Privacy Policy
Last updated: 2026-08-06
1. Who processes your data
KWeather Co., Ltd. (케이웨더 주식회사) is the personal information controller. It decides what is collected and why, and it is the party you exercise your rights against.
KWeather Co., Ltd. - Business Registration No. 110-81-37628 · 4F Room 401, 5 Digital-ro 26-gil, Guro-gu, Seoul, Republic of Korea · khelp@kweather.co.kr · +82 1644-0902.
Wellbian Labs Pte. Ltd. operates the platform on KWeather's behalf and is limited to technical operation and maintenance. It is an entrustee, not a controller: it does not decide what is collected or what it is used for.
2. What is collected, why, and for how long
Only what the service cannot run without. There is no advertising, profiling, or sale of personal data to anyone.
| Data | Why | Retention |
|---|---|---|
| Email address | Account identity and sign-in | Until the account is deleted |
| Password (scrypt hash with per-user salt) | Authentication. The password itself is never stored | Until the account is deleted |
| Wallet address | Linking purchases to the buyer and re-download by signature | Until the account is deleted; retained on purchase records as a transaction record |
| Session token | Keeping you signed in | 30 days, then deleted automatically |
| Purchase records (transaction hash, cities, period, amount, dataset hash) | Proving what was bought and delivering it again on request | 5 years, as a transaction record under the Act on Consumer Protection in Electronic Commerce |
| API credit balance and key (per wallet) | Metered per-call access for agents | Until the credit is spent or the wallet asks for removal |
| Prepaid top-up records (transaction hash, wallet, amount, calls credited) | Crediting prepaid calls and refusing the same transaction twice | 5 years, as a transaction record |
| Hashed caller identifier | Rate limiting, abuse blocking, sign-in lockout and crawler verification. The IP address is hashed with a secret salt before it is stored; the address itself is never written to the database here | 7 days, deleted by a scheduled job |
| Password reset token (SHA-256 hash) | Verifying a reset link, once | Until it expires or is used |
| Administrator action log (setting key, masked before/after values, IP address of the administrator) | Tracing who changed a configuration value - the payment recipient and contract addresses are set here, so this has to identify a person rather than count one. This is the one place an IP address is stored in full | 1 year, deleted by a scheduled job |
| Language and unit preference (cookie) | Showing the site in your language and units | Stored in your browser only; not sent to the server as an identifier |
3. What is not collected
No name, phone number, address, date of birth, or payment-card details - payment happens from your own wallet on a public blockchain and never passes through this service.
Page-view counting records the page group only (for example "home", "buy"). No cookie, identifier, IP address or user agent is stored with it, so it cannot be traced back to a person. It exists to tell the operator which pages are used.
4. Entrusted processing, and processing outside Korea
Technical operation of the platform is entrusted to Wellbian Labs Pte. Ltd. (UEN 202604584N), a Singapore company, 111 Somerset Road #06-01W, Singapore 238164. Entrusted work: operating, maintaining and monitoring the service infrastructure, and responding to technical faults.
Infrastructure providers process data on our behalf as part of that operation, and are therefore also entrusted: Vercel Inc. (application hosting and delivery; served from its Seoul region) and Supabase (managed PostgreSQL; Seoul region). Their role is storage and execution - neither is given the data for any purpose of its own. An earlier version of this policy said nothing else was entrusted; that was incorrect and is corrected here.
Application servers and the database are located in Seoul, Republic of Korea (Vercel region icn1; Supabase Seoul). Data is therefore stored in Korea. Because the entrustee is incorporated in Singapore, administrative access from outside Korea is possible, and this is disclosed as an overseas transfer of processing under Article 28-8 of the Personal Information Protection Act.
Items transferred: those listed in section 2. Recipient: Wellbian Labs Pte. Ltd. (admin@wellbianlabs.io), Singapore. Purpose: technical operation and maintenance. Method: encrypted remote administrative access, as needed. Retention: for the duration of the entrustment. This is disclosed here rather than collected by separate consent, as permitted for entrustment necessary to perform the contract; you may refuse it, in which case the service cannot be provided - the entrustment covers wallet-only purchase records as well as accounts, so it is not limited to members.
No personal data is provided to any third party other than the above, except where a law or a warrant requires it.
4-a. If you are in the European Economic Area or the United Kingdom
This service is operated from the Republic of Korea and is offered globally. Where the GDPR or the UK GDPR applies to you, this section states how that regulation is met; it supplements, and does not replace, the rest of this policy.
Controller: KWeather Co., Ltd., 4F Room 401, 5 Digital-ro 26-gil, Guro-gu, Seoul, Republic of Korea, khelp@kweather.co.kr. Wellbian Labs Pte. Ltd. operates the platform as a processor on its behalf.
