Privacy Policy

1. Personal Information Collected and Methods of Collection

The Company collects the following personal information during member registration, provision of the Service, and the payment/settlement process.

Optional Instagram connection: we store the account ID, username, app ID, connection and expiration times, encrypted access token, and selected post IDs and official links. During connection we use a session-bound, single-use state hash valid for up to ten minutes. Unselected posts are fetched transiently for selection and are not stored. We associate these records with Castera member, persona and internal connection IDs. For connection security, we also store a browser-binding hash, locale, and state expiration and consumption times. Post types are used transiently in the selection screen and are not stored.

The original data of payment instruments, such as card numbers, is processed by the electronic payment service provider (Toss Payments), and the Company does not store it.

2. Purposes of Processing Personal Information

Personal information collected is processed for the following purposes, and where the purpose changes, separate consent will be obtained in accordance with applicable laws.

We use this data to verify Instagram account access, select posts belonging to the account and publish explicitly approved official links. Tokens are encrypted in server-only storage and are never provided to visitors or brands. The operator is INTELLIEFFECT. This connection is not real-name, know-your-customer (KYC), or content-rights verification, and does not guarantee recommendations or increased algorithmic exposure. Publication uses official links only; original images and videos are not downloaded or rehosted.

1. Member registration, authentication, and management — identity verification, prevention of fraudulent use, and various notices
2. Age verification — blocking registration by anyone under 19 (confirmed by the member's own consent)
3. Provision of the Service — Creator–Brand matching, support for executing and performing Campaign contracts, inter-Member messaging functions
4. Payment processing, escrow deposit, and settlement processing
5. Maintaining a safe transaction environment — preventing circumvention transactions, responding to disputes, protecting accounts
6. Service improvement and statistical analysis (in a form that does not identify individuals)
7. Fulfilling obligations under applicable laws

Where personal information is used for marketing purposes, separate consent will be obtained, and use of the Service is not restricted if consent is not given.

3. Retention and Use Period of Personal Information

In principle, the Company destroys personal information without delay upon a Member's withdrawal. However, in the following cases, the information is stored separately for the relevant period before being destroyed.

Connection data is retained while connected. Connection data and selected links are deleted on disconnect, processing of deletion requests, account/persona deletion or confirmed authorization loss. Expired connections are hidden and deleted on next access. Single-use OAuth states become unusable after ten minutes and are removed when the same persona next starts a connection, disconnects or is deleted; there is no scheduled cleanup job. When revalidation detects that source posts are deleted, private or inaccessible, links are hidden; stored selections are not necessarily deleted immediately.

A Creator's SNS handle is deleted within 30 days of the Member's withdrawal, in accordance with the SNS Handle Non-Disclosure Policy. The connection-data deletion rules above apply to optional Instagram connection data; the general 30-day SNS-handle retention period after withdrawal does not extend token retention.

4. Provision of Personal Information to Third Parties

In principle, the Company does not provide users' personal information to outside parties, and provides it only where the user has given prior consent or there is a legal basis for doing so.

Given the nature of the Service, the following provision occurs during the process of executing a Campaign contract.

Private SNS handles are not provided to advertisers before a contract. However, official links selected and explicitly approved for publication in the Instagram connection screen are public to visitors and brands and can reveal the account. Unselected handles and other private information remain protected.

5. Outsourcing of Personal Information Processing

To provide a stable Service, the Company outsources personal information processing tasks as follows.

When entering into an outsourcing agreement, the Company stipulates compliance with applicable personal information protection laws, restrictions on re-outsourcing, and technical and administrative protective measures, and supervises the processor.

6. Overseas Transfer of Personal Information

The servers of some cloud services used by the Company are located overseas, and personal information is transferred overseas as follows in the course of using the Service.

Users may refuse the overseas transfer of their personal information. However, because overseas transfer is essential infrastructure for providing the Service, use of the Service may be restricted if refused. A refusal request may be made to dev@intellieffect.com.

7. Procedure and Method for Destruction of Personal Information

The Company destroys personal information without delay once it becomes unnecessary, such as upon expiry of the retention period or achievement of the processing purpose.

Information in electronic file form is deleted using a technical method that prevents recovery, and paper documents are destroyed by shredding or incineration. Information that must be retained under applicable law is stored separately in a separate storage space and destroyed immediately upon expiry of the retention period.

8. Users' Rights and How to Exercise Them

Users may exercise the following rights against the Company at any time, and the Company shall take action without delay within the period prescribed by applicable law.

Rights may be exercised through the settings screen within the Service or by email (dev@intellieffect.com), and may also be exercised through a legal representative or an authorized agent. In such a case, a power of attorney in accordance with applicable law must be submitted.

