Privacy Policy

Meroni Swing (the "Service") values your privacy and complies with the Korean Personal Information Protection Act (PIPA) and related regulations.

This policy explains what personal information we collect, why we collect it, how long we retain it, and your rights regarding your data.

The Service is intended for individuals aged 14 or older. Users under 14 may not create an account or use the Service, and we do not knowingly collect personal information from children under 14. If we confirm that an account or personal information belongs to a user under 14, we will restrict the account and delete or anonymize the related personal information.

The public release version does not serve advertisements, and we do not provide or sell members' personal information to third parties for advertising purposes.

Required

Optional

User-Generated Content

Automatically Collected

Payment Information

Lesson payment features are currently not operational. When payment features are activated in the future, this policy will be updated and user consent will be obtained. Sensitive payment information such as card numbers will not be directly collected by the Service and will be processed through payment gateway (PG) providers.

• Member identification and account management
• Event, lesson, and social dance registration and management
• Team and organization management and community features
• Lesson payment and refund processing (if payment features are activated)
• Customer support and inquiry response
• Abuse prevention and service stability
• Consent record keeping (legal obligation)
• Statistical analysis for service improvement (de-identified)

Personal information is destroyed without delay once the retention period has expired or the purpose of processing has been achieved. Where retention is required by law, data is stored separately for the required period before destruction.

We do not share your personal information with third parties for advertising, marketing, or other commercial purposes. Sharing occurs only in the following cases:

• With your prior consent
• When required by law

Data Processors

Push Notifications (W3C Web Push)

The Service does not use any third-party SDK (such as Firebase Cloud Messaging) for push notifications. We use the W3C standard Web Push API with VAPID authentication, self-implemented. When delivering messages, they are sent directly to the endpoint provided by the user's browser push service (Chrome → Google FCM endpoint, Firefox → Mozilla Autopush, Safari → Apple APNs) — no separate contractual relationship exists with these providers. Message contents are end-to-end encrypted using VAPID + Web Push Encryption.

Your personal information may be transferred outside of Korea for processing by our service providers. Only the minimum data necessary for service operation is transferred, and all recipients maintain appropriate security measures.

The Service uses cookies and similar technologies for the following purposes:

• Essential cookies: Login session management, authentication token handling
• Analytics cookies: Service usage statistics via Google Analytics 4 (de-identified data, client ID-based)
• Vercel Analytics: Page views, route tracking, and Web Vitals performance metrics. Uses anonymized visitor IDs (no personally identifiable information collected)
• Diagnostic data (non-cookie): Sentry collects crash logs and performance traces for debugging and stability improvement
• Web Push subscription: When users opt in to push notifications, the browser Push API subscription (endpoint URL, encryption keys) is stored on our servers

You may refuse cookies through your browser settings, but some features of the Service may be limited. Push notification subscriptions can be revoked at any time from in-app settings.

You may exercise the following rights at any time:

• Request access to, correction, or deletion of your personal data
• Withdraw consent for data collection and use (account deletion)
• Request suspension of data processing

Profile information can be directly edited or deleted through the in-service profile editing feature. Upon requesting account deletion, your data is preserved in a recoverable state for a 30-day grace period, after which it is permanently deleted or anonymized. During the grace period, the deletion may be cancelled by signing in. However, information required to be retained by law (e.g., consent records, transaction records) will be stored separately for the applicable retention period before destruction.

Account deletion channels:

• In-app: /mypage/account/delete (email OTP verification)
• Website (no login required): https://meroniswing.com/en/account/delete-request

For inquiries regarding the exercise of these rights, please contact us at the address below.

We implement the following measures to ensure the security of your personal information:

• Encrypted password storage (Supabase Auth, bcrypt)
• HTTPS / TLS encryption for all data transmission
• Database Row-Level Security (RLS) policies
• Role separation and least-privilege admin access
• Audit logging for administrator actions
• Regular security reviews and dependency patching
• Regular database backups (managed by Supabase)
• Automatic masking of user identifiers in Sentry diagnostic data when possible

For inquiries, complaints, or remedies regarding personal data processing, please contact us at:

• Service: Meroni Swing
• Email: support@meroniswing.com

For reporting or consulting on personal information breaches in Korea, you may contact:

• KISA Privacy Center (privacy.kisa.or.kr / 118)
• Personal Information Dispute Mediation Committee (kopico.go.kr / 1833-6972)

This policy may be updated due to changes in law or service operations. Changes will be announced through the Service. For material changes, a separate consent process will be conducted.

Effective date: 2026-06-02