Privacy policy

Privacy policy

Article 26 (Purpose of Collecting and Using Personal Information)
① Purpose of Collecting Personal Information
ATOVIA (hereinafter “the Company”) collects the minimum personal information necessary to provide an optimized, customized service, and does not use it for purposes beyond that stated at collection without the user's consent.

② Purpose of Processing Personal Information
The Company processes personal information for the following purposes, and if the purpose of use changes, takes the necessary steps — including obtaining separate consent — pursuant to Article 18 of the Personal Information Protection Act.
ⓐ Website membership sign-up and management

Confirming intent to join, identity verification and maintaining eligibility, preventing fraudulent use
Confirming legal-guardian consent for children under 14
Handling various notices and complaints
ⓑ Providing goods or services

Shipping goods, providing services, sending contracts and invoices
Providing content and customized services, identity and age verification
Billing and settlement, debt collection
ⓒ Handling complaints

Verifying the complainant's identity and responding to inquiries
Investigating the facts and notifying the outcome
③ Possibility of Collecting Additional Information
The Company may collect the following additional information as needed while you use the service.
ⓐ Payment, refunds, and settlement
ⓑ Shipping and exchange of goods
ⓒ Handling customer inquiries and complaints
ⓓ Fulfilling obligations required by law

④ Principle of No Third-Party Provision
The Company does not provide personal information to third parties without the user's consent.
The following are exceptions, however.
ⓐ When required by law (e.g., a legitimate request from an investigative agency)
ⓑ When the member has given prior consent
ⓒ When minimal information must be shared with a shipping company, etc., to provide the service
ⓓ When urgent protection is needed due to imminent danger to a user's life, body, or property

⑤ Principles of Processing Personal Information
The Company uses collected personal information only for the purpose of providing its service, and does not use it for marketing or advertising, or provide it to a third party, without the member's consent.
The Company also establishes and discloses this Privacy Policy pursuant to Article 30 of the Personal Information Protection Act, to respond to personal information protection and complaint handling promptly and smoothly.

 

Article 27 (Period of Processing and Retaining Personal Information)
① Principle of Retention
The Company processes and retains personal information within the retention and use period required by law, or within the period the member consented to at the time of collection.

② Period of Processing and Retention
In principle, the Company destroys personal information without delay once the purpose of its collection and use has been achieved. However, the Company may retain personal information for the periods set out below, as required under relevant laws.

1. Website Membership Sign-Up and Management
Retained until the member withdraws
However, retained until the following reasons end, if applicable
ⓐ If an investigation is underway for a violation of relevant law, until that investigation concludes
ⓑ If a claim or debt from using the website remains outstanding, until that claim or debt is settled

2. Providing Goods or Services
Until goods and services are fully supplied and payment is settled
However, may be retained for a set period under the following laws
a. Retention under the "Act on Consumer Protection in Electronic Commerce, Etc."
Records of labeling and advertising: 6 months
Records of contracts, withdrawal of subscription, payment, and supply of goods: 5 years
Records of consumer complaints or dispute handling: 3 years
b. Retention under the "Credit Information Use and Protection Act"
Records of collecting, processing, and using credit information: 3 years
c. Retention under the "Act on Promotion of Information and Communications Network Utilization and Information Protection, Etc."
Records of identity verification: 6 months
d. Retention under Article 41 of the "Protection of Communications Secrets Act"
Subscriber's telecommunication date/time, start/end time, the other party's subscriber number, usage amount, and originating base station location-tracking data: 1 year
Computer communication and internet log records, and connection-location tracking data: 3 months

③ Retention Based on Individual Consent
If a member has individually consented to retaining personal information for a specific period, it may be retained until that period ends.

④ Records of Conversations with VIA (AI coach)
ⓐ Members: so that each coaching session can pick up where the last one left off, we keep, for each member, what the member and VIA said to each other and a summary of it (memory notes). These are kept until the member closes their account; if you close your account or ask us to delete them (customer service: admin@atovia.kr), we destroy them without delay.
ⓑ Trial (VIA used without signing in): to improve quality, we keep the conversation text for 6 months and then destroy it. The IP address used to count the number of trial uses is processed only as a value converted so that it cannot be recognised (a hash), and this value is generated anew every day.
ⓒ Photos taken together with VIA (“📸 Photo together”) are created only on the user's device and are not sent to ATOVIA's servers.

