This is an English translation, provided for reference. The Korean version is the legally binding text, and it prevails if the two differ. Read the Korean version
At a glance
- We never log in to delivery apps or map services, and never pull reviews in automatically. We only process a review when you paste it in, one at a time.
- Customer nicknames, names, phone numbers and addresses in a pasted review are masked automatically before it is stored or sent anywhere. Masking may not catch everything.
- Reviews are analysed on servers in Korea by our own models. Reply drafts are written by a generative AI service in the United States (Google Gemini, accessed through OpenRouter).
- The reviews and replies you enter are never used to train any AI model, and never used for any other restaurant.
- We collect no payment information during the beta.
- To access, correct or delete your information, email privacy@____. We reply in Korean within 10 days.
Art. 1General
[Company name] ("we", "us") operates ReviewBom (polarvec.com, the "Service"), an AI service that helps restaurant owners reply to reviews on delivery apps and map services. We publish this policy under Article 30 of Korea's Personal Information Protection Act (PIPA).
This policy applies during the beta. When we launch paid plans, we will revise it to cover payments.
This policy is written in Korean. The English and Chinese versions are translations provided for reference; if a translation differs from the Korean, the Korean version prevails.
Art. 2Why we process personal information
- Sign-up, log-in, identity verification and account management
- Analysing the reviews you paste and drafting AI replies
- Personalising drafts using your restaurant's previous replies
- Calculating beta usage limits and handling requests for more
- Handling bug reports and improving the Service
- Preventing abuse and keeping the Service secure
- Understanding how the Service is used, and supporting you (time spent, log-ins, and when usage limits are reached). This is for our staff to look at; nothing is decided automatically on the basis of it.
Art. 3What we process
We process all of the items below without asking for your consent, because they are necessary to perform our service agreement with you (PIPA Article 15(1)(iv)). During the beta, we process nothing that requires separate consent.
| Category | Items |
|---|---|
| Sign-up and log-in | Email, nickname (or name), and your Kakao or Naver account identifier. We receive only what you agreed to share when signing in with Kakao or Naver. |
| Restaurant details | Restaurant name, cuisine, when it opened, description, contact details, location (if entered), whether replies may offer compensation, and your answers to the setup questions |
| Reviews and replies | Pasted reviews (after masking), star rating, platform, whether it was a repeat order, AI reply drafts, your edits, and the replies you copy |
| Usage records | While you have a signed-in page open, the page path and time (about once a minute); log-in times; when usage limits are reached; number of uses; AI processing cost per request |
| Bug reports | Title and description, the page you reported from, browser information, and the last error message |
| Trial without an account | The pasted review (after masking), the trial results, and an identifier derived from your IP address (transformed so it cannot be reversed) |
Before pasting a review, please remove anything a reply doesn't need, such as the customer's phone number, address, bank account number or health details. We mask these automatically, but may not catch everything.
Art. 4Information about the customers who wrote the reviews
A review you paste may contain information about the customer who wrote it. We process that information only as a processor acting on your behalf, and never use it for any other purpose or any other restaurant.
- Names, places, phone numbers, addresses, messenger IDs and bank account numbers in a review are masked automatically before it is stored or sent anywhere.
- The customer's nickname at the top of a review is held only in server memory, for up to 24 hours, so it can be shown on your screen again. It is never stored.
- The date a review was written is used only to detect duplicates. It is never stored or sent anywhere.
- A review may include health-related details, such as an upset stomach or an allergic reaction after a meal. These are used only to draft a reply, and the same masking and the conditions for transfer outside Korea in Article 9 apply to them.
- Customers who wrote a review may ask the restaurant concerned, or our privacy officer (Article 14), to access or delete their information, or to exercise their other rights.
Art. 5How long we keep it
| Item | Retention |
|---|---|
| Account information, restaurant details, reviews, replies and personalisation data | Until you close your account. Deleted without delay after you request closure, and within 30 days at the latest |
| Signed-in session | 30 days |
| Usage records (page use, log-ins, usage limits reached) | 1 year |
| Bug reports | 1 year after the report is resolved |
| Security records (such as blocked requests) and records of admin access | 1 year |
| Trial content without an account | 24 hours |
| Nicknames of customers who wrote reviews | Not stored (held in server memory for up to 24 hours) |
| AI processing cost per request | When you close your account, anything linking it to you is removed; it is kept only as cost statistics |
| Backups | Our own backups rotate out within 12 hours. Our hosting provider's snapshots are deleted within [__ days] |
Art. 6How we delete it
When a retention period ends, or the purpose of processing has been achieved, we delete the information without delay. Electronic files are deleted from our database and log files so that they cannot be recovered; copies in backups expire on the cycle set out in Article 5. When you close your account, your information is deleted from every data store the Service uses.
Art. 7Sharing with third parties
We do not provide personal information to third parties. We do not sell the reviews and replies you enter, or give them to other companies to train AI models. The only exception is where a law specifically provides for it.
