Privacy Policy

코딕스(CODIX) ("the Company") complies with the Personal Information Protection Act, the Act on Promotion of Information and Communications Network Utilization and Information Protection, and other relevant laws of the Republic of Korea, and operates this Privacy Policy to safeguard members' personal information.

1. Categories of Personal Information Collected

The Company collects the following personal information for member registration and service provision.

2. Methods of Collection

• Input via the sign-up form or external authentication providers (Google, Kakao, etc.)
• Direct input during service use and via automated collection tools
• Transferred from the payment processor during payment method registration
• Automatic extraction from AI consultation conversations (AI memory and life event records). Automatically extracted life event records are stored only as “unconfirmed” until the member confirms them.
• Direct entry by users in a request form provided by an advertising platform (Meta)

3. Purposes of Use

• Member identification and authentication; service provision and operation
• Birth chart calculation and AI analysis response generation
• Paid subscription management, payment processing, refunds, and fraud prevention
• Service quality improvement, new feature development, statistical analysis
• Customer inquiry response and notice delivery
• Publishing member-written reviews within the Service and using them to present and promote the Service (display names are masked so that only the first character remains)
• Generating and providing compatibility analyses using birth information submitted by non-members who respond to an invitation link, and preventing abuse
• Determining the minimum age applicable to a non-member who responds to a compatibility invitation, based on the country of access
• Analyzing Service usage statistics, measuring advertising performance and showing personalized advertising on advertising platforms
• Calculating and providing the day's flow requested by users of the pre-sign-up "Try today's flow" preview, limiting request volume, and determining the minimum age by country of access
• Calculating the birth chart and a chart for the moment of the question, preparing the reading and sending it by email for non-members who request a free reading through an ad request form

4. Retention and Use Period

• Member information: until the member withdraws. Where there is just cause such as fraud prevention, information may be retained for the period prescribed by applicable law.
• E-commerce related records: retained for the following periods under the Korean Act on Consumer Protection in Electronic Commerce.
  • Records of contracts or withdrawal of subscriptions: 5 years
  • Records of payment and supply of goods: 5 years
  • Records of consumer complaints or dispute resolution: 3 years
• AI memory (RAG): 90 days from the date of storage on the Free plan; for other plans, retained until the member deletes it or closes their account — members may delete it at any time. From the effective date of this amendment, AI memory content that constitutes sensitive information, such as health, sex life or sexual orientation, is extracted and stored only if the member has given separate consent to health-category records. Once consent is withdrawn, no further such content is extracted; content stored before the withdrawal is not deleted automatically, and the member can delete it directly.
• Life event records: retained until the member deletes them, deletes the profile they belong to, or closes their account. Members can edit and delete them directly, and they are included in the data export. Health-category records are stored only with the member's separate consent, and whether they are used in consultations is set separately in Settings. Automatically extracted records remain visible only to the member until confirmed, are not used as reference material for AI consultations, and are deleted if not confirmed within 90 days. Life event records are kept independently of the AI memory setting, and only records the member has confirmed are used in consultations.
• Access logs: 3 months under the Korean Protection of Communications Secrets Act
• Information of non-members who respond to a compatibility invitation: where storage is not consented to, birth information is deleted immediately after the analysis is generated, and the analysis and display name are deleted 30 days after the invitation link was created. Where storage is consented to, the information is retained until the inviting member deletes it or closes their account.
• Birth details entered in the pre-sign-up “Personality preview”: discarded on the server immediately after the calculation and not stored. They remain only in the user’s browser for 30 days to pre-fill the sign-up form, and are deleted once sign-up is completed.
• Information received through ad request forms: 30 days after the reading is sent, the Company destroys the copies it holds (the downloaded list of applications, the profiles and charts created to prepare the reading, the AI conversation records from preparing the reading and the records derived from them, and the emails sent and replies received). Applications for which no reading could be sent within 30 days of the application date are destroyed when that period ends, and applications to which a reading cannot be sent (such as those from persons under 14) are destroyed as soon as this is confirmed. The Company cannot itself delete application records that remain in Meta’s lead form storage; Meta deletes them after the retention period it sets.
• Right to data portability: You can download your personal data as a ZIP archive at any time to transfer it to another service. Request from Settings > Data; a download link is sent by email and expires in 24 hours.
• Destruction procedure and method: personal information is destroyed without delay once the retention period has elapsed or the purpose of processing has been achieved. Electronic files are deleted by means that make recovery impossible, and any printed materials are shredded or incinerated. Information retained under a legal obligation is destroyed in the same manner once that period ends.

