Bananatouch Inc. (the “Company”) establishes and discloses this Privacy Policy in accordance with Article 30 of the Personal Information Protection Act (PIPA) of the Republic of Korea to protect data subjects’ personal information and to handle related complaints promptly. This Privacy Policy is distinct from the Terms of Use and from consent forms for the collection and use of personal information.
1. Company Information and Chief Privacy Officer
| Company name | Bananatouch Inc. (주식회사 바나나터치) |
|---|---|
| Service name (brand) | Bananatouch |
| Representative | Lee Seonghee (이성희) |
| Business registration number | 513-81-93630 |
| Address | Room 1037, 10F, 704 Seolleung-ro, Gangnam-gu, Seoul, Republic of Korea |
| Chief Privacy Officer | Lee Seonghee (Representative) · contact@bananatouch.com |
| Access requests and complaints | contact@bananatouch.com |
2. Purposes, Items, Legal Bases and Retention Periods
| Activity | Purpose and legal basis | Items processed | Retention period |
|---|---|---|---|
| Consultation request | Receiving the request, confirming identity and affiliation, scheduling, product explanations tailored to the organization, and related contact Basis Article 15(1)(1) of the Personal Information Protection Act (PIPA) (consent) | Required Organization name, organization type, recording method, areas of interest, name, contact number, email, request IP, browser information (User-Agent) Optional Job title, inquiry details, free-text entries (other entries for organization type, recording method and areas of interest; main difficulty) Generated Request ID, time of receipt, processing status, consultation notes | 1 year from the request date; destroyed earlier upon withdrawal of consent or achievement of the purpose |
| Service brochure request | Receiving the request, sending the service brochure, and related contact Basis Article 15(1)(1) of the Personal Information Protection Act (PIPA) (consent) | Required Organization name, organization type, name, email, request IP, browser information (User-Agent) Optional Contact number Generated Request ID, time of receipt, processing status | 1 year from the request date; destroyed earlier upon withdrawal of consent or achievement of the purpose |
| Visit statistics and security | Statistics on visit flows and popular paths, responding to errors and misuse, and stable operation of the website Basis Article 15(1)(6) of the Personal Information Protection Act (PIPA) (legitimate interests of the Company). Not used for advertising or individual profiling | Access time, random session ID, IP and IP range, User-Agent, visited path, referring page address, proxy forwarding information (X-Forwarded-For) | Page visit records: 90 days from collection Session cookie: 1 year from issuance or until deleted by the user |
| Direct email inquiries | Reviewing inquiries, replying and handling requests Basis Article 15(1)(4) (measures taken at the data subject’s request before entering into a contract) or consent | Sender email, and the name, affiliation and inquiry details written in the email by the user | 1 year from completion of the inquiry |
| Record recognition demo (document upload format, ended October 19, 2026) | Recognizing uploaded documents, reviewing and editing answers, checking and reproducing errors, and preventing misuse of the demo Basis Article 15(1)(1) of the Personal Information Protection Act (PIPA) (consent on the demo screen) | Uploaded original and converted images, file names, OCR inputs, responses, results and edit history, request and session IDs, browser information, converted visitor and IP identifiers, processing and access records | Originals, responses, results, edit history and the detailed identifying information of each request: 90 days after the request (the last uploads before the end are destroyed by January 17, 2027) Converted visitor identifiers and usage counts, and processing and access records with the original content removed: for the period the service is operated |
The record recognition demo now uses only samples created with fictitious information and does not accept uploads of users’ documents. No personal information other than the visit statistics above is processed during the demo. The document upload demo row in the table above sets out the retention and destruction of information uploaded before the demo ended.
The Company does not ask for resident registration numbers, identifying information of care recipients, health information, or care or medical records in the website request forms. If the Company finds that a user has written unrequested sensitive information in a free-text field or an email, it will not use that information and will delete it without delay.
