian-sharing feature; the Company does not continuously collect all Ordinary Messages.
- If the Member consents when using the how-to inquiry (Ask an agent directly) feature on web customer support, the Company provides that Member’s email address to Crisp IM SAS to respond to the live chat (Articles 5 and 7). Refusing consent means the how-to inquiry feature cannot be used, but other customer-support features such as 1:1 inquiry remain available.
2. Access to device features for mobile app functions (OS app permissions)
The Company uses Android OS permissions to access certain features and data on the user’s device. These access permissions may be allowed or denied directly by the user in the operating system (OS) settings, and when allowed they are processed only temporarily within the stated purposes of collection and use.
| Category / Permission | Purpose and Method of Processing | Information Collected and Used | Information Not Collected or Stored |
|---|---|---|---|
| Phone status check and call control (`android.permission.READ_PHONE_STATE`, `android.permission.ANSWER_PHONE_CALLS`) | For older smartphone users who find it difficult to end an existing connected call and then place a new call: when the user taps the phone button on the widget, to check whether an ongoing call exists and, if so, end it (`TelecomManager.endCall`) | Call status information (idle/in-call level information) | Other party’s phone number, call content, call logs, and contacts ※ This app does not place calls itself; the contacts button launches the system phone app (`Intent.ACTION_DIAL`). The `android.permission.CALL_PHONE` permission is not used. |
| Notifications and foreground service (`android.permission.POST_NOTIFICATIONS`, `android.permission.FOREGROUND_SERVICE`, `android.permission.FOREGROUND_SERVICE_CAMERA`, `android.permission.FOREGROUND_SERVICE_MEDIA_PLAYBACK`) | To display schedule notices, emergency/prolonged non-use alerts, and screen-update notices, and to provide guardian video-call (video assistant) request alerts (including Foreground Service notifications and TTS guidance) | Push notification token (FCM token) and device/account identifiers needed to receive notifications | Retained for the Service use period or until logout/token refresh; unnecessary device information beyond notification delivery is not collected |
| Camera and microphone (`android.permission.CAMERA`, `android.permission.RECORD_AUDIO`) | To perform the guardian-requested video assistant (video call) feature (processed not immediately upon first app launch, but only when a video-call request is accepted or pre-consented auto-accept runs) | Real-time video and audio streams during a video-call session, and in-session display data (such as images) | Processed only temporarily for real-time call relay; recording/audio files are not stored on servers or retained permanently (destroyed immediately when the call ends) |
| System settings and control (`android.permission.ACCESS_NOTIFICATION_POLICY`, `android.permission.WRITE_SETTINGS`, `android.permission.VIBRATE`, `android.permission.MODIFY_AUDIO_SETTINGS`) | To switch sound/vibration modes in the app, adjust ringtone volume, and apply the user-selected screen brightness to the device | None (used only to change device settings) | No personal information is collected or transmitted to external servers |
| Foreground Service (`android.permission.FOREGROUND_SERVICE_CAMERA`, `android.permission.FOREGROUND_SERVICE_MEDIA_PLAYBACK`) | To maintain stable camera streaming during video calls, and media (guidance audio) features such as schedule and video-request TTS | Same | Same |
Article 3 (Methods of Collecting Personal Information)
The Company collects personal information by the following methods.
- Direct input or submission by the Member during membership registration, information changes, payment, schedule registration, or content upload on the website
- Automatic generation and collection when the Member installs the app on the Smartphone User (Protected Person)’s device, logs in, or links the device to an account
- Collection of UI usage history automatically generated when the Smartphone User (Protected Person) uses app features
- Receipt of transaction information necessary for payment confirmation and subscription management from KG Inicis or Paddle
- Automatic generation of IP address, access date/time, device/browser information, and security logs when accessing the website or app
- Collection based on optional functional consent: Automatically generating and receiving smartphone usage pattern (action log) data according to in-app functional consent settings
- Registration and device application of an Ordinary Message matching whitelist by the guardian on the web, or transmission by the Smartphone User (Protected Person) of whitelist-matched Ordinary Messages to the guardian via the guardian-sharing feature
- Automatic generation and collection of a visit identifier, traffic-source information, and landing-page usage events after the user consents to cookie use on the web advertising landing page (to identify visitor traffic sources and to use conversion data to measure advertising performance)
- Direct entry and submission by the Member of inquiry text and attached images on the web customer-support (1:1 inquiry) screen
- Provision of the email address to Crisp IM SAS to respond to the inquiry after the Member consents when using the how-to inquiry (live chat) feature on web customer support
Article 4 (Processing of Smartphone Users (Protected Persons)’ Personal Information and Functional Consent Notice)
App UI usage history of a Smartphone User (Protected Person), and Ordinary Message matching information that the user has shared with the guardian, is personal information about that Smartphone User (Protected Person). When the app is installed on the Smartphone User (Protected Person)’s device and the user logs in for the first time, the Company informs the user of the following and obtains consent.