5. Provision of Personal Information to Third Parties

As a rule, the Company does not provide the personal information of users — members and non-members alike — to third parties, and does so only in the cases listed below and in the provision arising from the compatibility invitation feature set out beneath them.

• When the user has given prior consent
• When required by law or by an investigative authority through lawful procedures

6. Outsourcing of Personal Information Processing

The Company outsources personal information processing as follows for service provision.

As shown in the table above, some trustees are located outside the Republic of Korea. Details of international transfers are set out in Section 9.

7. Rights of Data Subjects and How to Exercise Them

Members may exercise the following rights at any time.

• Request access, correction, or deletion of personal information
• Request suspension of personal information processing
• Withdraw membership (can be done directly via the in-service settings page or customer support)

Rights may be exercised directly within the service or by contacting customer support ([email protected]).

Non-members without an account may also exercise the same rights. Those who responded to a compatibility invitation may use the channel described in Section 10, and those who requested a reading through an ad request form may reply to the reading email they received or contact customer support ([email protected]). For requests from those who applied through an ad request form, identity is verified by whether the request is sent from the email address used in the application.

Remedies for infringement: you may seek redress for personal information infringements from the data protection supervisory authority or dispute resolution body in your jurisdiction. In the Republic of Korea these are the Personal Information Dispute Mediation Committee (kopico.go.kr) and the Privacy Infringement Report Centre (privacy.kisa.or.kr).

8. Safeguards for Personal Information

• Passwords are stored using a one-way hash algorithm (bcrypt); the original cannot be recovered.
• All communication channels are encrypted with HTTPS/TLS.
• Database access is restricted to authorized backend servers, with Row Level Security ensuring members can access only their own data.
• Birth information, conversation history, and other data are stored in databases under the access controls above and are not exposed externally.
• Administrator access logs are recorded and regularly reviewed to monitor for abnormal access.
• Authorized administrators may review pseudonymized conversation content for the purposes of service quality improvement, security, and legal compliance. Personally identifiable information in messages is automatically masked, and every access is recorded in an audit log.
• Where the Company outsources personal information processing, it sets the scope of the outsourced work and the required safeguards by contract, and supervises whether the processor handles personal information securely.

9. International Data Transfers

The Company transfers personal information outside the Republic of Korea in order to provide the Service. The details are as follows.

• Legal basis for transfer: the Company transfers personal information overseas for the purpose of outsourced processing and storage, to the extent necessary to enter into and perform its contract with you, under Article 28-8(1)3 of the Personal Information Protection Act of the Republic of Korea, and discloses the matters listed in Article 28-8(2) of that Act in this policy.
• Recipients: the overseas processors listed in the table in Section 6 and the advertising business (Meta) described in Section 1, item D
• Countries of transfer: the United States, Japan, India, Ireland, and the countries determined under the final item of this section (each processor's location is shown in the table in Section 6)
• Timing and method of transfer: transmitted on an ongoing basis over encrypted connections (HTTPS/TLS) as you use the Service
• Items transferred: as listed under ‘Information Processed’ in Section 6
• Purpose: limited to performing the outsourced work listed in Section 6
• Retention period: as set out in Section 4; data are destroyed once they are no longer needed for the outsourced work
• How to object: you may object to international transfers by contacting customer support. However, because these processors are essential to providing the Service, objecting means you will need to close your account or stop using the relevant features. Non-members who responded to a compatibility invitation may request deletion of their information through the channels set out in Section 10, and non-members who requested a reading through an ad request form may do so by the methods set out in Section 7.
• Where the processing country cannot be identified in advance: the AI model the Company uses is offered only through a route that does not allow a region to be specified, so the country in which an individual request is processed is determined by how the model is operated at the time of the request and cannot be identified in advance. Content delivery network traffic may likewise be processed in a region close to the user. The countries concerned fall within the service regions published by each processor, and if you contact customer support we will tell you the scope as at the time of your enquiry together with the contact details of each processor. Regardless of the processing country, the same data processing agreement concluded between the Company and each processor applies, under which the processor is bound by obligations on security, confidentiality and control of sub-processing, and under which Google does not use this information to train its AI models.

