Privacy Policy

How we use, keep and delete the personal information collected on this site, and how we protect your rights.

Cooking Transfer AI ("the Company" or "we") protects the personal information of visitors to this website (a public site that introduces the business and takes partnership and Priority Partner applications; "the Site") in line with Korea's Personal Information Protection Act (PIPA) and related laws, and this policy explains how that information is handled. It covers the personal information you enter yourself on the Site, such as in applications and inquiries. (Data handled by the separately operated learner app and admin systems will be covered in a separate notice at the official launch stage.)

Effective date: October 11, 2026 · Version: 2026-10-11-v4

1. What we collect and how

We collect the following through the forms you fill in yourself. Each field is marked required or optional, and leaving optional fields blank has no consequences for you.

  • Partnership and Priority Partner applications (/en/apply): For everyone — contact person's name, business name and invitation code (required); email and phone number (optional, but email is required for Priority Partners); self-introduction, photos and intro video files (optional); and, if account sign-in is used, your Kakao member ID (the unique account number Kakao gives us, and when the account was connected to this service) or your Google account ID and email, together with a verification record (sign-in method, time, IP address and browser details). Korean head restaurants — cuisine category, year founded, location (city/district), average wait at peak time and signature dishes (required). Priority Partners — headquarters country, state (if in the U.S.) and address (city level), the countries and U.S. states you'd like to operate in, franchise operating experience and the brands you run (required).
  • Inquiry (/en/contact): display name (a nickname is fine; required); email (optional; used to reply and kept private); subject and message (required); for private inquiries, a password (stored with one-way encryption). If you sign in with Google: account ID and email (optional).
  • "Likes" on our listings page (/en/agreements): a Google account ID and a browser device ID, used to identify U.S. visitors and to prevent duplicate likes and enforce limits.

2. Why we process it

  • To receive, review and respond to partnership and Priority Partner applications, and to check whether they are a good fit (for Priority Partners, this includes checking the legal steps that apply in each region).
  • To run the inquiry board and answer questions.
  • To list partnerships and applicants publicly with consent (Section 7) and to count "likes" as a signal of demand.
  • To prevent misuse, verify identity and keep the service running reliably.

3. How long we keep it, and how we delete it

  • Retention: If no formal contract is signed, application data is kept for 1 year from the application date and then deleted. If a contract is signed, it is kept for as long as the contract is in force. Inquiries are deleted within 1 year after they are resolved. Intro videos attached to an application are kept for only 30 days after upload and are then deleted automatically (within that time we blur any faces and post the video on our company YouTube channel). Documents we receive during review to confirm identity or authority (such as a business registration certificate) are kept for 90 days after the application is approved or declined, and are then deleted automatically. Account verification records (sign-in method, account number, connection time, verification time, IP address and browser details) are kept to check for false applications and to handle disputes: for 1 year from verification if the record was used for an application, and for 30 days if you signed in but never applied. They are then deleted automatically. Where the law requires longer retention, we keep the data for that period.
  • Procedure: Once the retention period ends or the purpose has been fulfilled, the data is deleted without delay.
  • Method: Electronic files are deleted permanently so they cannot be recovered; any printouts are shredded or incinerated.

4. Sharing with third parties

As a rule, we do not share your personal information with anyone outside the Company. We share it only in the cases below, and only if you consent (you can still apply or send an inquiry without consenting).

  • Sharing within Korea (PIPA §17): Recipient: Korean sponsor (Republic of Korea) / Items: name, email, business name, message / Purpose: reviewing identity and business fit, and contacting you / Retention: until the review ends or 1 year passes, whichever comes first.
  • Sharing abroad (PIPA §28-8): We do not share application data with any third party outside Korea during the application and review stage. If a formal contract requires us to share it with the other side (a Korean head restaurant or a Priority Partner, including companies in the U.S. or elsewhere), we will first tell you who will receive it, in which country, which items, for what purpose and for how long, and ask for your separate consent.

5. Processors

We do not currently entrust the processing of your personal information to any outside processor. If we do so in the future (for example, for cloud hosting or email delivery), we will name the processor and the work in this policy and supervise it as the law requires.

