1. Information We Collect
We collect and process the following categories of information:
- Account & Authentication Information (processed via Clerk): email address, and sign-in/session activity.
- Personal & Relationship Service Input: your name, date of birth, time and place of birth, and gender, where you provide them, used to generate your Personal and Relationship analyses.
- Behavioral Psychology Questionnaire Responses: your answers to our behavioral survey, used alongside your birth information to generate your analysis.
- Third-Party Data (Relationship Analysis): information you submit about another person -- such as their name, date of birth, time and place of birth, or gender -- in order to generate a Relationship analysis involving them. See Section 2 below for the responsibility this places on you.
- Payment & Transaction Information: we do not collect or store your full card number or other payment credentials. Our third-party payment service provider collects your payment details directly and shares limited transaction data back with us -- a transaction identifier, the product purchased, the price/currency, and transaction status.
- Automatically Collected Technical & Usage Information: IP address, browser/device information, and usage/analytics events, collected via cookies and Google Tag Manager (currently configured for GA4 analytics only -- see Section 6).
- Decision Journal entries are currently stored locally on your device and are not transmitted to our servers unless a future feature explicitly informs you otherwise.
2. Third-Party Data You Submit
If you submit another person's information to generate a Relationship analysis, you confirm that you have the appropriate authority or basis to provide that information -- for example, their consent, or another lawful basis recognized where you or they are located. Do not submit another person's sensitive or special-category information without their knowledge and agreement.
3. How We Use Your Information
We use the information described in Section 1 for the following purposes:
- To generate your Personal analysis, Relationship analysis, and to support the Decision Journal feature (which, as noted above, is stored on your device, not ours).
- To combine your behavioral psychology questionnaire responses with Saju- and astrology-derived signals from your birth information, producing a self-insight report -- not a fortune-telling or future-prediction service, and not a substitute for professional advice (see Section 4).
- To process payments and manage your purchases through our third-party payment service provider.
- To communicate with you about your account, service updates, or customer support requests.
- To maintain the security of the Service and to improve it over time.
4. AI Processing Disclosure
We use OpenAI's API to help generate part of your analysis. Only the information needed for that purpose is sent: your birth-date/time-derived signals and your behavioral questionnaire responses, and in some cases a name for personalizing the report's tone. We never send your account email address or any payment/billing information to OpenAI.
Per OpenAI's published API platform data usage policy, data submitted through the API is not used to train OpenAI's models by default, and OpenAI may retain it for up to 30 days to provide the service and to monitor for misuse. We have not entered into any separate agreement with OpenAI that changes these terms.
Your analysis is an AI-assisted, self-insight tool intended for personal reflection and entertainment. It is not medical, legal, financial, or psychological professional advice, and should not be relied on as a substitute for consulting a qualified professional.
5. Service Providers & Sub-Processors
To operate the Service, the following vendors process personal data on our behalf, only for the purposes below:
- Vercel Inc. (United States) -- application hosting and content delivery. Our production functions currently run in Vercel's sfo1 (San Francisco) region.
- Supabase (United States) -- database hosting and storage. Our production database is hosted in Supabase's us-west-1 (Oregon) region.
- Clerk (United States) -- authentication and account/identity management. Clerk provides no selectable regional data residency; account data is processed and hosted on Clerk's US infrastructure.
- Third-party payment service providers -- payment and refund processing may be handled by a third-party payment service provider, which processes payment details directly; we never receive your full card details.
- OpenAI, L.L.C. (United States) -- AI-assisted analysis generation, as described in Section 4.
- Google LLC, via Google Tag Manager (United States) -- currently configured to load Google Analytics 4 only, for website usage analytics. No advertising or remarketing tag is configured as of this writing.
6. International Transfers
We are located in the Republic of Korea. Because the service providers listed in Section 5 are located outside Korea, using their services necessarily involves transferring your personal data internationally. The table below sets out, for each recipient and to the extent we can confirm from our own production configuration and each vendor's own published policy, the country/region of processing, the data transferred, the purpose, the timing/method, retention, and where to find that vendor's own contact/privacy information. Where a vendor does not publish an exact retention period applicable to our account, we say so rather than stating a specific figure we cannot verify.
- Vercel Inc. | United States (production functions run in the sfo1 / San Francisco region) | IP address, request/browser metadata | Application hosting and content delivery | Continuous and automated, with each request to our Service | Governed by Vercel's own data retention policy | See Vercel's published privacy policy for contact details.
- Supabase | United States (production database region: us-west-1 / Oregon) | Account identifiers, service input, questionnaire responses, relationship analysis data, transaction identifiers | Database hosting and storage | Continuous and automated | Retained while your account is active; backup copies are retained for a limited period in accordance with our database provider's own backup lifecycle policy | See Supabase's published privacy policy for contact details.