Article 28 (Third-Party Provision and Outsourced Processing of Personal Information)
① Third-Party Provision of Personal Information
ATOVIA does not provide personal information to third parties without the member's consent, and provides it only in the following cases.
ⓐ When a law requires providing personal information to a specific institution (e.g., a request from an investigative agency)
ⓑ When the member has given prior consent to providing personal information
ⓒ When minimal information must be shared with a payment or shipping partner to provide the service
ⓓ When urgent protection is needed due to imminent danger to a user's life, body, or property

② Outsourcing the Processing of Personal Information
To provide the service smoothly, ATOVIA may outsource some personal information processing tasks, and complies with the following.
ⓐ Pursuant to Article 26 of the Personal Information Protection Act, ATOVIA specifies in its contracts matters such as a ban on processing personal information beyond the purpose of the outsourced task, technical and administrative safeguards, restrictions on re-outsourcing, management and supervision of the contractor, and liability for damages, and supervises the contractor's compliance with personal information protection.
ⓑ When outsourcing personal information processing is necessary, ATOVIA clearly notifies members of the details in advance and obtains their consent.
ⓒ If the outsourced task or the contractor changes, ATOVIA discloses this without delay through this Privacy Policy.

ATOVIA outsources the processing of personal information as set out below in order to provide the service. Where the outsourced work changes or a processor is added, we give notice through this policy. ① Kakao Corp. — Kakao account sign-in and identity verification (until the member closes their account or the outsourcing contract ends) ② KG Inicis Co., Ltd. — payment processing and prevention of payment fraud (for the period set by relevant law) ③ Cloudflare, Inc. — web traffic security and delivery (for the period the service is provided) ④ Web hosting provider — server operation and data storage (for the period the service is provided) ⑤ Anthropic, PBC (USA) — generating replies for VIA (AI coach) (for the period set by Anthropic's policy; for the transfer abroad, see Article 28 ④). ⑥ Hanabi AI Inc. (USA, Fish Audio) — voice synthesis for VIA (for the period set by Fish Audio's policy; for the transfer abroad, see Article 28 ⑤) ⑦ Vast.ai Inc. and Runpod, Inc. (USA) — rental of the graphics processing servers that create VIA's face and voice video (until the connection ends and the server is deleted; for the transfer abroad, see Article 28 ⑤). When entering into an outsourcing contract, ATOVIA sets out in the contract, under Article 26 of the Personal Information Protection Act, the prohibition on processing personal information beyond the purpose of the outsourced work, technical and administrative safeguards, restrictions on sub-contracting and liability for damages, and supervises whether the processor keeps to them.

③ Transfer of personal information abroad (website usage analysis)
To make the website easier to use, ATOVIA uses Microsoft Clarity, and in the process the information below is transferred abroad.
ⓐ Recipient: Microsoft Corporation (privacy enquiries: https://www.microsoft.com/concern/privacy)
ⓑ Destination countries: the United States and other countries where Microsoft operates data centres
ⓒ Items transferred: addresses of the pages you visit, records of how you use the screen such as where you click, scroll and move the mouse, browser and device type, approximate location (country and city), and cookie identifiers. Text you type is masked before it is sent, and nothing is recorded on payment, sign-in or account screens.
ⓓ When and how: sent over the internet while you use the website
ⓔ Purpose and retention: used for visit statistics, improving pages and finding errors; session recordings are kept for about 30 days and statistics for up to 13 months, after which Microsoft deletes them.
ⓕ How to refuse and what happens: click “Turn off recording in this browser” in Article 34 ⑤ and nothing will be recorded in that browser from the next page on. Refusing does not limit your use of the website. Visitors from the European Economic Area, the United Kingdom and Switzerland are asked for consent first, and Clarity is used only if they agree.

