Privacy Policy
1. Overview
32personas (“Service”) respects user privacy and complies with applicable laws including the Korean Personal Information Protection Act (PIPA). This policy describes what personal information is collected, used, shared, and disposed.
2. Information collected (minimization principle)
- Email address · for account creation, newsletter subscription, result saving, and customer support responses
- Personality type selection result · personality-based 32 types, anonymized
- Age group, gender, country · optional, for statistical analysis
- Birth date, birth time (optional), solar/lunar calendar type, leap-month flag · collected with separate consent when you use a birth-data reading
- Age-18 confirmation records · the confirmation timestamp and wording version are collected during signup and confirmation by signed-in users, including external sign-in, to enforce the minimum age requirement. These records document the user's self-declaration, not verification of identity or actual age. Retention: account confirmation records are kept while the account exists and for 30 days after account deletion, then removed by scheduled cleanup. Pending signup records are removed by scheduled cleanup after they have been used or invalidated, or once 24 hours have passed since verification expiry.
3. Purpose and retention
| Item | Purpose | Retention |
|---|---|---|
| Account email | Account management + service delivery | Deleted immediately on account deletion (PIPA Article 21) |
| Customer support | Response + dispute resolution | 3 years (Framework Act on Consumers, Enforcement Decree Article 8) |
| Quiz results (personality type) | Service quality improvement | Anonymized on account deletion, then retained (non-identifiable) |
| External sign-in link records (oauth_identities) | Map Google, Apple, and Kakao sign-in identifiers to your account | Permanently deleted immediately upon unlink or account deletion |
- Item
- Account email
- Purpose
- Account management + service delivery
- Retention
- Deleted immediately on account deletion (PIPA Article 21)
- Item
- Customer support
- Purpose
- Response + dispute resolution
- Retention
- 3 years (Framework Act on Consumers, Enforcement Decree Article 8)
- Item
- Quiz results (personality type)
- Purpose
- Service quality improvement
- Retention
- Anonymized on account deletion, then retained (non-identifiable)
- Item
- External sign-in link records (oauth_identities)
- Purpose
- Map Google, Apple, and Kakao sign-in identifiers to your account
- Retention
- Permanently deleted immediately upon unlink or account deletion
4. User rights
Under PIPA, users may exercise the following rights, processed within 30 days of request. Use Request or export personal data or email support@mymonday.ai:
- Right to access · view collected personal information and processing status
- Right to rectification · request correction of inaccurate data
- Right to erasure · request deletion of personal information
- Right to restriction · request suspension of processing
- Right to opt out of or request an explanation for automated decisions (PIPA Art. 37-2). This service performs two automated processes: (a) personality scoring and (b) external AI-assisted birth-data interpretation. Contact support@mymonday.ai to opt out or request an explanation. Opting out deletes the related automated output and disables access immediately.
5. Third-party sharing and international transfers (Korean PIPA Arts. 17, 26, 28-8)
Personal information is never sold, and account data (email address, test results, birth data) is never used for ad targeting. Google AdSense ads are, however, served on individual content hub articles; the "Advertising" paragraph at the end of this section covers that separately. Personal data is transferred internationally to the following processors; please refer to each processor's privacy policy.
- Supabase, Inc. USA, database storage, from signup through account deletion plus 30 days, transfer method: HTTPS API.
- PostHog Inc. USA/EU, service usage analysis including anonymous visitor identifiers, page views and clicks, 30 to 365 days depending on event type, consent can be refused, transfer method: HTTPS API.
- Vercel Inc. USA, static asset hosting and function execution, at request time; log retention follows Vercel's published policy, transfer method: HTTPS.
- Resend, USA, transactional email delivery for account verification and data export, from send time for the period specified in Resend's published policy, transfer method: HTTPS API.
- Google / Gemini
- Recipient and contact
The recipient is Google LLC (USA). The contract in Korea is through reseller Google Cloud Korea LLC. Google privacy contact: https://policies.google.com/privacy; 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Service support: support@mymonday.ai.
- Destination countries
Google’s published facility countries: USA, India, Taiwan, Thailand, Japan, Malaysia, Singapore, Germany, Ireland, Netherlands, Belgium, Denmark, Finland, Sweden, Austria, Norway, United Kingdom, Uruguay and Chile. This list follows Google’s published facilities, including locations in development, as of 2026-10-14.
- Processing scope
Under the Gemini API paid terms, data may be processed and temporarily stored or cached in countries where Google or its agents maintain facilities. Facilities: https://www.google.com/about/datacenters/locations/
- Data sent by purchased feature
Depending on the purchased feature: public/private personality types, scores and explanations; calculated Saju results and birth information; selected situation or period; and supplied relationship/group member results. Other people’s data requires their use and transfer consent. Names, emails, account identifiers and raw questionnaire answers are excluded.