For users in the European Economic Area and the United Kingdom, transfers are made under Standard Contractual Clauses (SCCs, including the UK Addendum where applicable) or another transfer mechanism recognised by applicable law, and a copy can be made available to you on request to customer support. Regardless of where you are located, you may exercise your rights as a data subject at any time as described in Section 7, and you have the right to lodge a complaint with your local supervisory authority.

10. Processing of Personal Information of Non-Members Who Respond to a Compatibility Invitation

The Company processes the personal information of users who respond to a compatibility invitation link without creating an account (‘non-members’) as follows.

• Controller: the Company is the controller of non-members' personal information. The fact that the analysis is stored in the inviting member's account does not make that member the controller.
• Legal basis: generating and delivering the compatibility analysis is necessary to perform the service the non-member requested (GDPR Art. 6(1)(b)). Continued storage of the non-member's birth information in the inviting member's account rests on the separate consent obtained on the input screen (Art. 6(1)(a)).
• Withdrawal of consent: a non-member who consented to storage may withdraw that consent at any time through the channel below. Withdrawal does not affect the lawfulness of processing carried out before it, and does not restrict access to the analysis already provided.
• International transfers: a non-member's birth information and analysis request are processed through the processors listed in Section 6, and Section 9 applies to those transfers in full.
• Age: the Service is not directed to children under 13 and we do not knowingly collect their personal information. In any case, persons under 14 may not respond to a compatibility invitation, and the Company verifies this from the date of birth entered. Where the applicable age in your country of residence is higher, or where the Company applies a higher age based on the country of access, you may not use this feature until the age shown on the invitation screen is reached.
• No detriment: declining to consent to storage places no restriction whatsoever on viewing the compatibility analysis.
• Supervisory authority: you may lodge a complaint with the data protection supervisory authority in your jurisdiction. In the Republic of Korea this is the Personal Information Protection Commission (privacy.go.kr); infringements may also be reported to the Privacy Infringement Report Centre (privacy.kisa.or.kr).
• Who can view the result: the compatibility result page can be opened by anyone holding the invite link. Access is blocked once the link expires or the inviting member closes it.

Exercising your rights: without an account or login, non-members may use the following channels. To withdraw only the storage consent, use ‘Delete only the saved information’ on the result screen — you will still be able to view the analysis. To erase the result and the conversation as well, use ‘Request deletion of my data’. After the invitation link has expired, please contact customer support ([email protected]). Possession of the invitation link serves as the means of identity verification.

11. Personal Information Protection Officer

12. Changes to This Policy

When this Privacy Policy changes, the Company posts the full amended text on this page, records the change and its effective date in the revision history below, and the change takes effect upon posting. Processing that requires the member's consent (such as the processing of sensitive information) does not begin through a policy change alone; separate consent is obtained on the screen where that processing starts.

