Privacy Policy

Visitor data collected by sites and apps our members build (form submissions, sign-ups, orders, bookings) does not pass through VibeCampus: it is saved straight into an external database the member owns and connected themselves (for example, their own Supabase account). VibeCampus does not newly collect or store this data; the controller is the member who built the site. Direct any access, correction, or deletion request to that site's operator.

Some visitor data stored through the previously offered platform-hosted backend (retired in 2026) may remain. New collection is shut off, and the residue is being destroyed on an automated schedule: form submissions are deleted once their stored retention deadline (about 180 days) passes, guest order/booking contact details are removed after 180 days, and activity logs older than 90 days are deleted. When the owning member deletes their account, their visitor data is deleted immediately.

The data controller is 바이브캠퍼스 VibeCampus (CEO HUHJUNMIN, 66 Dongtan-daero 1-gil, Dongtan-gu, Hwaseong-si, Gyeonggi-do, Republic of Korea). This Policy covers the VibeCampus website and its features. For any privacy request, contact wondertarot.kr@gmail.com.

We collect the following. At signup we ask only for the minimum: email, nickname, and password.

• Account (required): email, nickname, password (stored only as a one-way hash), email verification code records, whether you agreed to the Terms, and whether you opted in to marketing

• Social login: the provider (Google, Kakao, Apple, GitHub, Naver), the provider's account identifier, email, and name or nickname

• Optional: phone number, secondary password (6-digit PIN, one-way hashed), profile (bio, avatar), referral code

• Content you create: posts, comments, projects, messages, team activity records, and the prompts, conversations, and attachments (images, PDFs) you submit to AI features

• Inquiries: name, email, and message content (support chat, contact form, inbound email)

• Cash-out requests only: legal name, payout (bank/recipient) details, requested amount and currency

• Payments: amount, currency, and PayPal transaction identifiers. We never collect or store full card numbers (PayPal processes them).

• Usage and security data: last-seen time, service usage records, AI usage metering (model, token counts and similar billing metadata), and IP addresses for security (used transiently for login protection and rate limiting; a one-way hash of the signup IP is kept to prevent referral fraud)

• External service keys you register (BYO keys: Anthropic, Supabase, etc.), stored encrypted with AES-256-GCM

• Usage statistics (only with your consent): visit and usage statistics collected by Google Analytics 4

• Cookie-free anonymous visit records: the pages you view, the names of buttons and links you press, the time a page is visible, where you came from, and similar (never your name, email address, or IP address itself; Section 6-2)

Purposes: creating, authenticating, and protecting accounts; providing the service and its AI features; running the Credits economy including settlement and cash-outs; community and team features; responding to inquiries; preventing abuse; meeting legal obligations; and, only with consent, marketing and usage analytics.

Essential service messages (signup, account, password, payment notices) are always sent because the service cannot operate without them. Marketing (tips, events, offers) is sent by email or SMS only if you opt in; you can withdraw in account settings at any time and it stops immediately.

Prompts, content, and attachments you enter into AI features (build, edit, chat, image, video, music, speech, support) are transmitted to and processed by the third-party AI providers below to generate results.

• Anthropic (Claude): studio builds, edits and chat, live support, automated funding-campaign review, arcade assignment grading

• Google: Vertex AI (Imagen images, Veo video, Lyria music), Cloud TTS speech synthesis, and the Gemini API when certain support/verification features are enabled

• ElevenLabs: music generation prompts

• OpenAI: only when automated content-moderation or search-quality features are enabled (the text being checked)

• Failover routes: equivalent models via Google Cloud or Amazon Web Services are configured for outages and, if activated, process data for the same purposes

• Browser speech recognition (Studio 'Dictate'): what you say after pressing the microphone button is not sent to our servers; the speech-recognition feature built into your browser converts it to text. During this process your voice data may be sent to and processed by the browser vendor's servers (e.g. Google Chrome, Microsoft Edge, Apple Safari) under that vendor's privacy policy, not ours. We never receive or store the audio. The recognized text stays in your browser until you review it in the input box and press Send, after which it is handled exactly like typed input.

