Privacy Policy
Effective date: 2026-09-05
Vacatio Inc. ("the Company") complies with the Personal Information Protection Act ("PIPA") and related laws of the Republic of Korea, and establishes and discloses the following privacy policy to protect the personal data of data subjects. This policy applies to the websites and services provided by the Company (including Vacatio Solution, FineStay and VACATIO Hotel). Effective date: 5 September 2026 · Last amended: 5 September 2026.
Article 1 (Categories, purposes and retention periods of personal data processed)
The Company processes the following personal data. No item is used for purposes other than those specified, and separate consent is obtained if a purpose changes.
| Category | Items collected | Purpose | Legal basis | Retention period |
|---|---|---|---|---|
| Inquiries, consultations and demo requests | (required) name, email, phone, inquiry details / (optional) business information | Responding to inquiries, consultation, supporting adoption reviews | PIPA Article 15(1)4 | 3 years after the purpose is achieved (consultation history management) |
| Service booking and use (FineStay, etc.) | (required) name, phone, email, booking details | Concluding and performing accommodation bookings and customer support | PIPA Article 15(1)4 | Until the purpose is achieved. However, under the Act on Consumer Protection in Electronic Commerce, records of contracts or withdrawal of subscription are kept for 5 years, records of payment and supply of goods for 5 years, and records of consumer complaints or dispute resolution for 3 years. |
| Payment | Payment approval data (payment-method data such as card numbers is collected and processed directly by the payment gateway NICE Payments and is not held by the Company) | Payment and settlement of fees | PIPA Article 15(1)4 | 5 years under the Act on Consumer Protection in Electronic Commerce |
| Job applications | Name, email, phone, and information contained in resumes/portfolios | Conducting recruitment and notifying results | PIPA Article 15(1)4 | Retained for 180 days after the process ends, then destroyed |
| Automatically collected data | IP address, cookies, service usage records, device/browser information, access logs | Service operation and improvement, statistical analysis, prevention of misuse | PIPA Article 15(1)4 | Access logs are kept for at least 3 months under the Protection of Communications Secrets Act and then destroyed. |
| AI phone and message handling | Caller phone number, call/consultation content (voice and text) | Automating responses and managing consultation quality | PIPA Article 15(1)4 | Retained for 3 years after the purpose is achieved, then destroyed |
| Marketing (optional consent) | Name, email, phone | Sending newsletters, promotions and other advertising information | PIPA Article 15(1)1 (consent) | Until consent is withdrawn |
※ When AI handles a phone call, we notify you at the start of the call that the call may be recorded and logged. After personally identifiable information is removed, consultation data may be used to improve response quality and AI performance; you may object to this use at any time via operation@vacatio.us.
※ We ask applicants not to include sensitive data such as beliefs or health information, or unique identifiers such as resident registration numbers, in their resumes; even if included, the Company does not use them in evaluation. Under the Fair Hiring Procedure Act, applicants may also request the return of the application documents they submitted.
Article 2 (Purposes of processing)
The Company processes personal data for the following purposes: (1) responding to inquiries and consultations; (2) providing services, concluding and performing bookings/contracts, and settling fees; (3) conducting recruitment; (4) improving services and analyzing statistics; (5) preventing misuse and maintaining a secure service environment; (6) fulfilling legal obligations; and (7) sending advertising information (only where consent has been given).
Article 3 (Personal data of children under 14)
As a rule, the Company does not collect personal data from children under the age of 14. Where collection is unavoidable, the consent of a legal representative is obtained.
Article 4 (Provision to third parties)
The Company does not provide personal data to third parties without the data subject’s consent, except: (1) where specially provided by law; (2) where an investigative agency requests it in accordance with the procedures and methods prescribed by law; or (3) where the data subject has consented in advance.
Article 5 (Outsourcing of processing)
To provide the service smoothly, the Company outsources the following personal data processing tasks. Outsourcing contracts include the matters required for safe management and supervision under PIPA Article 26, and any re-outsourcing by a processor requires the Company’s prior approval.
| Processor | Outsourced task |
|---|---|
| Amazon Web Services, Inc. | Cloud infrastructure operation and data storage |
| NICE Payments Co., Ltd. | Payment processing and settlement |
| Google LLC | Business email delivery and storage of inquiry/support data (Google Workspace, Sheets, Drive) |
| Vercel Inc. | Website hosting and deployment |
| NAVER Cloud Corp. | Outbound AlimTalk/SMS message dispatch (NAVER Cloud SENS) |
| Kakao Corp. | AlimTalk message delivery |
| Moru (moru.io) | AI phone and message consultation handling |
Article 6 (Transfer of personal data overseas)
To provide the service, the Company transfers personal data overseas as follows. The legal basis is PIPA Article 28-8(1)3 (outsourcing of processing and storage).
