Whispot Privacy Policy
Effective Date: August 6, 2026
This Privacy Policy explains how Montan Maru ("we", "us", or "the Company"), a business registered in the Republic of Korea, collects, uses, and protects your personal data when you use the Whispot mobile application ("the Service").
Data Controller: Montan Maru Address: 101-S115, 1F, 154-29 Imbangul-daero, Gwangsan-gu, Gwangju, Republic of Korea Contact: support@whispot.co
1. Personal Data We Collect
a. Account and Service Data
| Category | Data |
|---|---|
| Required | Firebase Authentication UID, sign-in provider (Google or Apple) |
| Optional | Email address, display name, profile picture (where provided by your sign-in provider) |
| Automatically collected | Device information (manufacturer, model, OS version, app version), device identifier, IP address, service usage records, access logs |
b. Location Data — Not Collected
- We do not collect or transmit your device's GPS location to our servers.
- Location permission is used solely to display your current position on the map. Coordinates are processed only on your device and are not stored.
- Location permission is optional. All features other than the current-position indicator remain available if you decline.
- You can revoke location permission at any time in your device settings.
- Our analytics tools (Section 5) may derive an approximate location (country/region level) from your IP address. This is not your device's precise location.
c. Purchase Data
- Purchase records: city ID, product name, payment amount and currency, purchase time, store platform, store order/transaction ID
- Refund records: refund time, refund amount
- Payment card details are processed directly by Apple App Store or Google Play Store. We do not collect or store them.
2. Purposes and Legal Bases of Processing
Under the EU General Data Protection Regulation (GDPR), we process your personal data on the following legal bases:
| Purpose | Data | Legal Basis (GDPR Art. 6) |
|---|---|---|
| Account creation and management | Account and sign-in data | Performance of a contract (Art. 6(1)(b)) |
| Providing audio guides, bookmarks, and core features | Service usage data | Performance of a contract (Art. 6(1)(b)) |
| Map display and current-position indicator | Map viewport coordinates (not personal location) | Performance of a contract (Art. 6(1)(b)) |
| Processing purchases and granting access to paid content | Purchase data | Performance of a contract (Art. 6(1)(b)) |
| Customer support and service notices | Contact and account data | Performance of a contract (Art. 6(1)(b)) |
| Crash analysis and service stability | Device information, error records, IP address | Legitimate interests (Art. 6(1)(f)) — ensuring the Service functions reliably |
| Usage statistics | Device information, usage records, IP address | Consent (Art. 6(1)(a)) — optional, withdrawable at any time |
| Responding to violations of law or our Terms | Relevant records | Legitimate interests (Art. 6(1)(f)) |
| Complying with legal obligations (e.g., transaction record retention) | Purchase records | Legal obligation (Art. 6(1)(c)) |
We do not use your personal data for automated decision-making or profiling that produces legal or similarly significant effects.
3. Data Retention
We delete your personal data without undue delay when you delete your account. The following records are retained separately for the periods required by Korean law and are not used for any other purpose during retention:
| Records | Period | Legal Basis |
|---|---|---|
| Contract and withdrawal records | 5 years | Korean E-Commerce Act |
| Payment and supply records | 5 years | Korean E-Commerce Act |
| Consumer complaint and dispute records | 3 years | Korean E-Commerce Act |
| Service access logs | 3 months | Korean Protection of Communications Secrets Act |
How purchase records are retained: After account deletion, purchase records are retained with account identifiers removed (store order ID, product name, amount, time only). You can request transaction verification using the order number shown in your App Store or Google Play purchase history.
4. Sharing of Personal Data
We do not sell your personal data, and we do not share it with third parties for advertising purposes. We disclose personal data only:
- with your prior consent; or
- where required by law or valid requests from public authorities.
