Privacy Policy

Upcode (Easy BRG) (the “Service”) maintains this policy to protect personal data and to handle related concerns promptly, in accordance with the Personal Information Protection Act of Korea (PIPA). The Service does not crawl arbitrary websites and does not continuously collect your browsing activity; it only handles the necessary values from pages you open on supported booking sites.

This is a courtesy English translation. If this translation and the Korean 개인정보 처리방침 differ, the Korean version prevails.

Effective date: 2026-08-11

Article 1 · Personal data we collect

The Service collects and uses the following items.

a. Sign-up and authentication (Google sign-in)

Google account identifier, email address, name (if set on your Google account), internal member identifier, sign-in session token
Date of birth: processed once, at sign-up or on your first sign-in after a change to the minimum-age requirement, solely to confirm you are 18 or older. Only users aged 18 or older may register. Your date of birth is never stored or logged; only the over-18 confirmation result is kept on your account.
For paid (Pro) use: plan status and expiry date

b. While using rate comparison

Search conditions: hotel name, city, country, check-in/check-out dates, guest count, room count
Compared rates: price, currency, whether taxes are included, room type, meal/cancellation terms, the booking site address (domain only — no paths or query strings), and capture time
On manual-entry sites, you select a recent comparison and site, then enter the total and currency you checked. To determine the save method, the Chrome extension checks the active tab URL once on your device, derives only the hostname, and immediately discards it. The URL and hostname are neither stored nor transmitted, and Manual entry does not read the page title or content.
Booking conditions on official hotel sites are processed by the Chrome extension only when that hotel chain’s permission status is active. For chains that are inactive in the latest Chrome extension, the extension does not read the page body or title, and the server also refuses to store booking conditions for that chain.

c. On payment (paid use)

Order identifier, product name, payment amount, payment status, payment approval key, completion time
Payment-method details such as card numbers are handled directly by the payment processor (Toss Payments) and are never stored on the Service’s servers.

d. Automatically generated data

Service usage records (search, comparison, and claim history), access times
Automatic-capture failure diagnostics: supported-site domain, failure reason code, whether key fields were detected, and the Chrome extension version (no page address, hotel name, or page content)

Article 2 · Why we process personal data

Identifying and authenticating members and keeping you signed in
One-time confirmation, at sign-up or on first sign-in after a minimum-age change, that you may use the Service (18 or older), and management of that confirmation result
Hotel rate comparison (Best Rate Guarantee, BRG) and result guidance
Managing paid-service payments and usage history
Authorized operators’ payment settlement and monitoring of automatic-comparison operations
Service improvement and abuse prevention (such as rate limiting)

Article 3 · Retention periods

In principle, personal data is destroyed without delay once its processing purpose is fulfilled. The Service’s automatic retention and deletion policy is as follows.

Sign-in session tokens: expire and are deleted after 7 days of inactivity, or 30 days at most
Date of birth: discarded immediately after the over-18 check; never stored
Over-18 confirmation result: kept with your account until you delete the account
The Chrome extension’s Google authentication token for age verification: kept in Chrome session storage for up to 5 minutes while waiting for date-of-birth input, and deleted on completion, failure, sign-out, expiry, or browser close
Search history: the most recent 10 searches on Free, 200 on Pro (older entries are deleted automatically). Searches and comparisons whose check-in date has passed are deleted automatically at sign-in (claim records are kept for statistics). Of these, direct web searches with no automatic capture or claim attached keep only the 3 most recent, and search conditions are not stored separately in cookies or browser storage.
Comparison (capture) history: up to 10 per search on Free, 20 on Pro; older entries deleted automatically
Anonymous rate-pool data (Article 4 below): kept only for the day of collection, then destroyed
On account deletion: related personal data, including the Google account identifier, is destroyed and operator identifiers in audit history are anonymized (transaction records that must be retained by law are kept separately for the required period)

Transaction records that must be retained under the Act on Consumer Protection in Electronic Commerce and related statutes are kept for the periods below.

Records on contracts and withdrawal of offers: 5 years
Records on payment and supply of goods or services: 5 years
Records on consumer complaints and dispute resolution: 3 years
Completed, failed, or cancelled transactions past the 5-year retention period, and their linked payment events, are destroyed automatically by a scheduled batch job

Article 4 · Anonymous rate statistics

The Service may anonymously aggregate rates confirmed by multiple users and show them as a “suggestion” (for reference) to other users searching the same conditions. This aggregation stores nothing that could identify who collected the rate (no member identifier, no page address), and a rate is included only when the official and candidate rates’ dates, guest count, room count, and room type are all confirmed to match, with no explicit mismatch in meal, cancellation, or tax terms. The data is used only on the day of collection and then destroyed.

Article 5 · Third-party provision

The Service does not provide personal data to third parties without your consent, except where required by law or upon a lawful request from an investigative authority. (For processing entrusted to service providers, see Article 6.)

Article 6 · Entrusted processing and cross-border transfers

The Service entrusts the following processing to provide the Service.

