- We process only the birth details, consultation content, and account and payment information needed for saju calculations and consultations, and collect no advertising, location or behavioral data.
- To write AI answers, the needed information is sent to an external AI service; neither we nor the provider use it to train models.
- When you request account deletion in the app, your account, birth details and consultation history are deleted automatically after 7 days.
About this policy
Seedbox LC (시드박스 유한회사) (the ‘Company’) sets out and publishes this Privacy Policy to comply with Korea's Personal Information Protection Act (PIPA) and other applicable law and to protect users' personal information and rights. It applies to the Ari mobile app, the ari.day website and related services (the ‘Service’).
1. Why we process personal information
We process personal information only for the following purposes. If a purpose changes, we take the steps PIPA Article 18 requires, such as obtaining consent in advance.
| Purpose | What it covers |
|---|---|
| Accounts | Guest use, sign-in and identity checks, linking guest history to a member account, account deletion |
| Saju and AI consultations | Calculating charts, luck cycles, daily fortune, compatibility and name readings; writing consultation answers with generative AI; keeping consultation history |
| Paid services | Verifying marketplace payments; granting, using and expiring subscriptions and credits; handling withdrawals and refunds; preventing duplicate grants |
| Protecting and improving the Service | Preventing excessive requests and abuse, analyzing errors, improving features from usage statistics |
| Support and notices | Handling questions and complaints; announcing important matters such as changes to the terms or this policy |
2. What we process, legal basis and retention
We process only the minimum the Service needs. Nothing is processed on the basis of consent alone; the information below is processed to perform our contract with you or to meet legal duties. If you do not provide it, the related feature is unavailable.
| Category | Items | Legal basis | Retention |
|---|---|---|---|
| Guest use | Hash of the app installation identifier, operating system, language | Contract performance (PIPA Art. 15(1)(4)) | 7 days after an account deletion request |
| Sign-in | Account identifier from the sign-in provider (Apple, Google, Kakao, Naver), email address, name or nickname (if provided), whether Apple Hide My Email is used | Contract performance (PIPA Art. 15(1)(4)) | 7 days after an account deletion request |
| Email-code sign-in | Email address, code issuance records | Contract performance (PIPA Art. 15(1)(4)) | 1 day after issuance |
| Saju profiles | For you and up to seven relationship profiles: name, real name or nickname, relationship, gender, birth date, birth time or that it is unknown, solar or lunar calendar and leap month, birth country and city, birthplace latitude and longitude, time zone, time-correction setting | Contract performance (PIPA Art. 15(1)(4)) | Until you delete them, at the latest 7 days after an account deletion request |
| AI consultations | Questions, answers, topic, a copy of the profile used | Contract performance (PIPA Art. 15(1)(4)) | 7 days after an account deletion request |
| Payments | Marketplace product and transaction identifiers, subscription status and periods, a hash of the Google Play purchase token, credit and entitlement history, refund handling records (operator who handled it, reason) | Contract performance (PIPA Art. 15(1)(4)); Korean E-Commerce Act Art. 6 | Unlinked from the account at deletion, then 5 years |
| Attendance and coupons | Attendance dates, stars, coupon issuance and use | Contract performance (PIPA Art. 15(1)(4)) | 7 days after an account deletion request |
| Consent records | Kind, document version, time and device type of your terms agreement and of granting or withdrawing AI permission | Contract performance (PIPA Art. 15(1)(4)) | 7 days after an account deletion request |
| Operator records | Identifiers of accounts and transactions an operator viewed or acted on, the reason for the action, and the time | Legal obligation (PIPA Art. 15(1)(2): access records required by the security measures of Art. 29) | 2 years |
| Usage statistics | App version, operating system, language, country code, predefined usage events and values (no free text such as questions or answers) | Legitimate interests (PIPA Art. 15(1)(6)): improving the Service | 400 days after collection, or at account deletion |
| Request limits | Hash of the IP address | Legitimate interests (PIPA Art. 15(1)(6)): protecting the Service | 7 days |
| Error reports | Error type, app version, runtime environment (only in app builds with error reporting on) | Legitimate interests (PIPA Art. 15(1)(6)): error analysis | 90 days |
| Support | Email address, message, outcome | Contract performance (PIPA Art. 15(1)(4)); Korean E-Commerce Act Art. 6 | 3 years (records of consumer complaints and disputes) |
How we collect it: you enter it in the app; your sign-in provider gives it to us; we verify marketplace payments; or it is generated as you use the Service.
Before entering another person's information for compatibility or a relationship profile, get that person's consent. We process it only as needed for saju calculations and consultations.
3. What we do not collect
We do not collect the following.
- Device location: the app does not ask for location permission. Birthplaces are found from the city name you type; our server sends only the search term to OpenStreetMap (Nominatim) and nothing that identifies you.