| Recipient | Destination country | Items transferred | Method of transfer | Purpose | Retention period |
|---|---|---|---|---|---|
| Amazon Web Services, Inc. (aws-korea-privacy@amazon.com) | Overseas regions including the United States | Personal data collected in the course of service use | Transmitted and stored over the network when the service is used | Cloud infrastructure operation and backup | Until the outsourcing contract ends |
| Google LLC | United States | Email and inquiry/recruitment data | Transmitted and stored over the network when the service is used | Business email delivery and storage of inquiry/recruitment data | Until the outsourcing contract ends |
| Vercel Inc. | United States | Access data processed when the website is visited | Transmitted over the network when the website is used | Website hosting and deployment | Until the outsourcing contract ends |
| External language-model and speech-recognition processors | United States | Consultation content entered or spoken by the user during AI-assisted handling | Transmitted over the network when the service is used | Generating AI-based responses | Deleted after the request is processed (retained for up to 30 days before deletion, depending on the processor’s policy) |
Data subjects may refuse the overseas transfer via the contact in Article 12; refusal may limit the use of the relevant service.
Article 7 (Destruction and separate storage)
(1) The Company destroys personal data without delay once the retention period expires or the purpose of processing is achieved.
(2) Data in electronic file form is permanently deleted in a manner that makes recovery or reproduction impossible, and printed materials are shredded or incinerated.
(3) Data that must be retained by law is stored and managed separately from other personal data and is not used for any purpose other than that retention.
Article 8 (Rights of data subjects and how to exercise them)
(1) Data subjects may at any time request access to, correction or deletion of, or suspension of the processing of their personal data, and may withdraw consent.
(2) Rights may be exercised in writing or by email (operation@vacatio.us), and the Company will act without delay (within 10 days).
(3) Rights may be exercised through a legal representative or an authorized agent, in which case a power of attorney must be submitted.
(4) Where there is a statutory ground to refuse a request, the Company notifies the data subject of the reason and how to object.
Article 9 (Installation, operation and refusal of cookies and similar tools)
(1) The Company uses cookies to provide an optimized service.
(2) Users may refuse cookie storage through browser settings (e.g. Chrome — Settings > Privacy and security > Cookies). Refusal may limit the use of some services.
Article 9-2 (Collection, use and refusal of behavioral data)
The Company collects behavioral data using Google Analytics (GA4) and Google Ads.
| Category | Details |
|---|---|
| Items collected | Website visit records and usage records such as clicks |
| Method of collection | Automatic collection through Google Analytics (GA4) and Google Ads when the website is used |
| Purpose | Analyzing service usage and measuring advertising performance |
| Retention period | Up to 14 months from collection (the GA4 default setting), after which it is deleted |
| How to refuse | Block cookies in your browser settings, or turn off personalized ads in Google Ad Settings (adssettings.google.com). |
※ The Company does not collect sensitive behavioral data such as beliefs or medical history.
Article 10 (Operation of visual data processing devices)
(1) The accommodation facility operated by the Company (VACATIO Hotel) operates fixed visual data processing devices (CCTV) for facility safety and crime prevention. Details follow the CCTV operation and management policy posted on site.
(2) Mobile visual data processing devices, such as cameras mounted on the Company’s autonomous service robots, are operated with an indication that filming is taking place, in accordance with PIPA Article 25-2.
Article 11 (Measures to ensure the security of personal data)
The Company establishes and implements an internal management plan, manages access rights and controls access, encrypts personal data, retains access logs and prevents their forgery or alteration, installs security programs, and applies physical access controls.
Article 12 (Data protection officer and department receiving access requests)
· Data protection officer — Ji Hyunjun (Chief Executive Officer).
· Department receiving and handling access requests — Operations Team · operation@vacatio.us.
Privacy inquiries, complaints and requests for remedy may be submitted to the contact above, and the Company will respond without delay.
Article 13 (Remedies for infringement of rights)
Reports and consultations regarding personal data infringement may be directed to the following organizations.
| Organization | Contact | Website |
|---|---|---|
| Personal Information Dispute Mediation Committee | 1833-6972 | www.kopico.go.kr |
| Privacy Infringement Report Center (KISA) | 118 without an area code | privacy.kisa.or.kr |
| Supreme Prosecutors’ Office | 1301 | www.spo.go.kr |
| National Police Agency | 182 | ecrm.police.go.kr |
Article 14 (Changes to this privacy policy)
(1) If content is added to, deleted from or modified in this policy, we will give notice on the website 7 days before it takes effect (30 days in advance for significant changes such as items collected, purposes, or provision to third parties).
(2) Previous versions of this policy are available on request at operation@vacatio.us.