Privacy Policy

1. Overview

CheckLab (the "Company") values the privacy of FoodCheck AI service (the "Service") users and complies with applicable laws and regulations. This Privacy Policy explains what information we collect, how we use it, how we store it, and your rights.

2. Information We Collect

We may collect the following information when you use the Service:

• Account information: Email address, display name, profile photo (public profile information provided via Google or Kakao sign-in)
• Usage records: Analysis request history, credit usage records, service access timestamps
• Payment information: For paid services, payments are processed through our payment processor (PortOne). We do not directly store sensitive payment information such as credit card numbers. When signing up for a recurring subscription you may optionally enter a mobile phone number; it is passed to the payment processor for the payment record and receipt only and is not stored by us. Only if you separately consent to KakaoTalk notifications (on the subscription sign-up screen or in Settings > Notifications) do we store your mobile phone number and the time of consent
• Uploaded photos: Photos uploaded for food analysis are not stored on our servers after processing
• Launch notification requests: if you sign up to be notified about an upcoming feature, your email address (when not signed in) or account identifier (when signed in) and the requested feature. Used only to send the launch notification and deleted after it is sent or within 1 year of signing up
• Temporary storage of guest analysis results: if you run an analysis without signing in, the full analysis result is kept on our servers for up to 1 hour so you can continue with the same result after signing in, and is deleted afterwards. The uploaded photo itself is not stored

3. How We Use Your Information

Collected information is used only for the following purposes:

• Service delivery: Account management, analysis features, storing analysis history
• Service improvement: Usage statistics analysis, quality enhancement
• Customer support and notifications: Responding to inquiries, delivering notices, and sending KakaoTalk notifications with your consent (credit expiry notice, subscription payment notices). A mobile phone number stored with your consent is also passed to the payment processor for the payment record when a subscription renews

We process personal information based on user consent, performance of a contract for service provision, and compliance with legal obligations.

4. Data Storage & Security

User data is stored encrypted on Supabase (AWS ap-northeast-2, Seoul region). We apply industry-standard security measures (SSL/TLS encryption, RLS policies, access controls). However, no data transmission over the internet can be guaranteed to be completely secure, and users should also take care to manage their account credentials.

5. Third-Party Services

We use the following third-party services to operate. Each service follows its own privacy policy:

• Supabase: Authentication and data storage (supabase.com/privacy)
• Google: OAuth social login (policies.google.com/privacy)
• Payment service: Payments in Korea are processed via PortOne by the payment provider for each method (NHN KCP, Kakao Pay, Toss Pay); international payments are processed by Codapay. Only the minimum information needed for payment (order details, email, name, and mobile phone number if entered) is shared (portone.io, codapayments.com). If you consent to KakaoTalk notifications, your mobile phone number and the notification content are passed to Bizgo (Infobank), an official Kakao messaging partner, and Kakao
• Google Analytics: Service usage statistics and traffic analysis (marketingplatform.google.com/about/analytics)
• Microsoft Clarity: Behavioral analytics, session replay, and heatmaps to improve usability. Usage data is shared with Microsoft (USA) and may also be used for Microsoft's product improvement, security, and advertising (microsoft.com/privacy/privacystatement)

5-1. Cross-Border Data Transfer

We may transfer personal information outside of the country for service provision as follows:

• Recipient: Supabase Inc.
• Country: United States
• Data transferred: Account information, usage records
• Purpose: User authentication and data storage
• Method: Encrypted network transmission during service use
• Retention: Until account deletion or as required by applicable law

We comply with applicable laws when transferring personal information internationally and take necessary measures to protect users' personal information. In addition, usage data may be transferred to the U.S. servers of Google Analytics and Microsoft Clarity, which we use to improve our service, in accordance with each provider's privacy policy.

6. Data Retention

Analysis records are kept until you delete them or delete your account. Free members can view records from the last 30 days in the service, and members who have ever purchased credits can also view older records without a time limit (the history screen shows up to the 50 most recent records). When you delete your account, your personal information, analysis records, meal reports (condition data and report content), and sensitive-data consent records are immediately and permanently deleted, and deleted data cannot be recovered. However, as required by Article 6 of the Enforcement Decree of the Korean Act on Consumer Protection in Electronic Commerce, records of contracts or withdrawals of offers and records of payment and supply of goods (order number, amount paid, product, payment/refund status and time) are stored separately for 5 years and then destroyed. These records contain no condition data or report content. A mobile phone number stored for KakaoTalk notifications is deleted immediately when you turn the notifications off or withdraw consent in Settings > Notifications.

7. Your Rights

You have the following rights:

• Request to access, correct, and delete personal information
• Request to suspend processing and withdraw consent
• Account deletion: You can request account deletion on My Page, and all data will be deleted immediately, except payment records that must be retained by law
• Inquiries: For privacy-related inquiries, please contact support@checklab.ai

8. Cookies & Local Storage

The Service uses cookies to maintain authentication sessions and localStorage to track free-usage counts for non-logged-in users. We also use Google Analytics and Microsoft Clarity to improve our service; these use first- and third-party cookies and similar tracking technologies for visit statistics, usability analysis, and session replay. Usage data collected through these tools may also be used by Microsoft for product improvement, security, and advertising; for details, see the Microsoft Privacy Statement (microsoft.com/privacy/privacystatement).

9. Children's Privacy

This Service is not intended for children under 14 years of age, and we do not knowingly collect personal information from children. If we become aware that we have collected personal information from a child under 14, we will promptly delete that information.

10. Changes to This Policy

This Privacy Policy may be updated due to changes in laws or the Service. Significant changes will be communicated through in-service notices.