Privacy Policy

Data controller

Data controller: Jeon Jun-young (전준영) is the personal-data controller for this website. For privacy questions or access, correction, deletion, or restriction requests, contact [email protected]. This does not establish the salon's legal business name or representative.

Purpose

Purpose: to process questions for consultation confirmation and error handling, and to provide FAQ answers and booking guidance. The question may be sent to OpenAI for embeddings/question analysis and moderation of non-Korean input; the question and prior conversation may be sent for answer generation. Server visit records support website improvement and comparison of promotional traffic channels, not individual advertising targeting. Separately, the Meta Pixel is used to measure the performance of Facebook and Instagram ads and to set ad audiences; details are in the transfers section. They measure document requests for eligible public pages, not actual people or every screen transition.

Fields

Fields: (1) the conversation history stored locally in this browser; (2) the question and prior conversation sent to OpenAI for answer generation, plus the question processed for embeddings/question analysis and moderation of non-Korean input; and (3) server logs used for consultation confirmation and error handling, including the question, answer, language, a random session identifier, and error/processing records. These categories are not represented as completely anonymous information. Server visit records store the site identifier, creation/expiry times, language, fixed page type, allowed channel/source/medium categories, request classification and version, known-route status, and a daily HMAC pseudonymous identifier. IP addresses and User-Agent are processed transiently to create the identifier and classify requests. Referrer (Referer) and campaign parameters are read transiently to assign a traffic-channel category. Visit records do not store raw IP or User-Agent, individual page addresses or queries, referrer addresses or domains, campaign names, individual bot names, device/browser types, or country. The daily identifier is not certified anonymous.

Legal basis

Legal basis: for a reservation or use request, we are reviewing whether Article 15(1)4 of Korea's Personal Information Protection Act (measures necessary to perform or enter into a contract at the data subject's request) applies. For other chatbot processing and consultation-confirmation/error-handling logs, we separately review the requirements for Article 15(1)6 (legitimate interest that clearly overrides the data subject's rights). We do not treat the legal basis for every FAQ interaction or two-year server-log retention as settled; the specific scope and retention basis remain pending operator confirmation. Server visit recording operates separately from analytics-cookie consent. A legitimate-interest basis is under review, including necessity, minimization, retention, and visitors’ rights and impact.

Sections requiring operator confirmation will be updated when confirmed.

Retention and deletion

Retention and deletion: Chatbot server logs are retained for two years and then automatically deleted. Browser conversation history is deleted 30 minutes after the last question or answer while the site is running; if you close the browser, it is deleted on your next visit. Individual server visit records are limited to 180 days (4320 hours) after creation and deleted through daily cleanup. Deleting operational rows and removing provider backup copies may occur at different times; simultaneous complete deletion is not guaranteed.

Optionality

Optionality and effect of not entering a question: entering a question is optional; you can still browse the site, call, or use Naver booking without entering a question. Only the chatbot answer will be unavailable. Server visit records are processed regardless of question entry or analytics-cookie consent. Existing GA4 is a separate measurement feature: it initializes when a measurement ID is configured, and the current implementation does not wait for analytics-cookie consent. If you do not want GA4 measurement, you can refuse it by installing the Google Analytics Opt-out Browser Add-on provided by Google (https://tools.google.com/dlpage/gaoptout). The add-on is for desktop browsers; on phones and other devices you can use your browser's tracking or content blocking features. This site does not provide its own GA4 opt-out button. Deleting GA4 cookies removes the identifier stored in them, but blocking or deleting cookies alone does not stop measurement. Refusing does not limit your use of the site. The Meta Pixel runs when you view a page, without waiting for consent. If you do not want it, you can block transmissions to Meta with your browser's tracking or content blocking features, or use the "Your activity off Meta technologies" setting in Meta Accounts Center so that this activity is not connected to your account. That setting does not stop the site from sending data to Meta. This site does not provide its own Meta Pixel opt-out button.

Rights and contact

Rights and contact: send requests for access, correction, deletion, or restriction of processing to [email protected]. After the minimum verification needed for the request, we will explain the applicable statutory process and outcome. You do not have to provide a UUID that exists only in memory and is not visible to you. Without additional information, a daily pseudonymous identifier alone makes it difficult to connect all historical visit records to a particular person. If relevant records cannot be identified, we explain the scope we can verify and available handling. You do not have to supply the pseudonymous identifier.

Privacy policy

Privacy policy: the Korean page is https://www.junohair-posco.com/ko/privacy. The English, Chinese, and Japanese pages are https://www.junohair-posco.com/en/privacy, https://www.junohair-posco.com/zh/privacy, and https://www.junohair-posco.com/ja/privacy. The translations are not assigned a separate legal priority over one another.

AI notice and input caution

Please do not enter contact, payment, health, or other sensitive information. Confirm booking and price details through official salon channels. Responses are AI-generated and do not provide medical, efficacy, or safety guarantees.

Processors, sharing, and overseas transfers

Processors, sharing, and overseas transfers: OpenAI performs AI processing, including embeddings for question analysis, answer generation, and moderation of non-Korean input; Supabase provides storage; and Vercel provides hosting. Remaining details for chatbot processing—including recipient legal names and contacts, destination countries, fields, timing, method, purpose, retention, and the method and procedure for refusing a transfer and effect of refusal—are still being confirmed. Confirmed visit-record details follow. Describing the disclosure requirements in Article 28-8(2) of Korea's Personal Information Protection Act does not establish that an overseas transfer satisfies those requirements or is lawful. For visit-record storage, the recipient is Supabase Pte. Ltd. (corporate location: Singapore; [email protected]), with a database region in Tokyo, Japan. Hosting is provided by Vercel Inc. (United States; [email protected]); the confirmed function region is iad1, United States. At an eligible public-page document request, Vercel transiently processes request information including IP and User-Agent, then sends the minimized visit fields above to Supabase over HTTPS for website improvement and channel comparison. Individual records are limited to 180 days; residual provider hosting/security logs and backups have separate conditions, so complete removal timing is not asserted. Send transfer questions, objections, or restriction requests to [email protected]. To avoid overseas hosting processing of website requests, stop accessing the website. The rights section explains identification limits and request handling. The overseas-transfer basis and remaining disclosure conditions for visit records are still under review; this notice alone does not establish compliance. The recipient for visit analytics (GA4) is Google LLC (United States). Page views (including the previous page address), click events on booking, directions, menu and messenger buttons, events such as scrolling and outbound link clicks that GA4 measures automatically depending on the property settings, a cookie-based client identifier, browser and device information, and an approximate location estimated from the IP address are processed in Google data centers worldwide. Only predefined UTM category values (for example, naver or cpc) are sent as is; other values are dropped or replaced with "present". See the optionality section for how to refuse GA4 measurement. The recipient for ad measurement (Meta Pixel) is Meta Platforms, Inc. (United States). It is used to measure the performance of Facebook and Instagram ads and to set ad audiences. Page view events, the visited page address and the previous page address, page information such as title and description, screen size and time zone, a cookie identifier (_fbp) and an ad click identifier (_fbc), browser and device information, and the IP address are sent to Meta. Depending on Meta settings, the salon phone numbers shown on the page may also be sent as hashed values. Retention follows Meta's policy. See the optionality section for how to refuse the Meta Pixel.

Sections requiring operator confirmation will be updated when confirmed.