Privacy Policy

Version 1.1 · Effective October 19, 2026

Region
United States (CCPA)European Union (GDPR)

Privacy Policy

The operator of Roasting View (hereinafter the "Operator") operates the Roasting View service, values users' personal information, and complies with relevant laws such as the Personal Information Protection Act and the Act on Promotion of Information and Communications Network Utilization and Information Protection.

1. Purpose and Items of Personal Information Collection and Use

1.1 Purpose of Collection and Use

The Operator processes personal information for the following purposes:

  • Membership registration and management (including confirming that you are 14 or older)
  • Service provision and improvement
  • Producing service usage statistics (return visits, return visits after joining a theme, and theme participation in totals)
  • Taste matching system operation
  • Identity verification and prevention of unauthorized use
  • Customer inquiry response

The Operator does not show advertising in the service and does not use personal information for advertising.

1.2 Collection Items

The Operator processes the items in (A) to perform its service contract with you, under Article 15(1)4 of the Personal Information Protection Act, and the items in (B) with your consent.

(A) Items processed to provide the service (performance of contract) — Article 15(1)4 of the Personal Information Protection Act

  • Member information: email address, password (stored with one-way encryption), nickname, and name (if you enter it)
  • Kakao and Apple sign-in information (if you use that sign-in): the member identifier each service gives us, and nickname
  • Sign-in records: IP address, browser information, and sign-in time
  • Reviews: matched or different, the reason, text, photos, flavor notes, and visit date
  • Visit records: the café you visited and the date (the coordinates stored with them are the café's, not your location)
  • Taste profile settings, favorites, follows, and notifications
  • Current location: when you tap "My location" in the map or search, the location your browser provides is sent with that request and used only to sort results by distance; it is not stored.
  • Cookies: keeping you signed in and remembering your language (Section 7)

Theme participation (members who join a theme)

  • Items: the theme you joined, when you joined, the invite link you came from, and your answer about whether you live in the area (optional)
  • Purpose: handling your participation and showing it to you, and theme participation statistics in totals (such as joins by residency answer or by invite link)
  • Visibility: your participation is not shown to other users. Reviews you leave at theme cafés during the theme appear in the theme's records and results according to their own visibility.
  • Retention: deleted one year after the theme ends, and when you delete your account
  • How to refuse: joining a theme is optional, and you can join without answering the residency question.

Store listing requests — "Ask to list" (members who ask)

  • Items: the store you asked for, when you asked, and your member identifier
  • Purpose: sending you an in-service notification when the store's details are published, and a total count of requests per store (shown only from five)
  • Visibility: who asked is not shown to other users or to the store. The store sees only the total count.
  • Retention: deleted at the earliest of when the store's details are published and you are notified, when the store's details are taken down, one year after you asked, or when you delete your account
  • How to refuse: asking is optional. Tapping again cancels the request and deletes it right away.

Managing store information — "My store" (members who run a store)

  • Items: the member identifier of whoever edited or confirmed the store's information, the store and the before and after values of each changed field, the time, the IP address, and browser information
  • Purpose: knowing who changed store information and when, undoing wrong changes, and preventing misuse
  • Retention: kept while we run the service. The IP address and browser information are deleted after 1 year; when you delete your account, your member identifier, IP address and browser information are removed and only the change and the store information remain.
  • How to refuse: managing store information is optional. Instead of editing it yourself, you can ask an operator to change it.

(B) Items processed with your consent

Visit days (signed-in members who turn on "Keep my visit days" in settings)

  • Items: the date you opened the service (only the date in Korea time; we do not store the time, place or screens) and your member identifier
  • Purpose: return-visit statistics and return-visit statistics after joining a theme
  • Retention: deleted after 180 days, and when you delete your account
  • Consent and how to refuse: the setting is off at first, and we store visit days only if you turn on "Keep my visit days" in settings (Profile › Settings) yourself. If you leave it off or turn it off there, we store nothing, and when you turn it off we also delete the dates already stored without delay. Even when it is on, we store nothing if your browser sends Do Not Track or GPC. Leaving it off does not limit your use of the service.

