Privacy Policy
1. Overview
32personas (“Service”) respects user privacy and complies with applicable laws including the Korean Personal Information Protection Act (PIPA). This policy describes what personal information is collected, used, shared, and disposed.
2. Information collected (minimization principle)
- Email address · for account creation, newsletter subscription, result saving, and customer support responses
- Personality type selection result · personality-based 32 types, anonymized
- Age group, gender, country · optional, for statistical analysis
- Birth date, birth time (optional), solar/lunar calendar type, leap-month flag · collected with separate consent when you use a birth-data reading
3. Purpose and retention
| Item | Purpose | Retention |
|---|---|---|
| Account email | Account management + service delivery | Deleted immediately on account deletion (PIPA Article 21) |
| Customer support | Response + dispute resolution | 3 years (Framework Act on Consumers, Enforcement Decree Article 8) |
| Quiz results (personality type) | Service quality improvement | Anonymized on account deletion, then retained (non-identifiable) |
| External sign-in link records (oauth_identities) | Map external sign-in identifiers (e.g. Google) to your account | Permanently deleted immediately upon unlink or account deletion |
- Item
- Account email
- Purpose
- Account management + service delivery
- Retention
- Deleted immediately on account deletion (PIPA Article 21)
- Item
- Customer support
- Purpose
- Response + dispute resolution
- Retention
- 3 years (Framework Act on Consumers, Enforcement Decree Article 8)
- Item
- Quiz results (personality type)
- Purpose
- Service quality improvement
- Retention
- Anonymized on account deletion, then retained (non-identifiable)
- Item
- External sign-in link records (oauth_identities)
- Purpose
- Map external sign-in identifiers (e.g. Google) to your account
- Retention
- Permanently deleted immediately upon unlink or account deletion
4. User rights
Under PIPA, users may exercise the following rights, processed within 30 days of request. Use Request or export personal data or email support@mymonday.ai:
- Right to access · view collected personal information and processing status
- Right to rectification · request correction of inaccurate data
- Right to erasure · request deletion of personal information
- Right to restriction · request suspension of processing
- Right to opt out of or request an explanation for automated decisions (PIPA Art. 37-2). This service performs two automated processes: (a) personality scoring and (b) external AI-assisted birth-data interpretation. Contact support@mymonday.ai to opt out or request an explanation. Opting out deletes the related automated output and disables access immediately.
5. Third-party sharing and international transfers (Korean PIPA Arts. 17, 26, 28-8)
Personal information is never sold, and account data (email address, test results, birth data) is never used for ad targeting. Google AdSense ads are, however, served on the free surfaces (content hub, quiz, type catalogue, free result); the "Advertising" paragraph at the end of this section covers that separately. Personal data is transferred internationally to the following processors; please refer to each processor's privacy policy.
- Supabase, Inc. USA, database storage, from signup through account deletion plus 30 days, transfer method: HTTPS API.
- PostHog Inc. USA/EU, analytics telemetry (distinct_id, $pageview, click events), 30 to 365 days by event type, can be opted out, transfer method: HTTPS API.
- Vercel Inc. USA, static asset hosting and function execution, at request time; log retention follows Vercel's published policy, transfer method: HTTPS.
- Resend, USA, transactional email delivery for account verification and data export, from send time for the period specified in Resend's published policy, transfer method: HTTPS API.
- DeepSeek (Hangzhou DeepSeek), China, birth-data interpretation generation (birth date/time/gender), from call time for the period specified in DeepSeek's published policy, transfer method: HTTPS API; a hash of the input values is retained in the processing audit record.
Right to refuse: email support@mymonday.ai and we will stop optional functions that depend on the relevant processor. Refusal of the essential Supabase database or Vercel hosting means the service itself cannot be provided.
Advertising: Google AdSense ads from Google LLC (United States) are served on the free surfaces only (content hub, quiz, type catalogue, free result). They never appear on paid deliverables, checkout and account screens, or the landing page. The ad script loads only after consent is given in the cookie banner; from that point Google and its partners may process device data such as cookie identifiers, IP address and browser information in order to serve, cap and measure ads (transfer method: direct HTTPS between the browser and Google; retention: per Google's published policy). To refuse: choose "Decline" in the consent banner and the ad script never loads. If you have already accepted, "Cookie consent settings" in the footer withdraws it at any time. To turn off personalised ads only, use https://adssettings.google.com or https://www.aboutads.info.
6. Security measures
The service protects personal information with Supabase Row Level Security (RLS), HTTPS encryption in transit, and weekly access-policy reviews.
8. External Sign-in (Google, Kakao) Data Handling
When you use Sign in with Google or Sign in with Kakao, we receive limited information from that provider. The specifics of how we handle external sign-in user data are as follows.
- Collect: During the Google sign-in handshake we transiently receive from Google: (a) your email address, (b) your Google account identifier (the OpenID Connect sub claim), and (c) your profile display name and avatar URL if available. During the Kakao sign-in handshake we transiently receive from Kakao: (a) your email address and whether it is verified, (b) your Kakao member number, and (c) your profile nickname. In both cases we persist only three items in our database: your email address, that provider’s account identifier, and the last sign-in timestamp. Display names, nicknames, and avatar URLs are not stored. We do not request and do not receive data from other Google services such as Gmail, Drive, Calendar, or Contacts, nor KakaoTalk messages or friend lists.
- Use: We use this information solely for account identification and sign-in authentication. We do not use it for marketing email, ad targeting, profiling, or automated decision-making. Your external sign-in links are visible to you on the account security page.
- Share: We do not sell, share, or transfer data received from Google or Kakao to third parties. The data does not leave the processors listed in Section 5 above (Supabase database storage).
- Delete: You can unlink your Google or Kakao account at any time on the account security page (Manage sign-in connections) under “Linked external sign-in.” Unlinking deletes the corresponding row in our oauth_identities table immediately. Deleting your account (Request account deletion) also deletes the linked identity immediately.
9. Business Identity & Contact
Operator information (mandated by Act on the Consumer Protection in Electronic Commerce Article 10 + Personal Information Protection Act Article 30)
Company: 프로젝트먼데이 (Project Monday) · Business registration number: 106-68-00711
Contact channel
support@mymonday.ai (privacy rights, terms questions, technical support, response SLA 1-2 business days)
Send this through the support form instead of email →
The Data Protection Officer (DPO) is appointed alongside the business identity disclosure above. Until appointment, support@mymonday.ai serves as the interim DPO channel.