1. Purpose of Collecting and Using Personal Information

Arboreum Labs (hereinafter "the Company") processes personal information for the Chloris service (hereinafter "the Service") for the following purposes. Personal information collected will not be used for any purpose other than those stated below.

Service Provision: Providing AI fortune-telling consultation based on Saju, MBTI, and Tarot
Member Management: Identity verification and identification for membership services
Payment Processing: Processing payments and refunds for paid services
Service Improvement: Enhancing service quality and developing new services

2. Types of Personal Information Collected

Required Items

Email address (via social login)
Name or nickname
Date of birth (for fortune analysis)

Optional Items

MBTI type
Consultation records
Voice data (when using AI voice consultation)

Automatically Collected Items

IP address, browser type
Device identifier (Device Fingerprint) - for fraud prevention and security purposes
Service usage records, access logs
Information collected through cookies and similar technologies (see Section 10)

3. Retention and Use Period of Personal Information

Personal information is retained until account deletion, at which point it is promptly destroyed. However, if retention is required by applicable laws, it will be stored for the prescribed period.

Conversation records and consultation content: Automatically deleted after 90 days
Payment records: 5 years (under applicable Korean law)
Access logs: 3 months (Protection of Communications Secrets Act)
Email hash of deleted accounts: Up to 2 years
For the purpose of preventing fraudulent use, we retain an email hash (an irreversible encrypted value) of deleted accounts for up to 2 years. The original email address is not stored, and it is technically impossible to recover the email from the hash value. The hash is automatically destroyed upon expiration of the retention period.

4. Disclosure of Personal Information to Third Parties

As a general rule, the Service does not provide personal information to third parties. However, exceptions are made in the following cases:

When the user has given prior consent
When required by law

Third-Party Provision and Processing Entrustment

Deepgram: User voice stream (Korean speech recognition processing)
Data transmitted: Real-time voice audio data. Under the Model Improvement Partnership opt-out, voice data is not used for model training and is promptly deleted after processing (zero retention policy). Data from EU/EEA users is processed in the EU region (api.eu.deepgram.com). For more information, please refer to the Deepgram Privacy Policy.
ElevenLabs: AI response text (text-to-speech processing)
Data transmitted: AI-generated response text (TTS API). User voice is not sent to ElevenLabs. Data training opt-out is applied, and AI response text is not used for ElevenLabs model improvement. Logging is minimized with the enable_logging: false setting. For more information, please refer to the ElevenLabs Privacy Policy.
Anthropic / Google Gemini: Conversation history and analysis data (AI response generation)
Data transmitted: User conversation content, Saju/MBTI/Tarot analysis results. We use paid APIs, and conversation data is not used for model training. For details on each service's data processing policies, please refer to the Anthropic Privacy Policy and Google Gemini API Terms.
Supabase: Database hosting
Data transmitted: Member information, consultation records, payment information
RevenueCat: In-app payment management
Data transmitted: Anonymized user ID, purchase records, transaction IDs. RevenueCat processes purchase data collected through Apple App Store and Google Play in-app purchase systems, handling purchase verification and credit allocation. Arboreum Labs does not directly collect or store credit card or payment instrument details. For more information, please refer to the RevenueCat Privacy Policy.

The above third-party disclosures constitute cross-border data transfers. By agreeing to this Privacy Policy, you consent to such transfers.

5. Rights of Data Subjects

Users may exercise the following rights at any time:

Request to access personal information (Right of Access)
Request to correct any errors
Request for deletion (Right to Erasure / Right to be Forgotten)
Request to suspend processing
Request to transfer personal information (Right to Data Portability) - receive data in a machine-readable format

You may exercise these rights through the Settings menu within the Service or by contacting us at support@chlorisfortune.com. Requests will be processed within 10 days of receipt, and the results will be communicated via email.

6. Destruction of Personal Information

When the retention period for personal information has expired or the purpose of processing has been fulfilled, the relevant personal information will be destroyed without delay. Information in electronic file format will be permanently deleted using technical methods that prevent recovery.

7. GDPR (EU General Data Protection Regulation) Notice

Users residing in the EU/EEA are additionally guaranteed the following rights under the GDPR:

Right of Access: You may request a copy of your collected personal information.
Right to Erasure: You may request the deletion of your personal information.
Right to Data Portability: You may receive your personal information in a machine-readable format (JSON) or request its transfer to another service.
Right to Restriction of Processing: You may request the restriction of processing of your personal information under certain conditions.
Right to Object: You may object to processing based on legitimate interests.
Right Not to be Subject to Automated Decision-Making: You have the right not to be subject to automated decision-making, including profiling.

Legal basis for processing personal information: Performance of a service contract (GDPR Art. 6(1)(b)), user consent (Art. 6(1)(a)), legitimate interests (Art. 6(1)(f)). Data of EU/EEA users may be transferred to servers in Korea and external service providers (including the United States) under appropriate safeguards.

8. CCPA (California Consumer Privacy Act) Notice

California residents are guaranteed the following rights under the CCPA:

The right to know the categories and sources of personal information collected
The right to know the categories of third parties with whom personal information is shared or sold
The right to request deletion of personal information
The right not to be discriminated against for exercising your rights

Do Not Sell My Personal Information

Arboreum Labs does not sell users' personal information to third parties. We do not engage in any transactions of personal information that constitute a "sale" as defined by the CCPA. For privacy-related requests, please contact support@chlorisfortune.com.

9. Data Protection Officer

Data Protection Officer: Hyunwoo Park (CEO, support@chlorisfortune.com)

Email: support@chlorisfortune.com

10. Cookies and Tracking Technologies

The Service uses cookies and similar tracking technologies to improve user experience and analyze the Service.

Cookies Used

Essential Cookies: Maintaining login sessions and managing security tokens (Supabase Auth)
Analytics Cookies: Google Analytics - Analyzing service usage patterns for improvement
Error Tracking: Sentry - Detecting service errors and quality management

You may refuse cookie collection through your browser settings. However, blocking essential cookies may restrict your use of the Service. For more details, please refer to our Cookie Policy.

11. Changes to the Privacy Policy

This Privacy Policy may be updated with additions, deletions, or modifications in accordance with changes to laws, policies, or security technologies. Any changes will be announced through the Service's notice section.