Consent to list store information (members who run a store)

  • Items: your member identifier, the store and the information fields to publish, your answer for each field (correct · fix · remove, and what to fix), when you consented, the version of the consent wording, and the operator who confirmed it and how (in person · through the store's official channel)
  • Purpose: confirming and keeping proof of consent to publish store information, and linking the store to your account
  • Retention: consent not yet confirmed by an operator is deleted when the store leaves the pre-publication state or after 90 days, and consent sent back is deleted right away. Confirmed consent is kept as proof until the store's information is deleted from the service; when you delete your account, your member identifier is removed and only the fact of consent remains.
  • How to refuse: consent is optional. Without it the store's information is not published (except what the store published itself on its official channels), and you can ask to take the store's information down after publication.
1.3 Collection Methods
  • Direct input by users during membership registration and service use
  • When you sign up or sign in with Kakao or Apple, we receive your member identifier and nickname from Kakao or Apple
  • Automatically generated and collected during service use (sign-in records, cookies)

2. Retention and Use Period of Personal Information

The Operator processes and retains personal information within the retention and use period stipulated by law or consented to by users when collecting personal information.

2.1 Member Information
  • Retained and used until membership withdrawal or deletion under Section 2.3
  • Sign-in records (IP address, browser information, sign-in time): kept until membership withdrawal, and deleted with your account when you withdraw or when your member information is deleted under Section 2.3
  • However, stored separately for the required period when preservation is necessary under relevant laws
2.2 Preservation under Laws

Electronic Commerce Act

  • Records of contracts or subscription withdrawal: 5 years
  • Records of payment and supply of goods: 5 years
  • Records of consumer complaints or dispute resolution: 3 years

Protection of Communications Secrets Act

  • Records of visits: 3 months
2.3 Retention of Individual Items

We delete the following after these periods:

  • Visit days: 180 days (stored only for members who turn it on in settings; deleted without delay when turned off)
  • Theme participation records: one year after the theme ends
  • Store listing requests ("Ask to list"): at the earliest of publication, take-down, one year after asking, or account deletion
  • Consent to list store information: 90 days before confirmation; once confirmed, until the store's information is deleted
  • Store information change records: while we run the service (the IP address and browser information are deleted after 1 year, and your member identifier, IP address and browser information are removed when you delete your account)
  • Member information: deleted when you have not used the service for 3 years (no sign-in and no use of the service while signed in). We tell you the deletion date in an in-service notification 30 days before; if you sign in or use the service while signed in before then, we do not delete it.
  • Reviews, visit records and bean information you left: 5 years after you left them (for visit records, after the visit date). If your member information is deleted as above, or you delete your account, these records stay as records by "Deleted member", so that the author cannot be identified, and are deleted 5 years after you left them (for visit records, after the visit date).

3. Provision of Personal Information to Third Parties

The Operator does not provide users' personal information to third parties in principle. However, the following cases are exceptions:

  • When users have consented in advance
  • When required by law provisions or at the request of investigative agencies following procedures and methods prescribed by law for investigation purposes

A store sees only the total number of "Ask to list" requests, never who asked. When we share statistics with stores or other partners, we share only totals that meet a minimum number of records, and never one person's records or taste. Outsourcing of personal information processing is described in Sections 3.1 and 11.

3.1 Outsourcing of Personal Information Processing

The Operator outsources personal information processing tasks as follows for service provision:

  • Vercel Inc. (a U.S. company; server functions run in the Seoul, Republic of Korea region; contact: privacy@vercel.com): web hosting, running server functions, and running the daily job that deletes information past its retention period
  • Supabase Pte. Ltd. (a Singapore company; database region: Seoul, Republic of Korea; contact: privacy@supabase.com): database storage and operation of member information, service usage records, visit days and theme participation records
  • Outsourcing period: Until membership withdrawal or termination of outsourcing contract

Because both are foreign companies (U.S. and Singapore), the overseas transfer details are also given in Section 11.

