AILotto (Sera Trading) Privacy Policy

1. Information we collect and legal bases

We collect and use the following personal information. Legal bases under PIPA Article 15 are as follows.

2. Why we use it

1. Service delivery: Account identification; generative AI-based lottery analysis and recommendations; history; personalization
2. Billing: Subscriptions, credits, refunds
3. Improvement: Product analytics and quality (we do not use your inputs to train our own AI models — see section 6.3)
4. Support: Responding to inquiries and resolving disputes
5. Marketing (optional): Sending promotional information only to users who opted in
6. Legal compliance: Records required under Korean law

3. Retention

We delete personal information when it is no longer needed, unless retention is required under Korean law.

4. Deletion

1. Process: When retention ends or you delete your account, we remove or anonymize data per internal policy.
2. Method: Electronic records are securely erased; paper records are destroyed when applicable.

5. Sharing with third parties

We do not sell personal information. We do not sell or provide your prompts, dream text, or birth-chart inputs for third-party AI model training. We share data only with your consent, to operate the Service (as processors under section 6), or when required by law.

1. Processors listed below (hosting, payments, AI providers as needed for your request)
2. Law enforcement when legally compelled

We do not continuously make additional uses or disclosures under PIPA Arts. 15(3) / 17(4) for generative AI model training.

6. Processors

We use trusted vendors who process data on our instructions:

6.2 Overseas transfer

Under PIPA Article 28-8(1)(3) (entrustment/storage necessary to conclude or perform a contract with you) and Article 28-8(2), we transfer personal information overseas as follows. How to object and the effect of objection are in the table; objecting may limit some or all of the Service.

Onward transfers by processors may follow their sub-processor policies; we require appropriate safeguards under our contracts and applicable law. Questions: privacy contact in section 10 ([email protected]).

6.3 Generative AI processing

1. Analysis and recommendations are produced by generative AI and are reference information only.
2. Dream text, date/time of birth, combo constraints, and analysis requests may be sent to AI provider APIs to generate the results you request.
3. We do not use those inputs or outputs to train or fine-tune our own AI models, and we do not sell or provide them for third-party general model training.
4. Short-term API logging by providers may follow each provider’s enterprise or paid-API terms; we entrust processing only as needed for the Service.
5. Analysis history is available in My Page where applicable and is deleted when you close your account (except where law requires retention).

6.4 Pseudonymised information

We do not currently process pseudonymised information. If we do in the future, we will disclose purpose, items, and retention in this Policy.

6.5 Domestic agent

We are a personal information controller with an address/place of business in the Republic of Korea and are not required to appoint a domestic agent under PIPA.

7. Your rights

1. You may request:
   • Access to your personal information
   • Correction of inaccurate data
   • Deletion
   • Suspension of processing
   • Withdrawal of consent to collection, use, or provision
2. Contact us via My Page (account deletion), marketing settings, or [email protected]. We respond without undue delay.
3. Legal representatives of children under 14 may exercise these rights on the child’s behalf. We do not process children’s personal information (see section 7.2).
4. We do not currently operate a separate system for the statutory data portability (transmission) right. For access or copies, contact us as above; we will assist within law and technical feasibility.

7.2 Children under 14

We do not collect or use personal information of children under 14. Under our Terms, users under the lottery purchase age (19 in Korea) may not use the Service.

7.3 Sensitive and unique identifiers

We do not intentionally collect sensitive information or unique identifiers. Free-text fields (e.g. dream analysis) may contain sensitive content you choose to enter; we do not require it and do not process it as a separate sensitive-data product purpose.

7.4 Automated decisions

We do not make fully automated decisions that significantly affect your rights or obligations under PIPA Article 37-2. AI analysis is reference information; final choices (including purchases) remain yours.

8. Security

Under PIPA Article 29 and related standards, we apply measures including:

• Encryption in transit (SSL/TLS)
• Cloudflare WAF and DDoS protection
• Access controls and least-privilege administration for systems processing personal information
• Web server access log retention (section 3 — up to about 14 days) and infrastructure/application operational logs
• Staff training and limited access to personal data

We do not currently operate a separate personal-information-system audit-log platform. Web and infrastructure access/request logs are retained for the period in section 3. If we introduce dedicated audit logging, we will disclose retention and methods in this Policy.

8.2 Video surveillance devices

We do not install or operate fixed or mobile video surveillance devices (e.g. CCTV).

9. Cookies and personalized ads

1. We use cookies for session management, locale preferences, and analytics (PostHog, Google Analytics, Microsoft Clarity).
2. You can control cookies in your browser; blocking essential cookies may limit sign-in or checkout.
3. To show ads to free users, third-party ad providers may collect behavioral data such as cookies and ad identifiers:

Behavioral data is used to serve ads; we do not share identifiable personal information such as your name or email with ad providers. Ads are not shown while you have an active paid subscription or weekly pass.

10. Privacy contact

For privacy questions or complaints, contact:

• Personal Information Dispute Mediation Committee / KISA: privacy.kisa.or.kr / 118
• Personal Information Dispute Mediation Committee: www.kopico.go.kr / 1833-6972
• Supreme Prosecutors’ Office cyber unit: spo.go.kr / 1301
• National Police Agency cyber bureau: ecrm.police.go.kr / 182

You may also contact:

11. Marketing communications

1. We send promotional emails only to users who have opted in to marketing communications.
2. Marketing consent is optional. Declining or withdrawing consent does not restrict your use of the Service.
3. When sending advertising, we comply with the Network Act, including:
   • Labeling the email subject with "(광고)" (advertisement)
   • Including clear unsubscribe instructions in the body
   • Not sending advertising during night hours, from 9 PM to 8 AM (KST)
4. You may withdraw consent at any time via My Page or the "Unsubscribe" link in marketing emails; sending stops immediately upon withdrawal.

12. Changes

We may update this Policy. Material changes will be announced at least 7 days before they take effect via the Service. Factual corrections (e.g. processor name or transfer country) may be applied without delay.