Privacy Policy

Article 1 (Purpose)

YouR Star Inc. (the “Company”, “we”, “us” or “our”) is committed to protecting the personal data of individuals (“Users” or “you”) who use the services we provide (the “Services”). We process personal data in compliance with applicable data protection laws, including the Personal Information Protection Act of the Republic of Korea and any other data protection laws that may apply in the countries where our Users reside.

This Privacy Policy (the “Policy”) explains how and why we collect, use, store, share and otherwise process your personal data, and how you can exercise your rights.

Article 2 (Principles of Personal Data Processing)

• 1. We only collect and process personal data where we have a lawful basis to do so (for example, your consent, performance of a contract, compliance with a legal obligation, protection of vital interests, or our legitimate interests, balanced against your rights and freedoms).
• 2. In accordance with applicable laws and this Policy, the Company may collect your personal data and, where you have given your consent or where the law otherwise permits, provide such data to third parties.
• 3. However, even without your separate consent, we may provide your personal data to third parties if we are required to do so by applicable laws, regulations, court orders or requests from competent authorities.

Article 3 (Availability of this Policy)

• 1. We make this Policy easily accessible at any time via the first screen of our website or via a clearly visible link on the first screen of the website or in the Service.
• 2. When we display this Policy, we use clear formatting (such as readable font size and sufficient contrast) so that Users can easily read and review it.

Article 4 (Changes to this Policy)

• 1. This Policy may be amended in accordance with changes in applicable laws, guidelines, official notices, or changes in our Service or internal policies.
• 2. When we make changes to this Policy, we will notify you by one or more of the following methods:
• (1) Posting a notice on the first page of our website or in a dedicated notice area within the Service.
• (2) Providing notice by written document, facsimile, email, in-app message, push notification or a similar electronic method.
• 3. We will provide such notice at least seven (7) days prior to the effective date of the revised Policy. For changes that materially affect your rights or are disadvantageous to you, we will provide notice at least thirty (30) days in advance, where required by law.

Article 5 (Information Collected for Account Registration)

To create and manage your account for the Services, we collect the following personal data:

• 1. Required information: email address, password, name, nickname, date of birth and mobile phone number.

Article 6 (Information Collected for Identity Verification)

For identity verification purposes (where required by applicable law or our security procedures), we may collect:

• 1. Required information: mobile phone number, email address, name and date of birth.

Article 7 (Information Collected for Payment Services)

For the purpose of processing payments for paid Services, we may collect:

• 1. Required information: card number, card password or security code, card expiry date, date of birth (6 digits: yy/mm/dd), bank name and account number.
• 2. In many jurisdictions, certain payment information may be processed directly by our payment service providers and not stored by us. In such cases, the relevant provider’s privacy policy will also apply.

Article 8 (Information Collected to Provide Our Services)

To provide and operate the Services, we may collect:

• 1. Required information: user ID, email address, name, date of birth and contact information (such as mobile phone number).

Article 9 (Information Collected for Service Usage Analytics and Fraud Prevention)

To analyze service usage, compile statistics and prevent or investigate misuse or fraudulent activity (for example, repeated account creation and cancellation to abuse discounts, coupons or promotions; activities prohibited by our Terms of Service; or identity theft), we collect:

• 1. Required information: service usage logs, cookies, IP address and other connection information, and device information (such as device model, operating system and app version).

Article 10 (Other Information We Collect)

We also collect the following information to provide personalized and child-centered story creation and recommendations:

• 1. Purpose of collection: generation and recommendation of personalized stories tailored to each child.
• 2. Information collected: information about the child (e.g., name, nickname, date of birth, gender, language(s) used, language development level, attention tendencies, degree of emotional expression, emotional traits, cognitive/observational style, temperament and behavior patterns, expressive/play tendencies, favorite animals, favorite toys, favorite colors, preferred seasons, favorite places, preferred types of play, family members, close people/animals, activities with family, experiences the parent/guardian would like the child to have through stories, the child’s unique expressions, play habits, family routines, and phrases that the parent/guardian would like to be frequently included in the stories).
• 3. This information is optional and is used solely to personalize story content for the child. You may choose not to provide such information. You may also update or delete this information at any time through the Service where technically available, or by contacting us as set out in Article 33.