Legal bases. Purchase and delivery of data, account operation and support: performance of a contract (Art. 6(1)(b)). Rate limiting, abuse blocking and security logging: legitimate interests in keeping the service available and preventing unpaid bulk extraction (Art. 6(1)(f)). Tax and transaction records: legal obligation (Art. 6(1)(c)). No advertising or profiling is carried out and no special-category data is processed.
Caller identifiers. Rate limiting and abuse blocking need to know whether two requests come from the same caller, not who that caller is. For those purposes the IP address is hashed with a secret salt at the point of storage and only the hash is kept; the address itself exists in memory for the duration of the request and is not written down. Page-view counting stores no identifier at all. Hashed counters are deleted within seven days.
There is one exception, and it is stated rather than glossed over. The administrator action log records the IP address in full, because the payment recipient and contract addresses are configured through it and a change there has to be traceable to a person, not merely counted. It concerns the operator's own staff rather than users, is written only when a setting changes, and is deleted after one year. An earlier version of this section said without qualification that IP addresses are never written down; that was not true of this log, and the log now has a retention period where previously it had none.
Retention. Purchase and payment records are kept for the statutory period under Korean tax law and then destroyed. Account data is deleted on request or on account deletion. Hashed caller counters are removed within seven days. On-chain records - wallet addresses, transaction hashes, anchored snapshot hashes - are written to a public blockchain and cannot be altered or erased by us or by anyone; that is a property of the settlement mechanism and is disclosed here because it limits erasure.
International transfer. Data is processed in the Republic of Korea, which the European Commission recognised as providing an adequate level of protection in its adequacy decision of 17 December 2021. Infrastructure providers used in delivering the service (hosting, database, email) may process data in other regions under their own transfer safeguards.
Your rights. You may request access, rectification, erasure, restriction, portability, and object to processing based on legitimate interests, by writing to khelp@kweather.co.kr. Account holders can also export and delete their own data immediately from the Account page. You may lodge a complaint with your local supervisory authority.
No EU representative has been appointed under Art. 27 at this stage. This service is in public beta and, under section 14 of the Terms of Service, is not marketed in or directed at the EEA or the UK; should that change, a representative will be designated and named here before it does. That is a statement about where the service is sold, not a technical block - the pages are reachable from anywhere. If you are in the EEA or the UK and buy anyway, this section applies to you in full.
5. Your rights, and how to use them
You may request access, correction, deletion, or suspension of processing at any time (Articles 35 to 37 of the Personal Information Protection Act). Requests go to KWeather at khelp@kweather.co.kr or +82 1644-0902, and are answered within 10 days.
Deletion can also be done yourself, immediately, from the Account page: it removes your email, password hash, linked wallet and all sessions. Purchase records are retained for the statutory period but are detached from the account at that moment, so they no longer identify you through it; they remain reachable by wallet signature so that data you have already paid for is not lost. Prepaid call credits belong to the wallet, not the account, and are unaffected.
You may withdraw consent by deleting the account. Doing so does not affect processing already carried out lawfully.
6. Destruction
Data whose retention period has passed, or whose purpose has been achieved, is deleted without delay. Sessions and expired quotes are deleted automatically by a scheduled job; accounts are deleted on request; records held under a statutory retention period are deleted when that period ends. Deletion is a database row deletion, not a flag.
7. Security measures
Passwords are stored as scrypt hashes with a per-user salt and are never recoverable. Session tokens are 256-bit random values delivered only in an httpOnly cookie. All traffic is served over TLS. Administrative interfaces are excluded from search indexing and protected by a separate secret. Access to the production database is limited to the entrusted operator and logged.
8. Cookies
Three cookies are used: a session cookie (httpOnly, set only after you sign in), a language preference, and a temperature-unit preference. There are no advertising or analytics cookies and no third-party trackers. Blocking cookies leaves the site usable; you simply cannot stay signed in.
9. Data protection officer
Data protection officer: Ko Beom-seung, KWeather Co., Ltd. · khelp@kweather.co.kr · +82 1644-0902 · 4F Room 401, 5 Digital-ro 26-gil, Guro-gu, Seoul, Republic of Korea. Requests under section 5 are received and answered here.
If a matter is not resolved, you may also contact the Personal Information Dispute Mediation Committee (1833-6972, kopico.go.kr), the Personal Information Infringement Report Centre (118, privacy.kisa.or.kr), or the Supreme Prosecutors' Office and National Police Agency cybercrime units.
10. Changes
Changes are posted on this page at least seven days before taking effect, and thirty days ahead where the change is materially unfavourable to users.