Training use: Anthropic's API and Google Vertex AI state that API inputs are not used to train their models by default. For other providers, training use follows each provider's policy. We do not train our own AI models on your inputs.

How to refuse: if you do not use the AI features, none of your input is sent to AI providers. If you use your own API key (BYO key), those calls are governed by your agreement with that provider. AI output can be inaccurate; your review responsibilities are set out in Section 6 of the Terms. If you do not press the microphone button, or you deny the microphone permission in your browser, no voice is processed.

Principle: we destroy personal data without delay once its purpose is met. On account deletion, immediately: your email is irreversibly anonymized; name, real name, phone, profile and bio are deleted; stored BYO secret keys, connections, notifications and DMs are deleted; your public content is hidden; and all sessions are invalidated.

Statutory retention: records that the law requires us to keep (payments, transactions, cash-outs) are kept attached to an anonymized account shell, separated from identifying data, then destroyed after the period ends. We use them for no other purpose. Korean statutory periods:

• Records of contracts and withdrawal of offers: 5 years (Act on Consumer Protection in Electronic Commerce)

• Records of payment and supply of goods/services: 5 years (same Act)

• Records of consumer complaints or dispute resolution: 3 years (same Act)

• Tax records: the period set by tax law (generally 5 years)

Cash-out records (including legal name and payout details) are retained for those statutory periods and dispute handling even after withdrawal.

Automated destruction (runs daily): handled inquiries are deleted after 1 year; legacy visitor form submissions are deleted once their ~180-day deadline passes; guest order/booking contacts are removed after 180 days; legacy activity logs older than 90 days are deleted; BYO connection keys unused for 180 days are destroyed automatically.

Deleted content: content you delete is immediately hidden (soft delete) and may be retained internally for error recovery, dispute handling, and buyer protection for sold works. You can request permanent erasure of retained deleted content via Section 7, and we comply unless a legal duty requires retention.

We do not operate a per-member login/access-log database; we keep only the minimum status data (such as last-seen time) needed for security and presence. Anonymous visit records are deleted after 396 days (about 13 months), once their daily totals are complete under Section 6-2, leaving only date-and-hour totals that contain no personal data. Electronic files are erased using non-recoverable methods.

We entrust processing to the companies below to run the service. Each processor receives only the minimum needed for its task.

We do not sell personal data, and we do not provide it to third parties beyond this processing, except where a lawful request (such as from law enforcement) requires it.

When you preview YouTube or Vimeo videos in the embed tool, those players load and their own cookie and privacy policies apply.

Operational alert webhooks (if configured) receive only minimal data with emails and names masked.

To run the service, we transfer personal data abroad for entrusted processing and storage, disclosed here in accordance with Korea's Personal Information Protection Act (Article 28-8).

Timing and method: transferred continuously over encrypted network connections (HTTPS/TLS) as you use the service.

Refusal and consequences: you may refuse these transfers by contacting wondertarot.kr@gmail.com. Because they are essential infrastructure, refusing may limit your use of the service. Refusing the statistics transfer (GA4) never limits your use in any way.

Safeguards: encryption in transit end to end, data processing agreements (DPAs) with processors including standard contractual clauses, and the other safeguards required by law.

Cookies we set ourselves are listed below. We use no advertising cookies.

Statistics consent: choose in the banner on your first visit. Google Analytics 4 loads only if you agree (with IP anonymization). Declining never limits the service, and you can change your choice anytime via “Cookie settings” in the page footer.

Third-party cookies: PayPal on payment screens, hCaptcha and Cloudflare Turnstile on security checks (if configured), and YouTube/Vimeo players in embed previews may set their own cookies under their own policies.