Article 11 (Methods of Collecting Personal Data)

We collect personal data by the following methods:

• 1. When you enter your personal data directly on our website.
• 2. When you enter your personal data via our applications or other online services provided by the Company.
• 3. When we lawfully receive your personal data from third parties such as social login providers or payment processors, in accordance with their privacy policies and your consent.

Article 12 (Use of Personal Data)

We use your personal data for the following purposes:

• 1. To send notices and announcements necessary for the operation of the Services.
• 2. To respond to inquiries, handle complaints, and improve customer service.
• 3. To provide, operate and maintain the Services.
• 4. To prevent and respond to violations of applicable laws or our Terms of Service, including fraudulent, abusive or otherwise unlawful use of the Services.
• 5. To develop new services and improve existing Services.
• 6. To conduct marketing, such as providing information about events, promotions and surveys, in accordance with applicable laws and your marketing preferences.
• 7. To conduct demographic analysis and analyze Service visits and usage patterns.
• 8. To facilitate interactions and relationships among Users based on their preferences and interests, where permitted by law.

Article 13 (Provision of Personal Data to Third Parties)

• 1. As a general rule, we do not provide your personal data to third parties without your consent. However, if you have given prior consent (for example, through the user interface of the Service) or have chosen to make certain information public, we may provide your personal data to the following third parties to the minimum extent necessary:
• (1) Google Firebase: for purposes such as hosting, authentication, analytics, service provision and service improvement, we may provide information collected for account registration and service use.
• (2) Toss Payments Co., Ltd. (or its successor payment service provider): for payment processing when you use paid Services, we may provide information necessary for processing your payment and preventing fraud.
• 2. If the identity or details of third-party recipients change, or if our relationship with such third parties ends, we will notify you and, where required by law, obtain your consent again in accordance with the procedures described in Article 4.

Article 14 (Outsourcing of Personal Data Processing)

To provide the Services efficiently, we may entrust the processing of personal data to third-party service providers (data processors) as follows:

• 1. Google Firebase: we entrust certain tasks such as authentication, service provision, data hosting, analytics, push notifications and related operations. Personal data is retained and processed only for the duration of the outsourcing relationship or until account deletion, whichever comes first, unless applicable law requires a longer retention period.
• 2. We require all data processors to process personal data in accordance with this Policy, applicable law, and our written instructions, and to implement appropriate technical and organizational security measures.

Article 15 (Retention and Use Period of Personal Data)

• 1. We retain your personal data for as long as necessary to fulfill the purposes for which it was collected, including providing the Services, complying with our legal obligations, resolving disputes, and enforcing our agreements.
• 2. Notwithstanding the preceding paragraph, we may retain records of fraudulent or abusive use of the Services for up to one (1) year after account deletion for the purpose of preventing and responding to such misuse, in accordance with our internal policies and applicable law.

Article 16 (Retention Periods Required by Law)

To comply with applicable laws (including the laws of the Republic of Korea), we retain certain personal data for the periods specified below:

• 1. Under the Act on the Consumer Protection in Electronic Commerce, etc.:
• (1) Records of contracts or withdrawal of offers: 5 years
• (2) Records of payment and supply of goods or services: 5 years
• (3) Records of consumer complaints or dispute resolution: 3 years
• (4) Records relating to advertising and labeling: 6 months
• 2. Under the Protection of Communications Secrets Act:
• (1) Web access logs: 3 months
• 3. Under the Electronic Financial Transactions Act:
• (1) Records of electronic financial transactions: 5 years
• 4. Under the Act on the Protection and Use of Location Information:
• (1) Records of personal location information: 6 months

If the laws of your country require different retention periods, we will comply with those mandatory requirements to the extent they apply.

Article 17 (Principle of Personal Data Destruction)

We will promptly destroy your personal data when it is no longer necessary for the purposes for which it was collected, when the retention period has expired, or when applicable law requires destruction.

