This is a reference translation. The Korean text is the governing version. Where the two differ, the Korean text prevails.
In operating NatureLens (the "Service"), Kim Hyo-jun (the "Company") complies with the Personal Information Protection Act, the Act on the Protection and Use of Location Information (the "Location Information Act"), the Information and Communications Network Act and other applicable laws, collecting the minimum personal information and managing it securely.
Article 1 (General)
This Policy applies to the whole of the website and mobile application the Company provides. Through this Policy the Company discloses what personal information it processes, for what purpose, and for how long.
This Policy does not apply to the separate collection of personal information by external sites and services linked from it.
Article 2 (Items Collected and How)
The Company collects the following personal information.
| Category | Items collected | When collected |
|---|---|---|
| Sign-up | Email address, password | Entered by the user at sign-up. Names are not collected — nicknames are generated by the Company |
| Social login (optional) | Member identifier provided by Naver, Google or Apple; email address | Received from that provider when the user chooses social login and completes the provider's sign-in. Names, profile photos and phone numbers are not received |
| Nature record (observation) | Photograph, time taken, coordinates and elevation of the spot, address converted from the coordinates, the description and scale of the find entered by the user | When a record is created and sent |
| Route (survey) | Coordinates, times and distance of the survey route | From the moment the user starts a survey until it ends |
| Device and access information | Device identifier, device type, IP address, browser and app information (User-Agent), access time, service usage records | Generated automatically while using the Service |
| Enquiries | Name, contact details, content of the enquiry | When the user makes an enquiry |
Information is collected through direct entry by the user on the website or mobile app, automatic generation in the course of using the Service, and receipt of enquiries. The Company does not collect sensitive information such as ideology, belief, health or sex life, nor resident registration numbers.
Social login — sign-in takes place on the screen of Naver, Google or Apple; the Company never receives or stores the provider password. If "Hide My Email" is chosen in Sign in with Apple, the Company receives a relay address created by Apple. Users may also sign up with an email address instead of social login.
Capture data embedded in photographs (EXIF) — photograph files sometimes carry the time and coordinates of capture. The Company reads and stores the capture time and coordinates needed for the record, then strips the capture data from the original file. The original may remain intact for a short period before that stripping completes.
Article 3 (Purposes of Collection and Use)
- Member management — confirming intent to join, identifying the person, maintaining login, preventing improper use, delivering notices
- Providing the Service — storing and displaying nature records, identifying species through AI analysis, providing information on legal designations and hazards, displaying maps, recording survey routes
- Improving the Service — analysing usage statistics, diagnosing errors, developing new features
- Handling enquiries — receiving enquiries and replying with the outcome
- Biodiversity research and improvement of species identification models — limited to the scope separately consented to at sign-up; details are set out in Article 10.
Article 4 (Retention and Use Period)
The Company destroys information without delay once the purpose of collection and use is achieved. The following information is retained for the periods stated.
| Item | Retention period | Basis |
|---|---|---|
| Member information (email, password, nickname, social login link) | Until withdrawal of membership | Performance of the service agreement |
| Nature records (photographs, location information, descriptions) | Until deleted by the user. On withdrawal of membership they continue to be retained in a form severed from the author | Public-interest use as biodiversity records. Material severed from its author does not constitute information about a particular individual (Article 17 of the Terms of Service) |
| Login sessions and device information | Until the session expires or the user logs out | Security |
| Records confirming the collection, use and provision of personal location information | 6 months | Article 16(2) of the Location Information Act — retention is required by law and is not subject to deletion requests |
| Service access records (logs, IP) | 3 months | Protection of Communications Secrets Act |
| Records of consumer complaints or dispute handling | 3 years | Act on Consumer Protection in Electronic Commerce |
Article 5 (Procedure and Method of Destruction)
- Procedure — personal information whose retention period has passed or whose purpose has been achieved is destroyed without delay. Information that must be preserved by law is moved to a separate store and is not used for any purpose other than preservation.
- Method — electronic files are deleted by technical means that make recovery or reconstruction impossible; printed material is shredded or incinerated.
