Privacy Policy
Last modified: 2026-10-26
Nspace Jeju Co., Ltd. (hereinafter referred to as the 'Company') has established and disclosed this Privacy Policy in accordance with the Personal Information Protection Act of the Republic of Korea and other relevant legislation. This Policy aims to protect the personal information of members using SpaceBiz (spacebiz.ai) and to ensure that any grievances related thereto are handled promptly and smoothly.
Article 1 (Categories of Personal Information Collected and Collection Methods)
The Company collects the minimum required personal information upon registration (account linking) and during service usage to provide B2B customer concierge services and AI-driven space search/brokerage services.
(1) Guests (Space Users)
| Purpose of Collection | Mandatory Items | Optional Items | Retention Period |
|---|---|---|---|
| User Registration | Full name, email address, mobile phone number | - | Until account unlinking (cancellation) |
| SNS Sign-up (Google) | Google account ID, full name, email address, mobile phone number | - | Until account unlinking (cancellation) |
| SNS Sign-up (Apple) | Apple account ID, full name, email address, mobile phone number | - | Until account unlinking (cancellation) |
| SNS Sign-up (Facebook) | Facebook account ID, full name, email address, mobile phone number | - | Until account unlinking (cancellation) |
| AI Quotation Request | AI chatbot conversation history, search terms (prompts), quote request criteria | - | Destroyed without delay upon unlinking (Anonymised data is stored permanently) |
| Space Payment & Brokerage | Guest-designated booking holder’s name, email, contact details, booking date/time, number of attendees, purpose of use, payment method and amount | - | Statutory period under the Act on the Consumer Protection in Electronic Commerce (5 years) |
| Service Communications (Optional) | - | Inbox messages, enquiry email records, etc. | Until consent withdrawal or account cancellation |
| Marketing & Advertising (Optional) | - | Tailored B2B benefit information, promotional notices (via email, SMS) | Until consent withdrawal or account cancellation |
(2) Hosts (Space Providers)
| Purpose of Collection | Mandatory Items | Optional Items | Retention Period |
|---|---|---|---|
| Registration & Account Linking | Representative's name, email address, mobile phone number | - | Until account unlinking (cancellation) |
| SNS Sign-up (Google) | Google account ID, full name, email address, mobile phone number | Until account unlinking (cancellation) | |
| SNS Sign-up (Apple) | Apple account ID, full name, email address, mobile phone number | Until account unlinking (cancellation) | |
| SNS Sign-up (Facebook) | Facebook account ID, full name, email address, mobile phone number | Until account unlinking (cancellation) | |
| SpaceCloud Host Listing & Reservation Data Sync | SpaceCloud Account Identifier (User ID) [Space Information] Space/Product Name, Location/Address, Contact Information, Images, Usage Guidelines, etc. [Host Information] Member ID (Identifier), Name, Email Address, Mobile Phone Number, Profile Information (Image), Registration Information (Registration Channel, Registration Date & Time) [Business Information] Business Name, Representative Name, Business Registration Number, Business Address, Business Type/Category, Tax Type [Settlement Information] Bank Name, Account Number, Account Holder Name, Settlement Contact Person Info (Email, Phone Number) [Reservation Information] Reservation Schedule, Reserver Name, Contact Information |
Until account unlinking (cancellation) | |
| Google Calendar Sync | Google Account Unique Identifier (OAuth) [Calendar Information] Google Calendar Events (Read-Only) |
||
| Service Fee Settlement & Tax Documentation | Company/Trade name, representative's name, business registration number, business address, type/nature of business, settlement bank account details (bank name, account number, account holder) | - | Statutory period under the Act on the Consumer Protection in Electronic Commerce (5 years) |
(3) Automatically Collected Information During Service Use
- Collected Items: IP address, cookies, access timestamp, records of improper/unauthorised use, device information (PC/mobile environment).
- Collection Methods: SpaceCloud account linking (OAuth), direct input via in-service chatbot/search fields, payment processing systems, etc.
Article 2 (Purposes of Processing Personal Information)
The Company processes the minimum necessary personal information solely for the following purposes and shall not use it for any other purpose:
- Member Management: Identity verification via SpaceCloud account linking, granting access to B2B services, restricting sanctionable members (e.g. attempting off-platform direct transactions, property damage), handling grievances, and delivering notices.
- AI-Based Concierge & Booking/Payment Brokerage: Tailored space searches and price estimation using AI technology, providing concierge (chatbot) consultations, managing B2B bookings and payments, handling host settlements and issuing tax invoices for service charges, and API integration for issuing cash receipts to guests using the host's business registration number.
