Privacy Policy

Kinis Service (the "Company") processes personal data for the following purposes.

• Membership registration, identification of the individual, and prevention of fraudulent use
• Processing payments and refunds for paid services
• Running the web store and handling orders and delivery
• Responding to enquiries and resolving disputes
• Meeting obligations under applicable law

At the registration screen the User confirms being 14 years of age or older and consents to the collection and use of personal data; registration does not proceed without that consent. The Company does not collect personal data from children under 14.

• At registration (required): Discord user ID, Discord username, and the verified email address of the Discord account (plus the Google account email where a Google account has optionally been linked)
• At payment (required): payment amount and time, payment method, payment code. When a refund is requested, the bank name, account number and account holder name for the refund
• Collected automatically during use: access IP, browser information, access time, Discord server ID, and web panel activity records (who changed which setting and when)
• When visiting the Service (whether or not signed in): device characteristic values calculated by the browser together with sound device settings (playback quality, number of output channels and the like), plus the time and number of visits and the access IP. These are computed entirely inside the browser without playing any sound and are stored as a hash rather than the original values, so they contain no name, contact details or similar information in themselves. They are used for ① showing the seller their own list of signed-in devices, ② preventing fraudulent use such as return visits by restricted users or multiple accounts, ③ counting visitors per shop, and ④ limiting repeated enquiry submissions. They are not used for advertising, behavioural profiling or any other purpose, and are not provided to third parties. Where a buyer is signed in to a shop, the value is retained in association with that account. A seller's login device record is deleted on logout; visit records are deleted after the period given in section 3 below.
• When using the enquiry form: the content of the enquiry, the email address for a reply, access IP, and a random identifier stored in the browser (used only to prevent repeated submissions; it does not by itself identify an individual)
• When using the AI assistant: the question entered by the User and part of the immediately preceding conversation, and the access IP. Questions are forwarded to the AI providers listed in section 5 below in order to generate an answer, and the conversation is not stored on the Company's servers (only whether an answer was produced and its length are recorded).
• Entered by the User: Discord bot token (stored encrypted), product information, and payment details such as receiving bank accounts and crypto addresses
• Where identity verification is used: name, date of birth, mobile carrier, mobile phone number, and the time verification succeeded
• Buyers: Discord account information, per-shop balance and purchase/top-up history, and, where a buyer who has blocked Discord DMs has verified an email address in order to receive goods or restock alerts by email, that email address
• When ordering courier-shipped goods: recipient name, contact number and address (for international delivery this includes country, romanised address and postal code; stored encrypted), and the waybill number
• Where an automatic top-up app is linked: the deposit details forwarded by that device (sender name, amount), the device identifier and the time it was linked. The original text of the banking app notification is never sent to our servers; only the values needed to confirm a deposit are extracted and forwarded.

• Records of contracts and withdrawal of subscription: 5 years (Act on Consumer Protection in Electronic Commerce)
• Records of payment and supply of goods: 5 years
• Records of consumer complaints and disputes: 3 years
• Access logs: 3 months (Protection of Communications Secrets Act)
• Visitor device records (the device characteristic values and visit history in section 2): 180 days

The Company does not provide Users' personal data to outside parties, except in the following cases.

• Where the User has given prior consent
• Where there is a lawful request under legislation or from an investigative authority

To the extent needed to provide the Service, the Company entrusts the processing of personal data as follows.

• Discord, Inc. — Discord account login, bot operation, delivery of goods to buyers
• Google LLC — optional Google account login
• PayPal Pte. Ltd. — payment processing for overseas users (card and account details are not stored on the Company's servers)
• Paddle.com Market Ltd — card payment and recurring subscription billing (card details are not stored on the Company's servers)
• NICE Information Service Co., Ltd. — mobile carrier identity verification
• Resend, Inc. — sending payment, subscription and enquiry notices, and delivering goods by email
• NAVER Corporation — fallback delivery route when the above email sending is unavailable
• Cloudflare, Inc. — providing the access route to the Service and protecting traffic
• vpnapi.io, proxycheck.io, IPHub — checking at login whether the connection is via VPN/proxy or mobile carrier data (only where the seller has enabled the relevant feature)
• Groq, Inc. · OpenRouter, Inc. · SambaNova Systems, Inc. · Mistral AI SAS · Cerebras Systems, Inc. · Cloudflare, Inc. — generating AI assistant answers and automatically screening text posted in shops. The question entered into the assistant and part of the immediately preceding conversation are forwarded to generate an answer; the Company does not store that conversation.
• MEGA Limited — storage of service data backups

Any change of processor will be announced through this Policy.

Where a User links a smartphone in order to automate deposit confirmation, that device reads only the notifications from the banking apps the User has permitted.

• The original notification text is never sent to our servers. Only the values needed to confirm a deposit (sender name, amount) are extracted and forwarded.
• The device credentials used for linking are kept in secure storage on the device, and transmissions are signed to prevent forgery.
• A User may unlink at any time from the web panel or the app; forwarding from that device stops immediately.

• Requesting access to, correction of, or deletion of personal data
• Requesting suspension of processing
• Withdrawing membership (all personal data is deleted, except data the Company is required by law to retain)

• Sensitive values such as bot tokens and delivery addresses: stored under symmetric-key encryption
• Access control for the web panel, two-factor authentication (TOTP) and management of signed-in devices
• Separate databases per shop — one shop cannot reach another shop's buyer data
• Retention of web panel activity records (so it can be traced who changed what)
• Logging of admin console access IPs and detection of abnormal access

The Company uses essential cookies to maintain login sessions and to prevent CSRF.

• Data protection officer: the operator of Kinis Service
• Contact: the [Contact] page on this site

This Privacy Policy may be revised in line with changes in law or service policy; any change is announced at least 7 days before it takes effect.

This Policy was written in Korean. This English text is a reference translation provided for convenience. If there is any difference or dispute in interpretation between the two, the Korean version prevails.