Privacy Policy
Effective Date: August 16, 2026
SECONDPLAN CO.,LTD (Second Plan Inc.; Developer name: SecondPlan Co; Business Registration No. 706-86-00311; 802, 62 Sangwon-gil, Seongdong-gu, Seoul, Republic of Korea; Representative: KIM SUNG MO; hereinafter the "Company") complies with the Personal Information Protection Act and other applicable laws of the Republic of Korea, and handles users' personal information with care. This Policy applies to the apps 세렌메이트:True AI, True Connection (Serenmate: True AI, True Connection; formerly "리얼메이트: Real AI", "REALMATE GF"; package name com.realmate.mobileapp) and 세렌메이트 BF: True AI, Connection (Serenmate BF: True AI, Connection; formerly "리얼메이트 Boy Friends", "REALMATE BF"; package name com.realmate.mobileapp.bf), which the Company provides through Google Play and the Apple App Store, and to related services (hereinafter the "Services").
1. Categories of Personal Information Collected and Methods of Collection
The Company collects the following personal information in order to provide the Services.
- Upon sign-up: email address, nickname, password (or the relevant platform identifier when social login is used)
- When using paid services: payment records (payment method details are processed by the payment gateway, and the Company does not store full card numbers)
- Collected automatically in the course of service use: device information (OS, device model), access logs, service usage records, cookies
- When contacting customer support: email address, content of the inquiry
2. Purposes of Collection and Use of Personal Information
- Member identification, verification of intent to sign up, and member management
- Providing, maintaining and improving the Services, and developing new services
- Payment, settlement and refund processing for paid services
- Responding to customer inquiries and delivering notices
- Preventing misuse of the Services and maintaining a safe usage environment
- Fulfilling obligations under applicable laws
3. Processing of Conversation Data
- Conversations between a user and an AI companion are stored in order to provide the Services (maintaining conversational context and personalization).
- The Company does not provide conversation data to third parties for marketing purposes without the user's separate consent.
- Where conversation data is used to improve service quality, it is used only after being de-identified so that individuals cannot be identified.
4. Retention and Use Period of Personal Information
- As a general rule, the Company destroys personal information without delay once the purpose of its collection and use has been achieved or the member withdraws from the Services.
- However, the following information is retained for the periods specified by applicable laws.
- Records on contracts or withdrawal of subscription: 5 years (Act on the Consumer Protection in Electronic Commerce)
- Records on payment and supply of goods: 5 years (Act on the Consumer Protection in Electronic Commerce)
- Records on consumer complaints or dispute resolution: 3 years (Act on the Consumer Protection in Electronic Commerce)
- Records on access logs: 3 months (Protection of Communications Secrets Act)
5. Provision of Personal Information to Third Parties
As a general rule, the Company does not provide users' personal information to external parties. The following are exceptions.
- Where the user has given prior consent
- Where required under applicable laws, or where an investigative agency makes a request for investigative purposes in accordance with the procedures and methods prescribed by law
6. Entrustment of Personal Information Processing
To the extent necessary to provide the Services, the Company entrusts personal information processing tasks to external specialist providers as set out below. When entrusting such tasks, the Company stipulates the matters necessary to ensure that personal information is managed safely, including by concluding an entrustment agreement in accordance with applicable laws, and discloses any determination of or change to the entrusted providers without delay through this Policy.
- Entrusted provider: Supabase, Inc. / Fly.io, Inc. / Cloudflare, Inc. / Upstash, Inc. / Vercel, Inc. / Entrusted task: cloud infrastructure operation and data storage / Retention and use period: until account deletion or termination of the entrustment agreement
- Entrusted provider: Google LLC / Apple Inc. / Entrusted task: payment processing and payment gateway services / Retention and use period: until account deletion or termination of the entrustment agreement
- Entrusted provider: Google LLC / DeepSeek / xAI Corp. / Entrusted task: AI model operation (conversation processing) / Retention and use period: until account deletion or termination of the entrustment agreement
7. Overseas Transfer of Personal Information
Time and method of transfer: transmitted in encrypted form over the information and communications network at the time the Services are used
| Category | Transferee | Country | Items Transferred | Purpose of Use | Retention and Use Period |
|---|---|---|---|---|---|
| Infrastructure | Fly.io, Inc. | Singapore | All request data processed while the Services are running | Server hosting | Held temporarily during processing, not stored |
| Infrastructure | Supabase, Inc. | Singapore | Account information, conversation history, payment and coin transactions, usage records | Database operation | Until account deletion |
| Infrastructure | Cloudflare, Inc. | United States | Uploaded and generated images and videos | Storage and delivery | Until a deletion request or account deletion |
| Infrastructure | Upstash, Inc. | Japan | Sessions, queues and cache (including userId) | Cache and job queue | Until cache expiry (up to 30 days) |