Article 6 (Provision to Third Parties and Scope of Disclosure)
The Company does not provide users' personal information to third parties, except in the following cases.
- Where the user has consented in advance
- Where there is a basis in law, or an investigative agency makes a request following the procedures and methods prescribed by law
Nature records registered by a user, including the photograph and the spot where it was taken, are shown to other users on the Service. This is disclosure resulting from the user's own act of posting and does not constitute provision to a third party. The spot for species requiring legal protection is shown as a blurred area under Article 9(4).
Survey routes are disclosed only where the user chooses to share them. Once shared, the entire route is shown to other users, including the start and finish points.
Start and finish points are shown as they are. If a recording began or ended at home or at work, that location may be revealed. If not shared, a route is visible only to the user, and sharing can be turned off again at any time. The default is not shared.
Article 7 (Entrustment of Processing and Overseas Transfer)
The Company entrusts the processing of personal information as set out below in order to provide the Service, and some of the entrusted parties are located overseas. Transfer takes place over the network in encrypted form at the time the Service is used, and the retention period runs until the purpose of the entrustment is achieved or the entrustment agreement ends.
| Entrusted party | Entrusted work | Items transferred | Country |
|---|---|---|---|
| OpenAI, L.L.C. | Determining the taxonomic group of the subject, species identification, generating descriptions | Observation photographs | United States |
| Pl@ntNet (a consortium including Cirad and INRIA) | Retrieving candidate plant species | Observation photographs | France |
| Kindwise s.r.o. | Retrieving candidate insect and fungus species | Observation photographs | Czechia |
| Cloudflare, Inc. | Storage and delivery of observation photograph files | Observation photographs | United States |
| Supabase, Inc. | Database operation | Member information, observation records, location information | Republic of Korea (stored in the Seoul region) |
| NAVER Cloud Corp. | Map display and address conversion for domestic coordinates | Observation and route coordinates | Republic of Korea |
| Google LLC | Map display and address conversion for overseas coordinates | Observation and route coordinates | United States |
| Vultr Holdings, LLC | Server hosting | Information generally processed in the course of using the Service | Republic of Korea (located in the Seoul region) |
A user may refuse the overseas transfer of personal information. However, the processing above is necessary for core features such as species identification and map display, so refusal may restrict the use of those features or make the Service difficult to use. Please communicate any refusal to the contact in Article 15.
Article 8 (Processing of Photographs for AI Analysis)
Species identification on the Service is carried out by sending photographs registered by users to the AI providers listed in Article 7. Users use the Service on the basis of this processing, and the Company gives the following notice.
- What is sent is the photograph; identifying information such as name or email address is not sent with it.
- Please take photographs so that they do not contain faces or other information by which an individual could be identified.
- Analysis results (the estimated species name, confidence, execution records) are retained within the Service for review and quality improvement.
Species names and hazard information presented by artificial intelligence are reference material. For judgements that may affect the body, such as consumption or contact, please obtain confirmation from a specialist institution.
Article 9 (Processing of Personal Location Information)
The Company processes users' personal location information in accordance with the Location Information Act. Details are set out in the separate Location-Based Services Terms.
- Purpose — showing where a nature record was found, recording survey routes, providing area-based statistics and environmental information
- Method — collected, only where the user has consented, through the device's location function, photograph capture data and network information. Once a survey is started in the mobile app, the route is recorded even while the screen is off; collection stops when the survey ends.
- Retention — location information contained in a nature record is retained for as long as that record is retained. Records confirming collection, use and provision are automatically recorded and preserved for six months under Article 16(2) of the Location Information Act.
- Protective measures — for species requiring legal protection, exact coordinates are not disclosed; a blurred area is shown instead, to protect the habitat.
- Provision to third parties — where personal location information is provided to a third party designated by the user, the Company informs the user in advance of the recipient and purpose and obtains consent, and on each occasion immediately notifies the user's device of the recipient, the date and time, and the purpose.
- Withdrawal — a user may withdraw consent to the collection of location information, or suspend it temporarily, at any time. Revoking the location permission in the device's operating system settings stops collection immediately.