Browser storage (localStorage etc.): your cookie choice (vc-consent), display settings such as theme and sound, local copies of studio and support conversations, funding campaign drafts, and dismissed-banner flags are stored in your browser, not on our servers. A service-worker app cache is used for offline support. You can clear all of it with your browser's data-clearing tools.

To improve the service and keep operating statistics (such as visitor numbers, time on page, and the buttons people press most), we keep visit records without cookies or any storage on your device. They are stored only on our own servers and database (the hosting and database processors in Sections 4 and 5) and are never sent to third parties such as advertising or analytics companies.

What we record: the address of the page you viewed (query values and member or project ID positions removed), the name of the button or link you pressed (never the text on the screen or anything you typed), the time the page was actually visible, where you came from (search, social, direct, and so on, plus only the main name of another site), campaign tags in ad links (utm), device type (phone, tablet, or computer), browser language, the domain you visited, the time of the visit, and whether you were signed in (guest, member, or new member). Page slugs, action names, referring sites and campaign values are kept only from approved lists; other values are grouped as other. Staff accounts are excluded.

To count the same visitor only once per day, we use an anonymous marker made by irreversibly transforming your IP address and browser information with a secret value used only for that day. The secret value is generated at random each day, kept only until the end of the next day, and then deleted, after which not even we can turn a marker back into an IP address or link it to visits on other days. We never store your IP address itself. A random number used for one browser tab lives only in the browser's memory and disappears when the tab closes; our server keeps only a value transformed from it in the same way. Opening or reloading a document creates a new number. Because the marker is derived from the IP address and browser information, visitor counts are estimates: several people sharing one network and the same kind of device and browser may count as one visitor, and one person using several devices may count as several.

What we never record: your name, email address, phone number, member ID, anything you typed, or your IP address itself. Published member sites (/p/), embed pages, and visits by search robots, link previewers, and automated browsers are not recorded.

Retention: each daily cleanup processes the oldest raw records over 396 days (about 13 months), completes their totals, then deletes them. Unfinished dates after failures or backlogs are retried in the next cleanup. Cleanup and deletion of old daily secrets continue when collection is switched off. Date-and-hour totals without personal data are kept as service statistics.

Your choice: if you choose Essential only in the cookie notice at the bottom of the page, this record is not kept in that browser either, and you can change the choice at any time under Cookie settings at the bottom of the page. The usage statistics that Sections 1 and 6 describe as collected only with consent are Google Analytics 4 (statistics cookies); the records in this section use no cookies.

Legal basis: in Korea, the minimum processing needed to provide the service and compile statistics; for EEA and UK users, legitimate interests (GDPR Article 6(1)(f)). Under California law this falls under the internet activity category, and it is never sold or shared.

You may at any time request access, correction, deletion, restriction of processing, and withdrawal of consent. Directly in account settings you can: edit your profile and contact details, withdraw marketing consent (effective immediately), export your data (account, transactions, projects, posts as a JSON download), and delete your account (processed immediately).

For anything else (permanent erasure of retained deleted content, restriction requests, etc.), contact wondertarot.kr@gmail.com. After verifying it is you (minimal checks such as confirming your account email), we act without undue delay within the periods set by law. You may also act through a legal representative or an authorized agent.

Exercising your rights never degrades your service. For complaints to supervisory authorities, see Section 10.

We apply the following safeguards, all actually implemented:

• Passwords and secondary PINs are stored only as salted one-way hashes (scrypt), never in plain text. Sessions use HTTP-only, Secure, SameSite cookies, with remote session invalidation.

• All traffic is encrypted with HTTPS/TLS, with security headers (CSP, HSTS, X-Frame-Options) and sandboxed isolation of previewed content.

• Brute-force protection (login attempt limits and progressive delay), an optional secondary password (security PIN), and automated-attack checks (hCaptcha and similar).

• External service keys you register (BYO keys) are encrypted with AES-256-GCM; you can delete them in settings at any time and they are deleted on account closure. External connection keys (such as Supabase) are additionally destroyed automatically after 180 days of non-use.

