# Alliance Manager Privacy Policy Version: 1.2 Effective Date: Official Service Launch Date Double J Commerce values the personal information of Alliance Manager Users and strives to comply with applicable privacy laws. This Privacy Policy explains what information Alliance Manager processes, the purposes for which it is used, and when it is deleted. ## 1. Data Controller Business Name: Double J Commerce Representative: Jeong Young-min Business Registration Number: 489-19-01086 Address: 2731 Biseul-ro, Dalseo-gu, Daegu, Republic of Korea Email: contact@alliance-manager.app Privacy Officer: Jeong Young-min Contact: contact@alliance-manager.app ## 2. Age Requirement Alliance Manager is intended for **Users who are at least 18 years old**. The Company does not provide the service to persons under the age of 18 and confirms during registration that the User is at least 18 years old. Unless necessary for operation of the service, the Company does not collect an exact date of birth. ## 3. Personal Information We May Process ### Account and Authentication When using email login: - Email address - Account identifier - Authentication and Session information - Account creation and login status When using Google Sign-In, to the extent supported: - Stable identifier for the Google account - Email address - Authentication-related information When using Sign in with Apple, to the extent supported: - Apple User identifier - Email address or Apple Private Relay email - Authentication-related information As a general principle, the Company does not arbitrarily request Google or Apple Profile information that is not necessary for the service. ### Profile and Game Information The following information may be processed while using relevant features: - Nickname - Server - Alliance information - Profile Avatar, Frame, and Cover - Game-related Profile information - Images submitted by the User for Profile verification Profile verification images are used only for verification and, as a general principle, are deleted without undue delay after the verification process is completed. ### Social and Alliance - Friend relationships - Block relationships - Alliance Membership - Rank and service permissions - Alliance operation-related records ### Chat and Community - DM, Group Chat, and other Chat messages - Community posts and comments - Authors and creation times of messages and posts - Report and Moderation-related information ### Credit and Reward - Credit balance - Credit transaction Ledger - Source of free or paid acquisition - Reward grant and usage records - Rewarded Ad offer and server verification information - Identifiers used to prevent duplicates and replay ### Payments and Entitlements - Store product identifiers - Purchase and transaction identifiers - Information required for purchase or receipt verification - Subscription or access-right status - Expiration, cancellation, and refund status - Entitlement status Where Apple or Google directly processes a payment, Alliance Manager generally does not directly collect the User's full card number. ### Advertising When advertising services such as Google AdMob are used, the advertising provider may process information including: - IP address - Device or advertising-related identifiers - App and advertising interaction information - Advertising privacy choices or consent-related information - Technical information required for advertising requests For Rewarded Ads, the Alliance Manager server may separately process information including: - Reward offer identifier - Advertising transaction or verification identifier - Server verification result - Whether a Reward was granted - Information used to prevent duplicate rewards ### Automatically Generated Information The following information may be processed for service security and operation: - Login records - Access times - IP address - Device or app-related technical information - Error and security events - API requests and system logs As a general principle, unnecessary information is minimized. ## 4. Purposes of Processing Personal Information The Company processes personal information for the following purposes: - Account creation and authentication - Provision of the service and Profiles - Provision of Alliance, Friends, Chat, and Community features - Credit and Reward processing - Payment verification and provision of Entitlements - Rewarded Ad verification - Provision of requested features such as translation - Reports, Block, and Moderation - Service security and fraud prevention - Prevention of duplicate Rewards or payment fraud - Error analysis and service stability - Customer inquiries and dispute handling - Compliance with legal obligations - Management of privacy and advertising choices ## 5. Legal Bases for Processing Depending on applicable law, the Company may process personal information on the following bases: - Entering into and performing a service contract with the User - Providing a service requested by the User - Compliance with legal obligations - Service security, fraud prevention, and legitimate operational needs - User consent where separate consent is required by law In regions such as the EEA where specific legal bases are required, the Company applies bases recognized by applicable law, including performance of a contract, legal obligation, legitimate interests, or consent. ## 6. Advertising Privacy and UMP/CMP Acceptance of the Alliance Manager Terms and review of this Privacy Policy are handled separately from advertising privacy choices. Depending on regional advertising and privacy requirements, Google UMP or a Google-approved consent management feature may be displayed. A User's refusal to permit advertising-related use of personal information does not automatically prohibit ordinary use of the Alliance Manager account itself. Depending on whether and what type of advertising can be provided, non-personalized ads, limited