1. Request to access personal information
2. Request for correction where there is an error
3. Request for deletion
4. Request to suspend processing
5. Withdrawal of consent to the collection and use of personal information (withdrawal of membership)

The exercise of rights may be restricted where applicable law mandates the collection or retention of the relevant personal information, and in such a case the reason will be provided.

9. Cookies, Analytics, and Advertising Tools

The Company uses cookies essential to providing the Service, such as for maintaining login sessions. Essential cookies are required for use of the Service, and if blocked in the browser, some functions such as login may not be available.

The Company uses Vercel Web Analytics and Speed Insights to understand service usage (visitor counts, page views, referral sources) and web performance (loading speed, etc.). These tools do not use cookies (cookieless) and do not collect information that can identify an individual user.

Separately from the above, the Company uses Google Analytics 4 to analyze how the Service is used. This tool stores cookies on the user's device to distinguish visitors (such as _ga and cookies beginning with _ga_), and collects visit date and time, session duration, pages viewed, referral source, device and browser information, and approximate location (city level). The information collected is processed in a form that does not directly identify an individual, and is retained for 14 months.

Through the use of Google Analytics 4, the above information is transferred to and processed on servers operated by Google LLC (United States). The items transferred are the same as those described in the preceding paragraph, and the purpose of the transfer is analysis of Service usage. Users who do not wish for such transfer may block collection using the methods described below.

The Company uses Meta Pixel (Meta Platforms, Inc.) and Google Ads tags (Google LLC) to deliver targeted advertising and measure advertising performance. These tools store cookies and advertising identifiers on the user's device and collect ad clicks, referral paths, and conversion actions within the Service (such as sign-up and inquiry). The information collected is used for advertising performance measurement, delivery of targeted advertising, and delivery of advertising to similar audiences, and is transferred to and processed on servers operated by each provider (United States).

To measure Google Ads advertising performance, the Company sends signup started (a secondary conversion) and signup completed (split into creator and brand) to Google Ads as conversions. Submitted inquiries are not sent to Google Ads as conversions. When a user arrives by clicking an ad, the ad click identifier (gclid) is stored on the user's device as a cookie (such as _gcl_aw) and used to link that ad to the conversion; when a conversion occurs, the conversion type and conversion value are sent with it. The Company also sends a SHA-256 hash of the email address of the member who completed sign-up to Google Ads together with the conversion, to improve Enhanced Conversions matching accuracy — the plain-text email address is never sent. The Company also sets the defaults of Google Consent Mode (Consent Mode v2) to 'granted' for all of ad cookie storage (ad_storage), analytics cookie storage (analytics_storage), sending user data for advertising purposes (ad_user_data), and ad personalization (ad_personalization), and provides notice through this Policy instead of displaying a separate consent banner. Users can opt out of collection and targeted advertising using the methods below.

Users can block collection by enabling their browser's tracking prevention features (such as Safari's 'Prevent Cross-Site Tracking,' Chrome's 'Block third-party cookies,' or Firefox's 'Enhanced Tracking Protection'), or by installing the 'Google Analytics Opt-out Browser Add-on' provided by Google (https://tools.google.com/dlpage/gaoptout). Targeted advertising can be opted out of separately through Meta Ad Preferences (https://www.facebook.com/adpreferences) and Google Ads Settings (https://adssettings.google.com). This has no effect on use of the Service.

10. Measures to Ensure the Safety of Personal Information

The Company takes the following measures to ensure the safety of personal information.

1. Administrative measures — establishing and implementing an internal management plan, minimizing access privileges to personal information, and managing access records
2. Technical measures — one-way encrypted storage of passwords, encryption of data in transit (TLS), database access control, and application of Row Level Security
3. Physical measures — utilizing the cloud provider's physical access controls and security certification systems
4. Minimizing access privileges to, and managing access logs for, highly sensitive information such as SNS handles

11. Data Protection Officer and Contact

The Company designates a Data Protection Officer as set out below, who oversees personal information processing and handles users' complaints and remedies relating to the processing of personal information.

Users may direct any inquiry, complaint, or request for remedy relating to personal information arising from use of the Service to the contact below, and the Company will respond and address it without delay.

12. Remedies for Infringement of Rights

Users who need to report or consult regarding an infringement of personal information may contact the following institutions.

13. Duty to Notify and Amendments

Where the content of this Privacy Policy is added, deleted, or amended, notice will be given through the Service's announcements starting 7 days before the effective date. However, where an amendment materially affects users' rights, such as a change in the items collected or provision to third parties, notice will be given 30 days before the effective date, and separate consent will be obtained again where necessary.