Privacy policy
Effective October 20, 2026
HAUTEN (the “Company”) operates the stamp tour service STAMPY and handles users’ personal information as described below.
STAMPY visitors do not sign up. Taking part asks for no name, email address, or phone number, and a random identifier that tells us whose stamps are whose is kept on your device. Winners’ shipping details and the email address given in an inquiry are collected as listed below. The list below is what remains after we cut collection to the minimum.
1. What we process and why
Visitors (people taking part in a stamp tour through the app or web)
| Item | Purpose | When |
|---|---|---|
| Visitor identifier (a randomly generated value) | To decide whose stamps are whose | When you first join an event or first check in at a venue (or earlier, if you first link an account, send an inquiry, or agree to location checks) |
| Participation and visit history (which event, which place, when, by which method, whether you answered the event’s survey, and what you received as a perk and when) | Awarding stamps, judging completion, checking whether perks were received and survey conditions were met, and producing aggregate figures for partners | While you collect stamps |
| Location consent record (which version of the location service terms you agreed to, when you agreed, and when you withdrew) | To use coordinates only from visitors who agreed, and to prove when consent was given and withdrawn | When you first agree to location checks and when you withdraw |
| The identifier a provider gives us when you link an account (Apple, Google, Kakao, LINE) | So you can recover what you collected after changing devices or reinstalling | When you choose to link |
| Apple’s link-revocation token | So that unlinking also revokes the link on Apple’s side | When you link with Apple |
| Entry record for a prize draw (the fact that you entered; in events where the partner requires a link to enter, a transformed value of the link identifier, which lets us recognize the entry if the same account is linked again) | Running the draw and checking that each person enters once | When you press Enter |
| Winners’ shipping details (name, phone number, address) | So the partner (event organizer) can ship the prize | When a visitor drawn as a winner enters them in the app or on the web |
| Push notification address (the device’s registration token) and app language | To send notices such as winning a draw, a shipped prize, or a new notice from an event you joined | When you allow notifications for the app |
| Notification delivery records (which device was sent what, when, and whether it was accepted) | To answer inquiries about notifications that did not arrive | When a notification is sent |
| Link and app handoff attempt records (visitor identifier, the provider chosen or the event handed over from the web, outcome, time) | To stop the same link or handoff code from being used twice | When you link an account or hand over from the web to the app |
Linking stores one identifier only. We ask Apple, Kakao, and LINE for the identifier alone. Google has no way to ask for the identifier alone, so when you link with Google, your name, email address, profile photo, and language setting arrive along with the identifier. We store the identifier and none of the rest.
We send no promotional notifications. Notifications are only notices such as winning a draw, a shipped prize, or a new notice from an event you joined, and are sent on the device’s notification permission alone.
Entering a prize draw collects nothing. Shipping details are collected only from winners after the draw (Korea’s Personal Information Protection Commission guideline on online prize events). They are needed to perform the prize contract between the winner and the partner, so no separate consent is asked, but the screen where you enter them states what they are used for and how long they are kept.
Address search sends only the search words. When a winner searches for an address while entering shipping details, our server sends only the search words to the road-name address search of Korea’s Ministry of the Interior and Safety (Address-based Industry Support Service) and receives candidate addresses. We do not send the visitor identifier, name, phone number, or the visitor’s IP address, and we do not store the search words.
Survey answers are kept so that no one can tell whose they are. When a partner turns on a survey for an event, visitors pick options such as age group, gender, or satisfaction before receiving a perk or after completing the tour. The chosen answers are stored separately, without the visitor identifier and without the time of answering; the participation history only records that you answered and when. Partners see only how many people chose what, and not even that until five people have answered. Surveys have no free-text questions.
