Nugoona Company (누구나 컴퍼니) (the “Company”) values the personal information of users of the Nugoona Ad (누구나 광고) service (the “Service”) and complies with the Personal Information Protection Act (개인정보 보호법) and the Act on Promotion of Information and Communications Network Utilization and Information Protection (정보통신망 이용촉진 및 정보보호 등에 관한 법률).
This English version is provided for convenience. If there is any discrepancy between the Korean and English versions, the Korean version prevails.
01Data We Collect수집하는 데이터
1.1 Data Collected Through APIs
| Data Source | Data Collected | Method |
|---|---|---|
| Cafe24 API | Order data, sales totals, product information, refund data | OAuth 2.0 |
| Meta Marketing API | Ad account information (account name, ID, currency); settings (budget, status, schedule) and performance (impressions, clicks, conversions, spend) of campaigns, ad sets and ads; ad creatives (images, videos, text); Facebook Page information (name, ID); Instagram account information (name, ID, posts used in ads); Pixel (aggregated conversion signals such as purchases); product catalogs (product name, price, image, availability) | System User Token (only assets for which the business has shared ad management access) |
| Google Analytics 4 API | Website traffic, sessions, events, source/medium | Service Account |
| Google Ads API | Ad account information, campaign settings (budget, status) and performance, search ad keywords, conversion settings | OAuth 2.0 |
| Naver DataLab and Search Ad API | Naver search volume for the business's and competitors' brand names (daily search trends, monthly search volume) | API Key |
| Google Search Console API | Clicks, impressions and average position by search query leading to the business's online store (not stored; retrieved when the screen is opened) | Service Account |
| External fashion platforms | Publicly available best-seller rankings (rank, brand, product name, category, etc.) and the positions where the business's and competitors' brands appear in platform search results | Periodic collection of public information |
1.2 Information Collected While Using the Service
- Login information: login ID (the email address for businesses that sign up themselves), password (stored encrypted)
- Businesses that sign up themselves: business name, mobile phone number (for KakaoTalk notification messages and text notices), email verification time, and records of consent to the Terms of Service and this Privacy Policy
- Service usage records: access logs, page view records
- Device information: IP address, browser type, operating system
- Paid use (businesses that registered a card): the recurring-payment key issued by the payment gateway, the card issuer and part of the card number (we never receive the full card number, expiry date or password), payment and refund records, and the content and time of payment consent
- The email address of the business contact who receives billing notices
- Online store admin account (only for businesses that entrust us with running their ads): the store owner's (primary administrator's) login ID and password sent by the business. It is stored encrypted, viewable only by the dedicated marketer, and every view is logged.
- Inbox: inquiry messages and attached photos sent by the user, and the Google account email and ad account number sent for account connection
1.3 Restrictions on the Use of Data Received from Meta and Google
- Data received from Meta and Google is used only for the purposes in Section 02 (showing users their ad performance and operating recommendations, and carrying out the ad actions the user chooses).
- It is not sold, not used for ad targeting, not provided to other businesses, and not used to train generalized AI models.
- Nugoona's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
- Data received from Meta is processed in accordance with the Meta Platform Terms and Developer Policies.
Note: The Service does not directly collect or store personally identifiable information (PII) of shoppers, such as names, phone numbers or addresses. Shopper information visible in the online store's admin pages (orderer names, contact details, addresses, etc.) is viewed only as far as needed to connect sales data and install the pixel, and is not stored.
Text you enter into the AI chatbot is sent to external AI services (see the tables in Sections 03 and 08) to generate answers, so please do not enter personal information.
Text you enter into the AI chatbot is sent to external AI services (see the tables in Sections 03 and 08) to generate answers, so please do not enter personal information.