4. Users' Rights and Exercise Methods

Users may exercise the following rights:

4.1 Right to Request Access, Correction, and Deletion
  • Request for access to personal information
  • Request for correction of personal information
  • Request for deletion of personal information
  • Request for suspension of personal information processing
4.2 Methods of Exercising Rights
  • Directly in the service: you can delete your account (withdraw your membership) right away in Profile › Delete account. Reviews you wrote stay as reviews by "Deleted member" under §2.3 so that the author cannot be identified; you can also delete them yourself in Profile › My Reviews before deleting your account. You can change your nickname in Profile › Edit profile, and usage statistics and visibility in Profile › Settings. You can download the taste reviews you wrote as a spreadsheet file (CSV) right away in Profile › Settings › Download my records.
  • Ask the Personal Information Protection Officer (Section 8) by email (support@thengd.com)
  • Through a representative: you may exercise your rights through a legal representative or a person you have authorized. In that case, a power of attorney must be submitted.
  • Response time: the Operator acts on your request and tells you the result within 10 days of receiving it. If we refuse or delay your request, we tell you the reason and how to object.
4.3 Personal Information of Children under 14

The Operator does not accept sign-ups from children under 14, and confirms at sign-up that you are 14 or older. If we learn that personal information of a child under 14 has been collected, we delete it without delay.

5. Personal Information Destruction Procedures and Methods

5.1 Destruction Procedures

The Operator deletes personal information without delay once its retention period has passed or its purpose has been achieved. For information with a set retention period (Section 2.3), an automatic job that runs every day finds and deletes what has expired. Information that other laws require us to keep is stored separately from other personal information, on the basis and for the items given in Section 2.2, and deleted when that period ends. Reviews, visit records and bean information that remain when a member withdraws or when member information is deleted under Section 2.3 are changed into records by "Deleted member" so that the author cannot be identified, and are deleted 5 years after they were written (for visit records, after the visit date).

5.2 Destruction Methods
  • Electronic file format: Permanently deleted in an unrecoverable manner
  • Records, printed materials, documents, etc.: Shredded or incinerated

6. Measures to Ensure Safety of Personal Information

The Operator takes the following measures to ensure the safety of personal information:

  • Administrative measures: operators are given only the permissions their work needs.
  • Technical measures: one-way encryption of passwords, encryption in transit (HTTPS), management of access permissions to the systems that process personal information, audit logs of operator actions, and limits on sign-in attempts
  • Physical measures: the servers and database that process personal information are in the data centers of our cloud processors (Section 3.1) and are protected by their physical security measures.

7. Installation, Operation, and Rejection of Automatic Personal Information Collection Devices

7.1 Purpose of Cookie Use

The Operator uses cookies only for the following purposes:

  • Keeping you signed in (session)
  • Remembering your language setting
7.2 Cookie Settings Rejection Method

Users have the right to choose cookie installation and can select cookie permission/blocking through web browser settings.

However, refusing to store cookies may cause difficulties in using some services, for example staying signed in.

7.3 Browser Storage (Visit Day Marker)

To send a signed-in member's visit day only once a day, we store the last date sent and part of your member identifier (its last 8 characters) in your browser's storage (local storage). It stays on your device only, and we delete it when you turn "Keep my visit days" on or off in settings. You can also remove it by clearing site data in your browser.

7.4 Information Stored Only on Your Device

For your convenience, the Operator stores the following only in your browser's storage:

  • An unfinished review (café, menu, expected taste, and the answers and text you were writing): 14 days, up to 5
  • Recently viewed cafés (café name and page address): 30 days, up to 5
  • That you closed the notice about changed terms
  • Whether you answered the taste note question (the answer itself is not stored)
  • The visit day marker (Section 7.3)

This information is not sent to our servers. The visit day marker is only used to check that the visit day of a member who turned on "Keep my visit days" is sent once a day. An unfinished review is deleted when you send the review, and unfinished reviews and recently viewed cafés are deleted when you sign out or delete your account. You can also remove them by clearing site data in your browser.