Partners and staff (people using the console or the app’s staff mode)
| Item | Purpose |
|---|---|
| Email address | Account identification, invitations and sign-in, operational contact |
| Password (stored only as a one-way hash) | Sign-in |
| Staff approval history (who confirmed which visit and who handed over which perk) | Record of on-site confirmations and perk handovers |
| Access records: account, time of access, IP address, what was done (the feature and target requested), and the result | Kept under Article 8 of the Personal Information Protection Commission’s Standards on Measures to Ensure the Safety of Personal Information, to respond to misuse and leaks of personal information |
People who send an inquiry
| Item | Purpose | When |
|---|---|---|
| Website inquiries: organization, name, email, phone (optional), the type of inquiry and planned timing, expected number of places, the message, attached files | To reply and continue the conversation. The email address is used to notify you of a reply and to send the conversation link | When you submit the contact form on the website and when you write in the conversation |
| App inquiries: the message, email (optional), app version and device type, app language, visitor identifier, events you are taking part in | To reply and continue the conversation inside the app. The app version and device type are used to find the problem | When you send an inquiry from the app |
| Console inquiries: the message, attached files, the console account (email) that sent it and its event, console language | To reply and continue the conversation inside the console. The email address is used to notify you of a reply | When you send an inquiry from the console and when you write in the conversation |
Conversations for inquiries continue on the website, in the app, and in the console, not by email. Email and push notifications only tell you that a reply has been posted.
Location
For events that use the location condition, we use the coordinates sent by your device only to compute the distance to the place, and we do not store them. As required by Article 21-2 of Korea’s Location Information Act, the following is stated in this policy; consent and how to exercise your rights are governed separately by the Location service terms.
| Purpose and retention of personal location information | Confirming a visit to a place (computing the distance to it). Discarded as soon as the distance is computed; no retention period |
| Basis and retention of the records of location use | Article 16(2) of the same Act. We record the visitor identifier, place, time, and outcome, without coordinates, and keep them for 6 months |
| How personal location information is destroyed | Without delay once the period ends, and without delay when consent is withdrawn or you press “Delete all my records”, using a method that cannot be reversed |
| Disclosure of personal location information to third parties | None |
| Guardians of a child aged 8 or under, etc. | We do not accept a guardian’s consent under Article 26 of the Location Information Act: this service confirms visits to places and does not protect anyone’s life or body. Children under 14 cannot consent to location confirmation and confirm their visits by other methods (Location service terms, Article 8) |
| Location information officer | Taehun Yun (Representative, HAUTEN) |
| Contact | support@stampy.site, +82-70-8027-1500 |
Records created automatically
The server logs the path, outcome, and time of each request; logs are deleted after 14 days. Session tokens, passwords, and authentication keys are never logged. We do not keep visitors’ IP addresses. For partners and staff signed in to the console or staff mode, we keep separate access records as described under Partners and staff.
If the app stops or hits an error it cannot handle, it keeps an error report on the device and sends it the next time the app is opened. When there is no error, it sends nothing. The report contains where in the code the error happened and the error message, the state of the app at that moment (such as whether it was on screen and the screen orientation), the app version, device information such as the model, OS version, CPU type, memory and storage size, and whether the device is jailbroken or rooted, and random identifiers created to group reports (two per installation and one each time the app is newly opened). It contains no visitor identifier, no link identifier, and nothing you typed, and it does not record what you viewed or tapped. We use it only to find and fix errors.
2. Retention
| What | How long |
|---|---|
| Visitors’ participation and visit history | 3 years from the day the event ends |
| Visitors’ link identifiers | Until the visitor unlinks |
| Visitors’ location consent records | 6 months from the day consent is withdrawn. Until then, for as long as the consent stands |
| Prize draw entry records | Same as visit history (3 years from the day the event ends) |
| Winners’ shipping details | 30 days from the day the partner marks the prize as shipped. If it is never shipped, 30 days from the later of the event’s end and the address deadline |
| Push notification address | Until a delivery confirms the address is dead, or you press “Delete all my records” |
| Notification delivery records | 90 days from the day the record is made |
| Link and app handoff attempt records | 30 days from the day the record is made |
| Partner accounts | 3 years from the day the event ends |
| Staff accounts | 3 years from the day the last event they were assigned to ends. A staff account is deleted as soon as the staff member deletes it in the app |
| Website consultations that led to a contract | 5 years from the day that contract ends |
| Other website consultations and app inquiry conversations | 1 year from the last message. App inquiries are deleted when the visitor presses “Delete all my records” |
| Console inquiry conversations | Same as console accounts: 3 years from the day the event ends |
| Server logs | 14 days |
| Partner and staff access records | 400 days from the day each record is made |
| App error reports | 90 days from receipt |
When the period ends or the purpose is fulfilled, we destroy the data without delay. Where another law requires retention, we keep the data for that period and then destroy it. Statistics such as how many consultations and inquiries arrived and of what kind are kept only after they can no longer be linked to anyone.