Processor	Entrusted work	Data involved	Location	When and how	Retention basis
Amazon Web Services (AWS)	Web/API server and database hosting	Member, search/comparison, claim, and transaction records the Service collects and stores	South Korea (Seoul region)	Processed over HTTPS during Service use	Retention periods in this policy
Toss Payments Co., Ltd.	Payment processing and payment-history management	Order and payment details, email (shown in the payment window — card details are handled by Toss directly)	South Korea	Processed over HTTPS at payment request/approval	Applicable law and Toss Payments’ policy
Anthropic, PBC	AI-assisted rate extraction, comparison explanations, and claim checklist tips	Pattern-extracted amount/date/guest tokens; numeric, date, enum, and closed condition tokens; chain rules and checklist states (no page text, titles, URLs, hotel names, free-text room/meal/ cancellation descriptions, claim bodies, member identifiers, or emails)	United States (cross-border)	Sent over HTTPS when you run an AI-assist feature	Anthropic’s policy and contractual retention terms
Google LLC	Google account sign-in (authentication)	Authentication token, email and profile	United States (cross-border)	Sent over HTTPS when you sign in with Google	Google’s policy and contractual retention terms

Cross-border transfers — personal data leaves Korea only for AI processing (Anthropic, US) and Google sign-in (US). Closed tokens and rule data sent to the AI are not stored separately by the Service and are discarded after processing; page text, titles, URLs, hotel names, free-text room/meal/ cancellation descriptions, claim bodies, screenshots, raw HTML, cookies, passwords, and card details are never sent. If you do not wish to use Google sign-in, member features are unavailable; if you do not wish to use AI assistance, those assist features are unavailable. Rate comparison and history work without the AI assist features.

Article 7 · Your rights and how to exercise them

You may request access to, correction or deletion of, or suspension of processing of your data at any time.
Send requests by email to the privacy officer below; the Service will act without delay (within the statutory period).
Signing out revokes your sign-in session immediately.
Deleting your account from the account page immediately deletes your account and your search, comparison, and claim history. Transaction records that must be kept by law are retained separately for the required period. If you need help with deletion, contact flowx.system@gmail.com.

Article 8 · How data is destroyed

Data past its retention period, or whose purpose is fulfilled, is destroyed without delay.
Electronic files: permanently deleted from the database so they cannot be recovered.
Automatically deleted data (sessions, searches, comparisons, anonymous statistics) is destroyed by the system under the retention policy above.

Article 9 · Security measures

Sign-in uses Google authentication only, with no passwords — the Service stores no passwords.
Session tokens are issued from cryptographic randomness and expire on schedule (7 days unused, 30 days maximum).
Payments are protected against tampering by server-side amount checks, re-verification against Toss’s payment lookup, and duplicate-processing guards; a full refund revokes Pro access.
All traffic is protected with HTTPS, and access is restricted to allowed origins (domains).
Authorized operators see masked emails and minimal aggregate data for payment settlement and automatic-comparison operations, and manage per-chain feature permission status. Booking-condition text, payment approval keys, and card details are not visible in the admin screens.

Article 10 · Cookies and similar technologies

Easy BRG itself does not set advertising or tracking cookies.
Easy BRG may receive a commission when you visit or book through a link marked “Affiliate link.”
When you follow an “Affiliate link” to an external site, that destination site may use affiliate identifiers, cookies, or similar technologies under its own privacy and cookie policies.
To keep you signed in, the Service uses an authentication cookie (brg_session) and a request-forgery protection cookie (brg_csrf). The authentication cookie is httpOnly, so JavaScript cannot read it, and it expires after 30 days at the latest (sooner if unused for 7 days). You stay signed in after closing the browser, so on a shared computer be sure to sign out when finished.
The Chrome extension does not read or transmit cookies, passwords, payment details, screenshots, or raw HTML.
Signing out or clearing your browser cookies removes the sign-in data.

Article 11 · What we do not collect

Screenshots or raw HTML
Cookies, other sites’ login sessions, or passwords
Payment card details (never stored on the Service’s servers)
Full browsing history
No server-side automatic price crawling or scraping

Article 12 · Privacy officer

Operator (trade name): Upcode
Business registration number: 502-57-00970
Privacy officer: 강희욱
Contact (email): flowx.system@gmail.com

Article 13 · Remedies for privacy infringement

For counseling or dispute mediation regarding privacy infringement, you may contact the following Korean authorities.

Personal Information Dispute Mediation Committee (privacy.go.kr / +82-1833-6972)
KISA Privacy Infringement Report Center (privacy.kisa.or.kr / 118, within Korea)
Supreme Prosecutors’ Office Cybercrime Division (spo.go.kr / 1301, within Korea), National Police Agency Cyber Bureau (ecrm.police.go.kr / 182, within Korea)

Article 14 · Changes to this policy

This policy may be revised to reflect changes in law or the Service. Revisions and their effective dates will be announced on this page.

Change notice: 2026-08-11 Added notice about affiliate-link commissions and possible destination-site affiliate tracking.