Privacy Policy
Last updated: August 28, 2026
The Short Version
- ✅ Your face photo never leaves your device. Analysis runs entirely in your browser.
- ✅ We do not create customer accounts or retain names or email addresses on our servers.
- ✅ Card payments are processed by TossPayments. We never see or store your card details.
- ✅ If you accept analytics cookies, Google Analytics processes device and online identifiers and approximate location to help us understand site usage.
- ✅ Some pages contain affiliate links. We may earn a commission at no extra cost to you.
1. Data We Process
Face Photo (Face Reading tool)
When you use the Face Reading (관상) tool, your photo is processed entirely in your browser using MediaPipe Face Landmarker (a Google open-source library running as WebAssembly). The photo is analyzed locally to extract facial landmark coordinates. No photo or raw landmark coordinates are uploaded to our servers or any third party.Derived labels and scores may be sent to our AI provider for optional entertainment text. A thumbnail and derived result may remain in your browser's local storage so you can open the report; you can remove them by clearing this site's browser data.
Color Analysis Data
The Personal Color tool uses your device camera (with your permission) to sample colors from your skin, hair, and eyes. This processing happens in your browser. Only the final color classification result (e.g., "Spring Warm") is sent to our AI server to generate a text interpretation. No images or raw color data are transmitted.
Birth Date (Saju & Compatibility tools)
The Saju (사주) and Compatibility (궁합) tools ask for birth dates and times. For Compatibility, you provide birth data for two people. This data is sent to our server solely to calculate Four Pillars charts and generate AI interpretations. We do not store birth data after the response is sent.
Payment Data (AI Deep Report)
Our AI Deep Report uses TossPayments for overseas-card processing. TossPayments collects card and authentication information directly. We never receive, process, or store full card details.Before checkout, we collect the buyer-declared US state and ZIP code and compare the request's country-level IP geolocation when available. We use these fields only to limit the initial launch to US customers and maintain sales-tax evidence. We also retain the timestamp of the buyer's explicit request for immediate digital delivery as contract evidence. See TossPayments' Privacy Policy. If you optionally enter a receipt email, the browser sends it directly to the TossPayments checkout; it is not included in our checkout API request or stored in our database.
Deep Report Entitlement
After a successful payment, we store a purchase entitlement record in our Redis database (Upstash). This record links a random access token to the TossPayments payment and expires after30 days. It contains no buyer contact or card information — only random payment/order identifiers, amount, currency, and timestamps. A cancellation or partial refund deletes this record and the cached report immediately.
Analytics (Google Analytics 4)
GA4 (Measurement ID: G-6KXDD33DHK) loads only after you select "Accept analytics." Google then processes online identifiers, device and browser information, page interactions, IP-derived approximate location, and cookie identifiers to help us understand site usage. We do not ask Google to identify you by name, but these identifiers may still be personal data under privacy laws.
2. Data We Do NOT Collect
- Names, email addresses, or phone numbers on K-BeautyCode servers (unless you contact us directly)
- Face photos or biometric templates (processed locally only)
- Full card numbers or payment credentials (handled by TossPayments)
- Precise GPS location; checkout stores only declared US state/ZIP and country-level IP geolocation
3. Affiliate Links
Some pages on K-BeautyCode contain affiliate links to third-party retailers (e.g., Amazon). If you click an affiliate link and make a purchase, we may earn a small commission at no additional cost to you. A visible commission disclosure is placed next to the recommendations and links; technical link attributes are not used as a substitute for consumer notice. Our product recommendations are based on seasonal color analysis results and are not influenced by commission rates.
4. Cookies
| Cookie | Purpose | Duration | Provider |
|---|---|---|---|
| _ga | Distinguish browsers and measure site usage after consent | 2 years | |
| Maintain session state | 2 years | ||
| kbc_report_access | Restore paid report access (HttpOnly) | 30 days | K-BeautyCode |
| cookie_consent | Remember your cookie preference | 1 year | K-BeautyCode |
Non-essential analytics cookies are not loaded before consent. "Accept analytics" and "Reject non-essential" are presented with equal prominence. You can change your choice at any time using the "Cookie settings" link in the footer. The site functions without analytics cookies. The report-access cookie is necessary only for restoring a purchase. TossPayments may use necessary storage in its secure payment window.
5. Third-Party Services
- Groq — AI text generation (LLM). Receives only color/face/saju classification labels and birth data, never images.
- Pollinations.ai — AI image generation for ideal-type portraits. Receives only text prompts.
- TossPayments — Payment gateway for overseas-card authorization, settlement, refunds, and payment receipts. Handles card and authentication data directly. See TossPayments Privacy Policy.
- Upstash Redis — Database for rate limiting, purchase entitlements, and the payment tax ledger. Stores payment/order identifiers, amount, currency, US state/ZIP, country evidence, and timestamps, but no buyer contact or card data.
- Google Analytics — Consent-based traffic analytics using device, online, and cookie identifiers plus approximate location.
- Google Fonts — Web font delivery (no tracking).
- Vercel — Hosting and CDN. Standard server logs (IP, user-agent) per Vercel's privacy policy.
- Amazon Associates — Affiliate program. When you click an affiliate link, Amazon may set cookies per their privacy policy.
6. Biometric Data (Face Photos)
Under GDPR (EU/UK), BIPA (Illinois, US), and similar state laws, facial images may be classified as biometric data. We want to be unequivocally clear:
- Face photos are processed exclusively on your device using client-side WebAssembly.
- No facial image, biometric template, or landmark data is transmitted, stored, or shared.
- We do not build facial recognition profiles or databases.
- You can delete your photo at any time by closing the browser tab.
7. Your Rights
GDPR (EU/UK)
You may have rights to access, correct, delete, or port personal data we hold. Limited payment, tax, security, and browser-side records may exist as described in this policy. You may withdraw analytics consent at any time through the footer's Cookie settings link.
CCPA / CPRA (California)
California residents have the right to know what personal information we collect, request deletion, and opt out of the "sale" or "sharing" of personal information. We do not sell or share personal information as defined by the CCPA/CPRA. We do not use personal information for cross-context behavioral advertising. To exercise any rights, contact us at tonydev901@gmail.com.
Other US State Laws
Residents of Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), and other states with comprehensive privacy laws have similar rights to access, correct, delete, and opt out of targeted advertising. We do not engage in targeted advertising as defined by these laws.
8. Children's Privacy
K-BeautyCode is not directed at children under 13 (or 16 in the EU/UK). We do not knowingly collect data from children. If you believe a child has used the service, contact us and we will take appropriate action.
9. Data Retention
We retain data only as long as necessary for the purposes described above:
- AI analysis requests: processed in real time, not stored.
- Purchase entitlement and report cache records: 30 days (Redis TTL).
- Payment tax ledger (order/payment identifiers, amount, currency, US state/ZIP, country evidence, immediate-delivery consent timestamp): 7 years for accounting, contract, and tax compliance.
- Analytics data: retained per Google's default retention period (14 months).
- Server logs (IP, user-agent): retained per Vercel's standard log rotation.
10. Changes to This Policy
We may update this policy as the service evolves. Material changes will be noted on this page with an updated "Last updated" date. Continued use of the site constitutes acceptance of the current policy.
11. Contact
Data controller: Kit4AI (키트포에이아이) · Representative: Hanjun Yoo (유한준)
Business registration no.: 337-52-00901
Address: 3F, S114, 37 Ewhayeodae 7-gil, Seodaemun-gu, Seoul, Republic of Korea (Daehyeon-dong)
All inquiries (privacy, payments, general): tonydev901@gmail.com