Privacy Policy

1. Controller

• Company: 3Y CORPORATION (주식회사 쓰리와이코프레이션)
• Representative: 임환
• Address: 14-1, Hakdong-ro 50-gil, Gangnam-gu, Seoul, Republic of Korea
• Phone and email: +82-2-511-0618 / 3ymg@3ycorp.kr

2. Personal data we process

• Social sign-in: name, email, profile image, email verification status, provider, provider account ID, and authentication tokens and expiry data where supplied
• Agreement records: versions and timestamps for the Terms and Privacy Policy
• Vote: Song A/B selection, voting time, and identifiers linking the account and vote
• Prize entry: name, email, mobile number, country, postal code, address lines, and consent timestamp
• Automatically generated data: session IDs, cookies, access time, IP address, browser and device data, usage records, and error or security logs
• Analytics: page and button interactions, language, voting and entry steps, browser and device data, analytics identifiers, and session replay data

3. Purposes and collection methods

• Social sign-in, account and session management, and duplicate-vote prevention
• Receiving and counting A/B votes, campaign operation, and abuse prevention
• Prize draws, winner communication, verification, and prize delivery
• Service analytics, troubleshooting, security, and dispute handling
• Data is collected when you sign in, agree, vote, enter the event, use the service, or contact us by email.

4. Retention

• Account, sign-in, and vote data: until a verified deletion request or 90 days after the campaign ends. Anonymous aggregate statistics may be retained where individuals cannot be identified.
• Non-winner entry data: deleted within 30 days after the winner announcement.
• Winner data: deleted within 30 days after prize delivery is completed.
• Hosting logs: up to 30 days. Amplitude analytics: up to 90 days.
• Deleted data may remain in isolated backups for up to 90 days. Data required by law will be segregated and retained for the legally required period.

5. Sharing, processors, and international transfers

We process personal data only for the stated purposes and do not provide it to third parties unless required by law or separately authorized. Before appointing a prize delivery provider, we will disclose the provider, data, purpose, and retention period and obtain consent where required.

• Vercel, Inc.: website hosting, transmission, and operational logs / United States and configured service regions / transferred over the network when the service is used
• Turso (ChiselStrike, Inc.): account, vote, and event database hosting / configured regions including Japan / transferred over the network when stored
• Amplitude, Inc.: usage analytics, automatic event collection, and session replay / United States / transferred through the SDK when the service is used
• Google, Discord, and Kakao: social sign-in / locations and periods set by each provider's policy
• Google YouTube and Kakao Postcode: video playback and address search / locations and periods set by each provider's policy

6. Cookies and analytics

The service uses cookies or similar storage for sign-in sessions and service operation. Amplitude may perform automatic event collection and session replay, and third-party services such as YouTube may use their own cookies. You may delete or block cookies in your browser, but features including sign-in may not work correctly.

7. Deletion

When retention ends or the processing purpose is fulfilled, personal data is deleted without undue delay. Electronic files are deleted using methods designed to prevent recovery, and paper records, if any, are shredded or incinerated.

8. Your rights

You may request access, correction, deletion, restriction, withdrawal of consent, or account deletion. Send the request from your registered email address to 3ymg@3ycorp.kr. We will verify your identity and respond within the period required by applicable law. A legal representative may exercise rights where permitted by law.

9. Children's data

The service is not intended for children under 14. If we learn that data from a child under 14 was collected, we will verify and delete it without undue delay.

10. Security

We apply reasonable technical and organizational safeguards, including access controls, protection of authentication information, encryption in transit, log reviews, and processor management, to reduce the risk of loss, theft, disclosure, alteration, or damage.

11. Privacy officer and inquiries

You may also contact the Personal Information Protection Commission of Korea or your competent supervisory authority for privacy complaints or advice.

• Privacy Officer: Junho Kim (김준호)
• Email: 3ymg@3ycorp.kr
• Phone: +82-2-511-0618

12. Changes to this Policy

Ordinary changes will be announced at least 7 days before taking effect, and material changes adverse to users at least 30 days before, through the service or official social media. Urgent legal changes may be excepted.