LimePost Privacy Policy

Article 1 (General Provisions)

LimePost (hereinafter “the Company”) establishes and discloses this Privacy Policy in accordance with Article 30 of the Personal Information Protection Act of South Korea, in order to protect the personal information of data subjects and to handle related grievances promptly and smoothly.

This Policy applies to the AI-powered SNS marketing automation service for small business owners, “LimePost” (hereinafter “the Service”), provided by the Company.

Article 2 (Items of Personal Information Collected)

2.1 Items Collected at Account Sign-up

2.2 Items Collected at Store Registration

2.3 Items Collected upon Instagram Business Account Connection (Meta API)

When and only when the user explicitly approves the Instagram connection, the following information is collected via the Meta API.

instagram_business_basic permission (collected only upon explicit user approval):

instagram_business_content_publishing permission (used only upon explicit user approval):

This permission is used solely to upload content to the user's store Instagram account, not for data collection. No separate data is collected under this permission.

2.4 Information Automatically Generated and Collected During Service Use

Article 3 (Methods of Collecting Personal Information)

1. Direct input by the user at the time of account sign-up or store registration
2. Automatic collection of public information from a Naver Place URL provided by the user
3. Collection via the Meta API, only after the user explicitly approves the Instagram connection
4. Automatic generation during service use

Article 4 (Purposes of Collection and Use of Personal Information)

4.1 Member Management

• Verification of intent to register, identification and authentication of the user
• Password reset, delivery of notices

4.2 Service Provision

• Generation of AI-based store diagnosis reports
• Automatic generation of Instagram post content (images, captions, hashtags)
• Publishing to the store's Instagram account upon explicit user approval (within the scope of the instagram_business_content_publishing permission)
• Payment processing and payment history management

4.3 Service Operation and Improvement

• Analysis of service usage statistics
• Development of new features and quality improvement
• Prevention of fraudulent use, security management

The Company does not use personal information for purposes other than those stated above. No sharing with ad networks. No sales to data brokers.

Article 5 (Retention and Use Period of Personal Information)

In principle, the Company destroys personal information without delay once the purposes of collection and use have been fulfilled. However, when retention is required by applicable laws, the Company stores the information for the specified period as follows.

Deletion procedure: Upon membership withdrawal, store deletion, or Instagram connection revocation, logical deletion is performed immediately and all backup copies are completely purged within 30 days. This 30-day window exists to provide a safe recovery period for accidental deletion requests by the user.

Article 6 (Provision of Personal Information to Third Parties)

The Company processes the personal information of users only within the scope specified in “Article 4 (Purposes of Collection and Use of Personal Information)” of this Policy, and does not, in principle, use such information beyond this scope or provide it to outside parties without the user's prior consent.

The following cases are exceptions.

1. When the user has given prior consent
2. When required by applicable laws, or when an investigative agency requests information for investigative purposes in accordance with the procedures and methods specified by law

Article 7 (Entrustment of Personal Information Processing)

When entering into entrustment contracts, the Company specifies, in accordance with Article 26 of the Personal Information Protection Act, the prohibition of processing personal information for purposes other than the entrusted work, technical and managerial protection measures, restrictions on re-entrustment, and supervision of entrustees, so that entrustees process personal information safely.

Article 8 (Rights and Obligations of Data Subjects and Methods of Exercise)

Users may exercise the following rights related to personal information protection against the Company at any time.

1. Request to view personal information
2. Request to correct any errors
3. Request for deletion
4. Request to suspend processing

Such rights may be exercised by submitting a written or email request to the Company's Personal Information Protection Officer (email listed in Article 12). When the in-service “Settings > Account Management” menu is introduced in the future, the Company will provide a separate notice and an update to this Privacy Policy to inform users of the new method of exercise.

8.1 Meta · Instagram Data Deletion Request

When the user revokes the Instagram connection or deletes a store, all data collected via the Meta API is completely deleted from LimePost's servers within 30 days (immediate logical deletion + complete purge of backup copies within 30 days).

Separate data deletion requests may be submitted by email to the Company's Personal Information Protection Officer (song2yo@gmail.com). When the in-service “Settings > Store Management > Delete Store” or “Settings > Revoke Instagram Connection” menus are introduced in the future, the Company will provide a separate notice and an update to this Privacy Policy to inform users of the new method of exercise.

8.2 Membership Withdrawal

Upon withdrawal of membership, all personal information is completely deleted within 30 days. However, information whose retention is required by laws as specified in Article 5 will be separately stored for the required period before destruction.

Article 9 (Measures to Ensure the Safety of Personal Information)

9.1 Technical Measures

• All communications are encrypted via HTTPS (TLS 1.2 or higher)
• Passwords are stored using one-way encryption (hashing)
• Database storage is encrypted (Supabase standard encryption)
• Meta API access tokens are stored in a separate secure storage area and are not exposed in code or logs

9.2 Managerial Measures

• Access to personal information is minimized (limited to the solo founder)
• Regular security audits
• Prompt notification in the event of a security incident

9.3 Physical Measures

• Data centers apply the standard security measures of the entrustees (Supabase, Vercel)

Article 10 (Installation, Operation, and Refusal of Automatic Collection Devices)

The Company uses “cookies” to store and retrieve user information from time to time in order to provide individualized customized services.

10.1 Purpose of Use of Cookies

• Maintenance of login state
• Storage of user preferences

10.2 How to Refuse Cookie Settings

Users may control the acceptance or blocking of cookies through their web browser settings. However, if cookies are blocked, some service functions may be difficult to use.

10.3 Analytics Tools

The Company uses its own internal service usage logs for service operation. No external advertising tracking tools (such as Facebook Pixel or Google Analytics) are used.

Article 11 (Personal Information of Children under 14)

The Company does not collect personal information of children under the age of 14. The Service is intended for adult users who operate stores.

Article 12 (Personal Information Protection Officer)

Users may direct any inquiries, complaints, or requests for remedies regarding personal information protection that arise while using the Service to the Personal Information Protection Officer.

Article 13 (Methods of Remedy for Infringement of Rights and Interests)

• Personal Information Dispute Mediation Committee: (without area code) 1833-6972, www.kopico.go.kr
• Personal Information Infringement Report Center: (without area code) 118, privacy.kisa.or.kr
• Supreme Prosecutors' Office: (without area code) 1301, www.spo.go.kr
• National Police Agency: (without area code) 182, ecrm.police.go.kr

Article 14 (Changes to the Privacy Policy)

This Privacy Policy is effective from the date of enforcement. In the event of any additions, deletions, or corrections to its contents in accordance with laws or policies, the Company will provide notice via the notices section at least 7 days prior to the effective date of such changes.

Supplementary Provisions

This Policy shall take effect from May 20, 2026.

Revision History