02Purpose of Collection수집 목적
- Providing ad performance monitoring and an integrated analytics dashboard
- Visualizing and reporting the online store's sales data
- Trend analysis of external fashion platforms
- Providing AI features: understanding chatbot questions, suggesting ad copy and keywords, writing monthly analysis reports (using external AI services)
- Ad operation recommendations: reviewing ads daily and suggesting budget and creative changes (Ops Helper)
- Creating, turning on, turning off ads and changing budgets only when the user chooses and confirms the action (no automatic changes without the user's confirmation)
- Search ad keyword analysis and optimization
- Checking brand search volume trends and the search queries bringing visitors to the online store (Naver, Google Search Console)
- Verifying self sign-ups (email verification code) and sending notices (KakaoTalk notification messages, text messages and email)
- Processing subscription payments and refunds, and sending billing notices (free trial ending, failed payment and pre-deletion emails and in-app notices)
- Account connection on the business's behalf: when entrusted, the dedicated marketer connects the ad accounts and the online store's sales data and installs the pixel
- Responding to inquiries: answering messages received in the Inbox and notifying the progress of account connection
- Improving service quality and resolving technical issues
03Third-Party Sharing제3자 제공
In principle, the Company does not provide user data to outside parties, except in the following cases:
- When the user has given prior consent
- When required by specific provisions of law or necessary to fulfill a legal obligation
- Outsourced processing necessary to provide the Service (see the table below)
| Processor | Outsourced Task | Retention Period |
|---|---|---|
| Google Cloud Platform | Data storage and processing (BigQuery, GCS) | Duration of service use |
| OpenAI | Interpreting the meaning of questions entered into the AI chatbot | Per the processor's data processing terms |
| OpenRouter | Classifying the type of questions entered into the AI chatbot | Per the processor's data processing terms |
| Google (Gemini) | Suggesting ad copy and keywords from product page content, organizing keywords for trending products | Per the processor's data processing terms |
| Anthropic | Writing monthly analysis reports (summary sales and ad figures per business) | Per the processor's data processing terms |
| Korea PortOne Co., Ltd. (PortOne) | Relaying recurring subscription payments and refunds | Per applicable law and the processor's terms |
| KG Inicis Co., Ltd. | Processing recurring card payments and refunds | Per applicable law and the processor's terms |
| NHN KCP Corp. | Processing recurring card payments and refunds | Per applicable law and the processor's terms |
| Google (Gmail) | Sending billing notice emails and sign-up verification code emails | Per the processor's data processing terms |
| SOLAPI Inc. | Sending KakaoTalk notification messages and text notices (mobile number, business name, notice content) | Per applicable laws and the processor's terms |
04Data Retention보관 기간
| Data Type | Retention Period | Deletion Method |
|---|---|---|
| Sales, ad, visit and search volume data | Duration of service use | Destroyed within 7 days after a termination or deletion request is confirmed |
| Per-business trend analysis data | Duration of service use | Destroyed within 7 days after a termination or deletion request is confirmed |
| AI analysis reports | Duration of service use | Destroyed within 7 days after a termination or deletion request is confirmed |
| User account information | Duration of service use | Destroyed within 7 days after a termination or deletion request is confirmed |
| Payment, refund and payment-consent records | 5 years (Act on Consumer Protection in Electronic Commerce) | Destroyed after the period |
| Recurring-payment key | Until the day paid use ends and ad changes stop, the account is deleted, or the card is changed | Deleted that day at the payment gateway and in our records |
| Online store admin account (primary administrator ID and password) | Duration of service use (replaced when the business sends it again) | Destroyed within 7 days after confirming termination or a deletion request |
| Inbox messages and photos | Duration of service use (attached photos are automatically deleted after 90 days) | Destroyed within 7 days after confirming termination or a deletion request |
| Server operation logs (access and error logs) | Per the retention setting of the log storage (currently 30 days) | Automatically deleted after the retention period |
Retention and destruction: The Company retains the above data for the duration of service use and does not perform automatic time-based cleanup (except Inbox photo attachments and server operation logs, which the table above marks as automatically deleted). Upon receiving a termination or deletion request, the Company verifies the requester and destroys the data within 7 days following the procedure in the Data Deletion Guide.
From the day paid use ends and ad changes stop (subscription cancellation, 7 days after a failed payment, or no payment consent after the free trial), the data above is kept and can still be viewed for 30 days, then destroyed (with an email and in-app notice 7 days before; payment records are kept for 5 years). ‘Termination’ in the table above means account deletion.
Public information that is not specific to a business, such as the public best-seller rankings of external fashion platforms, may be retained regardless of a business's termination.
From the day paid use ends and ad changes stop (subscription cancellation, 7 days after a failed payment, or no payment consent after the free trial), the data above is kept and can still be viewed for 30 days, then destroyed (with an email and in-app notice 7 days before; payment records are kept for 5 years). ‘Termination’ in the table above means account deletion.
Public information that is not specific to a business, such as the public best-seller rankings of external fashion platforms, may be retained regardless of a business's termination.
05Data Protection데이터 보호
5.1 Technical Safeguards
- All data is stored encrypted with AES-256 on Google Cloud Platform
- Data in transit is protected with TLS 1.3
- API tokens are securely managed with Google Secret Manager
- Passwords are encrypted with a one-way hash (bcrypt)
5.2 Administrative Safeguards
- Access control based on the principle of least privilege (IAM)
- Per-business data isolation (filtering based on company_name)
- Separation of administrator and regular user permissions
- Demo accounts cannot access real data
07Your Rights이용자 권리
Users may exercise the following rights at any time:
- Right of access: You may view the data collected
- Right to rectification: You may request correction of inaccurate information
- Right to erasure: You may request deletion of your account and related data
- Right to restrict processing: You may request that processing of your data be stopped
- Right to data portability: You may request transfer of the collected data to another service
To exercise these rights, send an email to the contact below; requests are processed within 7 days.
