1. Personal Information We Process
We may process the following information when you create an account and use the service.
- Google and Privy authentication identifiers and your verified email address
- Nickname, Embedded Wallet address, and blockchain network identifiers
- Fan verification participation and results, and Fan Passport and Stamp issuance and status information
- LIVE reservations, attendance, and survey participation information
- Benefit application, receipt, and usage status, and notification settings and subscription information
- Optional: when you register for Kakao service notifications, the Korean mobile phone number confirmed through your Kakao account, its masked display value, a hash of the Kakao account identifier, and consent, withdrawal, and delivery status information
- Name and phone number for physical reward delivery or on-site pickup, plus postal code and address when shipping is required
- Descriptions and evidence images you submit for manual fan verification, review status, and reward records
- Notice comments, public nicknames and characters, fan rankings, and fan activity you choose to make public
- When a professional account owner consents to Instagram connection: account ID and username, encrypted access token and expiry time, and recent post captions, timestamps, original links, and media URLs
- Access logs, errors, and security events generated while you use the service
2. Purposes of Processing
- Identifying members, maintaining login sessions, and protecting accounts
- Providing fan verification, issuing Passports and Stamps, and confirming ownership
- Privately reviewing evidence, granting rewards, moderating comments, calculating fan rankings, and displaying fan activity you choose to share
- Displaying recent activity from a consenting Instagram professional account on its fan page and maintaining the connection
- Providing LIVE reservations, attendance, surveys, and benefits
- Sending notifications, responding to inquiries, and improving service quality
- Confirming consent for Kakao service notifications, sending service notifications to the phone number on the Kakao account, and checking provider acceptance and final delivery results
- Preventing misuse, responding to security incidents, and complying with legal obligations
3. Retention and Use Period
We retain personal information for as long as necessary to provide the service and maintain your account. We delete it without undue delay when the purpose of processing has been fulfilled or when you request deletion. We delete physical reward recipient details 30 days after shipping or on-site pickup is completed. If you withdraw consent for Kakao service notifications or disconnect Kakao, we delete the original phone number from kyaa systems and any incomplete registration information. Consent and withdrawal history, delivery correlation values, and provider acceptance and result records may be stored separately for the scope and period necessary to comply with applicable laws, resolve disputes, or respond to security incidents. We may also store information separately where applicable laws require retention for a certain period.
4. External Services and Processing Providers
We use Google and Privy authentication and wallet services to provide login and Embedded Wallet functionality. Each provider may process identifiers and technical information required for authentication under its own policies. We do not sell personal information beyond what is necessary to provide the service.
- Instagram connection requires separate consent from the professional account owner. kyaa requests basic read access, without publishing, commenting, or messaging permissions. We display media using Instagram-provided URLs without storing the original media files; cards open the original posts.
- When disconnection or a valid deletion request is processed, kyaa deletes the connected account information, access token, media cache, and connection-flow data. A hashed deletion confirmation code is retained for 30 days, and an account hash used to prevent deletion/reconnection races for up to 2 days before cleanup. Account owners can also revoke Meta access in Instagram's Apps and Websites settings.
- Kakao service notification registration uses Kakao's phone_number permission, with your separate consent, to read the phone number confirmed through that Kakao account. We do not retain the Kakao access token issued during this process.
- Processor: 솔라피 주식회사 (SOLAPI). Processing service: sending Kakao service notifications and checking provider acceptance and delivery results. The recipient phone number and information required to send the message are provided for this service. Under its official Privacy Policy, 솔라피 주식회사 retains message delivery records, including the recipient number, message content, delivery time, and delivery result, for one year from the delivery date.
5. Your Rights
You may request access to, correction or deletion of, restriction of processing of, or withdrawal of consent for your personal information. You may submit a request using the email address below. After verifying your identity, we will process the request in accordance with applicable laws.
6. Security Measures
We apply technical and administrative measures necessary to protect personal information, including server-side verification of authentication information, role-based access controls, non-public handling of sensitive information, and restricted access to and review of operational records.
7. Contact
For privacy inquiries or requests to exercise your rights, contact the Sallylab Inc. privacy team at support@kyaa.io.
8. Changes to This Policy
If we revise this Policy because of changes to applicable laws or the service, we will provide notice of the changes and their effective date through the kyaa service before the revised Policy takes effect.