1. Matters regarding provision to guardians
- Recipient: The guardian who is the Member linked to that smartphone
- Information provided: Records of app feature clicks and interactions within the most recent 1 month, and smartphone usage patterns and prolonged non-use status derived from those records; and, among Ordinary Messages, whitelist-matched messages (such as sender, message body, and received time) that the Smartphone User (Protected Person) has shared with the guardian via the guardian-sharing feature
- Purpose of provision: Providing Service features so the guardian can check smartphone usage status and offer necessary assistance
- Retention and use period: UI usage history is retained for 1 month from collection. Shared Ordinary Message matching information is retained until the Member deletes it or membership is withdrawn. Destroyed immediately upon membership withdrawal or when the smartphone is unlinked from the account
- Right to refuse consent and consequences: The Smartphone User (Protected Person) may refuse consent to personal information processing and provision to the guardian. However, related features such as usage pattern inquiry, prolonged non-use alerts, and Ordinary Message guardian sharing cannot be used if consent is refused.
2. Functional consent item (collection and upload of smartphone usage pattern action logs)
This item is not an Android OS mandatory permission prompt. It is a Service functional consent that the user expressly chooses on login or in-app settings screens.
- Purpose of processing: To analyze seniors’ (smartphone users’) screen and button usage patterns for guardian guidance and Service improvement.
- Categories collected: Time-series logs of button and screen touches within the app/widget (touch time, touched feature codes, etc.)
- Excluded from collection: Call content, original camera video, location information (GPS), and other core private-life data are not included in the action-log categories collected under this functional consent. Service Message bodies, and Ordinary Message bodies that have not been whitelist-matched and guardian-shared, are not collected as action logs.
- Consent and withdrawal: Data is collected and uploaded to the server only when the user consents via the web/app UI usage pattern upload consent setting (Android.setUploadUseLogConsent). The user may withdraw consent (switch to non-consent) at any time. After withdrawal, subsequent log uploads stop immediately, and local logs waiting on the device are securely destroyed.
- Consequences of non-consent: Usage pattern logs are not sent to the server, and there is no restriction or disadvantage to other essential basic app features as a result.
Members must not view or use a Smartphone User (Protected Person)’s information without their consent, or beyond the original Service purposes. Members must have lawful authority to install and link the app on such user’s device, and the Company may request confirmation of this authority and consent when necessary.
Article 5 (Provision to Third Parties and Payment Service Providers)
As a rule, the Company does not provide personal information to third parties beyond the scope stated in this Policy. Exceptions apply where the data subject has given prior consent, where a special provision of applicable law exists, or where permitted by law to prevent an imminent risk to life or body.
If the user consents to cookie use on the web advertising landing page, the Company provides personal information to a third party as follows in order to use conversion data to measure advertising performance.
| Recipient | Categories provided | Purpose of provision | Retention and use period |
|---|---|---|---|
| Meta Platforms, Inc. | Ad-click identifier (fbclid), conversion event type (such as CompleteRegistration for membership registration and Purchase for payment), time of the conversion, and, where applicable, payment amount | Measuring advertising performance, including whether an ad visit leads to registration or payment, and optimizing ads | The period set out in Meta’s privacy policy (typically up to about 6 months) |
The Company does not provide email addresses or Member identifiers (user_id) to Meta in the provision above. If the user declines cookie use, conversion data is not provided to Meta.
If the Member consents when using the how-to inquiry (Ask an agent directly) feature on web customer support, the Company provides personal information to a third party as follows in order to respond to the inquiry.
| Recipient | Categories provided | Purpose of provision | Retention and use period |
|---|---|---|---|
| Crisp IM SAS | Email address | Providing the how-to inquiry (live chat) feature and responding to the inquiry | The period set out in Crisp’s privacy policy. Provision stops when the Member withdraws consent or membership is withdrawn |
The Company does not provide the email address to Crisp unless it has obtained consent to use the how-to inquiry feature. Refusing consent still allows use of other customer-support features such as 1:1 inquiry.