| Infrastructure | Vercel, Inc. | United States | User data as viewed by an administrator at the time of lookup | Admin console | Not stored |
| Infrastructure | Expo(650 Industries, Inc.) | United States | App version and device runtime information | App update distribution | Until the purpose is achieved |
| LLM | Google LLC | United States | Conversation messages, form of address and profile settings, photos sent by the user | Generating conversation responses | Destroyed immediately after the response is generated (logs up to 90 days) |
| LLM | DeepSeek | China | Conversation messages, form of address and profile settings | Generating conversation responses | Destroyed immediately after the response is generated (logs up to 90 days) |
| LLM | xAI Corp. | United States | Conversation messages | Response fallback | Destroyed immediately after the response is generated (logs up to 90 days) |
| Image and video | Google LLC | United States | Generation prompts, reference and uploaded images | Image and video generation | Destroyed immediately after generation (logs up to 90 days) |
| Image and video | WaveSpeed AI | United States, Singapore, China | Generation prompts, reference images | Image and video generation | Destroyed immediately after generation (logs up to 90 days) |
| Image and video | AI/ML API | United States, China | Generation prompts, starting images | Video generation | Destroyed immediately after generation (logs up to 90 days) |
| Image and video | Runway AI, Inc. | United States | Generation prompts, starting images | Video generation | Destroyed immediately after generation (logs up to 90 days) |
| Analytics | Google LLC | United States | userId, subscription tier, sign-up date, usage and payment events | Usage statistics and improvement | 14 months |
| Advertising | TikTok Pte. Ltd. | Singapore, United States | userId, sign-up and payment conversion events, advertising identifier | Ad performance measurement | Until the purpose is achieved (up to 90 days) |
| Advertising | Meta Platforms, Inc. | United States | Install, sign-up and purchase events, advertising identifier | Ad performance measurement | Until the purpose is achieved (up to 90 days) |
| Push | Google LLC | United States | Device push token, notification content | Sending notifications | Until token expiry or account deletion |
| Push | Apple Inc. | United States | Device push token, notification payload | Sending notifications | Until token expiry or account deletion |
| Payment and authentication | Google LLC | United States | Email, authentication UID, purchase token | Authentication and payment verification | Until account deletion |
| Payment and authentication | Apple Inc. | United States | Email, authentication identifier, receipt | Authentication and payment verification | Until account deletion |
| Operations | Telegram FZ-LLC | UAE | Nickname, userId, subject of inquiry | Operational notifications | Until the purpose is achieved (up to 90 days) |
Contact details for each transferee can be found through the inquiry channels published in that company's own privacy policy.
ADPOPCORN (IGAWorks) is a domestic operator in the Republic of Korea and is therefore not subject to overseas transfer.
8. Users' Rights and How to Exercise Them
- Users may view or correct their personal information at any time, and may request withdrawal of consent to its collection and use (account deletion).
- These rights may be exercised through the settings menu within the Services, or by contacting the Privacy Officer in writing or by email, and the Company will take action without delay.
- The Company does not collect personal information from children under the age of 14, and where it is confirmed that such information has been collected without the consent of a legal representative, it is destroyed without delay.
9. Procedures and Methods for Destroying Personal Information
- Information in electronic file form is deleted using technical methods that make recovery impossible.
- Personal information printed on paper is destroyed by shredding or incineration.
10. Measures to Ensure the Security of Personal Information
- Encryption of personal information: important information such as passwords is encrypted for storage and management.
- Technical countermeasures against hacking and similar threats: installation and periodic updating of security programs, and access control
- Minimization of, and training for, staff who handle personal information
11. Use of Cookies
The Company may use cookies in order to provide users with customized services. Users may refuse the storage of cookies through their browser settings, in which case the use of some services may be restricted.
12. Privacy Officer
- Privacy Officer: Mark Lee (Business Director)
- Email: mark@secondplan.co
- Phone: 070-7178-4912
For reports of or consultations regarding infringements of personal information, you may also contact the Korea Internet & Security Agency Privacy Center (privacy.kisa.or.kr, 118 without area code) or the Personal Information Dispute Mediation Committee (www.kopico.go.kr, 1833-6972).
13. Duty of Notification
Where any addition, deletion or amendment is made to this Policy, notice will be given through announcements within the Services from 7 days before the effective date.
Addendum
- This Policy takes effect on August 16, 2026.
- This Policy applies equally to the services and users transferred from the former LABOON Co., Ltd. pursuant to the business transfer of August 1, 2026.
- Where the name of a service is changed, this Policy applies equally to the service under its changed name.
Governing Language
This document is provided in Korean as the governing version. In case of any discrepancy between the Korean and English versions, the Korean version shall prevail.