Article 18 (Procedures for Destruction)

• 1. Personal data entered by Users for account registration or service use is transferred to a separate database (or stored in a separate physical file for paper documents) after the purpose of processing has been achieved, and is retained for a period in accordance with our internal policies and applicable law (see Articles 15 and 16) before being destroyed.
• 2. We destroy personal data only after approval by our Data Protection Officer or another authorized person in charge of personal data protection.

Article 19 (Methods of Destruction)

We destroy personal data using the following methods:

• 1. Personal data stored in electronic form is irreversibly deleted using technical methods that make the data unrecoverable.
• 2. Personal data printed on paper is destroyed by shredding or incineration or by other secure methods.

Article 20 (Marketing Communications and Advertising)

• 1. Where required by applicable law, we obtain your prior, explicit consent before sending you marketing or promotional communications by electronic means (such as email, SMS or push notifications) for commercial purposes.
• 2. Even if you initially consent, you may withdraw your consent or opt out of receiving marketing communications at any time by following the instructions provided in the communications or in the Service settings. We will honor your choice as soon as reasonably practicable and will inform you of the result of processing your opt-out request where required by law.
• 3. In some jurisdictions (including the Republic of Korea), sending marketing communications during certain hours (for example, 9 p.m. to 8 a.m.) may require separate consent. Where such rules apply, we will obtain the required additional consent.
• 4. Every marketing communication we send by electronic means will clearly identify the sender, provide our contact information, and include a clear and simple method to opt out or withdraw consent.
• 5. We will not:
• (1) Obstruct or circumvent your ability to opt out of marketing communications.
• (2) Automatically generate contact details by randomly combining numbers, symbols or letters.
• (3) Automatically register contact details for the purpose of sending marketing messages without consent, where consent is required.
• (4) Conceal the identity of the sender or the source of the communication.
• (5) Mislead or deceive you in order to induce a response to a marketing communication.

Article 21 (Protection of Children’s Personal Data)

• 1. We do not knowingly allow children under 14 years of age in Korea, or under the minimum age required by the laws of their country of residence (for example, 13 in the United States or 16 in certain EU member states), to register for an account without the consent of a parent or legal guardian.
• 2. Where we are required by law to obtain parental consent, we will request such consent from the child’s legal guardian before collecting, using or sharing the child’s personal data.
• 3. In such cases, we may collect additional information about the legal guardian (such as name, date of birth, contact details and relationship to the child) for the purpose of verifying consent.
• 4. If we become aware that we have collected personal data from a child in violation of applicable law, we will take steps to delete such data as soon as reasonably practicable. Parents or legal guardians who believe that we have collected personal data from their child contrary to this Policy may contact us using the details in Article 33.

Article 22 (User Responsibilities)

• 1. You are responsible for keeping your personal data accurate and up to date. Any issues that arise from providing inaccurate or outdated information are your responsibility.
• 2. You must not use another person’s personal data without permission. If you register using another person’s identity or personal data, your account may be suspended or terminated, and you may be subject to penalties under applicable law.
• 3. You are responsible for maintaining the confidentiality of your email address, password and other login credentials, and must not transfer or lend them to any third party.

Article 23 (Our Management of Personal Data)

We implement appropriate technical, administrative and physical security measures to protect your personal data from loss, theft, unauthorized access, disclosure, alteration or destruction.

Article 24 (Processing of Deleted Data)

When your personal data is deleted or your account is terminated at your request or by your legal representative, we process such data in accordance with the retention periods described in Articles 15 and 16. After the retention period expires, the data is destroyed and is no longer used for any other purpose.

Article 25 (Password Encryption)

User passwords are stored and managed in encrypted form using one-way encryption methods. Only the User who knows the password can access or change it.

Article 26 (Measures Against Hacking and Other Intrusions)

• 1. We use reasonable security measures to protect personal data from unauthorized access, hacking, computer viruses and other security threats.
• 2. We use up-to-date security software and tools to prevent leakage or damage of personal data and files.
• 3. We operate intrusion prevention and detection systems and similar technical measures to protect our systems.
• 4. Where we collect or transmit sensitive personal data, we use encryption and other secure communication methods to protect the data over networks.

Article 27 (Minimization of Data Access and Staff Training)

We limit access to personal data to a minimum number of authorized personnel and provide regular training and guidance on data protection laws and internal policies to those who handle personal data.