• Least-privilege access; the source of for-sale builds is viewable/downloadable only by the owner and legitimate buyers; unauthorized scraping is blocked.

• The database runs on a managed cloud service whose backup and recovery mechanisms apply; content hashes are used to detect tampering.

No system is perfectly secure, so please use a strong, unique password (and the security PIN). If a breach occurs, we notify and report without delay as required by applicable law.

VibeCampus is not directed at children under 14 (under 13 for US residents), and we do not intend to collect children's data. We do not currently collect dates of birth; signup requires confirming you are 14 or older by accepting the Terms.

If we learn that a child's data was collected without the required guardian consent, we delete it without delay. Parents and guardians: please contact wondertarot.kr@gmail.com.

Privacy officer: HUHJUNMIN (CEO) · contact: wondertarot.kr@gmail.com. You may direct any privacy question, complaint, or remedy request there, and we will respond and act without undue delay.

For dispute mediation or counseling about privacy infringements, you can contact these Korean authorities:

• Personal Information Dispute Mediation Committee (privacy.go.kr / 1833-6972) · Privacy Infringement Report Center, KISA (privacy.kisa.or.kr / 118)

• Supreme Prosecutors' Office Cybercrime Department (spo.go.kr / 1301) · National Police Agency Cyber Bureau (ecrm.police.go.kr / 182)

Users outside Korea can also complain to their local supervisory authority (see the addenda in Sections 11 to 14).

This section applies to users in the European Economic Area and the United Kingdom. The controller is the company in Section 1. We have not appointed a DPO because we do not meet the mandatory designation criteria; direct all requests to the privacy officer in Section 10. No EU or UK representative is currently appointed.

Legal bases (GDPR Article 6): • Contract (Art. 6(1)(b)): providing your account, the service, AI features, and payments • Legitimate interests (Art. 6(1)(f)): security, fraud and abuse prevention, defending the service • Consent (Art. 6(1)(a)): marketing, statistics cookies • Legal obligation (Art. 6(1)(c)): transaction record-keeping, tax duties

You have the rights of access, rectification, erasure, restriction, data portability, and objection, and you may withdraw consent at any time (without affecting the lawfulness of processing before withdrawal). Exercise them as in Section 7.

We do not make decisions based solely on automated processing that produce legal effects on you or similarly significantly affect you.

Transfer safeguards: transfers from the EEA/UK to the Republic of Korea are covered by the European Commission's adequacy decision for Korea (2021) and the UK's adequacy regulations (2022). Transfers to processors in the USA and elsewhere are covered by data processing agreements incorporating Standard Contractual Clauses; some providers also hold EU-US Data Privacy Framework certification. See Sections 4 and 5 for the processor list.

Supervisory authorities: you may lodge a complaint with the authority of your member state (EEA list: edpb.europa.eu); in the UK, with the Information Commissioner's Office (ico.org.uk). If a breach poses a risk, we notify the supervisory authority within the GDPR deadline (72 hours as a rule) and take the required measures.

This section applies to California residents. We may fall below the CCPA's “business” thresholds (such as over $25 million annual gross revenue), but we honor the rights below for California residents regardless.

Categories of personal information collected in the last 12 months: • Identifiers (email, nickname, IP address) • Customer records (phone number; legal name and payout details for cash-outs) • Commercial information (purchase and transaction history) • Internet activity (usage statistics, only with consent) • Audio/visual information (content and profile images you upload) • Sensitive personal information limited to account login credentials, used only to provide the service. Sources, purposes, and recipients are as described in Sections 1 to 5.

We do not sell personal information, and we do not share it for cross-context behavioral advertising. A “Do Not Sell or Share My Personal Information” link is therefore not applicable. We do not sell or share the personal information of consumers we know to be under 16.

Rights: to know, access, correct, delete, limit use of sensitive personal information, and not to be discriminated against for exercising rights. Two ways to submit a request: (1) your account settings (data export, account deletion) or (2) email wondertarot.kr@gmail.com. We verify requests via your account email; you may use an authorized agent.

