Privacy policy

TINYGEM (the “Company”), in operating Unicorn Score (the “Service”), processes Users' personal information as follows in accordance with the Personal Information Protection Act.

1. Personal information processed and how it is collected
- Members: email address, name and profile photo (when provided by Google upon Google sign-in), and the account identifier of the sign-in method. If “Hide My Email” is selected in Apple sign-in, the Company receives a relay email address created by Apple.
- Non-members: an anonymous session identifier stored in the browser.
- Payments: order number, payment amount and status, and transaction, subscription and customer identifiers issued by Paddle. Payment method information such as card numbers is received directly by Paddle and not by the Company.
- Use of the Service: business materials that the User enters or attaches (which may contain personal information) and the Reports produced from them.
- Automatic collection: sign-in session cookies, language settings, an anonymous identifier cookie for Service improvement (us_aid, 1 year), and usage statistics (pages visited, language, referral source, usage behavior, and account and workspace identifiers if signed in). Usage statistics do not store entered business materials, IP addresses or device information. The hosting provider temporarily keeps access records (IP address, browser information, date and time of access) for security and incident response.

2. Purposes of processing
Identifying Members and signing in; running analyses and providing and storing Reports; managing payments, refunds and subscriptions; sending sign-in code and payment notification emails; responding to customer inquiries; preventing fraudulent use and ensuring security; and usage statistics for Service improvement.

3. Retention and use period
Member information and Reports are destroyed without delay when a Member closes their account. However, the following records are retained for the periods prescribed by applicable laws: records on contracts or withdrawal of orders, 5 years; records on payment and supply of goods, etc., 5 years; records on consumer complaints or dispute handling, 3 years (Act on the Consumer Protection in Electronic Commerce); and Service access logs, 3 months (Protection of Communications Secrets Act). Raw usage statistics are deleted after 13 months. Non-members' purchase records are retained for the transaction record retention periods above, and deletion may be requested via the customer support email.

4. Provision of personal information to third parties
The Company does not provide Users' personal information to third parties. However, when a payment is made, the Company provides the email address and order information (product, amount, order number) to the seller, Paddle.com Market Limited (UK), so that it can process the sale, payment, taxes and refunds, and Paddle retains this information in accordance with its own privacy policy (paddle.com/legal/privacy). No information is provided if no payment is made.

5. Entrustment of personal information processing and overseas transfer
The Company entrusts the processing of personal information as follows to provide the Service, and in this process personal information is transferred overseas. The transfer takes place by transmission over encrypted networks as needed when the Service is used, and the retention period lasts until the purpose of the entrustment is achieved or the retention periods in Section 3 above end.
- Vercel Inc. (USA) — Service hosting and execution, attachment storage, and relaying of AI model calls (AI Gateway). Items transferred: all personal information in the course of using the Service. Contact: vercel.com/legal/privacy-notice
- Neon (Databricks, Inc., USA) — database storage. Items transferred: member, order and Report information. Contact: databricks.com/legal/privacynotice
- Resend (Plus Five Five, Inc., USA) — sending sign-in code and payment notification emails. Items transferred: email address and email content. Contact: resend.com/legal/privacy-policy
- AI model providers (depending on the models selected by the User: Anthropic PBC, OpenAI, L.L.C., Google LLC, and SpaceX AI as the provider of Grok, all in the USA) — running analyses. Items transferred: Input Materials and analysis instructions. Using the prompt-training restriction of AI Gateway, the Company sends data only to providers that have agreed not to use inputs to train their models. Some providers keep requests for a limited period to monitor misuse and then delete them (for example, 30 days for Anthropic's Claude Fable models). Contact: each company's privacy policy (anthropic.com/legal/privacy, openai.com/policies/privacy-policy, policies.google.com/privacy, x.ai/legal/privacy-policy)
- Perplexity AI, Inc. (USA, called via AI Gateway) — web search at the time of the run. Items transferred: search queries created from the analysis topic. Contact: perplexity.ai/hub/legal/privacy-policy
Users who do not wish their personal information to be transferred overseas may stop using the Service or close their account. However, because the processing above is essential to providing analyses, Users who refuse it cannot use the Service.

6. Destruction procedures and methods
Personal information whose retention period has ended or whose processing purpose has been achieved is destroyed without delay. Electronic files are deleted using methods that make them unrecoverable, and information that must be retained under applicable laws is stored separately from other information.

7. Users' rights and how to exercise them
Users may at any time request access to, correction, deletion or suspension of processing of their personal information, and may withdraw their consent. Requests can be made to the email address of the Chief Privacy Officer below, and the Company will take action within 10 days and notify the User of the result. A legal representative or a person authorized by the User may also make requests.

8. Security measures
The Company implements encryption in transit (HTTPS), password-free sign-in (Google, Apple, one-time codes) with hashed storage of sign-in codes, minimization of access privileges, non-retention of payment method information, and separate storage of operational secrets.

9. Cookies and other automatic collection tools
The Company uses cookies necessary to keep Users signed in and to store language settings, and an anonymous identifier cookie (us_aid) used for in-house usage statistics without advertising or external analytics services. Users may refuse cookie storage in their browser settings, but sign-in will then not be maintained.

10. Children under 14
The Service does not accept sign-ups from children under 14 years of age.

11. Remedies for infringement of rights
For consultation or dispute resolution regarding infringement of personal information, Users may contact the Personal Information Dispute Mediation Committee (1833-6972, kopico.go.kr), the Personal Information Infringement Report Center (118, privacy.kisa.or.kr), the Supreme Prosecutors' Office (1301, spo.go.kr) or the Korean National Police Agency (182, ecrm.police.go.kr).

12. Amendments
This Policy takes effect on September 30, 2026. If its content changes, the Company will post a notice on the Service from 7 days before the changes take effect (30 days before for significant changes).

This is a translation. If it differs from the Korean original, the Korean original prevails.