3. Disclosure to third parties
The Company does not disclose users’ personal information to third parties.
Partners (event organizers) see aggregate figures and the visit history for their own event in the console. These are counts (participants, stamps awarded, entries, how many people chose each survey option) and a history of what was scanned at each place and when, not information that identifies an individual. The visit history does not say who scanned.
The one exception is winners’ shipping details. The name, phone number, and address entered by a visitor drawn as a winner are shown in the console to that event’s partner so they can ship the prize. This information belongs to the partner, who holds the prize contract with the winner; the Company collects, stores, and deletes it on the partner’s behalf (the partner is the controller and the Company the processor). The partner uses it only to ship the prize and neither uses it for any other purpose nor passes it on.
4. Processors
| Processor | Task | Location |
|---|---|---|
| Amazon Web Services | Running the servers and database, storing files, sending email | Republic of Korea (Seoul) |
| Google LLC (Firebase Cloud Messaging) | Delivering push notifications to Android and iPhone devices | United States |
| Apple Inc. (Apple Push Notification service) | Delivering push notifications to iPhone devices | United States |
| Google LLC (Firebase Crashlytics) | Collecting and storing app error reports | United States and other countries where Google has data centers |
Push notifications are transferred abroad. When a notification is sent, the push notification address and the notification’s title and body pass through servers of Google LLC and Apple Inc. in the United States on their way to your device. They are used only for delivery and deleted once delivered (undelivered notifications are held for up to 4 weeks by Google and up to 30 days by Apple, then deleted). To refuse the transfer, turn off notifications for STAMPY in your device settings; you will then receive no notifications.
App error reports are also transferred abroad. When the app stops or hits an error, the error report described in section 1 goes over the internet to servers of Google LLC (in the United States and other countries where Google has data centers) the next time the app is opened. We use it only to find and fix errors, and it is deleted 90 days after receipt. To refuse the transfer, take part through the web instead of the app; the web sends no error reports. Card check-ins at some places and staff mode work only in the app.
Both transfers are part of the processing we entrust to these companies to perform our contract with you, and under Article 28-8(1)(3) of Korea’s Personal Information Protection Act, disclosure in this policy takes the place of separate consent. The recipients can be reached through Google LLC’s privacy contact form and Apple Inc.’s privacy contact page.
Winners’ shipping details go the other way: the Company processes them on the partner’s behalf, as section 3 explains.
Personal information is stored on servers in the Republic of Korea. The Company is a Korean business, and personal information is handled under the protection of Korea’s Personal Information Protection Act. Data of users outside Korea is stored on the same servers.
5. External services your device talks to directly
The following are not disclosures by the Company; your device (app or browser) communicates with these services directly. Their handling is governed by the respective operator’s policy.
- Google Maps: when drawing the map screen
- Apple, Google, Kakao, LINE: when you choose a quick link
- Apple, Google (Firebase): when the app obtains a push notification address
A link starts with your device talking to the provider directly, but our server also checks the link with the provider and, when you unlink, asks Apple, Kakao, and LINE to revoke it. What we send then is only the identifier and tokens the provider gave.
6. How we destroy data
Personal information whose retention period has ended or whose purpose has been fulfilled is destroyed without delay. Electronic files are deleted in a way that cannot be recovered; any printed copies are shredded or incinerated.
7. Your rights and how to exercise them
You may at any time request access to, correction of, deletion of, or suspension of processing of your personal information.