7.5 Map Services

Map screens load the Naver Maps and Google Maps programs (SDKs) in your browser. Your browser then connects directly to those companies' servers, so connection information such as your IP address may be processed by them, and their own privacy policies apply to it.

7.6 Processing We Do Not Do
  • Behavioral information and targeted advertising: the Operator does not show advertising in the service, and does not collect your behavioral information for targeted advertising or give it to other companies. Usage statistics, except visit days (Section 1.2), are kept without your member identifier or IP address.
  • Pseudonymized information: the Operator does not process pseudonymized information.
  • Sensitive information: the Operator does not collect sensitive information.
  • Automated decisions: taste matching is a recommendation shown to help you choose a coffee. The Operator makes no fully automated decisions that affect your rights or obligations.

8. Personal Information Protection Officer

The Operator designates a Personal Information Protection Officer as follows to take overall responsibility for personal information processing and handle complaints and remedy damages related to personal information processing:

Personal Information Protection Officer

Privacy Contact for Requests (access, correction, deletion, suspension)

  • Assists the Personal Information Protection Officer and receives and handles privacy inquiries and requests for access, correction, deletion and suspension of processing.
  • Contact: support@thengd.com
  • You can also see the taste reviews you wrote right away in Profile › Settings › Download my records.

9. Methods for Remedying Personal Information Infringement

Users may apply for dispute resolution or consultation to the following institutions to receive remedies for personal information infringement:

  • Personal Information Infringement Report Center: (toll-free) 118, privacy.kisa.or.kr
  • Supreme Prosecutors' Office Cyber Crime Investigation Unit: (toll-free) 1301, www.spo.go.kr
  • Korean National Police Agency Cyber Investigation Bureau: (toll-free) 182, ecrm.police.go.kr
  • Personal Information Dispute Mediation Committee: (toll-free) 1833-6972, www.kopico.go.kr

10. Video Information Processing Device Operation and Management

The Operator currently does not install or operate video information processing devices (CCTV). In case of future installation, separate policies will be established and disclosed in accordance with relevant laws.

11. Overseas Transfer of Personal Information

The Operator outsources personal information processing to foreign companies as follows to provide the service. The database is stored in the Seoul, Republic of Korea region, and server functions run in the Seoul, Republic of Korea region.

Vercel Inc. (privacy@vercel.com)

  • Country: U.S. company (server functions run in the Seoul, Republic of Korea region)
  • When and how: As needed while you use the service, over information and communications networks
  • Items: Of the items in Section 1.2, the information server functions process while you use the service
  • Purpose: Web hosting, running server functions, and running the job that deletes information past its retention period
  • Retention and use period: Until membership withdrawal or deletion under Section 2.3 (or until the outsourcing contract ends, if earlier)

Supabase Pte. Ltd. (privacy@supabase.com)

  • Country: Singapore company (database region: Seoul, Republic of Korea)

  • When and how: As needed while you use the service, over information and communications networks

  • Items: Of the items in Section 1.2, the information stored in the database

  • Purpose: Database storage and operation

  • Retention and use period: Until membership withdrawal or deletion under Section 2.3 (or until the outsourcing contract ends, if earlier)

  • Legal basis: outsourcing and storage of personal information are necessary to perform our service contract with you, so we disclose them in this Privacy Policy and transfer under Article 28-8(1)3(a) of the Personal Information Protection Act.

  • How to refuse and its effect: you can refuse the overseas transfer by asking the Personal Information Protection Officer (Section 8) or by withdrawing your membership. Because this outsourcing is essential to the service, if you refuse, you cannot use the member services.

12. Changes to Privacy Policy

This Privacy Policy will be announced through service notices at least 7 days before the effective date when additions, deletions, or modifications are made according to changes in laws, policies, or security technologies.

Earlier versions of this Privacy Policy are listed in the version list on the Privacy Policy page.

Supplementary Provisions

  • Announcement Date: October 12, 2026
  • Effective Date: October 19, 2026
  • Previous Version: 1.0 (effective October 25, 2025)