Privacy Policy

Effective 2026-09-16 · Revised 2026-09-01

The Mapbox retention period (30 days) is based on Mapbox's public materials and is being verified. This Policy consists of Part 1 (personal information) and Part 2 (personal location information); Part 2 is the personal location information processing policy under Article 21-2 of the Act on the Protection and Use of Location Information. Website address: everyticket.kr/privacy (direct link to Part 2: everyticket.kr/privacy#location). This is a translation of the Korean original. If the two differ, the Korean text prevails.

Gorocket Company Co., Ltd. (the "Company") processes the personal information of users of Every Ticket (the "Service") in accordance with the Personal Information Protection Act, the Act on the Protection and Use of Location Information (the "Location Information Act"), and other applicable laws. This Policy explains what information we process, on what basis, and for how long, and what rights users have and how to exercise them.

At a glance

• The Company collects information users enter, capture, or register themselves; the route of travel of trips on which the user has tapped "Start recording"; and the device and usage information needed to run the app (the SDKs in Article 9). Location is not collected when recording is not in progress.
• Users' routes, Cuts, and photos are visible only in the user's own account and not to other users. The Company does not provide personal location information to third parties or use it for advertising.
• Photos, Cuts, and routes are stored in the user's own account area in a cloud leased by the Company (Google Cloud, Seoul region) and are destroyed without delay when the trip is deleted or the user withdraws (backups within 7 days at most).
• AI features (ticket information extraction, trip drafts) use Google's Gemini model. Photos and surveys you submit are not used for training, and Google keeps them for abuse monitoring for at most 55 days before deleting them.
• Some processing takes place abroad (United States, Japan, United Kingdom). Details by item and how to refuse are in Part 1, Article 6.

Part 1 Privacy Policy

Article 1 (Items, Purposes, Basis, and Retention Period of Personal Information Processed)

The Company processes the following personal information. The basis given in the table refers to the subparagraphs of Article 15 (1) of the Personal Information Protection Act; at sign-up, the Company informs the user of this content and obtains consent to the collection and use of personal information as a separate item.

② The Company does not request the iOS App Tracking Transparency (ATT) permission and does not collect the advertising identifier (IDFA). The Android Advertising ID can be reset or deleted in the device settings.

③ The Company does not collect sensitive information (thoughts and beliefs, health, etc.) or unique identifying information (resident registration number, etc.).

④ At sign-up the Company confirms that the user is 14 or older, and does not collect the personal information of children under 14. If use by a person under 14 is found, the account and related information are destroyed without delay.

Article 2 (How Personal Information Is Collected)

1. The user enters, captures, or selects it directly in the app or on the website
2. On social sign-in, Google, Apple, Kakao, or Naver passes it to the Company with the user's consent (for Kakao and Naver, the Company's server verifies the token issued by the provider and receives the member identifier, nickname, profile photo, and email (where consented))
3. Automatic collection through the device's location feature, only for a trip being recorded
4. Automatic generation and collection by software development kits (SDKs) included in the app (Article 9)
5. The store passes the payment result to the Company

Article 3 (Processing Beyond the Purpose of Use)

The Company uses personal information only within the scope of the purposes in Article 1, and if the purpose changes, processes it only with separate consent under Article 18 of the Personal Information Protection Act or within the scope permitted by law. If a feature is introduced that shows users' ratings and one-line reviews to other users, they are provided only in an anonymised, aggregated form from which individuals cannot be identified, and this Policy is revised to announce it.

Article 4 (Provision of Personal Information to Third Parties)

① In principle the Company does not provide users' personal information to third parties, and provides it only in the following cases.

The user's route of travel, Cuts, photos, and impressions are never provided to companions. Place search terms and the map view area are passed to Google Maps Platform through the Company's server, but account information, IP address, and device information are not sent with them, so this is not provision of personal information to a third party; for transparency it is listed in the table in Article 6.

② Where there is a special provision in law, or an investigative agency requests it in accordance with the procedures and methods prescribed by law, the Company may provide information within that scope; the Company verifies the legality of the request, provides the minimum necessary, and records the details.

Article 5 (Outsourcing of Personal Information Processing)

① To provide the Service, the Company outsources personal information processing as follows.

② In its outsourcing contracts the Company stipulates, under Article 26 of the Personal Information Protection Act, the prohibition of processing beyond the outsourced purpose, technical and managerial protective measures, restrictions on sub-outsourcing, management and supervision of the processor, and compensation for damages, and supervises whether the processor handles personal information safely.

③ Where a processor sub-outsources the Company's work, it obtains the Company's consent, and the sub-processor and its work are disclosed in this Policy. The current processors carry out their work using their own cloud infrastructure (Google Cloud, Amazon Web Services).