6. Cookies, logs and other automatic collection

  • We do not use third-party analytics or advertising tools (such as Google Analytics) or tracking cookies, and we do not show ads based on your behavior.
  • Browser local storage is used on your device only for site functions, such as remembering your language and preventing duplicate "likes" or enforcing their limit. It is not used to track your behavior or send it to our server.
  • IP addresses and access logs are processed to run and secure the service, and to tell whether a "like" comes from the U.S. (This is done on a limited basis during the pilot stage.)

7. Information published with consent

Business information shown on the /en/agreements page after admin approval is published only with the listing consent you gave when applying, and is removed immediately if that consent is withdrawn.

  • May be published: Korean head restaurants — business name, cuisine category, city (city/district), average wait at peak time, year founded, signature dishes, self-introduction, photos and the public intro video. Priority Partners — company name, headquarters country and state, operating experience, brands, self-introduction and photos.
  • Never published: detailed addresses (including headquarters addresses), target operating areas, revenue figures, royalties, family information or other sensitive information, and your name, email or phone number.

8. Your rights and how to exercise them

You can exercise the following rights at any time:

  • Ask to see, correct or delete your personal information or to stop its processing, and withdraw your consent.
  • Send requests to the Privacy Officer below and we will act without delay. You may also act through a legal representative or someone you have authorized.

9. How we keep it secure

We protect personal information with layered security measures, built in from the design stage and strengthened step by step, including encryption in transit, minimal and controlled access, and external security reviews. Core business data such as head restaurants' recipes is likewise isolated by design to keep it from outside exposure, and some security mechanisms are switched on in stages as the service develops.

10. Privacy Officer

We have appointed a Privacy Officer who oversees how personal information is handled and deals with your questions, complaints and requests for remedy.

11. If your rights are infringed

If you need advice or a remedy for a privacy infringement, you can contact these Korean bodies:

  • Personal Information Dispute Mediation Committee: 1833-6972 (kopico.go.kr)
  • Privacy Infringement Report Center (KISA): 118 (privacy.kisa.or.kr)
  • Supreme Prosecutors' Office, Cyber Investigation Division: 1301
  • Korean National Police Agency, Cyber Investigation Bureau: 182

12. Visitors outside Korea (GDPR, CCPA)

The Site is available in Korean and English and can be visited from abroad. If you live in the EU (GDPR) or California (CCPA/CPRA), you have rights under your local law, including access, deletion and objection to processing, and you can send requests to the Privacy Officer above. Specific legal wording will be added to this policy after legal review at the official launch stage.

How we handle publicly available information about content creators is explained in a separate Creator Information Notice.

13. Business information

We are preparing to set up a new company, so business details such as the registration number, representative and address have not been finalized yet. Once the company is incorporated, we will publish the business information required under Korea's E-Commerce Act and related laws in this policy and on the Site. Until then, please send privacy questions to the Privacy Officer contact above.

14. Changes to this policy

We may revise this policy when laws or the service change. Any revision will be posted on this page with its effective date, and we will give separate notice of significant changes by reasonable means.

Revision history: October 11, 2026 (v4) — switched Kakao account sign-in on partnership applications to a check our server makes directly with Kakao, named the Kakao member ID among the items we collect, and added how long we keep account verification records (1 year if used for an application, 30 days otherwise, then deleted automatically). · October 10, 2026 (v3) — split applications into partnerships (Korean head restaurants) and Priority Partner applications, and added what we collect from Priority Partners (headquarters country and state, and the countries and states they'd like to operate in). We also corrected which fields are required or optional, added the invitation code and account sign-in items, limited published location details to country and state instead of the headquarters address, and updated the cross-border sharing section to match how we actually operate. · October 8, 2026 (v2) — added how long we keep intro video files sent with partnership applications (deleted automatically 30 days after upload) and identity or authority documents (deleted automatically 90 days after an approval or rejection becomes final). · June 15, 2026 (v1) — first version.

Some of the security mechanisms described here are switched on in stages as the service develops. The final legal wording will be settled after legal review at the official launch stage.