Privacy Policy
Version 2026-10-27.1
Korean at Heart (“we”) is operated by Pascalmath Co., Ltd., Unit 214, Clover Shopping Center, 155 Dunsan-ro, Seo-gu, Daejeon, Republic of Korea (the data controller). This policy explains what we collect, why, who we share it with, how long we keep it and what you can ask us to do. Contact: admin@koreanatheart.com.
1. What we collect
- Name reading (no account needed): the name you type, gender, date of birth, optional time of birth and country of birth. We use them to calculate a birth chart (saju) and choose Korean names.
- Names requested through our social media: if you post your name, gender, birthday and country in a comment or message asking us for a Korean name, we create a name reading from exactly those details — the same as if you had typed them on this site — so that we can reply to you. The reading is deleted after 90 days unless you open your private link and save it, and public reply videos show only your social media username, never your birthday.
- Account: your email address (there is no password: each time you sign in we email you a one-time code), or the account identifier and email that Google, Apple, LINE or Facebook share with us when you sign in with them. We do not receive your friends, posts or profile picture.
- Photo (optional): a photo of your face, used only to create your hanbok portrait.
- Opening notice (optional): before membership opens you can ask us to email you once on opening day. We store the time you asked; you can withdraw it with one tap on the same page, and we send nothing else.
- Ambassador program (optional, paid members): full name, country of residence, links to your public content and your statement when you apply, used only to review applications, announce the result and contact selected Ambassadors.
- Payment: order number, amount and status. Card details are entered on the payment provider’s page; we never see or store them.
- Technical: a session cookie, a sign-in cookie (
kah_remember, 1 year) that keeps you signed in on that browser until you log out, a language cookie (kah_lang, 1 year), a cookie that remembers which link or site first brought you here (kah_utm, 30 days — the campaign tags in the link and the referring site, nothing about you) and server logs (IP address, browser, time) kept for security. - Advertising measurement (Meta): we use the Meta Pixel to see whether our advertising on Facebook and Instagram leads to name readings, sign-ups and memberships. It sets cookies (
_fbp,_fbc, 90 days) and sends Meta the pages you open and those steps, together with your IP address and browser details; it does not receive your name, email or birth data. Meta may match this with your Meta account under its own privacy policy. - Advertising measurement (TikTok): we use the TikTok Pixel to see whether our advertising on TikTok leads to name readings, sign-ups and memberships. It sets cookies (
_ttp,_tt_enable_cookie, 13 months;ttcsid, session) and sends TikTok the pages you open and those steps, together with your IP address and browser details; it does not receive your name, email or birth data. TikTok may match this with your TikTok account under its own privacy policy.
Your cookie choice. In the European Economic Area, the United Kingdom and Switzerland, statistics and advertising cookies are set only after you click “Accept” in the cookie banner; until then, and if you click “Reject”, the advertising pixels are not loaded at all and Google Analytics receives at most cookieless signals without an identifier. Elsewhere they are on by default. Anyone can change the choice at any time with “Cookie settings” at the bottom of every page; rejecting also removes the statistics and advertising cookies already set. Your choice is remembered in a cookie (kah_consent, 1 year).
We do not use any other advertising pixels. You can also block these cookies in your browser settings, or with Google’s opt-out add-on, without losing any feature of the site.
2. Why we use it (legal basis)
- To provide the service you ask for — your name reading, account, portrait, card and certificate (performance of a contract).
- Your photo is processed only with your explicit consent, given with a checkbox each time you upload one. You can withdraw it by not uploading, or by asking us to delete your portrait.
- To keep the service secure and prevent abuse (legitimate interest), and to meet legal obligations such as tax records for payments.
Your birth chart and names are for entertainment and cultural enjoyment. We do not use them to make decisions about you, and we do not sell your personal data.
3. Your photo
The photo is sent to Google’s Gemini image service to generate your portrait. Google processes it on our behalf and does not use it to identify you. We delete the original photo when you confirm your portrait, when your last regeneration finishes, or automatically 24 hours after an unfinished sign-up. Only the generated portrait is kept, and it stays private unless you are a paid member, in which case it appears on your card and certificate.
4. What is public
- The page of a name reading (
/n/…) can be opened by anyone who has its link. It shows the name you typed and the Korean names. Do not share the link if you do not want this. - For paid members, the certificate link and the card’s QR code open a public verification page that shows your Korean name, display name and member number.
- The home page shows recently saved Korean names with the country of birth only — never your English name, email or date of birth. You can ask us to hide yours at any time.
5. Who we share it with
- Cafe24 (Republic of Korea) — web hosting and database.
- Google LLC (United States) — portrait generation; usage statistics (Google Analytics 4); and Google sign-in if you choose it.
- Creatomate B.V. (Netherlands) — creates the name-reveal reel video for paid members from your display name, Korean name, member number, card, certificate and portrait. We keep the finished video; Creatomate deletes its copy within 30 days.
- Apple Inc. (United States) — Apple sign-in if you choose it.
- LY Corporation (Japan) — LINE sign-in if you choose it.
- Meta Platforms, Inc. (United States) — Facebook sign-in if you choose it; and advertising measurement (Meta Pixel) if you accept it.
- TikTok Pte. Ltd. (Singapore) and its affiliates — advertising measurement (TikTok Pixel) if you accept it.
- Our payment provider — to take your payment.
- Authorities, only where the law requires it.
Your data is stored in the Republic of Korea and may be processed in the United States by the providers above. Where the law requires it, these transfers rely on the providers’ standard contractual safeguards.
6. How long we keep it
- Account, chosen name, portrait, card and certificate: until you ask us to delete your account.
- Original photo: deleted as described in section 3 (at most 24 hours for an unfinished sign-up).
- Name readings that were not saved to an account: kept so their share link keeps working, until you ask us to delete them. Readings we made for you from a social media comment are deleted after 90 days unless you save them.
- Ambassador applications: applications not selected are deleted no later than 12 months after that year’s announcement day (normally March 1); selected Ambassadors’ details are kept for the duration of the program.
- Payment records: as long as tax law requires (usually 5 years).
- Sign-in codes expire after 10 minutes and are kept only as a hash in your browser session.
7. Your rights and deleting your data
Depending on where you live (for example under the EU/UK GDPR, California law or Korea’s Personal Information Protection Act) you can ask to access, correct, delete or receive a copy of your data, object to or restrict its use, and withdraw consent at any time. Email admin@koreanatheart.com from your account’s address and we will reply within 30 days. You can also complain to your local data protection authority.
To delete your account and all data (including anything received from Google, Apple, LINE or Facebook sign-in): email admin@koreanatheart.com with the subject “Delete my account” from the address on the account, or from the email linked to the Facebook/Google/Apple/LINE account you used. We delete the account, name, portrait, card, certificate and sign-in identifiers within 30 days and confirm by email. Removing Korean at Heart from your Facebook, Google or LINE account settings only disconnects the sign-in; it does not delete the account.
8. Children
You must be at least 13 years old to use Korean at Heart. If your country sets a higher age for consenting to online services (up to 16 in some EU countries), you need a parent’s or guardian’s permission. If we learn that a child under 13 has given us data, we delete it.
9. Security
The site uses HTTPS. We do not use passwords: sign-in codes are single-use, expire after 10 minutes and are limited in how often they can be requested, and member files are kept outside the public web folder.
10. Changes
If we change this policy in a way that matters, we will update the version above and post a notice on the site.