Article 28 (Notification in Case of Data Breach)

If we become aware of any loss, theft, leakage or other incident involving your personal data (“Data Breach”), we will, without undue delay and in accordance with applicable laws:

• 1. Inform affected Users of:
• (1) The categories of personal data involved.
• (2) The time and circumstances of the breach, to the extent known.
• (3) Steps the User can take to mitigate potential harm.
• (4) Measures we have taken or plan to take in response.
• (5) Contact details for further information or assistance.
• 2. Notify or report the incident to relevant supervisory authorities, such as the Korea Communications Commission or the Korea Internet & Security Agency (KISA), where required by law.

Article 29 (Exceptions to Individual Notification)

If, despite reasonable efforts, we are unable to contact affected Users individually (for example, because we do not have valid contact information), we may provide notice by posting a clear announcement on our website for at least thirty (30) days, to the extent permitted by law.

Article 30 (International Transfers of Personal Data)

• 1. We do not enter into international agreements that violate applicable data protection laws with respect to your personal data.
• 2. If we transfer your personal data outside your country of residence (including for storage, processing or access), we will do so in compliance with applicable cross-border data transfer laws. Where required, we will obtain your consent in advance or rely on other lawful transfer mechanisms.
• 3. Before obtaining your consent for an international transfer, we will inform you of:
• (1) The categories of personal data that will be transferred.
• (2) The country (or region) to which the data will be transferred, and the date and method of transfer.
• (3) The name of the recipient (or, if the recipient is a company, its name and the contact details of the person responsible for data protection).
• (4) The purposes for which the recipient will use the personal data and the retention period.
• 4. Where required by law (for example, when transferring personal data from the EU/EEA), we will implement appropriate safeguards such as standard contractual clauses or equivalent legal mechanisms.

Article 31 (Cookies and Similar Technologies)

• 1. To provide personalized Services and improve user experience, we use cookies and similar technologies that store and retrieve information on your device. A cookie is a small text file that a website’s server sends to your browser (including on PCs and mobile devices) and is stored on your device.
• 2. You can choose whether to accept cookies. Most browsers allow you to configure settings to accept all cookies, to notify you when a cookie is being set, or to reject some or all cookies.
• 3. If you refuse or delete cookies, some features of the Services that require login or personalization may not function properly.

Article 32 (How to Manage Cookie Settings)

You can manage cookie settings through your web browser options, for example:

• 1. Microsoft Edge: Settings > Cookies and site permissions > Manage and delete cookies and site data.
• 2. Google Chrome: Settings > Privacy and security > Cookies and other site data.
• 3. Naver Whale: Settings > Privacy > Cookies and other site data.

The exact menu names may vary depending on browser version and language.

Article 33 (Data Protection Officer and Contact Information)

To protect your personal data and handle questions or complaints, we have designated the following person in charge of personal data protection:

Data Protection Officer (DPO)

Name: Kibeom Kim

Title: CTO

Phone: +82-10-9125-2821

Email: info@yourstar.space

If you have any questions about this Policy or our data protection practices, or if you wish to exercise your rights, please contact us using the details above.

Article 34 (Remedies and Complaints)

• 1. If you are located in Korea and believe that your privacy rights have been infringed, you may seek dispute resolution or consultation from the following organizations:
• (1) Personal Information Dispute Mediation Committee: 1833-6972 (www.kopico.go.kr)
• (2) Personal Information Infringement Report Center (KISA): 118 (privacy.kisa.or.kr)
• (3) Supreme Prosecutors’ Office: 1301 (www.spo.go.kr)
• (4) National Police Agency Cyber Bureau: 182 (ecrm.cyber.go.kr)
• 2. Depending on your country of residence, you may also have the right to lodge a complaint with your local data protection authority.
• 3. In Korea, a person whose rights or interests are infringed by a disposition or omission of a public institution in response to a request under Articles 35–37 of the Personal Information Protection Act (access, rectification/deletion, suspension of processing) may file an administrative appeal in accordance with the Administrative Appeals Act (for example, via the Central Administrative Appeals Commission: 110, www.simpan.go.kr).

Supplementary Provision

This Policy is effective as of 19 November 2025.