ads, or no ads may apply. Where required, Users may review or change their advertising privacy choices through the Privacy choices menu in the app. Purchase of an AD FREE product and advertising privacy consent are separate matters. ## 7. Rewarded Ads Rewarded Ads are reward-based advertisements voluntarily selected by Users. A Credit reward is not confirmed merely because an advertisement was displayed on the client and is granted only when server-side verification has been completed. Economic policies such as reward amounts and daily limits follow the latest Reward Policy displayed in the app and are not fixed as specific numbers in this Privacy Policy. ## 8. Retention and Use Period The Company deletes personal information when the purpose of processing has been achieved or retention is no longer necessary. However, where there is a legitimate reason such as applicable law, dispute resolution, security, or prevention of misuse, necessary information may be separately retained to the required extent. ### Major Service Data Account, Profile, Friends, Block, Membership, and general settings information: Retained while the account is in use and generally deleted upon account deletion. Community posts and comments: Generally deleted upon account deletion. Chat message bodies: Generally deleted upon account deletion. Where it is necessary to preserve conversation structure, only a placeholder such as "Deleted message." may remain without retaining the message content or personal information that identifies the deleted User. Profile verification images: Processed temporarily for verification and deleted without undue delay. ### Internal Security and Operational Policy Login and security-related access records: Generally up to 1 year Evidence related to misuse, Reward replay, and enforcement: Up to 3 years from the date the relevant matter is finally concluded Evidence related to reports and disputes: Up to 3 years after conclusion of the matter Rewarded Ad SSV verification and duplicate-reward prevention records: Up to 3 years Purchase, refund, and Entitlement-related transaction records: Up to 5 years or the period required by applicable law Information may be deleted earlier where the need for retention ends sooner. ## 9. Retention of Transaction Records Required by Law Where applicable law requires, records including the following may be retained for the applicable periods: - Records concerning labeling and advertising: 6 months - Records concerning contracts or withdrawal of offers: 5 years - Records concerning payment and supply of goods or services: 5 years - Records concerning consumer complaints or dispute resolution: 3 years Information retained pursuant to law is managed separately from ordinary service information. ## 10. Account Deletion Users may request account deletion through account settings in the app. Where required by Store policy, the Company also makes it possible to request or begin the account deletion process through the official website. Upon account deletion, the following information is generally deleted or disassociated: - Auth account - Profile - Friends and Block - Alliance Membership - General settings information - Community posts and comments - Chat message bodies - Other ordinary personal information directly associated with the account Account deactivation or a simple suspension does not replace account deletion. ## 11. Account Deletion and Credit Upon account deletion, the available Credit balance, including both free and paid-acquisition Credit, becomes unavailable through that account and expires. As a general principle, Credit cannot be transferred to another account or Profile or restored after deletion. However, Ledger and transaction provenance necessary for purchase, refund, chargeback, misuse investigations, or legal obligations may be retained on a limited basis. This policy does not exclude refund or other legal rights available to Users under applicable law or Store policies. ## 12. Account Deletion and UGC When a User deletes an account, Community posts and comments created by that User are generally deleted. Actual Chat message bodies are also generally deleted. However, minimum evidence for which there is a legitimate need for retention in connection with reports, crime, fraud, security, or disputes may be stored separately from ordinary Chat data with restricted access. ## 13. Personal Information Used for Reports and Moderation When handling a report, the Company may process information including: - Reporter - Reported party - Reason for the report - Reported message or content - Minimum necessary surrounding context - Person handling the report - Action taken and time of action As a general principle, ordinary Moderators are not permitted to freely search or access a User's entire private DM history. Only information necessary for handling the report is exposed, and significant Moderation access may be recorded in audit logs. ## 14. Destruction of Personal Information When personal information is no longer necessary, the Company deletes or destroys it using appropriate methods designed to make recovery or reproduction difficult. Personal information that must continue to be retained pursuant to applicable law is stored separately from other personal information. ## 15. Backup and Recovery Systems Some data may temporarily remain in Backup or recovery systems for service stability and disaster recovery. Specific Backup retention periods may vary depending on operational infrastructure, recovery policies, and service plans. Even after account deletion or deletion of personal information is completed, information may remain in Backup for a limited period. Such information is not reused as ordinary service data and is removed or overwritten according to the Backup lifecycle. ## 16. Cloud and External Services Alliance Manager may use external technology services to provide the