Privacy Policy

ValueLabs, represented by Taebeom Kim (the "Company"), values users' personal information and complies with the Personal Information Protection Act and other applicable laws. This Privacy Policy explains the personal information processed through the Plandi website operated by the Company, including the AI planning tools, the sale of planning passes and digital products, and consultation and engagement inquiries (the "Service"), together with the purposes of processing, retention periods, users' rights, and protective measures.

The personal information controller is ValueLabs.
Company name: ValueLabs
Representative: Taebeom Kim
Business address: 104, 19 Yuhyeon-ro, Gimpo-si, Gyeonggi-do, Republic of Korea
Business registration number: 216-29-00213
Mail-order business registration number: 2016-Seoul Yangcheon-0055
Privacy inquiries: hello@plandi.app

The Company processes personal information for the following purposes:
1. Membership registration and identification, account creation and login (by email or through Naver, Kakao, or Google social login), and password reset.
2. Saving, viewing, editing, and deleting planning projects, and moving plans created as a non-member to the account the user registers.
3. Providing the AI planning tools (generating plans, IA, screens, and other output requested by the user).
4. Orders, payments, deposit confirmation, granting and managing planning passes, refunds, receipts, and purchase notices for planning passes and digital products.
5. Receiving and responding to consultation and engagement inquiries.
6. Contacting users as needed to operate the Service, such as notices and announcements of changes to terms.
7. Preventing misuse (such as improper circumvention of free limits or fraudulent payments) and security.
8. Sending marketing information such as events, news, and service announcements (only if the user has opted in).
9. Fulfilling legal obligations.
The Company does not use personal information for purposes other than those above.

The Company processes the following personal information to the extent necessary to provide the Service:
1. Email registration and account management: email address, password, name, mobile phone number, and whether the user agreed to the Terms of Service, the Privacy Policy, the age-14-or-older confirmation, and marketing communications.
2. Social login registration: the Company receives the information the user agreed to share with the social service.
a. Naver: user identifier, name, and email address
b. Kakao: user identifier, nickname, and Kakao account (email)
c. Google: user identifier, name, email address, and profile information
Users who register through social login are also asked to enter a mobile phone number and the required consents. The Company does not receive passwords for social services.
3. Purchases of planning passes and digital products: product ordered, order number, payment amount, type of payment method, payment date and time, payment status, points used, and records of planning passes granted, used, and expired.
a. Credit card payments: card payment information such as card numbers is processed directly by the payment service provider (Paddle), and the Company does not collect or store it. The Company receives the payment result (transaction number, amount, payment status, and receipt information such as country) from the payment service provider.
b. Bank transfers: depositor name, deposit amount, and deposit date and time. To confirm deposits, the Company matches deposit notifications received for its bank account (depositor name, amount, and time) against orders.
c. Refunds: bank name, account number, and account holder for receiving the refund (when refunding a bank transfer payment).
4. Use of the Service: access date and time, IP address, cookies, browser and device information, service usage records, error logs, and other access logs.
5. Planning projects: ideas, service descriptions, planning content, screen requests, generated output, and attached or saved content that the user enters or saves.
6. Consultation and engagement inquiries: name, email address, contact number, subject, inquiry content, linked planning project information, and handling results.

The Company retains and uses personal information until the purpose of processing is achieved. Upon membership withdrawal, personal information is destroyed or stored separately without delay. However, the following information may be retained for the period necessary to fulfill legal obligations, respond to disputes, and prevent misuse:
1. Member account information and planning project content: until the member deletes it or withdraws. Backup data is deleted after a certain period according to the backup cycle.
2. Records of contracts or withdrawal of purchases: 5 years under the Act on the Consumer Protection in Electronic Commerce.
3. Records of payment and supply of goods (including order, payment, deposit, and refund records): 5 years under the Act on the Consumer Protection in Electronic Commerce.
4. Records of consumer complaints or dispute resolution: 3 years under the Act on the Consumer Protection in Electronic Commerce.
5. Records of labeling and advertising: 6 months under the Act on the Consumer Protection in Electronic Commerce.
6. Transaction books and supporting documents: 5 years under the Framework Act on National Taxes and other tax laws.
7. Consultation and engagement inquiry records: until the purpose of handling the inquiry is achieved; thereafter, item 4 above applies to the extent necessary for handling consumer complaints or disputes.
8. Communication confirmation data such as access logs: 3 months under the Protection of Communications Secrets Act.
9. Minimum account identification information for preventing misuse: for a reasonable period necessary to achieve that purpose.
10. Marketing consent information: until consent is withdrawn or the member withdraws.
Refund account information is destroyed without delay once the refund is complete, except to the extent needed for the payment and refund records in item 3. Where a separate transaction with the Company takes place, such as an engagement contract or issuance of a tax invoice, the contract, tax invoice, and related transaction materials are retained for the periods required by applicable laws.