④ If the content of outsourced work or a processor changes, this Policy is revised without delay to announce it.

⑤ The Apple App Store and Google Play are not processors of the Company but independent businesses that enter into payment contracts directly with users; payment method details are held only by the store and are not passed to the Company. The sign-in services of Kakao, Naver, Google, and Apple are also governed by each company's privacy policy.

Article 6 (Cross-Border Transfer of Personal Information)

① Under Article 28-8 (1) 3 (a) of the Personal Information Protection Act (outsourcing of processing or storage for the formation and performance of a contract with the data subject, where the following matters are disclosed in the privacy policy), the Company outsources processing and storage of personal information abroad as follows. PostHog and Airbridge are outsourced processing needed for operating and improving the Service and for the invitation link feature, and fall under the same subparagraph, but users may refuse at any time.

② How to refuse cross-border transfer, and the effect

• Firebase (authentication, storage, notifications, diagnostics), Gemini, Google Maps Platform, RevenueCat, Mapbox, OpenWeather: these are processing needed for the basic structure of the Service, so to refuse them you must not use the feature concerned (AI features, place search, paid purchases, weather) or withdraw from the Service. Tickets can be entered manually without using AI features, and places can be added by tapping the map directly instead of searching.
• PostHog, Airbridge: turning off the "Send usage statistics and analytics data" switch on the app's My Page stops transmission immediately, with no disadvantage in using the Service.
• Requests to refuse or withdraw may also be made through the contact in Article 13.

③ For cross-border transfers the Company takes the protective measures under Article 28-8 (4) of the Personal Information Protection Act and its Enforcement Decree (concluding outsourcing contracts, encrypted transmission, supervising processors).

Article 7 (Procedure and Method of Destroying Personal Information)

① The Company destroys personal information without delay when the retention period has passed or the purpose of processing has been achieved.

② Procedure: when the user deletes content or deletes their account in the app, the operational data on the Company's servers (account, plans, tickets, photos, Cuts, routes, and push tokens in Firestore and Cloud Storage, and Firebase authentication information) and the local data on the device are deleted immediately, and social sign-in links such as Kakao and Naver are disconnected. The server backup created once a day is destroyed automatically within 7 days at most. The Company requests deletion of the user identifiers stored with processors (PostHog, Airbridge, RevenueCat) when the account is deleted.

③ Method: electronic files are deleted in a way that cannot be recovered, and any printouts are shredded.

④ Information kept under law (the payment and enquiry records in Article 1) is stored separately from other personal information, is not used beyond the purpose of retention, and is destroyed when the period has passed.

⑤ The personal information of users who have not used the Service for 1 year or more is also kept rather than destroyed. This is because long-term storage of travel records is the purpose of the Service, and users may delete it themselves at any time.

Article 8 (Rights of Data Subjects and Legal Representatives and How to Exercise Them)

① Users may exercise the following rights against the Company at any time.

1. Request access to personal information
2. Request correction or deletion where there is an error
3. Request suspension of processing
4. Withdraw consent (advertising notifications, marketing use of content, consent to cross-border transfer, etc.)
5. Refuse, or request an explanation of, a fully automated decision (Article 37-2 of the Personal Information Protection Act). The Service currently has no automated decisions that materially affect users' rights or obligations.

② How to exercise: App → My Page → Account (edit information, delete account) / App → Settings (notifications, analytics data, AI features) / for personal location information, My Page → Location settings (Part 2) / other requests by email to the contact in Article 13. The Company handles requests within 10 days of receipt and informs the user of the result.

③ A user's legal representative or an authorised person may exercise the rights on the user's behalf by submitting a power of attorney.

④ Where a request for access, correction, deletion, or suspension of processing is restricted by law (for example, where another law imposes a retention obligation), the Company informs the user of the reason.

⑤ No disadvantage results from exercising rights. However, requesting deletion or suspension of processing of information needed to provide the Service may make the feature concerned unavailable.

Article 9 (Installation and Operation of Automatic Collection Devices and How to Refuse)

① The Company's app includes the following SDKs; the information each collects automatically and how to refuse are as follows.

② Session replay (screen recording) is not used. The IP address sent to PostHog is set to be discarded immediately on collection.

③ The website (everyticket.kr) and the web planning tool use only the browser storage needed to provide the Service, such as keeping you signed in, and do not use cookies for advertising or tracking. Users may refuse cookies in their browser settings, in which case sign-in may not be kept.

Article 10 (Measures to Ensure the Safety of Personal Information)

The Company takes the following measures in accordance with Article 29 of the Personal Information Protection Act and the Standards for Measures to Ensure the Safety of Personal Information, and Article 16 of the Location Information Act and the Standards for Managerial and Technical Protective Measures for Location Information.

