Home · Privacy Policy

Privacy Policy

Effective: 2026-08-28

This is a reference translation. The Korean version is the legally binding text; if the two differ, the Korean version prevails.

JOSHUA & COMPANY Inc. (the "Company") establishes and discloses this Privacy Policy under Article 30 of the Personal Information Protection Act, to protect the personal data of data subjects and to handle related grievances promptly. It applies to the AI dream reading service "Ask Dalrae" (the "Service").

The Service can be used without signing up or logging in. The Company does not collect information that directly identifies an individual, such as name, contact details or date of birth.

Article 1 (Items collected and how)

The Company collects only the minimum needed to provide the Service.

Unless a user writes it into the dream themselves, the Company does not collect information that identifies an individual. When entering a dream, please take care not to include sensitive or identifying information such as a real name, contact details, resident registration number or account number.

The Company does not collect sensitive information under Article 23 of the Personal Information Protection Act, such as ideology, belief, health or sex life, nor unique identifying information under Article 24 of the same Act.

Planned additions

1. Kakao social login. If social login is introduced, profile information (nickname, profile image) will be received from the Kakao account. A separate consent procedure will be provided and this Policy will be amended and announced in advance.
2. Paid purchases. If the sale of Coins begins, payment method information and transaction records will be processed through a payment gateway. Even then the Company will not itself store payment method information such as card numbers, and this Policy will be amended and announced.

Article 2 (Purposes of processing)

1. Providing the Service — generating and displaying AI readings for the dreams users enter.
2. Improving quality — supplementing the dream dictionary, checking output quality, analysing causes of errors.
3. Operating the Service and preventing abuse — applying the daily usage limit, blocking abnormal bulk requests, keeping servers stable.
4. Statistics and usage analysis — producing usage statistics in a form that cannot identify an individual.
5. Responding to enquiries — verifying and handling enquiries, complaints and refund requests.

Where a purpose changes, the Company takes the necessary measures, including obtaining separate consent under Article 18 of the Personal Information Protection Act.

Article 3 (Retention and use periods)

Where a separate retention period is prescribed by law, the data is kept for that period.

Personal data whose retention period has passed or whose purpose has been achieved is destroyed without delay. Electronic files are deleted by technical means that make recovery impossible, and printed materials are shredded or incinerated.

Article 4 (Entrustment of processing)

The Company entrusts processing as follows. When entering into an entrustment contract, the Company specifies matters concerning safe management in the document under Article 26 of the Personal Information Protection Act and supervises compliance.

Any change to the entrusted work or the processor will be disclosed through this Policy.

Article 5 (Overseas transfer)

Under Article 28-8 of the Personal Information Protection Act, the Company discloses that it transfers personal data overseas as follows.

Users may refuse the overseas transfer of their personal data. However, because the transfer is essential to generating readings and to providing the Service itself, the Service cannot be used if it is refused.

Article 6 (Provision to third parties)

The Company processes personal data only within the purposes set out in Article 2 and does not provide it to third parties without the user's consent, except where the user has consented in advance, where there is a special provision of law or it is unavoidable in order to comply with a legal obligation, or where an investigative agency lawfully requests it in accordance with statutory procedures. The entrustment in Article 4 is for the Company's own processing and does not constitute provision to a third party.

Article 7 (Cookies and advertising identifiers)

Use of cookies. The Company may use cookies to improve the experience of using the Service and to display advertisements. A cookie is a small text file that a website stores in the user's browser.

Advertising services. The Company plans to display advertisements through third party advertising networks such as Google AdSense and Kakao AdFit. In that connection:

1. Third party vendors, including Google, use cookies to serve ads based on a user's visits to this site or other sites.
2. Google's use of advertising cookies enables it to serve ads based on a user's visits to this site and other sites on the internet.
3. Users may opt out of personalised advertising. Personalised advertising can be turned off in Ads Settings at https://www.google.com/settings/ads.
4. To opt out of third party vendors' use of cookies more broadly, see https://www.aboutads.info/choices/ or https://optout.networkadvertising.org/.
5. Personalised advertising through Kakao AdFit can be changed under Kakao AdFit's and Kakao's own privacy notices.

Installing, operating and refusing cookies. Users may refuse the storage of cookies or delete stored cookies through browser settings. Refusing cookies may cause some limitations in using the Service. Chrome: Settings > Privacy and security > Third-party cookies. Safari: Settings > Privacy > Cookies and website data. Edge: Settings > Cookies and site permissions > Manage cookies and site data. The browser local storage values the Company uses to store the usage count and Coin balance can also be deleted directly using the browser's clear site data function.

Article 8 (Rights of data subjects and how to exercise them)

Under Articles 35 to 37 of the Personal Information Protection Act, users may at any time request access to their personal data, correction of errors, deletion, or suspension of processing.

Rights may be exercised in writing or by email at hello@joshua.site, and the Company acts on the request without delay. Where a data subject requests correction or deletion of an error, the Company does not use or provide the personal data concerned until correction or deletion is complete. Where rights are exercised through a representative, a power of attorney under the Notice on Methods of Personal Information Processing must be submitted.

A note on the anonymous nature of the Service. Because the Service is used without an account, the dream inputs the Company holds are not linked to any particular user. When requesting access, correction or deletion, please also provide information that identifies the record, such as the time of entry and part of the dream text; otherwise the request cannot be processed.

Where the personal data of a child under 14 is processed, consent from a legal representative is obtained. The Company works to avoid collecting personal data from children under 14, and destroys such data without delay where it confirms that it was collected without a legal representative's consent.

Article 9 (Measures to secure safety)

1. Administrative measures — the number of people handling personal data is kept to a minimum and they receive regular security training. An internal management plan is established and implemented.
2. Technical measures — access rights to the processing system are granted and managed at differentiated levels. HTTPS encryption is applied across the whole transmission path, and the database is protected by access control policies and authentication.
3. Minimal collection — the Service is provided without accounts, minimising the collection of identifying information itself.
4. Retention of access logs — access logs of the processing system are retained and protected against forgery or alteration.
5. Physical measures — the equipment storing data is located in cloud providers' data centres, to which those providers' physical access control policies apply.

Article 10 (Personal data protection officer)

Data subjects may direct all enquiries, complaints and requests for remedy relating to personal data protection arising from use of the Service to the protection officer. The Company answers and acts on such enquiries without delay.

Article 11 (Remedies for infringement)

1. Personal Information Dispute Mediation Committee — 1833-6972 / www.kopico.go.kr
2. Privacy Infringement Report Centre — 118 / privacy.kisa.or.kr
3. Supreme Prosecutors' Office Cyber Investigation Division — 1301 / www.spo.go.kr
4. National Police Agency Cyber Bureau — 182 / ecrm.police.go.kr

A person whose rights or interests have been infringed by a disposition or omission by the head of a public institution in response to a request under Articles 35 to 37 of the Personal Information Protection Act may request an administrative appeal under the Administrative Appeals Act.

Article 12 (Changes to this Policy)

This Policy applies from its effective date. Where additions, deletions or corrections are made, the Company announces them on the Service from 7 days before the effective date of the change. Where a change materially affects the rights of data subjects, it is announced at least 30 days in advance.

Business information