- Visitors: Press “Delete all my records” at the bottom of Settings in the app, or at the bottom of the event info on the web. Every linked account is unlinked, the visitor identifier on your device or browser is erased, the push notification address and your app inquiries go with it, and your consent to location checks is withdrawn. From then on, that visit history can no longer be attributed to anyone, and it is destroyed once the retention period above ends. App error reports are not tied to the visitor identifier, so they cannot be attributed to anyone, and they are deleted 90 days after receipt. If you can use neither the app nor the web, use Account deletion request. Shipping details you entered as a winner are used by the partner to ship the prize and deleted within the period in section 2; to delete them sooner, contact us at the address below.
- Staff: Press “Delete account” at the bottom of staff mode in the app. Your email and password, your login on every device, and your assignments to events are deleted immediately. Records of the visits you verified and the perks you handed over remain for the period in section 2, attributable to no one, and the access records also remain for the period in section 2. If you cannot use the app, use Account deletion request.
- Partners: Contact us at the address below.
We do not separately collect personal information from children under 14. We do not verify a user’s age. An event’s survey may ask for an age group, but that answer is kept so that no one can tell whose it is (section 1), and the personal information we receive from visitors is limited to the items in section 1.
8. Automatic collection on your device
The app and the web keep the visitor identifier in device storage (the app’s storage area, or browser storage). The app also keeps random identifiers for grouping error reports, and error reports not yet sent, in its storage area (see “Records created automatically” in section 1). We do no advertising or behavioral analytics tracking. An error report records only the moment the error happened; it does not contain what you viewed or tapped. To remove these values, delete the app or clear browser storage; you will then need a link to recover what was collected on that device.
9. Security measures
- Passwords and session/invitation tokens are stored only as irreversible values.
- Traffic between you and the server is encrypted (HTTPS).
- The database sits in a network that cannot be reached directly from outside, and access rights are limited to the minimum needed.
- Automated checks confirm that tokens, passwords, and authentication keys never appear in logs.
10. Privacy officer
| Privacy officer | Taehun Yun (Representative, HAUTEN) |
| Contact | support@stampy.site, +82-70-8027-1500 |
Requests for access, correction, deletion, or suspension are received at the same address. Inquiries in English are welcome.
11. Remedies
If you need help regarding a privacy infringement, you may contact:
| Body | Phone | Address |
|---|---|---|
| Personal Information Dispute Mediation Committee (Korea) | 1833-6972 (within Korea) | www.kopico.go.kr |
| Privacy Infringement Report Center, KISA (Korea) | 118 (within Korea) | privacy.kisa.or.kr |
| Cyber Investigation Division, Supreme Prosecutors’ Office (Korea) | 1301 (within Korea) | www.spo.go.kr |
| Cyber Bureau, Korean National Police Agency (Korea) | 182 (within Korea) | ecrm.police.go.kr |
These phone numbers can be dialed only within Korea. From abroad, use the websites.
12. Business information
| Business name | HAUTEN |
| Representative | Taehun Yun (YUN TAEHUN) |
| Business registration number (Korea) | 609-42-06363 |
| Address | 201, 28 Neungdong-ro 53-gil, Gwangjin-gu, Seoul, Republic of Korea |
| Phone | +82-70-8027-1500 |
support@stampy.site |
13. Changes to this policy
This policy applies from October 20, 2026. When we add, change, or remove content, we announce it on this site at least 7 days before it takes effect, or 30 days for changes that are unfavorable to users.
Effective October 20, 2026. Amended on October 19, 2026. The one change in how we process personal information is that link and app handoff attempt records are now deleted 30 days after they are made (they were not deleted before); the rest adds records missing from the tables and corrects wording that read differently from what happens. Because the app had not yet been released, we did not wait 7 days, and the effective date matches the other legal documents amended the same day. The changes, before and after:
- 1. Visitors table. Added the row “Link and app handoff attempt records (visitor identifier, the provider chosen or the event handed over from the web, outcome, time)”. In the prize draw entry record, “an irreversibly transformed value of the link identifier” became “a transformed value of the link identifier, which lets us recognize the entry if the same account is linked again”. “checking perk receipts and survey conditions, and aggregate figures for partners” became “checking whether perks were received and survey conditions were met, and producing aggregate figures for partners”, and “The identifier issued by a provider on quick link” became “The identifier a provider gives us when you link an account”. The paragraph on promotional notifications moved here from section 4, where the Korean policy has it.
