This English version is provided for convenience. In case of any conflict, the Korean version prevails.
HyperReality Co., Ltd. (the "Company") complies with the Personal Information Protection Act of Korea and other applicable laws in providing TripCity (the "Service"). This Privacy Policy explains what personal information we process, why, for how long, and with whom we share or entrust it.
At a Glance
| What | Details |
|---|---|
| Information we collect | Email, name and profile image from your social sign-in account, travel content you upload, and Service usage records |
| What we use it for | Sign-in, running group trips, payments, customer support and security |
| Who processes it for us | Cloud, email, sign-in and payment providers — Articles 4 and 5 |
| What we do not process | Unique identifiers such as resident registration numbers, sensitive information such as health data, and personal location information (Article 2) |
| Retention | Until you close your account. Records required by law are kept for the legally required period |
| Contact | Chief Privacy Officer Juyoung Kang · contact@tripcity.im |
Article 1 (Items, Purposes, Legal Bases and Retention)
| When | Items | Purpose | Legal basis | Retention |
|---|---|---|---|---|
| Sign-up and sign-in (social sign-in) | Email, name (nickname), profile image, social account identifier | Identifying members, sign-in, notices | Performance of contract (Art. 15(1)4 of the Act) | Until account closure |
| Group invitations | Invitee's email or invitation link details | Sending invitations, processing group membership | Performance of contract | 30 days after acceptance or expiry |
| Travel content | Itineraries, notes, place notes, checklists, photos and comments you upload | Sharing with group members, managing schedules | Performance of contract | Until you delete it or close your account |
| Using the Service | IP address, browser and device information (User-Agent), access times, usage records, error logs | Security, fraud prevention, incident response | Legitimate interest (Art. 15(1)6 of the Act) | 1 year (access logs at least 3 months under the Protection of Communications Secrets Act) |
| Customer inquiries | Email, inquiry content, attachments | Responding to inquiries, handling disputes | Performance of contract | 3 years after resolution |
| Paid purchases (Korea) | Partial payment method details, payment and refund history | Payment, refunds, issuing receipts | Performance of contract, legal obligation | 5 years (E-Commerce Act, Framework Act on National Taxes) |
| Paid purchases (international) | Paddle collects international payment details directly (Article 6). We receive only payment status, product and country | Managing subscription status | Performance of contract | 5 years |
| Marketing messages | Not applicable (we do not currently send marketing messages) | — | — | — |
Records kept under law are stored separately from other information and used only for that purpose.
| Record | Period | Basis |
|---|---|---|
| Records on contracts or withdrawal of offers | 5 years | E-Commerce Act |
| Records on payment and supply of goods | 5 years | E-Commerce Act |
| Records on consumer complaints or dispute resolution | 3 years | E-Commerce Act |
| Website visit (sign-in) records | 3 months | Protection of Communications Secrets Act |
Article 2 (Information We Do Not Process, and Group Sharing)
- The Company does not collect unique identifiers such as resident registration numbers, sensitive information such as health conditions, or personal location information. If we introduce features that need such information (location-based recommendations, photo location records, etc.), we will amend this Privacy Policy and process it only after obtaining the separate consent required by law.
- Content you upload to a group yourself (itineraries, notes, photos, etc.) is visible to the group members you choose. The Company does not view or use it for any purpose other than storing and displaying it. Please do not upload copies of identity documents or resident registration numbers.
- Metadata in photos you upload, such as the location where a photo was taken, may be stored as uploaded. The Company does not extract or use it separately.
- Please obtain consent before uploading personal information of other people (such as travel companions).
Article 3 (AI Features)
- The Service provides, or plans to provide, generative AI features (AI draft itineraries).
- When you use an AI feature, the trip conditions or text you enter and the result are sent to an AI provider. When launching AI features, the Company will add the provider, country, items transferred and retention period to the tables in Articles 4 and 5 and announce it 7 days before it takes effect. Until then, no personal information is sent to any AI provider.
- The Company keeps AI input and output only when you save them to an itinerary, as part of that itinerary.
- If an AI result is inappropriate or wrong, let us know at contact@tripcity.im. We will review it, take action and reply.
- Do not enter sensitive information such as resident registration numbers or health information into AI features.
Article 4 (Entrustment of Processing)
| Processor | Task |
|---|---|
| Google LLC | Google account sign-in (authentication) |
| Amazon Web Services, Inc. | Sending email (Amazon SES) |
| HyperReality Co., Ltd. (self-operated cloud "zerocloud") | Service servers, databases and file storage |
| Payple Inc. | Domestic payment processing (when domestic payments are introduced) |
If processors are added or changed — for example Kakao or Apple sign-in, maps or AI providers — we will amend this Privacy Policy and notify you.