Article 10 (Use for Research and Model Improvement)
Only where a user has given separate consent at sign-up, the Company uses registered photographs for biodiversity research and to improve species identification models.
- What is used is the photograph and the corresponding species information, processed with identifying information such as the user's email address separated out.
- For species where an exact location could lead to habitat damage, coordinates are blurred or omitted.
- A user may withdraw this consent at any time. After withdrawal the material is not used in new research or training. It may, however, be technically impossible to reverse individual material within analyses already performed or research already published before withdrawal.
Article 11 (Users' Rights and How to Exercise Them)
A user may at any time request access to, correction of, deletion of, or suspension of the processing of their personal information, and may withdraw consent or withdraw from membership.
-
Member information can be viewed and corrected directly on the account screen in the Service.
-
Nature records can be deleted by the user directly.
-
Withdrawal of membership (deleting the account) — this can be done directly under Settings > Delete account in the app, or requested at catstopia@gmail.com. On withdrawal, information by which the user can be identified — email address, password, nickname and any social login link — is destroyed immediately and login is no longer possible.
Photographs, routes and conversations remain on the Service after withdrawal. The link to the author is severed and only a random nickname is shown, so it is not possible to tell who posted them. If you do not wish them to remain, please delete them yourself before withdrawing. After withdrawal it is not possible to identify whose records are whose, so deletion requests cannot be met.
-
Rights may also be exercised through a legal representative or an authorised agent, in which case a power of attorney under the Notice on Methods of Processing Personal Information must be submitted.
Personal information for which correction has been requested is neither used nor provided until the correction is complete.
Article 12 (Personal Information of Children Under 14)
Where the Company processes the personal information of a child under 14, it obtains the consent of the child's legal representative. In order to obtain that consent, the Company may ask the child for minimal information such as the legal representative's name and contact details. The legal representative may request access to, correction of and deletion of the child's personal information, and may withdraw consent.
Article 13 (Automatic Collection Devices and How to Refuse Them)
The Company uses cookies and browser storage to keep users logged in and to remember their settings. A user may refuse cookie storage in their browser settings, but features requiring login will then be unavailable.
The mobile app does not collect advertising identifiers and does not track users' activity across other companies' apps and websites.
Article 14 (Measures to Secure Personal Information)
- Administrative — establishing and implementing an internal management plan, granting minimal access rights, training staff
- Technical — one-way encryption of passwords, encryption in transit (HTTPS), access rights management, retention of access records
- Physical — access control for the facilities where data is stored
Article 15 (Personal Information Protection Officer and Location Information Manager)
The Company designates the following officers to oversee the handling of personal information and to deal with user complaints.
| Role | Name (position) | Telephone | |
|---|---|---|---|
| Personal Information Protection Officer | Kim Hyo-jun | 010-6751-0320 | catstopia@gmail.com |
| Location Information Manager | Kim Hyo-jun | 010-6751-0320 | catstopia@gmail.com |
Provider information — Name: Kim Hyo-jun · Address: Room 520, 7 Jangan-ro 20-gil, Dongdaemun-gu, Seoul, Republic of Korea
Article 16 (Remedies for Infringement of Rights)
If you need to report or discuss an infringement of personal information, you may contact the following bodies.
- Personal Information Infringement Report Centre — privacy.kisa.or.kr · 118 (no area code)
- Personal Information Dispute Mediation Committee — kopico.go.kr · 1833-6972
- Cybercrime Investigation Division, Supreme Prosecutors' Office — spo.go.kr · 1301 (no area code)
- National Office of Investigation (Cyber Bureau), Korean National Police Agency — ecrm.police.go.kr · 182 (no area code)
Article 17 (Changes to this Policy)
Where this Policy is changed, the effective date and the reason are stated and notice is given on the Service at least seven days before the effective date. Where there is a material change to users' rights — the items collected, the purposes of use, provision to third parties — notice is given at least 30 days in advance.
First effective: 6 September 2025 · Currently effective: 2 October 2026 (reason for change: items added for social login)