Privacy Policy
Last updated: September 7, 2026
The Short Version
- ✅ Your face photo never leaves your device. Analysis runs entirely in your browser; optional AI text receives derived labels only.
- ✅ We do not create customer accounts or retain names or email addresses on our servers.
- ✅ One-time PayPal payments are processed by PortOne. We never see or store your PayPal login or funding-source details.
- ✅ If you accept analytics cookies, Google Analytics processes device and online identifiers and approximate location to help us understand site usage.
- ✅ Some pages contain affiliate links. We may earn a commission at no extra cost to you.
1. Data We Process
Face Photo (Face Reading tool)
When you use the Face Reading (관상) tool, your photo is processed entirely in your browser using MediaPipe Face Landmarker (a Google open-source library running as WebAssembly). The photo is analyzed locally to extract facial landmark coordinates. No photo or raw landmark coordinates are uploaded to our servers or any third party. Derived labels and scores may be sent to our AI provider for optional entertainment text. A thumbnail and derived result may remain in your browser's local storage so you can open the report; the Face Reading report provides a delete control, and clearing this site's browser data also removes them.
Color Analysis Data
The Personal Color tool uses your device camera (with your permission) to sample colors from your skin, hair, and eyes. This processing happens in your browser. Only the final color classification result (e.g., "Spring Warm") is sent to our AI server to generate a text interpretation. No images or raw color data are transmitted.
Birth Date (Saju & Compatibility tools)
The Saju (사주) and Compatibility (궁합) tools ask for birth dates and times. For Compatibility, you provide birth data for two people. This data is sent to our server solely to calculate Four Pillars charts and generate AI interpretations. We do not store birth data after the response is sent.
Payment Data (AI Deep Report)
Our AI Deep Report uses PortOne with PayPal Smart Payment Buttons for a one-time USD checkout. PortOne and PayPal collect authentication and funding-source information directly. We never receive, process, or store PayPal login credentials or funding-source details.Before checkout, we collect the buyer-declared US state and ZIP code and compare the request's country-level IP geolocation when available. We use these fields only to limit the initial launch to US customers and maintain sales-tax evidence. We also retain the timestamp of the buyer's explicit request for immediate digital delivery as contract evidence. A receipt email is required for live PayPal digital-goods checkout and is sent to PortOne/PayPal for that payment only; it is not stored in our database. Face photos, landmarks, birthdates, and health or inference data are never sent to PortOne or PayPal. See the PortOne and PayPal privacy policies.
Deep Report Entitlement
After a successful payment, we store a purchase entitlement record in our Redis database (Upstash). This record links a random access token to the PortOne payment and expires 30 days after the verified PayPal paidAt timestamp, not from checkout start. Pending checkout records and per-order proof cookies last 7 days so asynchronous PayPal approval can be recovered. These records contain no buyer contact or card information — only random payment/order identifiers, amount, currency, and timestamps. A cancellation or partial refund deletes the entitlement and the cached report immediately. Guest PayPal checkout does not create a K-BeautyCode account; we do not send a merchant account id or account-creation date to PayPal.
Analytics (Google Analytics 4)
GA4 (Measurement ID: G-6KXDD33DHK) loads only after you select "Accept analytics." Google then processes online identifiers, device and browser information, page interactions, IP-derived approximate location, and cookie identifiers to help us understand site usage. We do not ask Google to identify you by name, but these identifiers may still be personal data under privacy laws.
2. Data We Do NOT Collect
- Names, email addresses, or phone numbers on K-BeautyCode servers (unless you contact us directly)
- Face photos or biometric templates (processed locally only)
- PayPal login credentials or funding-source details (handled by PortOne and PayPal)
- Precise GPS location; checkout stores only declared US state/ZIP and country-level IP geolocation
3. Affiliate Links
Some pages on K-BeautyCode contain affiliate links to third-party retailers (e.g., Amazon). If you click an affiliate link and make a purchase, we may earn a small commission at no additional cost to you. A visible commission disclosure is placed next to the recommendations and links; technical link attributes are not used as a substitute for consumer notice. Our product recommendations are based on seasonal color analysis results and are not influenced by commission rates.