service. Major services that may currently or at launch be used include: - Supabase: database, authentication, Storage, and Backend infrastructure - Google: Google Sign-In, Google Play, Google AdMob, and UMP - Apple: Sign in with Apple and the App Store An open-source verification module such as OneSub that runs within the Company's own Backend is not identified as an independent recipient of personal information unless personal information is actually transmitted to a separate third party. Where the external service configuration changes, this Privacy Policy will be updated to the extent necessary. ## 17. Supabase Data Processing Alliance Manager's current primary service Database/Auth/Storage infrastructure uses Supabase, and the **primary project data processing region is configured as the Seoul region in the Republic of Korea**. However, depending on the cloud provider's logs, support services, Edge features, Backup, subprocessors, or other infrastructure configurations, some technical processing may occur in other regions. The Company provides notices required by applicable law based on the actual operating configuration. ## 18. Cross-Border Processing and Transfers To provide a global service, personal information may be processed outside the User's country through the infrastructure of global service providers such as Google, Apple, and Supabase. Where separate consent or provision of specific transfer information is legally required for a cross-border transfer, the Company will verify the providers actually in use, categories of information transferred, purpose, country, method of transfer, and retention period and provide notice or obtain consent in the manner required by applicable law. The Company does not arbitrarily state unverified countries or processors. ## 19. Disclosure to Third Parties The Company does not arbitrarily sell Users' personal information beyond the purposes described in this Privacy Policy. Where disclosure is required by law, requested or consented to by the User, or lawful processing or disclosure is necessary to provide the service, the Company handles the information in accordance with applicable law. ## 20. User Rights Depending on applicable law, Users may exercise rights including: - Access to their personal information - Correction of personal information - Deletion of personal information - Restriction of or objection to processing - Withdrawal of consent - Account deletion - Other rights recognized by applicable regional privacy laws Requests may be submitted through features provided in the app or by contacting contact@alliance-manager.app. The Company may require authentication to the extent necessary to verify that the request is made by the User or another lawful rights holder. ## 21. Advertising Privacy Choices Advertising-related privacy choices are managed separately from acceptance of the Terms during registration. Users for whom UMP/CMP is required may change their choices through the applicable interface. Where a Privacy choices entry point is required, it will be accessible through the app settings. ## 22. Personal Information Security Measures The Company applies technical and administrative measures appropriate to the scale and risks of the service to protect personal information. Examples may include: - Separation of permissions - Data access limited to necessary administrators - Encryption in transit - Authentication and Session management - Database access controls - Security logs - Moderation access audit - Fraud and replay prevention - Least-privilege operation Although no system can guarantee absolute security, the Company continuously works to improve reasonable safeguards. ## 23. Personal Information Breaches If a personal information breach occurs, the Company will assess its scope and impact and, where required by applicable law, provide necessary notifications to Users and relevant authorities. ## 24. Long-Term Inactivity As a general principle, the Company does not automatically convert account personal information into a separate "dormant account" solely because the User has not accessed the service for an extended period. However, personal information for which the retention purpose has ended or which is no longer necessary is deleted in accordance with applicable law and this Policy. ## 25. Service Termination If the service is terminated, personal information that is no longer necessary to provide the service is deleted in accordance with applicable law and this Policy. Data that must be retained for payment, refund, legal disputes, security, or similar purposes may be stored separately from ordinary service data for the applicable purpose and retention period. ## 26. Sign in with Apple Account Deletion When an account using Sign in with Apple is deleted, procedures to revoke relevant Apple authentication tokens are performed in accordance with Apple's requirements and the actual authentication implementation. ## 27. Changes to this Privacy Policy This Policy may be changed when laws, the service, external Providers, or personal information processing methods change. Where there is a material change, Users will be informed through an appropriate method in accordance with applicable law and service policies. ## 28. Language Alliance Manager may provide this Privacy Policy in multiple languages. If there is a difference between a translation and the reference document, the reference version designated by the Company may be consulted to the extent permitted by applicable law, without limiting mandatory privacy rights applicable in the User's place of residence. Legal documents are provided as fixed documents supplied by the Company rather than through real-time AI translation. ## 29. Contact For privacy inquiries and the exercise of rights: Privacy Officer: Jeong Young-min Email: contact@alliance-manager.app Address: 2731 Biseul-ro, Dalseo-gu, Daegu, Republic of Korea