Payments are processed through Paddle.com Market Limited, the Merchant of Record, and related payment affiliates. Payment method information such as credit card numbers, card expiration dates, and card security codes is transmitted directly from the user’s browser or Paddle payment screen to Paddle. The Company does not collect or store full payment method information. For payment confirmation, subscription management, and refund processing, the Company receives from Paddle the transaction information it needs, such as the payment ID, purchased product, payment amount, and payment/refund status and date/time.
Article 6 (Outsourcing of Personal Information Processing)
To provide the Service smoothly, the Company outsources personal information processing to external processors as follows.
| Processor | Outsourced Work | Personal Information Outsourced | Retention and Use Period |
|---|---|---|---|
| Cloudflare, Inc. | Service hosting, data storage and transmission, network security, access and security log processing, and incident response | All Service collection categories stated in Article 2 of this Policy and access information | Until membership withdrawal or until the service contract between the Company and the processor ends (including retention of app member information, device registration information, and usage pattern logs) |
| Backblaze, Inc. | Backup storage of daily full database snapshots and recovery in the event of failure or disaster | All personal information included in full database snapshots | Automatically deleted after retention of up to 30 days from snapshot creation |
| LiveKit, Inc. | Real-time video/audio streaming relay for the guardian video assistant | Real-time video and audio data streams | Extinguished immediately after real-time relay without storage |
| Google LLC (Firebase) | Sending notification messages (FCM push) | FCM token and device identifiers | Until membership withdrawal or until push synchronization on the device is disabled |
| Paddle.com Market Limited and related payment affiliates | Payment processing, payment confirmation, recurring billing, cancellation/refund, and fraud prevention | Transaction information such as email address, payment ID, purchased product, payment amount, and payment/refund status and date/time | The period set out in Paddle’s privacy policy and applicable law |
When entering into outsourcing contracts, the Company specifies in writing, in accordance with applicable law, matters concerning personal information protection, prohibition of processing for other purposes, technical and administrative safeguards, restrictions on re-outsourcing, management and supervision of processors, and liability for damages, and manages and supervises processors’ personal information processing.
Article 7 (Cross-border Transfer of Personal Information)
In using hosting, data backup, real-time relay, notification, overseas payment, advertising-performance measurement, and live-chat services necessary to perform the Service agreement, the Company transfers personal information abroad.
1. Cloudflare
- Recipient: Cloudflare, Inc.
- Destination countries: The United States and locations of global network data centers used depending on Service access paths
- Personal information transferred: IP address, access date/time, browser/OS information, security logs, and information stored in Service hosting databases
- Purpose and method: Service hosting, data storage/transmission, and security processing / continuous automatic transmission over an encrypted network
- Retention and use period: Until membership withdrawal or until the Company’s service contract with Cloudflare ends
2. Backblaze B2
- Recipient: Backblaze, Inc.
- Destination country and region: United States, US West region
- Personal information transferred: Personal information included in daily full database snapshots
- Purpose and method: Data backup and failure/disaster recovery / encrypted automatic transmission once per day
- Retention and use period: Up to 30 days from the creation date of each snapshot
3. LiveKit
- Recipient: LiveKit, Inc.
- Destination countries: The United States and locations of global cloud servers used for real-time relay
- Personal information transferred: Real-time video and audio data streams for connecting and relaying video-call sessions
- Purpose and method: Real-time video and audio streaming relay for the guardian video assistant / automatic transmission over an encrypted real-time communications network
- Retention and use period: Processed only temporarily for real-time call relay; not stored on servers and destroyed immediately when the call ends
4. Google Firebase
- Recipient: Google LLC
- Destination countries: The United States and locations of the global notification serving network
- Personal information transferred: FCM token and device identifiers for receiving notifications
- Purpose and method: To securely deliver real-time Service notification messages (FCM push) to the user’s device / continuous automatic transmission over an encrypted network
- Retention and use period: Until membership withdrawal or until push synchronization on the device is disabled
5. Paddle
- Recipient: Paddle.com Market Limited and related payment affiliates
- Destination countries: The United Kingdom, the United States, Ireland, and other countries where Paddle performs its services
- Personal information transferred: Email address, payment reconciliation information, purchased product, payment amount, and payment/refund status and date/time
- Purpose and method: Overseas payment processing, subscription management, and fraud prevention / encrypted transmission when an overseas payment is made
- Retention and use period: The period set out in Paddle’s privacy policy and applicable law
6. Meta
- Recipient: Meta Platforms, Inc.