In principle, the Company does not provide users' personal information to third parties. However, it may provide information to the extent necessary where the user has given prior consent, where laws specifically require it, or where an investigative or supervisory authority requests it through lawful procedures.

To provide the Service smoothly, the Company may entrust personal information processing to, or use the processing infrastructure of, the following external services:
1. Paddle (Paddle.com Market Limited): processing credit card and other payments, acting as payment agent (including as reseller), issuing receipts, and preventing fraudulent payments.
2. Resend: sending service-related emails such as registration, verification, purchase and deposit notices, consultation replies, and announcements.
3. AI model providers connected by the Company, including OpenAI, Anthropic, Google (Gemini), DeepSeek, MiniMax, Moonshot AI (Kimi), and Zhipu AI (GLM): processing AI planning functions requested by users.
4. Cloud infrastructure and storage providers such as Railway and Cloudflare R2: server operation, file storage, and backup.
The Company manages the safeguards necessary for protecting personal information, the prohibition of processing for other purposes, and retention and destruction obligations through outsourcing agreements or each service's terms. If a processor or outsourced task changes, the Company will announce it through this Privacy Policy or the Service.
Naver, Kakao, and Google provide member information to the Company with the user's consent when the user chooses social login; they are not processors to which the Company outsources personal information processing.

Because the Company uses infrastructure and solutions provided by overseas companies, personal information or part of the content entered by users may be processed overseas. The recipients, items transferred, destination countries, timing and method of transfer, and retention periods are as follows:
1. Paddle (Paddle.com Market Limited, privacy@paddle.com): email address, name, country and postal code, payment amount and product information, and payment method information (entered directly with Paddle) / the United Kingdom and other locations of Paddle's processing infrastructure / electronic transmission through the checkout when the user pays by card / for payment processing and the retention period required by applicable laws.
2. Resend: email address, recipient information, and sending history / United States / API or other electronic transmission when sending emails related to registration, verification, purchase notices, consultation replies, and announcements / for the period necessary for sending emails and managing sending history.
3. AI model providers, including OpenAI, Anthropic, Google (Gemini), DeepSeek, MiniMax, Moonshot AI (Kimi), and Zhipu AI (GLM): prompts, attached content, and generated output / the United States and other overseas regions or the locations of each provider's processing infrastructure / API transmission when the user runs AI planning functions / for the period necessary to process the generation request; subsequent retention may follow each provider's policies.
4. Infrastructure providers such as Railway and Cloudflare R2: member and order information, access records, uploaded files, planning project data, and technical logs / overseas / electronic storage in the course of using the Service / for the period the Service is provided or the retention periods set out in this Policy.
Users may refuse overseas transfer. However, because the processing above is necessary to provide the Service, users who refuse cannot use the related functions (such as card payment, receiving emails, and AI planning functions). Overseas transfer information may vary depending on the services actually used and operating practices, and the Company applies the notices and protective measures required by applicable laws.

When personal information is no longer needed, such as when the retention period expires, the purpose of processing is achieved, or a member withdraws, the Company destroys it without delay. Electronic files are deleted in a manner that cannot be restored, and paper documents are shredded or incinerated. Information that must be retained under applicable laws is moved to a separate database or stored separately.

Users may at any time request access to, correction, deletion, or suspension of processing of their personal information, or withdraw consent. Requests can be made through the settings in the Service or by emailing the privacy contact, and the Company will handle them without delay in accordance with applicable laws. Users who registered through social login can, separately from membership withdrawal, disconnect Plandi in the account settings of the relevant social service (Naver, Kakao, or Google). Consent to marketing communications is optional, and not consenting does not restrict registration or use of the basic Service. Children under 14 may not register for the Service, and the Company does not knowingly collect personal information from children under 14.

10. Installation, Operation, and Refusal of Automatic Collection Devices
The Company may use cookies and similar technologies to keep users logged in, for security, to prevent misuse, to let non-members continue their plans, to store cookie consent status and language settings, and to improve service quality. Essential cookies are always used to provide the Service, while functional/preference, analytics, and marketing cookies are managed according to the user's choices. The Company does not currently add non-essential analytics or advertising retargeting scripts such as Google Analytics or Meta Pixel to the public site, and if introduced in the future, they will run only for users who have consented. Users can change or delete their cookie choices through the cookie settings in the footer or their browser settings. However, blocking essential cookies may restrict login, security, personalization, and some functions. For details, please see the Cookie Policy.

11. Measures to Ensure the Security of Personal Information
To protect personal information, the Company implements reasonable technical and administrative safeguards, including access control, password encryption or one-way hashing, encryption in transit, retention and review of access records, security updates, backups, an internal management plan, and minimizing the number of personnel who handle personal information.