5. Processors and International Transfers
We use the following processors, all located in the United States:
| Processor | Purpose | Data | Transfer Safeguards |
|---|---|---|---|
| Google LLC | Firebase Authentication (sign-in), Firebase Storage | Account identifier, email, profile data | EU-US Data Privacy Framework (certified); Standard Contractual Clauses incorporated in the data processing terms |
| Google LLC | Firebase Crashlytics (crash analysis — always active for service stability) | Device information, error records, IP address | Same as above |
| Google LLC | Google Analytics for Firebase — only with your consent | Device information, usage records, IP address | Same as above |
| Mapbox, Inc. | Map tiles and styles | Map viewport coordinates, connection data | EU-US DPF (certified); SCCs incorporated in the Mapbox DPA |
| MongoDB, Inc. | Database hosting | Data listed in Section 1 | EU-US DPF (certified); SCCs incorporated in the MongoDB DPA |
About map data: Mapbox receives the coordinates of the map area you are viewing, which is not your device's actual location. We have disabled Mapbox SDK location telemetry so that your device location is not transmitted to Mapbox.
About analytics: Firebase Crashlytics runs as part of providing a stable Service and collects device information and error records only when an error occurs; you may object to this processing by contacting support@whispot.co. Google Analytics for Firebase is activated only after you consent, and collects nothing before consent. You can withdraw consent at any time in the [Profile] screen; collection stops immediately upon withdrawal.
Apple as an independent controller: When you sign in with Apple, Apple Inc. acts as an independent data controller — not our processor — and handles sign-in data under its own privacy policy. Apple manages its own international transfers using Standard Contractual Clauses. The same applies to Google's processing in connection with your Google account itself.
Transfers to Korea: Our servers and administrative access are located in the Republic of Korea, which is covered by the European Commission's adequacy decision of 17 December 2021.
6. Your Rights
Under the GDPR, you have the right to:
- Access your personal data
- Rectify inaccurate data
- Erase your data ("right to be forgotten")
- Restrict processing
- Data portability (receive your data in a machine-readable format)
- Object to processing based on legitimate interests
- Withdraw consent at any time, without affecting the lawfulness of processing before withdrawal
To exercise these rights, use [Profile] → [Delete Account] in the app or contact support@whispot.co. We respond within one month.
You also have the right to lodge a complaint with a supervisory authority, in particular in the EU member state of your residence, place of work, or place of the alleged infringement.
7. Data Security
We implement appropriate technical and organizational measures, including access control to personal data processing systems, encryption in transit (HTTPS) and at rest, access logging, and an internal data protection management plan.
8. Advertising Identifiers
We do not collect advertising identifiers (Android Advertising ID, Apple IDFA) and do not serve personalized advertising. An anonymous per-installation identifier is used for usage statistics; it does not identify you personally and is created upon account registration.
9. Children
The Service is not directed at children. We do not allow account registration by children under 14 (or the higher minimum age required in your jurisdiction, such as 16 in certain EU member states). If we learn that we have collected personal data from a child below the applicable age, we will delete it without undue delay.
10. Additional Information for UK Residents
The UK GDPR applies to our processing of personal data of UK residents. All references to the GDPR in this policy apply equally under the UK GDPR. You may lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.
11. Additional Information for California Residents
- We do not sell your personal information and do not share it for cross-context behavioral advertising, and have not done so in the preceding 12 months.
- We do not use or disclose sensitive personal information for purposes requiring a "Right to Limit" under the CPRA.
- Our app does not currently respond to "Do Not Track" browser signals, as it collects analytics data only with your opt-in consent.
- You may request access to or deletion of your personal information by contacting support@whispot.co. We do not discriminate against users who exercise their privacy rights.
12. EU/UK Representative
We are in the process of designating representatives in the EU and the UK pursuant to Article 27 GDPR / UK GDPR. This section will be updated with their contact details upon designation.
13. Changes to This Policy
We will notify you of material changes at least 7 days before they take effect via in-app notice. The date at the top of this policy indicates the latest revision.