- Service Enhancement (Data Utilisation): Quality improvements to AI algorithms using de-identified (pseudonymised/anonymised) prompt and conversation data, user statistical analysis, and new feature planning.
- Marketing & Security: Information on new service benefits, event participation opportunities, prevention of fraudulent/unauthorised use, and building a secure operating environment.
Article 3 (Provision of Personal Information to Third Parties)
- Public Information: Information voluntarily disclosed by users (e.g. detailed profile information) may be displayed publicly on the platform and indexed by external search engines. Such information may remain visible for a period even after account deletion or a deletion request. However, the Company will comply with deletion requests within reasonable bounds upon receiving user enquiries (Contact:
office@spacecloud.city). - Precautions Regarding Voluntary Information Disclosure: Users must exercise caution when disclosing personal information in publicly accessible areas, keeping in mind that such information may be accessible to an unspecified number of people.
- Prior Consent and Statutory Exceptions: The Company does not share personal information with external third parties without prior consent, except where required by law or pursuant to a lawful order/request from public authorities (e.g. courts, law enforcement agencies, or administrative orders).
- Display of Optional Information: To enhance convenience and user experience, optional information provided by users (such as detailed profiles or preferences) may be displayed within the service. Users can review and manage the visibility of this information in advance via their account settings.
- Platform Information Sharing: Due to the nature of the service, specific personal information is shared between the transaction parties (Guest and Host) at the time a booking is made to ensure seamless service delivery.
Third-Party Sharing and Data Handling Management
| Use Case | Information Disclosed |
|---|---|
| Requests by Courts / Law Enforcement / Administrative Orders | Space details provided by Hosts |
Provision of Personal Information to Third Parties
| Recipient | Personal Data Provided | Purpose of Provision | Retention Period |
|---|---|---|---|
| SpaceBiz Host | Booker’s name, contact details, email address, masked payment information | Space booking guidance, entry/check-in instructions, processing refunds, and dispute resolution (e.g. damage compensation claims) | 7 days after service completion or 1 day after booking cancellation |
Article 4 (Outsourcing and Overseas Transfer of Personal Information)
To ensure stable AI concierge services and payment brokerage operations, the Company entrusts and transfers personal information abroad to external specialist providers as follows:
[Domestic Outsourcing]
| Service Provider | Outsourced Task | Retention & Usage Period |
|---|---|---|
| NICE Information & Telecommunication Inc. | Processing guest payments, API integration for issuing cash receipts on behalf of hosts, and host settlement processing | Until membership withdrawal or termination of the processing agreement |
[Overseas Data Transfers (AI Services)]
The Company transfers certain personal data overseas to provide AI-based space estimation and tailored search capabilities. All data transferred is securely protected through technical measures.
| Provider / Delegate | Purpose / Task | Data Transferred | Retention Period | Location (Country) | Address & Contact |
|---|---|---|---|---|---|
| Vercel Inc. | Transmission via network during service usage | Access logs, cookies, device information | Until service termination or contract expiry | USA | 340 S Lemon Ave #4133, Walnut, CA 91789, USAprivacy@vercel.com |
| Supabase Inc. | Network transmission upon user registration and data storage | Email, password, service usage data, etc. | Until account withdrawal or purpose completion | USA | 580 20th St, San Francisco, CA 94101, USAprivacy@supabase.com |
| Plus Five Five, Inc. (Resend) | Network transmission during email dispatch | Email address, recipient name, email body content | Until completion of dispatch and log retention period expiry | USA | 2261 Market Street #5039, San Francisco, CA 94114, USAsupport@resend.com |
| Google Gemini API | AI-based space analysis and quotation support | User prompt text (attendees, budget, purpose, etc.) | Subject to Google API Policy (Not used for AI model training) | USA | 1600 Amphitheatre Parkway, Mountain View, CA 94043, USAdata-access-requests@google.com |
| Meta (Facebook) | Ad targeting optimisation and performance measurement | Device identifiers (ADID/IDFA), web browsing activity, IP address | Subject to Meta Privacy Policy | USA | 1 Hacker Way, Menlo Park, CA 94025, USAdpfinquiry@support.facebook.com |
| Google (GA4) | Usage behavior analytics and statistics (SDK) | Cookie ID, device details, page navigation paths | Subject to Google Policy and configured retention periods | USA | 1600 Amphitheatre Parkway, Mountain View, CA 94043, USAdata-access-requests@google.com |
Article 5 (Rights and Obligations of Members and Exercise Methods)
- Members and their legal representatives may at any time inspect, correct, or request the deletion of their registered personal information by contacting the Privacy Officer or Department. However, doing so may restrict access to parts or all of the service.
