Privacy Policy
Promegas Interactive (the “Company”) publishes this Privacy Policy to protect users’ personal information and comply with applicable laws, including the Personal Information Protection Act of the Republic of Korea. This Policy applies to the Company’s website and the Book of Change app.
1. Personal Information We Process and Purposes
| Service | Information processed | Purpose | Retention period |
|---|---|---|---|
| Email inquiries | Email address and information the user includes in the message | Reviewing and responding to inquiries and providing follow-up support | Delete promptly after the inquiry is resolved, unless a longer period is required by law |
| Account and sign-in | Firebase user identifier (UID), sign-in provider and authentication status; for email sign-in, email address and password authentication data. The Company cannot view a user’s password in plain text. | Creating and authenticating accounts, maintaining sign-in, and protecting accounts | Until an account deletion request is processed, except for information that must be retained for a period required by law |
| Book of Change consultations and AI interpretations | User-entered questions, prompts assembled by the app for AI interpretation (including some consultation context when needed), and AI responses | Providing I Ching interpretations and consultation responses, and displaying consultation history when selected by the user | According to the app code, consultation history is stored on the user’s device until the user deletes the history in the app or removes the app’s stored data. See the international transfers section below for processing and retention by the AI provider. |
| Security and service operation | IP address and device/browser information processed by Firebase, Firebase UID, AI request ID, and rate-limit counter | Authentication, preventing abusive requests, service stability, and usage limits | For as long as needed for authentication and security. The precise cleanup schedule for logs and counters may depend on each service’s settings. |
| Website access | IP address, request time and URL, browser and device information that the hosting provider may process when serving a web request | Delivering the website, security, and troubleshooting | Under Cloudflare’s applicable service settings and retention policies |
The app code stores consultation history in the app storage on the user’s device, not in the Company’s database. When an AI interpretation is requested, the user’s text and the context needed to generate the interpretation are sent through Firebase Cloud Functions to the DeepSeek API. The app is implemented not to write the consultation text from the request body to server logs; however, the external provider’s processing and retention are governed by its service terms and actual settings.
2. Processing and Retention Periods
The Company deletes personal information promptly when the purpose of processing has been fulfilled. If applicable law requires retention, the Company keeps the information separately for the period and scope required by that law. Consultation history stored on the user’s device can be deleted in the app or by removing the app’s stored data. Requests to delete a Firebase account or exercise privacy rights may be sent to contact@promegas.com.
3. Processors and Service Providers
| Processor or provider | Service | Information processed |
|---|---|---|
| Google LLC and its affiliates (Firebase) | Sign-in authentication, Cloud Functions, Firestore storage for request limiting, and operation of web/app services | Account identifiers and authentication information, UID, access and security information, and AI request proxy data |
| DeepSeek API provider | Generating AI interpretations | Questions, prompts, and consultation context needed for AI interpretation |
| Cloudflare, Inc. | Static website hosting, delivery, and security | Access and technical information from website requests |
The Company uses contracts or service terms to require processors to handle information only as needed for the relevant purposes and to protect it securely. The Company will update this Policy if a processor or outsourced task changes.
4. International Transfers
The following overseas processing paths are identifiable from the app code and settings. The operator must confirm the legal basis for each transfer and align any required advance notice or consent flow with the actual contracts and app screens.
| Recipient and country | Information, timing, and method | Purpose and retention | How to refuse and effect |
|---|---|---|---|
| Google LLC / United States Firebase Authentication and Cloud Functions (us-central1) | Account authentication data, UID, and access information are transferred over the network during sign-in or app use. AI requests are sent over HTTPS when an interpretation is requested. | Authentication, security, request processing, and rate limiting. Retention is governed by Google’s service-specific terms and settings. | If you do not agree to overseas processing, you may be unable to use the affected features, such as sign-in or AI interpretations. This must match the app’s actual consent flow. |
| DeepSeek API provider / processing country to be confirmed | Questions, prompts, and consultation context needed for interpretation are sent through the API when an AI request is made. | Generating AI responses. The retention period and use for model training must be confirmed under the API agreement. | This transfer does not occur if you do not use the AI feature. Required notices and consent steps must be provided before the feature is used. |
| Cloudflare, Inc. / processing country to be confirmed | Technical and access information may be transferred and processed when the website is accessed. | Static website delivery and security. Retention is governed by the service terms. | You may choose not to use the website. |
Google states that Firebase Authentication operates from data centers in the United States. Cloud Functions runs in the region where it is deployed; the app code currently uses the us-central1 endpoint. The specific processing countries and API-specific retention conditions for DeepSeek and Cloudflare must be confirmed against the Company’s account contracts and settings before publication.
5. User Rights and How to Exercise Them
Users may request access to, correction or deletion of, or restriction of processing of their personal information, and may withdraw consent, by contacting the Company. A legal representative or authorized agent may also submit a request as permitted by law. Send requests to contact@promegas.com; the Company will verify the requester’s identity and respond under applicable law. Requests concerning information held by an external provider may need to be sent to that provider separately.
6. Destruction of Personal Information
When the retention period ends or the purpose of processing is fulfilled, the Company destroys personal information in a manner that prevents restoration or recovery. Electronic files are deleted so they are difficult to recover; paper documents are shredded or incinerated. Information retained by law is stored separately from other information.
7. Security Measures
The Company limits access to personal information, uses service providers’ security features during authentication and transmission, and takes steps to keep consultation text and authentication tokens out of the app’s ordinary logs. However, the security of internet transmission and users’ devices cannot be guaranteed absolutely.
8. Automatic Collection and Analytics
The current website HTML does not include advertising cookies or web analytics tools. However, service providers may process access information for security and operation when hosting the website or authenticating app users. If analytics or advertising SDKs are added, this Policy will be updated with the information collected and opt-out method, and any required consent will be obtained.
9. Generative AI Notice
The Book of Change AI feature generates reference interpretations based on a user’s question and necessary consultation context. AI responses may be inaccurate or incomplete, and the Company does not use user input to train its own AI model. Whether an external AI provider uses API inputs for processing, retention, or model improvement must be confirmed under the provider’s contract and account settings, and this section must be updated accordingly. Do not enter sensitive personal information, such as national identification numbers, financial information, health or sexual-life information, or another person’s personal information.
10. Privacy Contact
Privacy inquiries
Promegas Interactive
Email: contact@promegas.com
Before publication, confirm and add the privacy officer’s name and title and the operator’s legal business name and address.
For privacy infringement reports or advice in Korea, users may contact the Personal Information Infringement Report Center at 118. Privacy disputes may be referred to the Personal Information Dispute Mediation Committee at 1833-6972 or other competent authorities.
11. Changes to this Policy
If laws, services, or personal-information practices change, the Company will publish the changes on the website. Changes that materially affect users’ rights will be announced in advance or separately consented to as required by law.