13. Revision History

• Effective 2026-11-04 — Amendments to Articles 1 and 3: aligned the items collected through the ad request form with the actual form (place of birth → city and country, and explicit listing of the time of the request); clarified that the city submitted through the form was treated as the place of birth when preparing readings, including for requests made before this effective date; and added the calculation of a chart for the moment of the question (applies only to requests made on or after this effective date)
• Effective 2026-11-03 — Amendment to Article 1: added to the items collected, for non-members who applied through the ad request form, whether they clicked the button in the reading email and the time of their first click (email opens are not recorded)
• Effective 2026-10-31 — Amendments to Articles 1, 3, 4 and 6: aligned the items collected through the ad request form with the actual form (name → nickname, time of birth → a birth-time range chosen from two-hour options, and removal of the email-updates consent item and its retention — no email other than the reading email is sent)
• Effective 2026-10-31 — Amendments to Articles 1, 2, 3, 4, 6, 7 and 9: added the processing of information of non-members who request a free reading through the request form in a Meta ad (items collected, legal basis, purposes of use, a retention period of 30 days, Meta as a processor, and how to exercise rights)
• Effective 2026-10-25 — Articles 1 and 4 amended: the pre-sign-up preview changed from “Try today’s flow” to the “Personality preview”. Sex is no longer collected, and time of birth and birthplace became optional (handling unchanged — discarded right after the calculation, not stored on the server)
• Effective 2026-10-24 — Articles 1, 3 and 4 amended: added the handling of birth details from users of the pre-sign-up "Try today's flow" preview (discarded right after the calculation, not stored on the server) and the item kept in browser storage
• Effective 2026-10-21 — Amendments to Articles 1, 3, 6 and 9: added to Article 1 the items collected, the collection method, the retention period and how to refuse for the analytics and advertising cookies (Google Analytics, Meta Pixel) and behavioral data used for visit statistics and advertising performance measurement; added the purpose of use and the Google Analytics processing arrangement; listed Meta as an advertising business that collects behavioral data directly and added Ireland to the countries of transfer. Specified that users in the European Economic Area, the United Kingdom and Switzerland are tracked only after consent, and that users elsewhere can refuse via ‘Cookie settings’
• Effective 2026-10-12 — Amendments to Articles 1, 2, 4 and 6: added life event records (the date, category and title of past events together with the timing information computed in each system) to the items collected, added automatic extraction from AI consultation conversations to the collection methods, and specified the retention period (until deletion by the member, deletion of the profile or account closure), separate consent for the health category, non-use of automatically extracted records before confirmation and their deletion after 90 days, and the separate-consent condition for extracting sensitive information into AI memory
• Effective 2026-10-12 — Amendment to Article 12: the change notice method was revised to posting on this page, recording in the revision history and effect upon posting, and it was made explicit that processing requiring consent is obtained through a separate consent screen
• Effective 2026-08-29 — Amendments to Articles 1 and 6: added buyer verification details (name and mobile phone number) to the items collected and to the data handled by our payment processors (PortOne, KG Inicis/KakaoPay) — entered at checkout for payments in Korea or taken from the name provided by social login, and stored to auto-fill future payments. Retention is unchanged: until membership withdrawal (Article 4)
• Published 2026-08-26 — Correction to the stated effective date: the Compatibility Invitation feature has been available since August 3, 2026, but the effective date shown for the corresponding provisions of this Policy read October 1, 2026. We are correcting it to August 3, 2026 to match the date on which processing actually began. The full revised text was published on this page on August 3, 2026, before the feature became available, and the personal data of non-members who responded to an invitation was processed in accordance with the collection and use notice and the consent presented on the invitation screen. This correction does not change the categories collected, the purposes of use, the retention period, provision to third parties, or overseas transfers.
• Effective 2026-08-26 — Amendment to Article 4: the stated retention period for AI memory (RAG) was corrected to match actual processing (90 days from the date of storage on the Free plan; for other plans, until the member deletes it or closes their account)
• Effective 2026-08-18 — Amendment to Articles 6 and 9: added the error-diagnosis, hosting, and cache processors already used in operating the service to the table, and listed the countries to which data is transferred
• Effective 2026-08-10 — Sections 6, 8, 9 and 12 revised: added provisions on the countries in which AI model inference is processed, stated the legal basis for international transfers, revised how processor locations are described, added a processor supervision clause, and added a same-day effect proviso to the change notice clause
• Effective 2026-08-03 — Revised for the compatibility invitation feature: new section on processing non-members' personal information, revised third-party provision section, detailed international transfer disclosures, and processor locations added, new destruction procedure and infringement remedy sections, and added disclosures on browser storage and cookies
• Effective 2026-07-28 — Added the purpose of using member reviews to introduce and promote the Service