- Clerk | United States (Clerk offers no selectable regional data residency) | Email address, authentication and session data | Authentication and account management | Continuous and automated | Governed by Clerk's own data retention policy | See Clerk's published privacy policy for contact details.
- Third-party payment service provider (Toss Payments) | Toss Payments is located in the Republic of Korea; according to its published privacy policy, personal data is transferred outside Korea only when an overseas payment method is used. On our Service, the only overseas payment method is PayPal, offered only for U.S. dollar checkout where available: in that case Toss Payments provides your order details to PayPal Pte. Ltd. (United States) | For PayPal payments: order number, product purchased, name, email address, purchase amount, country code, payment method | Payment and refund processing | At checkout, immediately, over an encrypted network | Governed by each provider's own data retention policy | Contact contact@ahaitsme.com, or see the support information in your payment receipt.
- OpenAI, L.L.C. | United States | Birth-derived analysis signals, questionnaire responses, and (where applicable) a name for personalization -- never your account email or payment data | AI-assisted report generation | At the time each report is generated, via API | Not used to train OpenAI's models by default; retained by OpenAI for up to 30 days for service delivery and abuse monitoring | See OpenAI's published API/privacy policy for contact details.
- Google LLC (Google Tag Manager / Google Analytics 4) | United States | IP address, device/browser information, usage/analytics events | Website usage analytics only -- no advertising or remarketing tag is currently configured | Continuous and automated, via tags loaded on each page | Governed by Google's own data retention policy | See Google's published privacy policy for contact details.
7. Your Privacy Rights
Regardless of where you are located, you may request access to, correction of, deletion of, or a restriction on the processing of your personal information, at any time, by contacting us at contact@ahaitsme.com. We will respond without undue delay.
8. Privacy Officer
9. Security Measures
We take the following measures to protect your personal information, each of which is actually implemented in our production Service today:
- All traffic to our Service is encrypted in transit over HTTPS.
- Our database uses row-level security, with direct data access restricted to service-role, server-side API calls only -- never exposed to the browser.
- API credentials for our AI and payment providers are used exclusively in server-side code and are never present in code that runs in your browser.
- We do not collect or store your full payment card details on our own servers; that information is handled directly by our third-party payment service provider.
- Our server-side logging is designed to redact personal information -- including names, birth details, questionnaire answers, and free-text analysis content -- and to mask account and record identifiers, before anything is written to a log.
10. California Privacy Rights
Aha It's me does not currently sell your personal information for monetary consideration or knowingly share your personal information with third parties for cross-context behavioral advertising. If our practices change in a way that creates an applicable right to opt out under the California Consumer Privacy Act (CCPA), we will update this Policy and our Do Not Sell or Share My Personal Information page and provide the required opt-out mechanism.
California residents have the right, under the CCPA and CalOPPA, to request details about the personal information we have collected about them, to request deletion of that information, and to exercise the rights described in Section 7. To exercise these rights, contact us at contact@ahaitsme.com.
11. Children's Privacy
The Service is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If we become aware that we have done so, we will delete that information promptly.
12. Data Retention & Account Deletion
We retain your personal data for as long as your account is active.
When you delete your account: your reports and everything generated from them -- including your behavioral questionnaire responses, generated analyses, and relationship reports -- are deleted from our active database immediately, through automatic cascading deletion. Your active credit balances, entitlement/membership state, and gift coupons are also deleted from our active systems at that time.
A minimal transaction record (your payment processor's transaction identifier, the product purchased, and the transaction date/status) is retained afterward, as required for accounting and legal recordkeeping under applicable law (such as Korea's Act on Consumer Protection in Electronic Commerce), but it is no longer linked to your account identifier.
Decision Journal entries are never transmitted to our servers in the first place (see Section 1), so account deletion has nothing to remove on our end for that feature -- any entries remain only on the device where you last used them, until you clear them yourself.
We also maintain periodic backups of our database for disaster-recovery purposes. Deleting your account removes your data from our active, in-use systems, but we cannot guarantee that a copy will be instantly removed from those backups as well; backup copies are retired on our backup provider's own schedule.
Destruction method: personal data in electronic file form is deleted using methods that prevent recovery; personal data in paper form, if any, is shredded or incinerated.
13. Policy Changes
We may update this Privacy Policy from time to time. If we make material changes, we will update the "last updated" date above and, where required by law, provide additional notice.
14. Contact
Company Name: Aha It's me
Address: 5F, Ga-8, 18 Eonju-ro 134-gil, Gangnam-gu, Seoul, 06053, Republic of Korea
Email: contact@ahaitsme.com