Art. 8Processors who handle data on our behalf
| Processor | Work entrusted | Retention |
|---|---|---|
| Amazon Web Services (Seoul region) | Running the Service's servers and database (stored in Korea) | Until the contract ends |
| OpenRouter, Inc. and Google LLC | Drafting AI replies and checking analyses (transfer outside Korea; see Article 9) | See Article 9 |
Our contracts with these processors prohibit processing for any other purpose, and cover security measures, limits on onward entrustment, our oversight, and liability for damages. We check that they comply. If a processor changes, we will update this policy.
Art. 9Transfers outside Korea
To draft replies, we transfer personal information outside Korea as set out below. A transfer happens only when a review is analysed, and only after the masking described in Article 4.
| Recipient (contact) | Country | What is transferred | When and how | Purpose | Retention |
|---|---|---|---|---|---|
| OpenRouter, Inc. [privacy contact] | United States | The masked review; star rating and platform; restaurant details (name, description, contact details, etc.); examples of the restaurant's previous replies and a summary of its tone | Each time a review is analysed, over an encrypted connection | Routing requests to generative AI | Not kept once the request is processed |
| Google LLC (Gemini API) [privacy contact] | United States | As above | Sent through OpenRouter | Drafting replies and checking analyses | Kept for up to 55 days to detect abuse, then deleted. Not used to train models |
- Legal basis: PIPA Article 28-8(1)(iii) (entrustment or storage needed to perform a contract, disclosed in this policy).
- Every request we send carries a setting that prevents the recipient from using the data for training.
- How to refuse, and what happens if you do: if you do not want your information transferred outside Korea, you can stop using review analysis or close your account. You will then be unable to use AI replies.
Art. 10How we use AI
- Purpose. To help restaurant owners understand the reviews they receive and write replies.
- Where it runs. Review analysis (the key quote, the main complaint, the suggested reply direction, and whether action is needed) runs on models we built ourselves, on servers in Korea. Checking that analysis and drafting replies are handled by the external generative AI listed in Article 9.
- Inputs and outputs. Reviews, drafts and your edits are kept as part of your history for the periods in Article 5.
- Training. The reviews, drafts and edits you enter are never used to train or fine-tune any AI model, including our own. That is why there is no separate opt-out.
- Personalisation. Your previous replies are used only as reference for your own next drafts, never for another restaurant. To reset personalisation, email privacy@____.
- Masking. Masking is automatic, as described in Article 4, and some details may remain.
- Reporting an unsuitable draft. Use the bug report button in the Service, or email privacy@____.
- Automated decisions. None. A draft is a suggestion; you decide whether to post it and what it says.
Art. 11Cookies and information collected automatically
| Name | Purpose | Duration |
|---|---|---|
| rm_session | Keeps you signed in | 30 days |
| rm_lang | Remembers your language | 1 year |
| Usage signal (not a cookie) | While you have a signed-in page open, records the page path and time about once a minute | 1 year |
We use no advertising cookies, external analytics tools or third-party tracking. You can block cookies in your browser settings, but you will not stay signed in. The usage signal runs only while you are signed in; there is currently no setting to turn it off.
Art. 12Your rights and how to use them
- Data subjects (you, and anyone else whose information we process) may ask to access, correct or delete their personal information, or ask us to stop processing it.
- Email privacy@____ and we will reply in Korean within 10 days. You may also ask through a representative, in which case we will ask for a power of attorney.
- Exercising your rights will never be harder than signing up was.
- You can close your account [on the My Store page or by email]. Your information is then deleted as described in Article 6.
- Customers who wrote a review exercise their rights as set out in Article 4(5).
- Only people aged 19 or over can sign up, so we do not process personal information of children under 14.
Art. 13How we keep it secure
- All connections are encrypted (HTTPS).
- As few people as possible can access personal information, and every admin view is logged.
- Reviews are masked before they are stored, and if masking is not working, we do not accept reviews.
- Regular backups protect against outages.
Art. 14Privacy officer
| Name | [Name] |
|---|---|
| Position | [Representative] |
| privacy@____ | |
| Phone | [Phone number] |
Art. 15Where to get help
- Personal Information Dispute Mediation Committee: 1833-6972 (www.kopico.go.kr)
- Personal Information Infringement Report Center: 118 (privacy.kisa.or.kr)
- Supreme Prosecutors' Office: 1301 (www.spo.go.kr)
- Korean National Police Agency: 182 (ecrm.police.go.kr)
Art. 16If there is a data breach
If we learn that personal information has been leaked, we will tell the data subjects affected within 72 hours. If the leak involves 1,000 or more people, involves sensitive information or unique identifiers, or results from unlawful access from outside, we will also report it to the Personal Information Protection Commission or the Korea Internet & Security Agency (KISA) within 72 hours. If there is a security intrusion, we will report it immediately to the Ministry of Science and ICT or KISA.
Art. 17Changes to this policy
We will announce changes to this policy in the Service at least 7 days before they take effect, or at least 30 days before if what we process, or why, changes. Previous versions will stay available on this page.
This policy takes effect on October __, 2026.