1. Managerial measures: designating a privacy officer and a location information manager, establishing and operating guidelines for handling personal and location information, training staff who handle it, supervising processors
2. Access control: minimising persons with access to the management console (currently 1) and applying two-factor authentication, not issuing service account keys, keeping records of granting, changing, and revoking access rights for 5 years, blocking access from any account other than the user's own through database security rules
3. Access logs: keeping access logs for the database, storage, and management console for 1 year or more and inspecting them regularly
4. Encryption: TLS encryption in transit, encryption of stored data (Google Cloud encryption at rest), protection of device storage
5. Backup and recovery: daily database backup (Seoul region, kept for 7 days)
6. Incident response: a procedure for notifying users within 72 hours of a breach and, where required by law, reporting to the Personal Information Protection Commission or the Korea Internet & Security Agency (Article 15)

Article 11 (Other People's Information in Photos, Videos, and Audio)

① Ticket photos and Cuts a user registers may contain other people's information such as companions' names, booking numbers, faces, and voices. The Company processes such information only as part of the content the user registered, within the scope of providing the Service (storage, display, output creation), and does not separately extract or store it or use it for marketing.

② AI autofill is designed to extract only nine fields: whether it is a ticket, type, title, place, date, end date, origin, destination, and seat. It is instructed not to extract booking numbers, barcodes, or personal identification numbers, and the server filters them out once more.

③ Users are advised to mask other people's information before registering a photo, and must obtain that person's consent when sharing another person's information externally.

④ A person who believes their information is contained in another user's content may request deletion through the contact in Article 13, and may request notice of the source of collection and the purpose of processing under Article 20 of the Personal Information Protection Act.

Article 12 (Use of Generative AI)

The Service's AI draft and ticket information extraction features use a generative artificial intelligence model (Gemini) of Google LLC. The information processed, the transmission path, retention, and the user's choices are set out in detail in Appendix 1. The Company announces this once more on an app screen when an AI feature is first run, and labels outputs made by AI as "AI generated".

Article 13 (Privacy Officer and Contact for Access Requests)

As a small business, the Company's Chief Executive Officer also serves as privacy officer. Users may direct enquiries, complaints, and requests for remedy concerning personal information arising from use of the Service to the contact above, and the Company responds and handles them without delay.

Article 14 (Remedies for Infringement of Rights)

Users may contact the following bodies for remedy or advice concerning personal information infringement.

• Personal Information Dispute Mediation Committee: 1833-6972, kopico.go.kr
• Personal Information Infringement Report Center (Korea Internet & Security Agency): 118 without area code, privacy.kisa.or.kr
• Supreme Prosecutors' Office Cyber Investigation Division: 1301 without area code, spo.go.kr
• Korean National Police Agency Cyber Bureau: 182 without area code, ecrm.police.go.kr
• Location information disputes: application for adjudication by the Korea Communications Commission (02-2110-1300, kcc.go.kr)

A person who objects to the Company's disposition of a request for access, correction, deletion, or suspension of processing under Articles 35, 36, and 37 of the Personal Information Protection Act may file an administrative appeal under the Administrative Appeals Act (Central Administrative Appeals Commission 110, simpan.go.kr).

Article 15 (Notification of Personal Information Breaches)

If the Company becomes aware of the loss, theft, leakage, forgery, alteration, or damage of personal information (a "breach"), it notifies users within 72 hours, in accordance with Article 34 of the Personal Information Protection Act, of the items, time, and circumstances of the breach, what users can do, the Company's response, and a contact point, and where required by law reports to the Personal Information Protection Commission or the Korea Internet & Security Agency.

Article 16 (Changes to and Notice of the Policy)

① When this Policy is revised, the revised content and reasons are posted in the app notices and on the website from 7 days before the effective date. Matters requiring consent under law are consented to again.

② Where this Policy and the Terms of Service differ, whichever is more favourable to the user applies.

③ Previous editions can be viewed in the revision history on the website.

Part 2 Personal Location Information Processing Policy

This Part is the personal location information processing policy under Article 21-2 of the Location Information Act and Article 25-2 of its Enforcement Decree. The Company is a location-based service provider reported to the Korea Communications Commission (No. 12279, 8 September 2026), and the conditions for collecting and using personal location information follow the "Every Ticket Location-Based Service Terms".

Article 1 (Purpose of Processing and Retention Period of Personal Location Information)

① Purposes of processing

② Purpose and period of retention: the Company retains personal location information so that the user can keep, view, and replay the route the user recorded and create outputs from it, and the retention period lasts until the user deletes the trip, withdraws from the Service, or withdraws consent. At that point the purpose of retention is deemed achieved and the information is destroyed without delay.

③ Location is not collected when recording is not in progress, and personal location information is not used for advertising, marketing, or sales purposes.