④ Transfer of personal information abroad (VIA AI coach)
To create the replies of VIA (AI coach), ATOVIA uses Anthropic's Claude API, and in the process the information below is transferred abroad.
ⓐ Recipient: Anthropic, PBC (privacy enquiries: privacy@anthropic.com)
ⓑ Destination country: the United States
ⓒ Items transferred: the conversation text you send to VIA and, if you turn on the camera, one still photo (320 pixels wide) taken each time you send a message (including when VIA speaks first), and the text records of the Daily Routine and Weekly Journal read in VIA coaching for Full Recovery members (when you save a Daily Routine, that day's record and the one just before it; when you open “Read this week's journal”, that week's records — skin photos are not sent, only the number of photos you uploaded)
ⓓ When and how: sent over an encrypted connection (API) while you talk with VIA
ⓔ Purpose and retention: used only to create VIA's replies, and ATOVIA does not store the camera photos. Anthropic's retention and use of the information it receives follow Anthropic's policies, and Anthropic's commercial terms state that it does not train models on content received through the API.
ⓕ How to refuse and what happens: if you do not turn on the camera, no photos are sent, and if you do not use VIA, no information is transferred. Refusing does not limit your use of services other than VIA.

⑤ Transfer of personal information abroad (VIA voice and face video)
To create VIA's voice and face video, ATOVIA uses the companies below, and in the process the information below may be transferred abroad.
ⓐ Recipients: Hanabi AI Inc. (Fish Audio; privacy enquiries: https://fish.audio/privacy/) · Vast.ai Inc. (https://vast.ai/privacy) · Runpod, Inc. (https://www.runpod.io/legal/privacy-policy)
ⓑ Destination countries and regions: Fish Audio — the United States. Graphics processing servers — rented as needed in a location close to the region you connect from: Korea is chosen first and, if none is available, Japan, Taiwan, Hong Kong or Singapore; if you connect from the Americas or Europe, one of the United States, Canada, Germany, the Netherlands, France, Poland, the Czech Republic, Sweden, Norway, Finland, Spain or the United Kingdom
ⓒ Items transferred: Fish Audio — the text VIA is about to speak (if VIA's reply repeats what you said, that text may be included). Graphics processing servers — the text you write during that connection (including text converted from voice input), one photo each time you speak if you turn on the camera, your VIA settings (how VIA addresses you, speaking style, the language you are learning, level) and, if a Full Recovery member opens “Read this week's journal”, that week's text records (skin photos are not sent, only the number of photos you uploaded)
ⓓ When and how: sent over an encrypted connection while you talk with VIA
ⓔ Purpose and retention: used only to create VIA's voice and face video. Fish Audio's retention and use of the information it receives follow that company's policies. On the graphics processing servers, the information is held only in memory during the connection and is erased together with the server when the connection ends and the server is deleted.
ⓕ How to refuse and what happens: if you do not use VIA, no information is transferred. Refusing does not limit your use of services other than VIA.

※ If you use voice input (🎤), turning your voice into text is done by your browser's speech recognition feature, and your voice is then processed under the policies of the browser's maker (Google for Chrome, Apple for Safari, Microsoft for Edge). ATOVIA does not receive your voice, only the converted text. Camera video and microphone audio are not sent to ATOVIA's servers; if you turn on the camera, only one photo is sent each time you speak.

Article 29 (Items and Methods of Collecting Personal Information)
① Items of Personal Information Collected
ATOVIA collects the minimum personal information necessary for membership sign-up, service use, payment and refunds, and customer support, and does not collect resident registration numbers or i-PIN information.

a. Items required at registration and for using the service

General sign-up: ID, password, name, mobile phone number, email address, gender, date of birth, birth year, age group, address and delivery information
Kakao sign-in/sign-up: name, mobile phone number, email address, gender, date of birth, birth year, age group, address and delivery information
For guest orders: orderer's name, payer's address, recipient's name, delivery information, contact number, customer memo
For refund requests: orderer's name, payer's address, recipient's name, delivery information, contact number, refund account number

