Privacy Policy

AEON B ('the Service') takes your privacy seriously and complies with Korea's Personal Information Protection Act (PIPA) and related laws. This policy explains what information we collect, why we collect it, how long we keep it, and your rights.

[Required]
- Chat input text (to generate AI procedure recommendations)
- Hashed IP identifier (for abuse prevention and rate limiting; the original IP address is never stored)

[When submitting a consultation request]
- Name, contact information (phone or email), KakaoTalk ID (optional), preferred consultation time

[Automatically collected]
- Usage logs (request timestamps, language setting, usage patterns) — for service improvement and error analysis

We do not intentionally collect or store sensitive medical data (diagnoses, prescriptions). We advise against entering personal health records in the chat.

We use collected information only for:
- Generating AI aesthetic procedure recommendations
- Connecting you with a human consultant (when requested)
- Improving service quality and diagnosing errors
- Preventing unauthorized automated requests and abuse

- Chat logs: Retained for up to 30 days after session end, then automatically deleted (de-identified data may be retained longer for service improvement)
- Consultation request data: Retained for 1 year after consultation completion, or deleted immediately upon user request
- Legally mandated retention: Certain records may be retained for the periods required by applicable law

Data is securely destroyed after the applicable retention period.

We do not sell or share your data with third parties. We engage the following processors to operate the Service:

| Processor | Purpose | Retention |
|-----------|---------|-----------|
| Google (Gemini API) | AI response generation | Until contract termination |
| Supabase | Database storage and management | Until contract termination |
| Resend | Email delivery | Until contract termination |
| Vercel | Hosting and deployment | Until contract termination |

Each processor is contractually prohibited from using your data beyond the specified purpose.

You have the right to:
- Access: Request details of how your data is processed
- Rectification: Request correction of inaccurate information
- Erasure: Request deletion of your personal data
- Withdraw consent: Revoke consent at any time (note: this may limit Service access)
- Restrict processing: Request temporary suspension of data processing

Submit requests to the contact below. We aim to respond within 10 business days.

For privacy-related inquiries, please contact:

- Email: kj@flowos.work
- Response target: within 3 business days

For complaints about personal data handling in Korea, you may also contact the Personal Information Protection Commission (privacy.go.kr, hotline: 182) or the Korea Internet & Security Agency (privacy.kisa.or.kr, hotline: 118).