Privacy Notice

Version: privacy-2026-09-27-v4

Who is responsible

SER Group Co., Ltd. / (주)세르그룹 operates Cool Creator and determines how application information is used. Privacy enquiries and complaints are handled by SER Group Co., Ltd. — Privacy enquiries, at contact@coolcreator.page. This describes the company’s handling function, not a separately staffed department.

Sign-in and account information

For Google sign-in, we request basic identity, profile and email information. We verify Google’s identity token and keep its account identifier and supplied name, our account identifier, and a masked email hint so you can recognize the connected method. We discard the full email address from the application sign-in flow rather than retaining it in the account database. The provider identifier, not email matching, associates your identity with your account. We do not request Gmail, Drive, Calendar, contacts or offline access, store your Google password, or retain Google access or refresh tokens. Phantom verifies wallet ownership through a signed message, not a transaction or permission to move funds; we retain the wallet address as its sign-in identifier. Authentication providers handle their services under their own policies.

Optional email and password sign-in

If you choose email sign-in, we retain your normalized email address and a salted password hash to authenticate you and send verification and password-reset messages. We do not store your password in plain text. Resend receives the recipient address and account-email content to deliver these messages and processes delivery information under its privacy policy (https://resend.com/legal/privacy-policy). The configured sending region is Tokyo; this does not guarantee that all processing stays in Japan. Verification and reset links expire after 30 minutes and work once. We store their hashes and pending email details until use or expiry cleanup. Short-lived hashed address and network-address counters limit abuse and expire within one hour. Expired records are removed by scheduled cleanup or subsequent authentication requests. Email credentials are deleted when the account is removed. Password reset invalidates existing sessions. Email sign-in is optional; other available sign-in methods remain available.

Optional username sign-in

If you use temporary username and password sign-in, we keep your private login username and a salted password hash to authenticate you. We do not store your password in plain text or publish your login username. No email address is required and password reset is not available for this method. We keep short-lived hashed username and network-address buckets with attempt counts to limit abuse; these expire within one hour. Credentials are deleted when your account is removed.

Sessions and cookies

We retain hashed session tokens to keep you signed in. Sessions expire after 30 days or end sooner when you sign out. Short-lived sign-in challenges expire after five minutes. Expired records are removed by scheduled cleanup. Session cookies support authentication; the current app does not add optional advertising cookies.

Your choices and activity

We store your chosen nickname, connected sign-in methods, following and account-linked activity needed for achievements and discovery. If you activate curator features, we store your profile, images, collections, products, links and publishing choices. Published curator content is visible to others and can be copied or indexed outside our control. Member account details, following lists and achievements remain private. Curators see follower counts rather than an identifying list of followers.

Optional partnership finder

If you choose to use personal partnership matching, we send the content topic and product preferences you enter, together with relevant entries from our public program directory, to TypeSafe AI for relevance assessment. We do not send your account identifiers, email, private profile, or browsing history. Audience-market and category filtering happens in our application. Do not include sensitive information in your answers. We do not save the questionnaire answers in our database; we keep an account-linked request count and timestamps to limit usage, removed when your account is deleted. TypeSafe processes requests under its applicable terms and privacy policy (https://typesafe.ai/legal/privacy-policy). You can continue browsing the directory without using personal matching.

Statistics and network information

Curator statistics count page views and outgoing link activations using target IDs, event type, UTC day and random event receipts. Those statistics do not store visitor identity, IP address or a persistent visitor identifier. Counts are not confirmed unique visitors, purchases or earnings. Statistics cover 30 UTC calendar days; old event rows are removed when the next accepted event is recorded. Cloudflare processes network information needed to deliver and secure requests. External product images and linked websites may also involve requests to their providers.

Agreements and age affirmation

When you explicitly agree, we record your account identifier, exact agreement and notice versions, text, hashes, acceptance time and your affirmation that you are at least 18. We do not collect a date of birth or claim to verify your age. Acknowledging this notice is not consent to unrelated advertising or optional processing. Curator agreement acceptance is separate. Updating a document never rewrites an earlier acceptance.

Support, providers and international processing

When you contact us, we receive your sender address, message and information you choose to include. Cloudflare Email Routing forwards the message to the operator’s Google inbox. Cloudflare provides application hosting, database and incoming-mail forwarding. Google provides sign-in and the support destination inbox. These services operate internationally; the current database configuration reports APAC without a country-level jurisdiction restriction. We do not promise storage solely in Korea. Cloudflare and Google may process information in countries where they or their service providers operate, using their applicable contractual and certification safeguards. Declining provider processing means the affected sign-in, support or application service cannot be provided. Contact us to ask about the current arrangements or exercise an applicable objection right. We do not sell Google account data or use it for advertising.

Retention and removal

We keep active account information to provide the account until it is removed, subject to a specifically applicable legal retention requirement. New incomplete registrations become eligible for cleanup after 30 days without agreement acceptance or member/curator content. Support-verification codes expire after seven days. Full verified account removal deletes connected identities, sessions, preferences, following, curator content, products, activity, achievements and agreement records from the live database. Hiding or deleting only a curator page has narrower effects.

Backups and support correspondence

Cloudflare’s configured database recovery window is seven days. Manual database backups are retained for no more than 30 days from creation. Support correspondence is removed within 90 days after the request is resolved unless a specific legal obligation requires identified information to be kept for an identified period. This is an operator procedure, not an automatic Gmail deletion feature. Removed account IDs and request references remain in a restricted restoration record only to prevent an old copy from reviving the removed account. Restored databases stay offline until removals and expired-signup cleanup are reapplied. Provider recovery copies may not be physically erased immediately.

Your rights and notice changes

Contact contact@coolcreator.page to request access, correction, deletion or restriction, ask about processing, or raise a privacy concern. Applicable rights and complaint routes depend on the rules that protect you; nothing in this notice removes mandatory rights. If you cannot sign in, support will discuss a proportionate alternative ownership check. We publish a new notice when practices change and request separate consent where legally required. Earlier use or a notice acknowledgement is not consent to a new unrelated purpose.