b. Information collected automatically while using the service

Service usage records, access logs, cookies, access IP information, payment records
When using the ATOVIA desktop program: device information (device name, operating system, program version, install and run history)
※ Device information is collected to link a registered device to your account and to identify why an install or run failed, and it is destroyed without delay once you stop using the program and disconnect the device.
VIA (AI coach) camera photos: only when you turn on the camera, one photo taken each time you speak is used solely to create the reply and is not stored.
VIA (AI coach) conversations: what is said between you and VIA (for members, including the summarised memory notes) — for retention, see Article 27 ④
② Items Required When Signing Up with a Kakao Account
To complete Kakao sign-in or sign-up, ATOVIA collects your name, mobile phone number, email address, gender, date of birth, birth year, age group, and address and delivery information. These items are used for member identification, identity verification, age verification, providing customized services, and delivery and customer support.
③ Additional Items Collected When Signing Up a Business/Organization Kakao Account
When identity verification is required for the person in charge of a business or organization account: name, mobile phone number, email address, gender, date of birth, birth year, age group, and address and delivery information
④ Items Collected for Identity Verification
Name, date of birth, gender, mobile phone number, domestic/foreign national status, identity verification value (DI), and encrypted user confirmation value (CI)
⑤ Items Collected When a Legal Guardian Consents
Legal guardian's name, date of birth, gender, mobile phone number, duplicate sign-up check information (DI), and encrypted user confirmation value (CI)
⑥ Methods of Collecting Personal Information
Automatically collected during shopping mall sign-up, online consultation, customer center contact (phone and online inquiries), and service use
When legal-guardian consent is required, collected after separate consent obtained through an identity verification agency

Article 30 (Personal Information Items Processed)
ATOVIA processes the following personal information items to provide its service.

① Website Membership Sign-Up and Management
Required: ID, password, full name, date of birth, gender, phone number, email address
Optional: areas of interest, marital status
② Providing Goods or Services
Required: ID, password, full name, date of birth, gender, phone number, email address, credit card number, bank account information, and other payment information
Optional: purchase history, areas of interest
③ Automatically Collected Items (information generated while using our internet service)
IP address, cookies, MAC address, service usage records, visit records, records of improper use, etc.

Article 31 (Destruction of Personal Information)
① Principle of Destruction
ATOVIA destroys personal information without delay once it becomes unnecessary — for example, when the retention period has passed or the purpose of processing has been achieved.

② Exceptions to Retention
In the following cases, personal information may be moved to a separate database (DB) or preserved in a different storage location.

When retention for a set period is required by law
When the user's consent has been obtained
③ Procedure and Method of Destruction
a. Destruction Procedure

ATOVIA identifies personal information subject to destruction and destroys it upon approval from the Personal Information Protection Officer.
b. Method of Destruction

Personal information recorded and stored as an electronic file is permanently deleted (e.g., low-level format) so that it cannot be recovered.
Personal information in paper form is destroyed by shredding or incineration.

 

Article 32 (Measures to Ensure the Security of Personal Information)
Pursuant to Article 29 of the Personal Information Protection Act, ATOVIA implements the following measures to ensure the security of personal information.

① Administrative Measures
Establishing and implementing an internal management plan
Regular staff training and security checks
② Technical Measures
Managing access rights to personal information processing systems, etc.
Installing access control systems and firewalls
Protecting personal information through encryption (encrypting unique identifying information)
Installing security software and conducting periodic checks
③ Physical Measures
Controlling and restricting access to server rooms, data storage rooms, etc.
Designating secure areas and managing entry
Safely storing and disposing of documents and storage media containing personal information

Article 33 (Rights of Users and Legal Guardians, and How to Exercise Them)
① Rights Related to Personal Information Protection
Users may exercise the following personal information protection rights against ATOVIA at any time.
ⓐ Requesting to view their personal information
ⓑ Requesting correction if there is an error
ⓒ Requesting deletion of their personal information
ⓓ Requesting suspension of processing of their personal information

② How to Exercise These Rights
Users may exercise the rights above in writing, by phone, by email, or by fax, and ATOVIA will act on the request without delay.

③ Handling Requests to Correct or Delete Personal Information
If a user requests correction or deletion of an error in their personal information, ATOVIA does not use or provide that personal information until the correction or deletion is complete.

④ Exercising Rights Through an Agent
Users may exercise their personal information protection rights through a legal guardian or an authorized agent.
In this case, a power of attorney using Attached Form No. 11 of the Enforcement Rule of the Personal Information Protection Act must be submitted.

⑤ Obligation to Protect Personal Information
Users must comply with the Personal Information Protection Act and other relevant laws, and must not engage in conduct that infringes on another person's personal information or privacy.

