Effective date: August 4, 2026 · Last updated: August 4, 2026
BAWAIN ("the Operator" or "the Service") values your privacy and complies with applicable data protection regulations. This policy explains what personal data we collect, how we use, store, and delete it, and what rights you have as a user.
1. Information We Collect
a. At Registration
- Required: username, password (stored encrypted), email address
- Optional: nickname, primary language
b. Generated/Collected During Use
- Trip information you enter (trip name, country, dates, locations, routes, booking sources, budget, notes)
- Trip notes (text, attached links) you write
- Screenshot images (flight tickets, booking confirmations, etc.) uploaded for the auto-fill feature
- Email change request information (target email address, request IP address, and request time)
- Access logs, service usage history, device information (browser/OS type)
2. Purpose of Collection and Use
- Confirming registration intent, identity verification, account management
- Providing the trip itinerary management service, sharing itineraries among trip members
- Email verification, password reset, sending service-related notifications
- Preventing misuse, improving the service, and error analysis
- AI-based analysis of screenshot images (automatic recognition of ticket/reservation information)
3. Retention Period
When an account is deleted, personal data including trips you own is deleted without delay, except:
- Deleted trips are kept in the trash for 30 days for possible recovery before automatic permanent deletion.
- Email change request records used to prevent misuse are retained for 30 days and then deleted.
- Where required by applicable law, data is retained for the period specified by that law.
4. Third-Party Processing
For smooth service delivery, we entrust data processing to the following parties:
| Provider | Task | Retention |
|---|
| Brevo (Sendinblue SA) | Email verification & notification delivery | Until the delivery purpose is fulfilled |
| Google (Gemini API) | Automatic recognition of itinerary information from images | Not retained after analysis |
| Namecheap, Inc. (Singapore data center) | Server hosting and data storage | For the duration of service use |
Some of the above providers operate servers outside your country, meaning your personal data may be transferred and processed internationally. This is limited to what is necessary for providing the service.
5. Your Rights
You may exercise the following rights at any time:
- View/correct your personal data: directly via the "Edit Profile" menu in the app
- Delete your account and personal data: directly via the "Delete Account" menu in the app
- Other requests (processing suspension, objection, etc.) can be made using the contact information below.
Children under 14 are not permitted to register for the service, and we do not knowingly collect personal data from children under 14.
6. Data Deletion Procedures
Personal data is deleted without delay once its purpose has been fulfilled. Information in electronic file form is permanently deleted using methods that prevent recovery.
7. Security Measures
- Passwords are stored using one-way encryption (hashing) that cannot be decrypted.
- All communications are encrypted using HTTPS (SSL/TLS).
- Database access is restricted to the minimum necessary.
8. Use of Sessions
The Service uses sessions to maintain login state. These are used solely for service functionality, not for advertising purposes.
9. Data Protection Contact
| Operator | 최호영 (Republic of Korea national, independently operated) |
| Email | [email protected] |
For any questions regarding your personal data, please contact us using the information above. We will respond promptly and in good faith.
10. Changes to This Policy
This policy may be revised in response to changes in law or policy. Any changes will be announced within the app or on this page.