4. Cookies
| Cookie | Purpose | Duration | Provider |
|---|---|---|---|
| _ga | Distinguish browsers and measure site usage after consent | 2 years | |
| Maintain session state | 2 years | ||
| kbc_ck_* | Per-order checkout proof (HttpOnly). Not sufficient alone to open the report | 7 days | K-BeautyCode |
| kbc_report_access | Restore paid report access (HttpOnly), set only after verified PAID | 30 days from paidAt | K-BeautyCode |
| cookie_consent | Remember your cookie preference | 1 year | K-BeautyCode |
Non-essential analytics cookies are not loaded before consent. "Accept analytics" and "Reject non-essential" are presented with equal prominence. You can change your choice at any time using the "Cookie settings" link in the footer. The site functions without analytics cookies. The report-access cookie is necessary only for restoring a purchase. PortOne and PayPal may use necessary storage in the PayPal checkout window.
5. Third-Party Services
- Groq — AI text generation (LLM). Receives only color/face/saju classification labels and birth data, never images.
- Pollinations.ai — AI image generation for ideal-type portraits. Receives only text prompts.
- PortOne — Payment gateway that renders PayPal Smart Payment Buttons, confirms one-time payments, and sends signed webhooks. See PortOne Privacy Policy.
- PayPal — Funding-source authorization and settlement for the one-time digital report. See PayPal Privacy Policy. Digital-goods transaction context is sent as limited commerce fields (receipt email and country). This does not guarantee Seller Protection.
- Upstash Redis — Database for rate limiting, purchase entitlements, and the payment tax ledger. Stores payment/order identifiers, amount, currency, US state/ZIP, country evidence, and timestamps, but no buyer contact or card data.
- Google Analytics — Consent-based traffic analytics using device, online, and cookie identifiers plus approximate location.
- Google Fonts — Web font delivery (no tracking).
- Vercel — Hosting and CDN. Standard server logs (IP, user-agent) per Vercel's privacy policy.
- Amazon Associates — Affiliate program. When you click an affiliate link, Amazon may set cookies per their privacy policy.
6. Biometric Data (Face Photos)
Under GDPR (EU/UK), BIPA (Illinois, US), and similar state laws, facial images may be classified as biometric data. We want to be unequivocally clear:
- Face photos are processed exclusively on your device using client-side WebAssembly.
- No facial image, biometric template, or raw landmark data is transmitted, stored, or shared on our servers. A downscaled thumbnail and derived result can remain in this browser until you delete them.
- We do not build facial recognition profiles or databases.
- You can delete the locally retained thumbnail and derived result at any time from the Face Reading report's delete control.
7. Your Rights
GDPR (EU/UK)
You may have rights to access, correct, delete, or port personal data we hold. Limited payment, tax, security, and browser-side records may exist as described in this policy. You may withdraw analytics consent at any time through the footer's Cookie settings link.
CCPA / CPRA (California)
California residents have the right to know what personal information we collect, request deletion, and opt out of the "sale" or "sharing" of personal information. We do not sell or share personal information as defined by the CCPA/CPRA. We do not use personal information for cross-context behavioral advertising. To exercise any rights, contact us at tonydev901@gmail.com.
Other US State Laws
Residents of Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), and other states with comprehensive privacy laws have similar rights to access, correct, delete, and opt out of targeted advertising. We do not engage in targeted advertising as defined by these laws.
8. Children's Privacy
K-BeautyCode is not directed at children under 13 (or 16 in the EU/UK). We do not knowingly collect data from children. If you believe a child has used the service, contact us and we will take appropriate action.
9. Data Retention
We retain data only as long as necessary for the purposes described above:
- AI analysis requests: processed in real time, not stored.
- Pending checkout records and per-order proof cookies: 7 days.
- Purchase entitlement and report cache records: 30 days from verified payment paidAt (Redis TTL).
- Payment tax ledger (order/payment identifiers, amount, currency, US state/ZIP, country evidence, immediate-delivery consent timestamp): 7 years for accounting, contract, and tax compliance.
- Analytics data: retained per Google's default retention period (14 months).
- Server logs (IP, user-agent): retained per Vercel's standard log rotation.
10. Changes to This Policy
We may update this policy as the service evolves. Material changes will be noted on this page with an updated "Last updated" date. Continued use of the site constitutes acceptance of the current policy.
11. Contact
Data controller: Kit4AI (키트포에이아이) · Representative: Hanjun Yoo (유한준)
Business registration no.: 337-52-00901
Address: 3F, S114, 37 Ewhayeodae 7-gil, Seodaemun-gu, Seoul, Republic of Korea (Daehyeon-dong)
All inquiries (privacy, payments, general): tonydev901@gmail.com