Privacy Policy

This policy sets out which personal information KOLUNE (kolune.app, covering K-Saju and our K-pop compatibility readings, operated by Solunepage in Namyangju, Gyeonggi-do, Republic of Korea) collects, the reasons we collect it, how it is used and shared, and the rights you hold over it. Certain features allow you to enter another person's birth date, or that of a public figure such as a K-pop idol, to produce a compatibility reading; any third-party birth detail you choose to enter is your responsibility. Using the Service means you accept the practices described on this page.

1. Information we collect

The categories of personal information we collect are:

• Birth information, which you give us at checkout: your name, gender (optional), date of birth, time of birth (optional), city and country of birth, and IANA timezone.
• Contact details: your email address, which we use to send the report and to answer support requests.
• Payment metadata passed to us by our processor: order ID, amount, currency, type of payment method, billing country, and the last four digits of the card. Full card numbers never reach us and are never stored by us; they go straight to the payment processor (currently one of Dodo Payments, Payhip, or Lemon Squeezy; see Section 3).
• Generated content, meaning the saju chart we compute and the AI-written reading produced for your purchase.
• Device and usage signals: your IP address, user agent and referrer; analytics events such as page views, form steps, checkout and purchase; UTM parameters from the ad that brought you here; and the advertising identifiers we use to measure ad conversions (Meta _fbp/_fbc and TikTok ttp).
• Customer support correspondence, meaning whatever you write to us by email or message.

2. How we use it

• To produce your saju reading
• To deliver that reading and support you afterwards
• To take payment, guard against fraud, and process refunds
• To measure whether our ads work (Meta Conversions API and TikTok Events API; what we send is a hashed email together with event data and advertising identifiers, and never your birth details)
• To make the Service better, using analytics in aggregate form
• To meet our legal obligations and answer lawful requests

3. Sharing & processors

Your data goes only to vetted processors we rely on to run the Service:

• Payment processing: Dodo Payments, Payhip, or Lemon Squeezy (only one is live at a time; we may move between them for reliability, regional coverage, or cost, and this page is updated within 30 days of any such change)
• Resend: sends our transactional emails
• Vercel: hosts the application (US infrastructure)
• Supabase: our managed Postgres database and object storage, running on Asia/US infrastructure
• Inngest: runs our job queue
• AI generation: OpenAI and/or Anthropic. They receive your computed saju chart and nothing else: no name, no email, no IP
• Meta and TikTok: ad measurement, using their Conversions API / Events API and pixels loaded through Google Tag Manager. They receive a hashed email, event metadata, the advertising identifiers fbp/fbc/ttp, your IP, and your user agent

We do not sell your personal data, and apart from the ad attribution described above we do not pass it to marketing partners.

4. Retention

Your birth information and the reading generated from it are kept for up to 24 months after purchase, so you can reopen the reading and we can help you if something goes wrong. Once 24 months have passed we delete or anonymise them. Aggregated analytics, financial records we must keep for tax purposes, and webhook logs may be held longer where the law requires it.

5. International transfers

Our systems run in the United States and in Asia. Where the law calls for it, data moving between those regions is covered by Standard Contractual Clauses or equivalent safeguards.

6. Your rights

Depending on where you live, you may access, correct, delete, or export your personal data, restrict or object to certain processing, and withdraw consent. In particular:

• Korea (PIPA): the right to access, correct or delete your data, and to have its processing suspended
• EU/UK (GDPR): the rights of access, rectification, erasure, portability, restriction and objection, and the right to withdraw consent
• California (CCPA/CPRA): the right to know, delete and correct, and to opt out of "sale or sharing"

To use any of these rights, write to support@kolune.app from your purchase email and tell us what you need. You will hear back within 30 days.

7. Security

Data in transit is protected with TLS 1.3, backups are encrypted at rest, database access uses scoped service-role keys, report access links carry HMAC-signed tokens, and incoming webhooks are checked with standard signature verification. No system can be made perfectly secure, but these are reasonable, industry-standard measures.

8. Children

The Service is offered as entertainment for a general audience. It is not aimed at children under 13, and we do not knowingly collect personal data from anyone under 13; if you think a child under 13 has given us data, contact us and we will remove it. Anyone below the age of majority should only use the Service with a parent or guardian involved. To make a purchase you must be at least 18, or of the age of majority where you live.

9. Cookies & analytics

We use cookies for sessions, analytics, and measuring advertising. Through Google Tag Manager we may load the Meta (Facebook) Pixel and the TikTok Pixel, and these can set advertising cookies such as _fbp and _fbc. When advanced matching is switched on, the Meta Pixel may also take details you type into our forms, such as your email, name, phone number, gender, and rough location (city, state/region, postal code, country), hash them, and send them to Meta so events can be matched to accounts. We additionally send conversion events from our server via the Meta Conversions API and the TikTok Events API, matched using a hashed email, event metadata and, where present, the advertising identifiers (fbp/fbc/ttp), IP address, and user agent. All of this serves one purpose, measuring ad performance; we do not sell your data or build profiles beyond it. Your browser's cookie settings and your device's ad controls let you limit it.

10. Changes to this policy

This policy may change over time. The "Last updated" date at the top tells you when the current version took effect. If a change is material, we will let you know by email or with a banner on the Service.

11. Contact & data protection officer

Questions about privacy, or a request to exercise your rights? Write to support@kolune.app. The mailing address of the business is on our Contact page.