- Requests for inspecting or modifying personal data can be submitted in writing, via telephone, or by email to the Privacy Officer. The Company will act on such requests without delay.
- If a member requests the correction of an error in their personal data, the relevant information will not be used or provided until the correction is complete. If incorrect personal data has already been provided to a third party, the correction result will be communicated to the third party immediately to ensure the correction is applied.
Article 6 (Retention and Usage Period of Personal Information)
In principle, the Company destroys personal information without delay upon the unlinking or cancellation of the member's SpaceBiz account. However, where preservation is required by applicable laws (such as the Act on the Consumer Protection in Electronic Commerce), the data will be securely stored for the statutory periods specified below:
(1) Act on the Consumer Protection in Electronic Commerce
- Records regarding contracts or withdrawal of subscription: 5 years
- Records regarding payment and supply of goods/services (settlement, payment processing): 5 years
- Records regarding consumer complaints or dispute resolution: 3 years
- Records regarding advertisements and displays: 6 months
(2) Electronic Financial Transactions Act
- Records regarding electronic financial transactions: 5 years
(3) Protection of Communications Secrets Act
- Logins and system access logs: 3 months
Article 7 (Data Destruction Procedures and Methods)
- Destruction Procedure: Personal data that has achieved its processing purpose is retained for a set period according to internal policies and relevant legislation before being destroyed. Data moved to a separate database is not used for any other purpose unless required by law.
- Destruction Method:
- Electronic Files: Permanently deleted using technical methods that prevent recovery or restoration (e.g. low-level formatting).
- Paper Documents: Shredded using a paper shredder or incinerated.
Article 8 (Installation, Operation, and Rejection of Cookies)
- Purpose of Cookies: The Company uses cookies to analyse member access frequency, AI search patterns, and visit durations, enabling the provision of optimised B2B tailored space recommendations and concierge services.
- Installation, Operation, and Refusal: Users retain the choice to accept or reject cookies. You can adjust your web browser settings to accept all cookies, receive a notification whenever a cookie is set, or refuse all cookies. (Please note that blocking cookies may limit your access to logged-in features and AI-customised services.)
Article 9 (Technical and Managerial Protection Measures)
The Company implements the following technical, administrative, and physical measures to ensure that members' personal data is protected against loss, theft, leakage, alteration, or damage:
- Administrative Measures: Establishing and executing internal management plans, conducting regular staff training, and operating a dedicated privacy protection team.
- Technical Measures: Strong encryption protocols (SSL, etc.) for host settlement accounts and unique identification numbers, web application firewalls and AI-driven security tools against hacking, and strict access control systems.
- Physical Measures: Restricting physical access to server rooms and data archives to unauthorised personnel.
Article 10 (Contact Information of the Privacy Officer)
Members may report any privacy-related grievances or concerns arising from service usage to the Privacy Officer or responsible department listed below:
- Data Protection Officer: Gunwoo Lee (Department: Management Support Team / Email:
kunq@spacecloud.kr) - Data Protection Manager: Yeryung Kim (Department: Global Service Team / Email:
stella@spacecloud.kr) - Customer Centre Contact:
office@spacecloud.city
For further assistance regarding privacy infringements, remedies, or advice, you may contact the following organisations:
- Personal Information Infringement Report Centre: privacy.kisa.or.kr / Dial 118
- Personal Information Dispute Mediation Committee: www.kopico.go.kr / Dial 1833-6972
- Supreme Prosecutors' Office Cyber Investigation Division: www.spo.go.kr / Dial 1301
- National Police Agency Cyber Bureau: ecrm.cyber.go.kr / Dial 182
Article 11 (Google User Data)
- The Company shall not use user data received through Google APIs (Google Calendar API) for any purpose other than providing the Company's reservation service and viewing schedules (checking available reservation times), nor shall it sell or share such data with third parties for advertising purposes.
- The Company's use and transfer to any other app of information received from Google APIs, including both raw and derived user data, will adhere to the Google User Data Policy, including the Limited Use requirements.
Article 12 (Amendments and Duty to Notify)
Any additions, deletions, or modifications to this Privacy Policy will be announced through the 'Notices' section within the SpaceBiz platform at least 7 days prior to the effective date. However, for significant changes affecting members' rights—such as changes to the categories of personal data collected or the purposes of use—notice will be given at least 30 days in advance, and separate re-consent will be obtained where necessary.
Addendum (Date of Enforcement)
This Policy shall enter into force on October 27 2026.