- Voice recordings: with voice input, your device or operating system's speech recognition (Apple or Google) turns speech into text, and we receive only the text you choose to send.
- Profile photos: a photo you pick stays on your device and is never sent to our servers.
- Advertising and behavioral data: the Service shows no ads, collects no advertising identifiers (IDFA or advertising ID) or behavioral data for targeted ads, and does not track you across other apps or websites.
- Payment details: Apple or Google processes card numbers and other payment details; we never receive them.
- Health app data: if you allow it, the app reads sleep time, heart rate variability and step count from your device's health app (Apple Health on iPhone, Health Connect on Android) and uses them on your device to shape the day's advice. This data is never sent to our servers or stored by us, and is not used for advertising or any other purpose. On iPhone, if you allow it, the mood from your evening check-in is written to State of Mind in the Health app (iOS 18 or later). On Android the app only reads from Health Connect and writes nothing to it. You can turn the connection off at any time in the app's settings or in the Health app or Health Connect settings.
4. Generative AI
We use an external generative AI service to write AI consultation answers. What we entrust to it and the transfer abroad are described in 7. Processors and 8. International transfers.
We send the AI only what an answer needs: the chart we calculate (birth date and time, gender, birthplace and coordinates, time zone), your question, recent conversation (up to 10 turns), and your name if name reading is on. We do not send your email, account identifiers or payment information. Before your first AI consultation, the app explains this and asks for your permission, which you can withdraw at any time in Settings → Data and privacy; AI consultations are then unavailable.
We do not use your questions or answers to train AI models, and under their contracts the AI providers do not use your input to train their models either.
Questions and answers are kept as consultation history so you can see past consultations. To delete a particular consultation, write to support@jambo.team.
We do not automatically filter what you type. Do not include sensitive information a reading does not need, such as ID numbers, bank or card numbers, passwords or detailed health records. Please report inappropriate or wrong answers to support@jambo.team.
5. Retention and deletion
We delete personal information without delay when the retention period in section 2 ends or its purpose is met. Information that Korean law requires us to keep is unlinked from your account and stored separately:
- Records of contracts and withdrawals: 5 years (Act on Consumer Protection in Electronic Commerce)
- Records of payment and supply: 5 years (same act)
- Records of consumer complaints and disputes: 3 years (same act)
When you request account deletion, you are signed out at once and your account and related information are deleted automatically after 7 days. The 7-day grace period lets you withdraw a request made by mistake or by someone else.
How we delete: electronic files are removed from the database so they cannot be restored. Database copies made before server updates are limited to the latest 14 and removed automatically, oldest first. We hold no personal information on paper.
6. Sharing with third parties
We do not share personal information with third parties, except where a law specifically requires it, where it is unavoidable to meet a legal duty, or where investigative authorities request it through legal procedures.
Apple, Google, Kakao and Naver sign-in and App Store and Google Play payments are handled by those companies under the terms you agreed with them. We only query them for sign-in tokens and transaction information to verify sign-in and payments, and give them nothing more.
7. Processors
We entrust the following processing to service providers.
| Processor | Task |
|---|---|
| Generative AI service provider | Writing AI consultation answers |
| Google LLC | Sending email sign-in codes (Google Workspace) |
| Cloudflare, Inc. | Encrypted delivery and security of Service traffic |
Our contracts with them (their data processing addenda) prohibit processing beyond the task, require safeguards, restrict sub-processing and set liability, and we supervise their handling of personal information. We update this policy when processors or tasks change.
8. International transfers
For the processing in section 7, we transfer personal information abroad as follows. The legal basis is PIPA Article 28-8(1)(3) (processing entrusted for concluding or performing a contract and disclosed in this policy). Our servers are in Korea.
| Recipient (contact) | Country | When and how | Items | Purpose | Retention |
|---|---|---|---|---|---|
| Generative AI service provider | The US and other countries where the provider has data centers | Over an encrypted connection each time you request an AI consultation | Chart results (birth date and time, gender, birthplace and coordinates, time zone), question, recent conversation, name (if name reading is on) | Writing AI consultation answers | Not kept after the answer is written, except that requests may be kept up to 90 days for abuse monitoring and then deleted |
| Google LLC support.google.com/cloud/contact/dpo | The US and other countries with Google data centers | Over an encrypted connection when you request email sign-in | Email address, code | Sending sign-in codes | Deleted under Google Workspace's sending-log retention policy |
| Cloudflare, Inc. privacyquestions@cloudflare.com | The US and other countries in Cloudflare's network | In real time over an encrypted network while you use the Service | Traffic between the app or web and our servers | Encrypted delivery and security | Not kept after delivery (security logs follow Cloudflare's policy) |
If you do not want your information transferred abroad, you can avoid AI consultations or email sign-in, or request account deletion; those features are then unavailable. Delivery through Cloudflare is essential to the Service, so refusing it means you cannot use the Service.
