Privacy Policy

1. Information We Collect

When you use VoidSay, we may collect the following personal information:

• Account Information: Email address, display name, and authentication credentials (Passkeys/WebAuthn).
• Content: Comments, reactions, upvotes, and other content you post.
• Usage Data: Pages visited, features used, and interaction patterns for service improvement.
• Payment Information: Processed by Lemon Squeezy (Merchant of Record) — we do not store your full credit card details. We receive subscription status and transaction IDs from Lemon Squeezy.

2. Legal Basis for Processing (GDPR)

For users in the European Economic Area (EEA) and the UK, we process your personal data on the following legal bases:

• Contractual necessity: To provide the Service you requested (account creation, comment posting, subscription management).
• Legitimate interests: To improve and protect our Service (analytics, spam detection, security monitoring).
• Consent: Where required by law (e.g., non-essential cookies). You may withdraw consent at any time.
• Legal obligation: To comply with applicable laws and regulations.

3. Purpose of Processing

We use your information to:

• Provide, maintain, and improve the Service
• Process payments and manage Pro subscriptions
• Personalize your feed and content recommendations
• Communicate with you about account updates and service changes
• Detect and prevent abuse, spam, fraud, and Terms violations
• Comply with legal obligations

4. Data Retention & Destruction

We retain your personal data only for as long as necessary to fulfill the purposes described in this policy, or as required by law:

• Account data: Retained while your account is active. Upon account deletion, data is removed within 30 days.
• Comments & content: Retained while your account is active or until you delete them. Anonymized content may be retained for archival purposes.
• Payment records: Retained for 5 years as required by Korean tax law.
• Usage logs: Retained for up to 12 months, then anonymized or deleted.

Destruction method: Personal data is permanently deleted from our databases (Turso/libSQL) and backups. Electronic records are irrecoverably deleted using technical measures. Printed records (if any) are shredded.

5. Data Sharing & Third-Party Processors

We do not sell your personal data. We share data only with the following service providers (“data processors” or “수탁사”) who process data on our behalf:

We may also disclose data when required by law, to protect our rights, or in connection with a business transfer (merger, acquisition, or sale of assets).

6. International Data Transfers

Your data may be transferred to and processed in countries outside your country of residence, including the United States (where Vercel and Turso operate) and the United Kingdom (where Lemon Squeezy operates). We ensure appropriate safeguards are in place, including standard contractual clauses and reliance on adequacy decisions where applicable.

7. Data Security

We implement reasonable technical and organizational security measures including: encrypted connections (HTTPS/TLS 1.3), WebAuthn/Passkey-based passwordless authentication, and access controls. However, no method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.

8. Cookies

We use essential cookies for authentication and session management (these are strictly necessary and do not require consent under GDPR). We may use analytics cookies to understand Service usage — for these, we will request your consent where required by law. You can control cookie preferences through your browser settings.

9. Your Rights

Depending on your jurisdiction, you have the following rights regarding your personal data:

For EEA/UK Users (GDPR):

• Right to access your data
• Right to rectification (correction)
• Right to erasure (“right to be forgotten”)
• Right to restrict processing
• Right to data portability
• Right to object to processing
• Right to withdraw consent (where processing is based on consent)
• Right to lodge a complaint with your local data protection supervisory authority

For Korean Users (개인정보보호법):

• 개인정보 열람 요구권 (Right to access)
• 개인정보 정정·삭제 요구권 (Right to correction/deletion)
• 개인정보 처리정지 요구권 (Right to suspend processing)
• 개인정보 수집·이용·제공 동의 철회권 (Right to withdraw consent)
• 개인정보 침해 신고: 개인정보침해 신고센터 (privacy.kisa.or.kr, 국번없이 118)

For California Residents (CCPA/CPRA):

• Right to know what personal information is collected, used, shared, or sold
• Right to delete personal information
• Right to opt-out of the sale or sharing of personal information
• Right to non-discrimination for exercising CCPA rights
• We do not sell your personal information as defined under the CCPA.

To exercise any of these rights, contact our Privacy Officer at repontage@gmail.com. We will respond within 30 days (or the timeframe required by applicable law).

10. Privacy Officer / 개인정보 보호책임자

11. Third-Party Services

VoidSay may embed or link to third-party content (e.g., YouTube videos, external websites). These services have their own privacy policies, and we encourage you to review them. We are not responsible for the privacy practices of third parties.

12. Children's Privacy

VoidSay is not intended for children under 13 (or the applicable minimum age in your country — 14 in South Korea, up to 16 in some EU countries). We do not knowingly collect personal information from children under the applicable age. If you believe we have inadvertently collected such information, please contact us immediately and we will delete it.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify users of material changes by posting a notice on the Service or sending an email. Continued use after changes become effective constitutes acceptance of the updated policy.

14. Contact

For privacy-related inquiries or to exercise your rights, contact our Privacy Officer at repontage@gmail.com.