3. Collection Methods and Children Under 14
- Entered directly by users in the consultation and brochure request forms on the website
- Documents uploaded and results edited by users on the record recognition demo screen (ended October 19, 2026)
- Emails sent directly to the Company by users
- Access records generated automatically by the server when users visit the website
Consultation and brochure requests are intended for business staff of care and medical organizations and companies, and the Company does not knowingly collect personal information of children under 14. If the Company becomes aware that a child has submitted information, it will delete it without delay after confirming a request from the legal guardian.
4. Provision of Personal Information to Third Parties
The Company does not provide personal information to third parties except with the data subject’s separate consent or where specifically required by law. The outsourcing described below is performed on the Company’s behalf and is distinct from provision to third parties.
5. Outsourcing of Processing and External Processing Services
| Service | Processing tasks |
|---|---|
| Plus Five Five, Inc. (Resend) | Sending confirmation and staff notification emails for consultation and brochure requests; processing email addresses, metadata and message bodies |
| Google LLC (Google Workspace) | Providing the Company email inbox; storing request notifications and inquiry emails |
| Google LLC (Google Cloud Platform) | Providing server and database infrastructure for the website (Seoul region); storing request information |
| Upstage | Recognizing document images for the record recognition demo (the document upload demo that ended on October 19, 2026) |
| OpenRouter and the selected AI model providers | Structuring results using page images and part of the recognized text (the document upload demo that ended on October 19, 2026) |
In the document upload demo that ended on October 19, 2026, document images were sent to Upstage, and page images and part of the recognized text were sent through OpenRouter to the selected AI model providers for processing. No external AI processing takes place after the demo ended. The scope of processing of information remaining with these external services can be found in the policies of Upstage and OpenRouter.
To ensure that processors handle personal information securely, the Company confirms in its contracts or the services’ data processing addenda the prohibition of processing beyond the outsourced purpose, protective measures, sub-processing, and management and supervision. Any change of processor or tasks will be reflected in this Policy without delay.
6. Cross-Border Transfer of Personal Information
To confirm consultation and brochure requests and for business contact, personal information is processed and stored overseas as follows. The transfer is based on Article 28-8(1)(3) of the Personal Information Protection Act (PIPA), to the extent necessary to provide the consultation and brochure delivery requested by the data subject.
| Recipient | Country, timing and method | Items and purpose | Retention period |
|---|---|---|---|
Plus Five Five, Inc. (Resend) privacy@resend.com | United States · transmitted via a TLS-protected API immediately after the request | Organization name, organization type, recording method, areas of interest, name, contact number, email, job title, inquiry details and free-text entries, request IP, User-Agent, request ID and time · sending confirmation and staff notification emails | For the retention period of request information set by the Company. When the Resend account is closed, customer data is deleted within 90 days under the service's policy |
Google LLC (Google Workspace) Google privacy inquiry channel | United States and other countries where Google or its sub-processors operate facilities · transmitted over an encrypted network when emails are received | Sender, recipient, subject, body and attachments of request and inquiry emails · receiving and storing Company email | For the retention period of the request or inquiry information, after which it is deleted from the Company mailbox |
In the document upload demo that ended on October 19, 2026, document images were transmitted to Upstage’s global API, and page images and part of the recognized text were transmitted through OpenRouter to the selected model providers, so processing may have taken place overseas. The 90-day period for which the Company retains originals and results is separate from the retention periods of the external services.
If you do not wish your information to be transferred overseas, you may contact us at the address above before submitting a request. However, online requests and email replies currently require the services above, so refusing the transfer may limit requests and replies by those methods. General browsing of the website is not affected.
7. Destruction of Personal Information
- When the retention period ends or the purpose of processing is achieved, the personal information is destroyed without delay.
- Database records are deleted so that they are difficult to restore, and emails and electronic files are deleted from operating systems and mailboxes. Any paper printouts are shredded or incinerated.
- Backups are deleted in turn when their retention cycle under the backup policy ends, and until then are not used except for recovery.
- If retention becomes necessary under other laws, the information is stored separately only for the statutory period.