Article 5 (Transfer of Personal Information Overseas)
To provide the Service (performance of contract), the Company entrusts the storage and processing of personal information overseas as follows (Art. 28-8(1)3 of the Act). Transfers occur over the network when you use the Service.
| Recipient (contact) | Country | Items | Purpose | Retention | How to refuse, and the effect |
|---|---|---|---|---|---|
| Google LLC (privacy.google.com) | United States | Email, name, profile image, Google account identifier | Google sign-in | Until account closure | No transfer occurs if you do not use Google sign-in. Google is currently the only sign-in method, so refusing means you cannot use the Service |
| Amazon Web Services, Inc. (aws.amazon.com/compliance/contact) | Republic of Korea (Seoul region) — not an overseas transfer | Recipient email, message content | Sending email | Per AWS policy after sending | — |
Article 6 (Provision to Third Parties)
The Company does not provide personal information to third parties except with the data subject's consent or where the law specifically provides. International payments, however, involve the following provision.
| Recipient | Country | Items | Purpose | Retention |
|---|---|---|---|---|
| Paddle.com Market Limited | United Kingdom | Email, country, payment method details, billing address, payment and refund history | Payment and tax processing as Merchant of Record for international payments | Per Paddle's privacy policy |
We obtain consent to this provision on the international checkout screen. If you do not consent, you cannot use international payment, but domestic payment remains available.
Article 7 (Destruction of Personal Information)
- When the retention period ends or the purpose is achieved, we destroy personal information without delay.
- Electronic files are deleted irreversibly; paper documents are shredded or incinerated.
- After account closure, information is kept for 30 days so that accidental closures can be restored, and then destroyed. Copies in backups are removed according to the backup cycle (up to 30 days). Records required by law are stored separately for the periods in Article 1.
Article 8 (Cookies and Similar Technologies)
- The Service uses essential cookies (or browser storage) to keep you signed in. The website remembers your chosen language and whether you dismissed the language banner in browser storage.
- The Service does not currently use visitor analytics or advertising tracking tools. If we introduce them, we will amend this Privacy Policy and notify you.
- You can refuse cookies in your browser settings. If you refuse essential cookies, you will not stay signed in.
- Chrome: Settings → Privacy and security → Third-party cookies
- Safari: Settings → Privacy
Article 9 (Children Under 14)
The Service does not accept sign-ups from children under 14. If we learn that a user is under 14, we delete the account without delay.
Article 10 (Your Rights and How to Exercise Them)
- You may request access to, correction or deletion of, suspension of processing of, and portability of your personal information, and withdraw consent, at any time.
- You can do this yourself in account settings or by emailing contact@tripcity.im; we will act within 10 days.
- You may also exercise these rights through a representative (legal guardian or authorized person), who must submit a power of attorney.
- Information that other laws require us to keep cannot be deleted on request.
Article 11 (Automated Decisions)
The Company does not make decisions that significantly affect your rights or obligations by fully automated means. When restricting an account for suspected fraud, a person reviews the case.
Article 12 (Security Measures)
- Administrative: internal management plan, minimal access privileges, regular reviews
- Technical: access control, encryption in transit (HTTPS), encrypted storage of secrets and third-party credentials, per-member access control for group content, retention of access logs
- Physical: access control for servers and storage locations
Article 13 (Chief Privacy Officer)
- Chief Privacy Officer: Juyoung Kang (CEO)
- Email: contact@tripcity.im
- Phone: +82-507-0178-7546
Article 14 (Remedies)
For consultation or dispute resolution regarding privacy infringements, you may contact the following organizations (Korean-language services).
- Personal Information Infringement Report Center (KISA): privacy.kisa.or.kr / 118 (no area code)
- Personal Information Dispute Mediation Committee: www.kopico.go.kr / 1833-6972
- Supreme Prosecutors' Office Cyber Investigation Division: www.spo.go.kr / 1301 (no area code)
- Korean National Police Agency Cyber Bureau: ecrm.police.go.kr / 182 (no area code)
Article 15 (Changes to This Policy)
- This Privacy Policy takes effect on 2026-10-13. (Compared with the 2026-10-12 version, wording about features the Service does not offer was removed; no new data is processed.)
- If it changes, we announce it on the Service 7 days before the effective date. Changes important to your rights, such as new collection items or provision to third parties, are announced 30 days in advance, with renewed consent where required.
- Previous versions are available under "Previous versions" at the bottom of this page.