- Destination countries: The United States and locations of Meta advertising-performance measurement servers
- Personal information transferred: Ad-click identifier (fbclid), conversion event type (such as registration or payment), time of the conversion, and, where applicable, payment amount
- Purpose and method: Measuring advertising performance and optimizing ads / continuous automatic transmission over an encrypted network when the user consents to cookie use on the web advertising landing page
- Retention and use period: The period set out in Meta’s privacy policy (typically up to about 6 months)
7. Crisp
- Recipient: Crisp IM SAS
- Destination countries: France and locations of Crisp chat service servers
- Personal information transferred: Email address
- Purpose and method: Providing the how-to inquiry (live chat) feature and responding to the inquiry / transmission over an encrypted network when the Member consents to using that feature
- Retention and use period: The period set out in Crisp’s privacy policy. Provision stops when the Member withdraws consent or membership is withdrawn
Article 8 (Statutory Retention of Personal Information)
Even after membership withdrawal or a request for deletion of personal information, if information must be retained under applicable law, the Company stores that information separately from other personal information for the statutory period.
- Records relating to contracts or withdrawal of offers, etc.: Electronic Commerce Act (5 years)
- Records relating to payment and supply of goods/services: Electronic Commerce Act (5 years)
- Records relating to consumer complaints or dispute resolution: Electronic Commerce Act (3 years)
- Records relating to labeling and advertising: Electronic Commerce Act (6 months)
Article 8-2 (Retention of Personal Information to Prevent Abuse)
To prevent abuse of the Service (including duplicate use of free trials and repeated payment cancellations and refunds within 14 days) and to block unlawful use of the Service, the Company retains the following minimum identifying information even after membership withdrawal.
- Retained item: One-way encrypted value (hash) of the email address
- Purpose of retention: Preventing duplicate free-trial use and abuse through repeated refunds within 14 days
- Retention period: 6 months after membership withdrawal (destroyed immediately upon expiry)
Article 9 (Procedures and Methods for Destruction of Personal Information)
When personal information becomes unnecessary because the retention period has expired, the purpose of processing has been achieved, or membership has been withdrawn, the Company destroys that personal information without delay.
Upon membership withdrawal, as a rule personal information other than payment/transaction records that must be retained separately under applicable law and the email hash retained under Article 8-2 to prevent abuse is deleted immediately from the production system. However, if the Member opts in during withdrawal to “temporary retention for account recovery within 30 days,” the data is stored securely and separately for 30 days from the withdrawal date and then destroyed.
Backup snapshots stored in Backblaze B2 for failure and disaster recovery are automatically deleted in an unrecoverable manner 30 days after creation. When restoring the production system, membership withdrawal and deletion history are re-applied so that permanent destruction is maintained. Real-time video and audio streaming data generated during video-assistant calls is not stored and is completely extinguished immediately upon relay.
Article 10 (Use of Cookies and Local Storage)
The Company uses cookies and local storage as follows.
- Essential: Maintaining login status, managing security tokens, storing the display language, remembering the cookie accept/decline choice, and providing essential Service features. Users may refuse cookie storage through browser or mobile device settings; however, refusing strictly necessary cookies may limit login and some features.
- Optional (advertising performance): To identify visitor traffic sources and to use conversion data to measure advertising performance, the Company stores a visit identifier (visit_id) and similar values in cookies and local storage, and retains the landing-visit information stated in Article 2 on its servers. If the user consents, conversion data (such as registration or payment) may be provided to Meta Platforms, Inc. to measure advertising performance (Articles 5 and 7). This information is stored and provided only when the user consents on the web landing page. Declining still allows use of the Service, including viewing the landing page and registering, but the Company does not record that visit’s traffic source or advertising performance and does not provide conversion data to Meta.
Users may accept or decline in the cookie notice on the web landing page.
Article 11 (Rights of Data Subjects and How to Exercise Them)
- Members and Smartphone Users (Protected Persons) may exercise rights against the Company at any time, including requests for access to, rectification of, and erasure (destruction) of personal information.
- Mobile app users may individually revoke each Android OS permission in the device menu [Settings] > [Apps] > [CSSP EasyPhone] > [Permissions]. However, refusing a specific permission may partially limit use of the related features stated in the table under Article 2(2).
- Users may withdraw consent to the “smartphone usage pattern upload” feature at any time through in-app settings or feature screens.