Article 34 (Installing, Operating, and Declining Automatic Personal Information Collection Devices)
① Purpose of Using Cookies
ATOVIA uses "cookies" to provide users with a customized service.
A cookie is a small data file that a website's server sends to the user's browser, and it may be stored on the user's hard disk.

② Purposes of Using Cookies
Cookies are used for the following purposes.
ⓐ Analyzing how users visit and use websites and services
ⓑ Identifying popular search terms and verifying secure connections
ⓒ Providing information customized to the user

③ How to Set or Decline Cookies
Users can decline to store cookies through their web browser settings.
How to set this:

Internet Explorer: Tools > Internet Options > Privacy > Advanced Settings
Chrome: Settings > Privacy and Security > Cookies and Other Site Data
④ Notes on Declining to Store Cookies
If you decline to store cookies, your use of customized services may be limited.

⑤ Website usage analysis tool
ATOVIA uses Microsoft Clarity to record how you move through our pages (where you click, scrolling and screen movement) and reviews this as statistics and session recordings. Text you type is masked, and it is not switched on for payment, sign-in or account screens. Details of the transfer abroad are set out in Article 28 ③.
Turn off recording in this browser

 

Article 35 (Personal Information Protection Officer and Contact Information)
① Personal Information Protection Officer
ATOVIA oversees personal information protection and processing, and designates a Personal Information Protection Officer as follows to handle user complaints and provide remedies for damage.

▶ Data protection officer

Name: KIM JUN NYEON
Title: CEO
Contact: 010-2844-9201 / atovia@naver.com / 0504-442-9201
※ Data protection enquiries are handled by the data protection department.

▶ Data protection department

Department: Administration
Contact person: KIM JUN NYEON
Contact: 010-2844-9201 / atovia@naver.com / 0504-442-9201
② Inquiries and Response Regarding Personal Information Protection
Users may direct inquiries about personal information protection, complaint handling, and requests for remedy arising from the use of ATOVIA's services to the Personal Information Protection Officer or the responsible department.
ATOVIA guarantees a prompt response and resolution to user requests.

 

Article 36 (Requests to View Personal Information)
① Department for Receiving and Processing Requests to View Personal Information
Users may request to view their personal information pursuant to Article 35 of the Personal Information Protection Act, and ATOVIA processes such requests promptly.

▶ Department receiving and handling access requests

Department: Administration
Contact person: KIM JUN NYEON
Contact: 010-2844-9201 / atovia@naver.com / 0504-442-9201

Article 37 (Remedies for Infringement of Rights)
Users may contact the institutions below for remedy and consultation regarding personal information infringement.

▶ Privacy Infringement Report Centre (operated by the Korea Internet & Security Agency)

Responsibilities: Reporting personal information infringement, requesting consultation
Website: privacy.kisa.or.kr
Phone: 118 (no area code needed)
Address: (58324) 3F, Personal Information Infringement Report Center, 9 Jinheung-gil, Naju-si, Jeollanam-do (Bitgaram-dong 301-2)
▶ Personal Information Dispute Mediation Committee

Responsibilities: Filing for personal information dispute mediation, collective dispute mediation (civil resolution)
Website: www.kopico.go.kr
Phone: 1833-6972 (no area code needed)
Address: (03171) 4F, Government Complex Seoul, 209 Sejong-daero, Jongno-gu, Seoul
▶ Supreme Prosecutors' Office Cyber Investigation Division

Phone: 02-3480-3573
Website: www.spo.go.kr
▶ National Police Agency Cyber Safety Bureau

Phone: 182
Website: http://cyberbureau.police.go.kr
Article 38 (Effective Date and Changes to This Privacy Policy)
This Privacy Policy takes effect on February 25, 2023.
Amended: 28 September 2026 — added the website usage analysis tool (Microsoft Clarity) and its transfer abroad.
Amended: 1 October 2026 — added the VIA (AI coach) camera photo item and the outsourcing of processing to Anthropic with its transfer abroad.
Amended: 2 October 2026 — added the outsourcing of processing for VIA (AI coach) voice synthesis (Fish Audio) and graphics processing servers (Vast.ai, RunPod) with their transfer abroad, the retention period for VIA conversation records, and information on voice input.