④ Storage location: the user's own account area in the Seoul region (asia-northeast3) of Google Cloud Firebase leased by the Company. It can be viewed only from the user's own account and is not visible to other users, and the Company's access is restricted under the protective measures in Article 9.

Article 2 (Basis and Period of Retention of Records Confirming Collection, Use, and Provision of Location Information)

① In accordance with Article 16 (2) of the Location Information Act, the Company automatically records and keeps in its location information system materials that confirm the collection, use, and provision of personal location information (confirmation records). Confirmation records do not include coordinates.

② Items: start and end time of collection for each trip, method of collection (device location feature), consent version and consent time, date and time, purpose, and trip concerned for each use, any provision to third parties (where applicable), and the user's exercise of rights.

③ Basis for retention: Article 16 (2) of the Location Information Act. Retention period: 6 months from the date of the record. Records are destroyed automatically when the period has passed, and if the user withdraws consent or withdraws from the Service, that user's confirmation records are destroyed without delay regardless of the period.

Article 3 (Procedure and Method of Destroying Personal Location Information)

① When destroyed: when the user deletes the trip or route; when the user withdraws (including withdrawal of consent, with confirmation records destroyed together); when the user withdraws consent (including confirmation records); when use by a person under 14 is found.

② Method: operational data in cloud storage is deleted immediately, and the backup created once a day is destroyed automatically within 7 days at most. Copies on the user's device are deleted when the app is deleted or the user signs out. Outputs the user has already exported are not subject to destruction.

③ Confirmation records are destroyed automatically when the retention period in Article 2 has passed.

Article 4 (Provision of Personal Location Information to Third Parties)

① The Company does not provide personal location information to third parties. What companions in a shared plan can see is the place, itinerary, and ticket information the user has directly entered or registered in the plan; the user's route of travel and the locations of Cuts are not provided to anyone, including companions.

② The Company outsources processing to Google LLC to store personal location information in Google Cloud Firebase (Seoul region), and to Mapbox, Inc. (United States) for the map view area coordinates in order to display the map during recording (Part 1, Articles 5 and 6). This is outsourced processing, not provision to a third party, and Mapbox telemetry (separate transmission of the user's location) is turned off.

③ Should the Company in future launch a service that provides personal location information to a third party designated by the user, it informs the user of the recipient and the purpose, obtains separate consent, and revises this Policy to disclose it.

Article 5 (Notification on Provision to Third Parties)

Where the Company provides personal location information to a third party designated by the user under Article 4 ③, it notifies the user each time, immediately, of the recipient, the date and time, and the purpose of provision, on the device from which the personal location information was collected, in accordance with Article 19 (3) of the Location Information Act. With separate consent, the user may choose to receive notifications in batches, within a maximum of 30 days, by number (10, 20, or 30 times) or by period (10, 20, or 30 days), and may return to immediate notification at any time.

Article 6 (Rights and Obligations of Guardians of Children Aged 8 or Under, etc., and How to Exercise Them)

① Where the guardian of a child aged 8 or under, a person under adult guardianship, or a person with a severe mental disability under the Act on Welfare of Persons with Disabilities (limited to registered persons with disabilities) consents to the collection, use, or provision of that person's personal location information to protect that person's life or body, the person is deemed to have consented.

② The guardian submits to the contact in Article 8 a signed written consent form stating the name, address, and date of birth of the child aged 8 or under, etc., the name, address, and contact details of the guardian, and that the purpose is limited to protecting life or body, together with a document proving guardianship.

③ The guardian may exercise the rights in Article 7 regarding the personal location information of the child aged 8 or under, etc., and must use that personal location information only to protect the life or body of the child, etc., giving priority to the child's interests.

④ The Company does not collect the personal location information of children under 14, and should it intend to do so in future, obtains and confirms the consent of the legal representative under Article 25 of the Location Information Act.

Article 7 (Rights of Subjects of Personal Location Information and How to Exercise Them)

Turning off the location permission in the device operating system technically prevents location collection but is separate from the withdrawal of consent above; to have already-collected personal location information destroyed, please use withdrawal of consent or deletion.

Article 8 (Location Information Manager)

Article 9 (Protective Measures for Location Information)

In accordance with Article 16 (1) of the Location Information Act and the Standards for Managerial and Technical Protective Measures for Location Information, the Company establishes guidelines for handling and managing location information, minimises persons with access (currently 1) and applies two-factor authentication, keeps access-right records for 5 years, encrypts data in transit and at rest, blocks access by anyone other than the user through database security rules, keeps access logs for the location information system for 1 year, and automatically records and retains confirmation records (see Part 1, Article 10).

Appendix 1. Details of Generative AI Processing

Appendix 2. Revision History

Previous edition: View the 2026-09-10 Privacy Policy