- Right of access to retained information
- Members may directly access their personal information through the individual menus on the Service main screen based on their registered account, as follows.
- Payment history: Available under [Payment Management] on the website main screen
- App UI usage history: Available under [Smartphone Usage Pattern Inquiry] on the website main screen
- Uploaded content: Photos and videos can be viewed directly on the respective feature screens within the Service where they are displayed
- Schedules: Available directly on the schedule and calendar screens within the Service
- Customer support inquiries: Available under [Contact support] in website Support
- However, to prevent malicious bot access, scraping, and excessive consecutive requests that may overload server traffic, and to maintain system stability, lookup access may be automatically restricted temporarily if excessive repeated requests occur within a short period from the same IP address or account.
- Right of rectification of retained information
- Users may directly change or modify their email address and password on the screen reached by clicking [Change Information] on the website main screen.
- If a user wishes to modify account information due to input error or a simple change of mind, the Change Information menu above should be used. However, past device access information and already recorded app UI usage history (smartphone usage patterns) are technical facts of past events and cannot be arbitrarily modified or changed.
- Media files (photos, videos) uploaded by the user are not subject to in-place editing; to change them, delete the existing file on the relevant screen and upload a new one.
- Right of erasure (destruction) of retained information
- Members may request account deletion and destruction through the membership withdrawal feature on the website. Upon a deletion request, all personal information other than payment information that must be retained separately under applicable law, consumer complaint or dispute records that must be retained separately, and the email hash retained under Article 8-2 to prevent abuse (email, password, device information, photos/videos, schedules, UI usage history, Ordinary Message whitelist and shared matched messages, customer-support inquiry records, etc.) is destroyed in a secure manner.
- Smartphone Users (Protected Persons) may request unlinking of the Member account from the smartphone and deletion of their own app UI usage history through the app or the personal information protection department.
Article 12 (Photos/Videos and Third-Party Personal Information)
Members (Guardians) or Smartphone Users (Protected Persons) should upload only photos and videos necessary for use of the Service. If uploaded materials contain third-party personal information, lawful authority or consent must be obtained. The Company does not use photos or videos that users upload for display on Service screens for advertising, marketing, sale, or AI model training. Images attached to customer-support (1:1 inquiry) submissions may, after personal information is masked as stated in Article 2, be used in de-identified form to improve Service quality and advance the technology.
Article 13 (Safeguards for Personal Information)
The Company takes the following technical and administrative measures so that collected personal information is not lost, stolen, leaked, altered, or damaged.
- Encryption of personal information: User passwords are stored with irreversible one-way encryption so that even internal operators cannot identify them. Payment IDs, connected device IDs and similar data, as well as real-time streaming control data, are transmitted and stored over secure channels (SSL/TLS).
- Access control and traffic management: An intrusion prevention system is operated to block external hacking, and server protections such as API rate limiting are applied to prevent unauthorized traffic load.
- Data lifecycle management: Media files and schedule information are stored in isolated secure storage and destroyed upon withdrawal. App UI usage history logs and smartphone usage pattern (action log) data collected under functional consent are managed within a secure time-series log architecture and are automatically destroyed 1 month after collection to minimize retention.
- De-identification of support records: Before using customer-support conversation text or attached screenshots for quality improvement, technology advancement, analysis, or training, the Company automatically masks personal information such as email addresses, phone numbers, names, and device unique identifiers.
Article 14 (Privacy Officer and Contact)
The Company designates a personal information protection officer as follows to oversee personal information processing and handle related inquiries and requests to exercise rights.
| Company Name | TRUIN TECH CO.,LTD. |
|---|---|
| Privacy Officer / Department | CEO (Choi Hyong Chol) / Personal Information Protection Team |
| [email protected] | |
| Phone | 070-4098-7461 |
| Address | 603-75, 18, Mugunghwa-ro, Ilsandong-gu, Goyang-si, Gyeonggi-do, Republic of Korea |
Article 15 (Remedies for Infringement of Rights)
Data subjects may contact the following organizations for consultation, reporting, or dispute mediation regarding personal information infringement. These organizations are separate from the Company. For inquiries and rights requests regarding the Company’s personal information processing, please first contact the Company’s personal information protection department.
- Personal Information Infringement Report Center: 118 (no area code), privacy.kisa.or.kr
- Personal Information Dispute Mediation Committee: 1833-6972, www.kopico.go.kr
Article 16 (Changes to This Privacy Policy)
This Privacy Policy takes effect on September 14, 2026, 00:39:54 UTC.