- 1. Partners and staff table. In access records, “what was done (the screen and request)” became “what was done (the feature and target requested)”. The server does not know which screen was opened and records only requests.
- 1. Location. ‘For events with a “near the place” requirement’ became “For events that use the location condition”.
- 2. Retention. “Partner and staff accounts: 3 years from the day the event ends” was split into “Partner accounts: 3 years from the day the event ends” and “Staff accounts: 3 years from the day the last event they were assigned to ends”, and “Link and app handoff attempt records: 30 days from the day the record is made” was added.
- 4. Processors. “Both transfers are processing on our behalf” became “Both transfers are part of the processing we entrust to these companies”.
- 5. External services. Added a paragraph saying our server also talks to the providers when checking and revoking a link.
- 11. Remedies. The phone numbers are marked “(within Korea)”, with a sentence pointing to the websites from abroad. “+82-1833-6972” and “+82-118” became “1833-6972 (within Korea)” and “118 (within Korea)”.
- Spelling and style. American spelling (organizer, inquiries, behavioral, unfavorable), dates written as “October 20, 2026”, no contractions, and a comma before the last item of a list.
Effective October 19, 2026. Wording only; how we process personal information did not change. Because the app had not yet been released, this took effect on the day it was announced. The changes, before and after:
- 1. Location table. “which version of the Location-Based Service Terms you agreed to” became “which version of the location service terms you agreed to”.
- 4. Processors. “turn off notifications for Stampy” became “turn off notifications for STAMPY”.
- 7. Your rights. “the rewards you handed over” became “the perks you handed over”.
- Document names are written as in the app and the site footer: “Location Service Terms” became “Location service terms” (section 1).
Effective October 17, 2026. Amended again on October 16, 2026: added a row on guardians of a child aged 8 or under, etc., to the location table in section 1, stating that we do not accept a guardian’s consent under Article 26 of the Location Information Act (as Article 25-2(2) of its enforcement decree requires). How we process personal information did not change. Because the app had not yet been released, this takes effect on October 17, 2026 rather than 7 days later.
Effective October 16, 2026. The first version took effect on October 15, 2026 and was amended on 16 October 2026. How we process personal information did not change: we corrected statements that did not match what we actually do and added what the law requires. Because the app had not yet been released, the amendment took effect on the day it was announced rather than 7 days later. The changes, before and after:
- Opening. “We don’t collect names, email addresses, or phone numbers. The only thing kept on your device is a random identifier that tells us whose stamps are whose” became “Taking part asks for no name, email address, or phone number, and a random identifier that tells us whose stamps are whose is kept on your device. Winners’ shipping details and the email address given in an inquiry are collected as listed below”.
- 1. Location table. Added the location information officer (Taehun Yun,
Representative, HAUTEN) and contact details (
support@stampy.site, +82-70-8027-1500), as the enforcement decree of Korea’s Location Information Act requires (Article 25-2). - 2. Retention. ‘when the visitor chooses “delete everything”’ became ‘when the visitor presses “Delete all my records”’.
- 4. Processors. “undelivered notifications are held briefly by those services” became “undelivered notifications are held for up to 4 weeks by Google and up to 30 days by Apple”.
- 5. External services. Added “Apple, Google (Firebase): when the app obtains a push notification address”, as in the Korean policy.
- 11. Remedies. Replaced the empty “Your local data protection authority” row with the Cyber Investigation Division of the Supreme Prosecutors’ Office (1301) and the Cyber Bureau of the Korean National Police Agency (182), as in the Korean policy.