This section applies to users in Japan. The purposes of use are published in Section 1 of this Policy.

Provision to third parties (processors) in foreign countries: your data is processed in the Republic of Korea (operations) and in the countries shown in the tables in Sections 4 and 5 (USA, Japan). Each processor is bound by contract and applies safeguards such as encryption. Information about those countries' data protection regimes is available in the survey materials published by Japan's Personal Information Protection Commission (ppc.go.jp).

Disclosure, correction, and suspension of use of retained personal data: request via account settings or email (no fee); we respond without undue delay. Security measures are as described in Section 8.

Contact: wondertarot.kr@gmail.com. You may also consult Japan's Personal Information Protection Commission.

We have no entity, servers, or dedicated representative in mainland China; the service is provided from the Republic of Korea. The Chinese-language interface is offered for convenience.

If you use the service from China, your personal data is transferred outside China (to Korea, the USA, and Japan) for processing. Recipients, items, purposes, and contacts are as shown in the tables in Sections 4 and 5. You can exercise access, correction, deletion, and account-deletion rights via account settings or email (Section 7).

If you do not agree to this offshore processing, you may stop using the service and request account deletion.

This revision takes effect on October 15, 2026.

• 2026-06-23: previous version in force

• 2026-07-19: full rewrite. Named processor and transfer tables; cookie and browser-storage inventory with consent-gated statistics; expanded generative-AI notice (ElevenLabs, OpenAI, and more); retention wording corrected to match actual operations; new EEA/UK, California, Japan, and China addenda

• 2026-09-24: Studio 'Dictate' (browser speech recognition) notice added. Section 2 now states that your voice is processed by your browser's vendor and never received or stored by us, the refusal method is extended, and a paragraph is added to Section 8 of the Terms

• 2026-10-16: Added the Legal Notice Pack’s reference-only purpose, restrictions on access from and drafting for the EU, EEA and mainland China, user responsibilities and country-code use to the Terms and Privacy Policy.

• 2026-10-17: Added the AI Marketing Studio scope and information-processing provisions, effective October 17, 2026.

• 2026-10-15: Added the notice on cookie-free anonymous visit records (visits, clicks, time on page) as Section 6-2, and updated the data list in Section 1 and the access-log sentence in Section 3 to match

For material or unfavorable changes we give advance notice in the service. Previous versions are available on request at wondertarot.kr@gmail.com.

The Legal Notice Pack creates reference drafts. It does not provide legal advice or replace review by a lawyer.

The Legal Notice Pack is not available to users located in the EU, EEA or mainland China. It must not be used to draft notices for those markets.

You are responsible for complying with the laws that apply in your region. Consult a lawyer in the relevant jurisdiction before using a draft.

To check regional availability, we use the country code attached to the request by our hosting provider. This check does not separately look up your location or IP address from your device. The code estimates the connection location, not your residence or nationality.

Visits to published websites are retained only as daily totals that cannot identify individuals (visits, page views, and referral categories), for the same retention period as visit records. When a member uses AI Marketing Studio, we collect and use website information verified by the member: business name, business category, address, contact details intended for publication, opening hours and links. This information may be provided to search engines, maps and AI services for public disclosure.

Questions submitted through website consultations are used only as aggregates without personal information. AI answer samples and measurement data are deleted 13 months after collection.

For other website URLs entered in diagnostic mode, only publicly available content is checked. The website body content is not stored, and diagnostic results are deleted seven days after creation.

Recipients are search engines (IndexNow participating engines and Google Search Console) and AI API providers (Anthropic and OpenAI). We use AI APIs under terms that exclude inputs and outputs from model training. Members' email addresses and payment information are not disclosed through this feature.

In plain language, only website details the member has verified for publication are shared externally, and consultation questions are reviewed only as counts that do not identify anyone.