8. Rights of Data Subjects and How to Exercise Them
- Data subjects may request access to, correction or deletion of, or suspension of processing of their personal information, and may withdraw consent.
- The data subject or a lawful representative may make a request to the email address in Section 1. The Company verifies the identity or authority of representation to the extent necessary and handles the request within the statutory period.
- Where there are legal grounds for restriction, the Company explains why the request cannot be fulfilled and how to object.
- Withdrawal of consent applies to subsequent processing and does not affect the lawfulness of processing carried out on the basis of consent before withdrawal.
9. Cookies and Automatic Collection Tools
| Name | Value and purpose | Validity and attributes |
|---|---|---|
| bt_sid | Randomly generated UUID · distinguishes page visits from the same browser by session | 1 year · HttpOnly, Secure, SameSite=Lax |
| __Host-bt_ocr_trial | Random demo identifier and signature · counts demo uses from the same browser (no longer issued from October 19, 2026) | 400 days · HttpOnly, Secure, SameSite=Strict |
Users can refuse cookies or delete existing cookies in their browser settings. Even if cookies are refused, general pages and request forms remain available, but visit statistics may be limited. The Company does not use advertising cookies or combine visit records with third-party advertising profiles.
10. Security Measures
The Company applies the following measures according to the risk of the information it processes.
| Access control | Authentication on request management features, with access limited to personnel who need it for their work |
|---|---|
| Transmission protection | HTTPS/TLS for the website and communication with the external email API |
| Input protection | Length and format validation per field, and escaping of user input when generating email HTML |
| Cookie protection | HttpOnly, Secure and SameSite attributes on the session cookie |
| Administrative measures | Prohibition of unauthorized disclosure, and review of related records in response to requests or incidents |
11. Generative AI, Pseudonymized Information and Automated Decisions
- The Company does not use consultation and brochure request information from the website as input or training data for AI models.
- The record recognition demo now uses only samples created with fictitious information and does not accept users’ documents. The document upload demo that ended on October 19, 2026 used external AI services for document recognition and result structuring, and used identifiers converted from the original IP and a random visitor ID for usage limits.
- The Company does not use personal information to make, in a fully automated manner, decisions that significantly affect data subjects’ rights or obligations, such as whether to accept a request.
AI inputs and outputs, external model providers, retention and training, processing of pseudonymized information, and how to object for services provided to customer organizations are explained in separate service privacy documents and the AI Use Notice.
12. Remedies for Infringement of Rights
- Personal Information Infringement Report Center (KISA): 118 (privacy.kisa.or.kr)
- Personal Information Dispute Mediation Committee: 1833-6972 (kopico.go.kr)
- Korean National Police Agency: 182 (ecrm.police.go.kr)
- Supreme Prosecutors’ Office: 1301 (spo.go.kr)
13. Changes to this Policy and Revision History
When this Policy is changed, the effective date and main changes are announced so that they can be checked on the website. Changes that significantly affect data subjects’ rights are announced with sufficient notice. Previous versions of the Policy may be requested at the email address in Section 1.
| Effective date | Main changes |
|---|---|
| October 25, 2026 | Restated, for the document upload record recognition demo that ended on October 19, 2026, the retention and destruction of uploads made before the end, external processing and cross-border transfer, and the demo cookie |
| October 1, 2026 | Changed the operator to Bananatouch Inc. and designated a Chief Privacy Officer; reflected consultation and service brochure request items; changed the record recognition demo to a sample-based format and removed document upload, external AI processing and demo cookie items |
| September 30, 2026 | Reflected the processing items and periods of the public OCR demo, external AI processing and anonymous demo cookies |
| August 11, 2026 | Clarified the website scope; reflected actual demo request and visit record items; supplemented outsourcing and cross-border transfer to Resend and Google Workspace, cookies, non-use of AI and procedures for exercising rights |
| May 1, 2026 | First published |
— Addendum: This Policy takes effect on October 25, 2026. —