Caution: When an account is deleted, the integration data, integration credentials and AI analysis reports kept by the Company are deleted together and cannot be recovered. Materials already sent to external AI services (tables in Sections 03 and 08) are retained and deleted according to each processor's data processing terms (see Section 05 of the Data Deletion Guide).
08International Transfer국외 이전
To provide the Service, data may be transferred abroad as follows:
| Recipient | Country | Purpose | Safeguards |
|---|---|---|---|
| Google Cloud Platform | Republic of Korea (asia-northeast3) | Data storage/processing | SOC 2 Type II certification |
| Meta Platforms | United States | Advertising API integration | Standard Contractual Clauses (SCC) |
| Google (Ads/Analytics) | United States | Advertising/analytics API | Standard Contractual Clauses (SCC) |
| OpenAI, OpenRouter | United States | Interpreting and classifying AI chatbot questions (entered text) | Processor's data processing terms |
| Google (Gmail) | United States and others | Sending billing notice and sign-up verification code emails (recipient email, business name, notice content) | Processor's data processing terms |
| Google (Gemini) | United States | Suggesting ad copy and keywords (product page content) | Processor's data processing terms |
| Anthropic | United States | Writing monthly analysis reports (summary sales and ad figures) | Processor's data processing terms |
09Children's Privacy아동 보호
The Service is a B2B service and does not collect personal information of children under 14. If a user under 14 is found to have registered, the account and its data are deleted immediately.
10Policy Changes방침 변경
This policy may be amended due to changes in relevant laws or the Service. When amended, the effective date and changes are posted on this page and notified to the user (business contact) contact details known to the Company (such as email). Changes material to users' rights are notified 7 days before they take effect.
The current version (v2.3) takes effect on October 26, 2026 (as a material change, it is announced earlier than 7 days before it takes effect).
Revision History
| Version | Revised | Effective | Changes |
|---|---|---|---|
| v2.5 | 2026-10-23 | The day account connection on the business's behalf and the Inbox open | Online store admin account (primary administrator ID and password — stored encrypted, viewable only by the dedicated marketer, every view logged) while shopper information is not stored, Inbox messages and photos and the email and ad account number sent for account connection, purposes for account connection on the business's behalf and responding to inquiries, two retention rows; external fashion platforms are described by type instead of by name; self sign-up (business name, mobile number, email verification and consent records) and notification message processing (SOLAPI) |
| v2.4 | 2026-10-21 | The day subscription payment opens | Paid-use information (recurring-payment key, payment records, payment consent) and billing notice emails; payment processors (PortOne, KG Inicis, NHN KCP); 5-year retention of payment records; subscription cancellation distinguished from account deletion; 30-day retention after paid use ends and immediate deletion of the recurring-payment key |
| v2.3 | 2026-10-12 (supplemented 10-18) | 2026-10-26 | Aligned with actual operations. Supplemented on 10-18: Meta entries in the collection table updated to the information actually received (ad accounts, Pages, Instagram, Pixel, catalogs); ad operation recommendations and ‘ad actions only when chosen by the user’ added to the purposes; new Section 1.3 on restrictions on Meta and Google data (Google Limited Use requirements). Also: cookie table corrected to the actual cookies (ngn_token, session, device); Naver entry corrected to what is actually collected (search volume) and Google Search Console and external fashion platforms added; login information changed to ‘ID and password’; automatic deletion promises not actually performed (13, 12 and 3 months) removed from retention and replaced with ‘retained during use, destroyed within 7 days of a termination or deletion request’; notification channel for policy changes corrected to the actual channel; Chief Privacy Officer (Choi Woohyun, CEO, and contact) stated; version and effective date notation cleaned up |
| v2.2 | 2026-09-30 | 2026-09-30 | AI processors and international transfer recipients corrected to those actually used (OpenAI, OpenRouter, Google, Anthropic); chatbot input notice added |
| v2.1 | 2026-02-01 | 2026-02-01 | Google Ads API provisions added; cookie policy introduced |
| v2.0 | 2025-07-01 | 2025-07-01 | GDPR/PIPA compliance provisions strengthened; international transfer specified |
| v1.0 | 2025-01-01 | 2025-01-01 | Initial version |
The paid-use content added in v2.4 applies from the day subscription payment opens in the app; that date will be announced by email and in-app notice 7 days in advance. It does not apply to users who have not registered a card.
Versions before v2.3 did not state a separate effective date, so the revision (posting) date is listed as the effective date.
11Contact문의처
Chief Privacy Officer
CompanyNugoona Company (누구나 컴퍼니)
OfficerChoi Woohyun (최우현), CEO
Phone010-2781-4543
Emailoscar@nugoona.co.kr
Websitenugoona.co.kr
Remedies for infringement: For consultation on personal information infringement, you may contact the Personal Information Infringement Report Center (개인정보침해신고센터, 118) or the Personal Information Dispute Mediation Committee (개인정보분쟁조정위원회, 1833-6972).