We have data protection agreements (data processing addenda, standard contractual clauses and the like) with each recipient.
9. Sensitive information, automated decisions, pseudonymized data
- Sensitive information: we do not collect it. If you type health or other sensitive information in a question, it is stored in your consultation history and used to write the AI answer. Consultation history is never made public.
- Automated decisions: AI answers are for reference only, and we make no fully automated decisions with significant effects on your rights or duties (PIPA Article 37-2).
- Pseudonymized data: we do not process pseudonymized information.
10. Your rights and how to use them
You can ask at any time to access, correct, delete or stop processing your personal information, and withdraw consent (PIPA Articles 35 to 37). A legal representative can exercise the same rights.
- In the app: edit or delete saju profiles, and request account and data deletion under 계정 및 개인정보 (Account and privacy) → 데이터 및 개인정보 (Data and privacy).
- By email: send your request to support@jambo.team, even if you cannot sign in to the app.
- Through an agent: a legal representative or authorized person may make a request with a letter of authorization.
We act within 10 days of receiving a request and tell you the outcome. If we refuse or limit a request as the law allows, we tell you why and how to object. Information another law requires us to keep cannot be deleted on request.
11. Security measures
We take the following measures under PIPA Article 29.
- Administrative: we keep the number of people handling personal information to a minimum, and the operator console is designed not to show birth details or consultation content. Operators' access records (operator, time, IP address, account concerned, task) are kept for 2 years and reviewed at least monthly.
- Technical: all traffic is encrypted (HTTPS); only authorized accounts can reach the operator console after authentication; users' device identifiers, IP addresses and purchase tokens are stored only as hashes; server logs never contain birth details, consultation content, request bodies, credentials or email addresses; and security updates are applied.
- Physical: servers are kept in an access-controlled location and reachable from outside only through an encrypted tunnel.
13. Children
The Service is only for people aged 14 and over. We do not knowingly collect personal information from children under 14, and delete it without delay if we learn we have.
14. Privacy officer
- Privacy officer: Jang Seongheon (장성헌)
- Contact: support@jambo.team, +82-2-6959-6619
Requests for access, questions, complaints and requests for relief go to the contacts above, and we answer and act without delay.
15. Remedies
For advice or dispute resolution about a privacy infringement, you can contact:
- Personal Information Dispute Mediation Committee: 1833-6972 (www.kopico.go.kr)
- KISA Personal Information Infringement Report Center: 118 (privacy.kisa.or.kr)
- Supreme Prosecutors' Office Cyber Investigation Division: 1301 (www.spo.go.kr)
- Korean National Police Agency Cyber Bureau: 182 (ecrm.police.go.kr)
If our action or inaction on a request for access, correction, deletion or suspension infringes your rights or interests, you can file an administrative appeal (Central Administrative Appeals Commission: 110, www.simpan.go.kr).
16. Users outside Korea
This policy also applies when you use the Service outside Korea. Where the law of the place you live gives you stronger rights, we respect them.
- EU and UK users: we process personal information on the bases of contract performance (GDPR Art. 6(1)(b)), legitimate interests (Art. 6(1)(f): protecting and improving the Service) and legal obligation (Art. 6(1)(c)). International transfers are protected by standard contractual clauses and similar safeguards with our processors. You have the rights of access, rectification, erasure, restriction, portability and objection, and may lodge a complaint with the supervisory authority where you live.
- Users in California and other US states: we do not sell your personal information or share it for targeted advertising. You may request access to, correction of and deletion of the information we hold, and you will not be discriminated against for exercising your rights.
- Send requests to support@jambo.team.
17. Changes to this policy
This policy applies from 2026-10-06. When it changes, we announce the change in the app and on this page at least 7 days before it takes effect (30 days for changes important to your rights), and keep earlier versions published so you can compare them.
Version history
Earlier versions are available below.
- 2026-10-06 – present (Current version): Added the optional health app connection to 'What we do not collect': sleep, heart rate variability and steps are used only on your device and never collected, and on iPhone the evening mood can be written to State of Mind in the Health app, if you allow it.
- 2026-09-26 – 2026-10-05: Full revision to match how the Ari mobile app actually processes data: items, legal bases and retention; generative AI; detailed international transfers; rights of users outside Korea; paid services and withdrawal; operator details.
- 2026-08-01 – 2026-09-25: First publication (text written for the Ari web service).
- Company
- Seedbox LC (시드박스 유한회사)
- Representative
- Ra Jonghwan
- Business registration no.
- 241-88-02529
- Mail-order business report no.
- 2025-Seoul Guro-1408
- Address
- Suite 206, 234 Gocheok-ro, Guro-gu, Seoul, Republic of Korea
- Phone
- +82-2-6959-6619
- Contact
- support@jambo.team