12. Privacy Officer
Privacy officer: Taebeom Kim
Privacy inquiries: hello@plandi.app
Users may contact the above for inquiries, complaints, or requests for remedies regarding personal information protection while using the Service.

13. Remedies for Infringement of Rights
Users who need consultation or dispute resolution regarding personal information may contact relevant authorities, including the Personal Information Infringement Report Center (privacy.kisa.or.kr / 118), the Personal Information Dispute Mediation Committee (www.kopico.go.kr / 1833-6972), the Supreme Prosecutors' Office (www.spo.go.kr / 1301), and the National Police Agency (ecrm.police.go.kr / 182).

14. Changes to this Policy
The Company may amend this Privacy Policy due to changes in law, the Service, or personal information processing practices. Material changes will be announced through the Service, email, or notices.

10. Behavioral Information and Analytics and Advertising Tools
The Company uses the tools below for visit analytics, advertising performance measurement, and remarketing to returning visitors. These tools automatically collect information about how users use the website (behavioral information). If this section differs from earlier sections, this section prevails.
Tools used: Google Analytics 4 and Google Ads conversion tracking (Google LLC, measurement ID G-VSW190TEX6), Meta Pixel (Meta Platforms, Inc.), Kakao Pixel and SDK (Kakao Corp.), and NAVER Analytics web logs and NAVER Ads (search and display) conversion tracking (NAVER Corporation).
Information collected: pages visited, referral source (which site or ad brought the user), device, browser, and operating system information, IP address, online identifiers such as cookies, and action events such as completed sign-up, completed inquiry or entry submission, and completed purchase. A purchase event includes the payment amount and currency, and the order number is sent to Google only. Visit records and completed-request events (free resource requests and completed inquiries) are sent to NAVER; information that identifies a user, such as name or email address, is not sent.
Information not sent: information that directly identifies a user, such as name, email address, phone number, or planning content entered by the user, is not sent to these tools.
Purposes: visit analytics and service improvement, advertising performance measurement, and remarketing to users who have visited the Service (including NAVER search and display ads).
Method: scripts installed on the website automatically collect this information in the user's browser through cookies and similar technologies and transmit it to each provider.
Recipients and transfers abroad: each provider processes this information under its own terms and privacy policy.
1) Google LLC: the country of transfer is the United States and other countries where Google operates data centers. The items transferred are those listed above. The timing and method are automatic network transmission when the website is used. The purpose is visit analytics and advertising performance measurement. Retention is up to the data retention period the Company sets in its Google account. Privacy information is available at policies.google.com/privacy.
2) Meta Platforms, Inc.: the country of transfer is the United States and other countries where Meta operates data centers. The items transferred are those listed above. The timing and method are automatic network transmission when the website is used. The purpose is advertising performance measurement and remarketing. Retention follows Meta's policies and the period the Company sets. Privacy information is available at www.facebook.com/privacy/policy.
3) Kakao Corp. and NAVER Corporation are domestic companies, so no transfer abroad applies. They process information under their own privacy policies (privacy.kakao.com, policy.naver.com).
Retention: cookies expire when the browser is closed or within two years at most, depending on the cookie. Collected behavioral information is used only until its purpose is achieved or the user opts out, and is deleted after the retention period the Company sets in each tool.
How to opt out: users may opt out of collection and personalized advertising at any time in the ways below. Opting out does not limit sign-up or basic use of the Service.
- Website cookie settings: use the Cookie Settings button at the bottom of the page. Default: before the visitor makes a choice, the tools above operate by default in Korea, and the visitor can turn them off at any time with the Cookie Settings button (for the EEA, the UK, and Switzerland, Google storage is denied by default before consent). Turning off analytics cookies switches Google Analytics storage to denied, so it no longer stores identifiers or cookies for measurement. Turning off marketing cookies stops the Meta, Kakao, and NAVER scripts from loading and sets Google ad storage, ad user data, and ad personalization to denied. If the Meta and Kakao tools are already loaded, they stop sending information as soon as you turn them off.
- Browser settings: delete or block cookies in your browser, or use private browsing.
- Google: turn off personalized ads at adssettings.google.com, or get the analytics opt-out add-on at tools.google.com/dlpage/gaoptout.
- Meta: adjust personalized ads in your Facebook or Instagram ad settings (www.facebook.com/settings?tab=ads).
- Kakao: opt out in the personalized ad settings of your Kakao account.
- NAVER: opt out in the personalized ad settings of your NAVER account.
The Service is not intended for children under 14, and the Company does not collect behavioral information from or show personalized advertising to children under 14. The tools above do not run for visits by signed-in administrator accounts.
Contact: send questions about behavioral information to hello@plandi.app.

Supplementary Provision
This Privacy Policy applies from the effective date.