- Data sent for groups
We send members’ supplied public personality codes, explanations and scores on all five axes, plus group composition and calculated group metrics. Members use neutral numbered labels in AI requests. Names and nicknames appear only on this service’s screens and are excluded from AI requests. Birth information, raw answers, emails and account identifiers are excluded. Confirm members’ consent to use and transfer their information.
- Data sent for personality and Saju reports, including compatibility
We send your personality-test results saved at purchase: types when with people and alone; each context's sociability, emotionality, organization, agreeableness and inquisitiveness scores (0–100); result clarity (distance from type boundaries); and traits near those boundaries. We also send calculated Saju data and related reference commentary. Individual answers, original birth dates and times, names, emails and account identifiers are excluded. For compatibility, we also send the partner’s calculated Saju data and related reference commentary. Their personality scores are not sent. Their consent to use and cross-border transfer is required.
- Transfer timing and method
HTTPS API requests are sent after consent and payment during generation, review and correction.
- Google’s use and retention
For paid Gemini API services, Google does not use prompts or responses to improve Google products.
Google may use data, including training or fine-tuning models specifically for policy enforcement, to detect and prevent policy violations.
Abuse monitoring may retain prompts, context and responses for up to 55 days; authorized Google personnel may review flagged content.
This service uses no explicit caching or grounding.
- Our retention
Purchase inputs and reports are retained for delivery and recovery, subject to account deletion procedures and statutory transaction retention.
- Refusal and withdrawal
Refusing prevents this paid purchase. Free tests and results remain available.
Withdraw through account consent records or support@mymonday.ai to stop later transfers. New generation then requires renewed consent.
Reading a saved report does not send it to AI again. Undelivered orders follow the refund policy and support procedure.
A request already in progress may finish. No later request is sent until you renew consent.
Right to refuse: email support@mymonday.ai and we will stop optional functions that depend on the relevant processor. Refusal of the essential Supabase database or Vercel hosting means the service itself cannot be provided.
Advertising: Google AdSense ads from Google LLC (United States) are served on individual content hub articles only. They never appear on paid deliverables, checkout and account screens, or the landing page. The ad script loads only after consent is given in the cookie banner; from that point Google and its partners may process device data such as cookie identifiers, IP address and browser information in order to serve, cap and measure ads (transfer method: direct HTTPS between the browser and Google; retention: per Google's published policy). To refuse: choose "Decline" in the consent banner and the ad script never loads. If you have already accepted, "Cookie consent settings" in the footer withdraws it at any time. To turn off personalised ads only, use https://adssettings.google.com or https://www.aboutads.info.
6. Security measures
The service protects personal information with Supabase Row Level Security (RLS), HTTPS encryption in transit, and weekly access-policy reviews.
8. External Sign-in (Google, Apple, Kakao) Data Handling
When you sign in with Google, Apple, or Kakao, we receive information from that provider to identify your app account. Google and Apple authentication is brokered through Supabase. The app's external sign-in links are handled as follows.
- Collect: For Google and Apple sign-in, we check the requested provider's account identifier (sub), email address, and email verification status. With Apple's Hide My Email, we receive the Apple relay address instead of your actual email address. For Kakao sign-in, we check the Kakao member number, email address, and verification status. Provider-supplied names, nicknames, or profile images may be included in the authentication process, but the app does not copy them into its external sign-in link records. The app account database stores your email address; oauth_identities stores the provider type, provider account identifier, email at linking, linking time, and last sign-in time. This describes the app's account and link records, not the full scope of user metadata stored by the Supabase authentication broker. We do not request data from other Google services such as Gmail, Drive, Calendar, or Contacts, or KakaoTalk messages or friend lists.
- Use: We use this information for account identification and sign-in authentication. A provider-verified email matching an existing account's email may link to that account. An Apple relay address differs from your original address, so it does not guarantee an automatic link to the same account. We do not use this information for marketing email, ad targeting, profiling, or automated decision-making. Your links are visible on the account security page.
- Share: External sign-in information is processed by Google, Apple, or Kakao for authentication and by the processors listed in Section 5. Supabase brokers Google and Apple authentication and stores the app database. The app does not sell this information to third parties or provide it for advertising.
- Delete: You can unlink Google, Apple, or Kakao on the account security page (Manage sign-in connections) under Linked external sign-in. A password or another linked provider is required to sign in again; the web security screen requires a password to be set. When unlinking completes, the app deletes the corresponding oauth_identities link record. These records are also deleted when app account deletion (Request account deletion) completes. Deleting a link record does not delete the provider's original account or the Supabase authentication broker account itself.
9. Business Identity & Contact
Operator information (mandated by Act on the Consumer Protection in Electronic Commerce Article 10 + Personal Information Protection Act Article 30)
Company: 프로젝트먼데이 (Project Monday) · Business registration number: 106-68-00711
Contact channel
support@mymonday.ai (privacy rights, terms questions, technical support, response SLA 1-2 business days)
Send this through the support form instead of email →
The Data Protection Officer (DPO) is appointed alongside the business identity disclosure above. Until appointment, support@mymonday.ai serves as the interim DPO channel.