Privacy Policy
Last updated: 2026-07-30
1. Who processes your data
KWeather Co., Ltd. (케이웨더 주식회사) is the personal information controller. It decides what is collected and why, and it is the party you exercise your rights against.
KWeather Co., Ltd. — Business Registration No. 110-81-37628 · 4F Room 401, 5 Digital-ro 26-gil, Guro-gu, Seoul, Republic of Korea · [email protected] · +82 1644-0902.
Wellbian Labs Pte. Ltd. operates the platform on KWeather's behalf and is limited to technical operation and maintenance. It is an entrustee, not a controller: it does not decide what is collected or what it is used for.
2. What is collected, why, and for how long
Only what the service cannot run without. There is no advertising, profiling, or sale of personal data to anyone.
| Data | Why | Retention |
|---|---|---|
| Email address | Account identity and sign-in | Until the account is deleted |
| Password (scrypt hash with per-user salt) | Authentication. The password itself is never stored | Until the account is deleted |
| Wallet address | Linking purchases to the buyer and re-download by signature | Until the account is deleted; retained on purchase records as a transaction record |
| Session token | Keeping you signed in | 30 days, then deleted automatically |
| Purchase records (transaction hash, cities, period, amount, dataset hash) | Proving what was bought and delivering it again on request | 5 years, as a transaction record under the Act on Consumer Protection in Electronic Commerce |
| API credit balance and key (per wallet) | Metered per-call access for agents | Until the credit is spent or the wallet asks for removal |
| Language and unit preference (cookie) | Showing the site in your language and units | Stored in your browser only; not sent to the server as an identifier |
3. What is not collected
No name, phone number, address, date of birth, or payment-card details - payment happens from your own wallet on a public blockchain and never passes through this service.
Page-view counting records the page group only (for example "home", "buy"). No cookie, identifier, IP address or user agent is stored with it, so it cannot be traced back to a person. It exists to tell the operator which pages are used.
4. Entrusted processing, and processing outside Korea
Technical operation of the platform is entrusted to Wellbian Labs Pte. Ltd. (UEN 202604584N), a Singapore company, 111 Somerset Road #06-01W, Singapore 238164. Entrusted work: operating, maintaining and monitoring the service infrastructure, and responding to technical faults.
Infrastructure providers process data on our behalf as part of that operation, and are therefore also entrusted: Vercel Inc. (application hosting and delivery; served from its Seoul region) and Supabase (managed PostgreSQL; Seoul region). Their role is storage and execution - neither is given the data for any purpose of its own. An earlier version of this policy said nothing else was entrusted; that was incorrect and is corrected here.
Application servers and the database are located in Seoul, Republic of Korea (Vercel region icn1; Supabase Seoul). Data is therefore stored in Korea. Because the entrustee is incorporated in Singapore, administrative access from outside Korea is possible, and this is disclosed as an overseas transfer of processing under Article 28-8 of the Personal Information Protection Act.
Items transferred: those listed in section 2. Recipient: Wellbian Labs Pte. Ltd. ([email protected]), Singapore. Purpose: technical operation and maintenance. Method: encrypted remote administrative access, as needed. Retention: for the duration of the entrustment. This is disclosed here rather than collected by separate consent, as permitted for entrustment necessary to perform the contract; you may refuse it, in which case the service cannot be provided - the entrustment covers wallet-only purchase records as well as accounts, so it is not limited to members.
No personal data is provided to any third party other than the above, except where a law or a warrant requires it.
5. Your rights, and how to use them
You may request access, correction, deletion, or suspension of processing at any time (Articles 35 to 37 of the Personal Information Protection Act). Requests go to KWeather at [email protected] or +82 1644-0902, and are answered within 10 days.
Deletion can also be done yourself, immediately, from the Account page: it removes your email, password hash, linked wallet and all sessions. Purchase records are retained for the statutory period but are detached from the account at that moment, so they no longer identify you through it; they remain reachable by wallet signature so that data you have already paid for is not lost. Prepaid call credits belong to the wallet, not the account, and are unaffected.
You may withdraw consent by deleting the account. Doing so does not affect processing already carried out lawfully.
6. Destruction
Data whose retention period has passed, or whose purpose has been achieved, is deleted without delay. Sessions and expired quotes are deleted automatically by a scheduled job; accounts are deleted on request; records held under a statutory retention period are deleted when that period ends. Deletion is a database row deletion, not a flag.
7. Security measures
Passwords are stored as scrypt hashes with a per-user salt and are never recoverable. Session tokens are 256-bit random values delivered only in an httpOnly cookie. All traffic is served over TLS. Administrative interfaces are excluded from search indexing and protected by a separate secret. Access to the production database is limited to the entrusted operator and logged.
8. Cookies
Three cookies are used: a session cookie (httpOnly, set only after you sign in), a language preference, and a temperature-unit preference. There are no advertising or analytics cookies and no third-party trackers. Blocking cookies leaves the site usable; you simply cannot stay signed in.
9. Data protection officer
Data protection officer: KWeather Co., Ltd., Personal Information Protection team · [email protected] · +82 1644-0902 · 4F Room 401, 5 Digital-ro 26-gil, Guro-gu, Seoul. The named officer and department are being registered and will be published here; until then requests to the address above reach the responsible team.
If a matter is not resolved, you may also contact the Personal Information Dispute Mediation Committee (1833-6972, kopico.go.kr), the Personal Information Infringement Report Centre (118, privacy.kisa.or.kr), or the Supreme Prosecutors' Office and National Police Agency cybercrime units.
10. Changes
Changes are posted on this page at least seven days before taking effect, and thirty days ahead where the change is materially unfavourable to users.