This English version is provided for convenience. In case of any conflict, the Korean version prevails.
HyperReality Co., Ltd. (the "Company") complies with the Personal Information Protection Act of Korea and other applicable laws in providing Fooding (푸딩, the "Service"). This Privacy Policy explains what personal information we process, why, for how long, and to whom we entrust or provide it.
The Service consists of a diner service for finding restaurants and joining waitlists or booking visits (fooding.im and the Fooding app), and an owner service for running restaurants (restaurant management, waitlist kiosk and POS). This policy applies to both.
At a Glance
| What | Details |
|---|---|
| Information we collect | Email from social sign-in, nickname and profile, phone number, waitlist and booking history, reviews, reward and coupon activity, usage records |
| What we use it for | Sign-in, waitlists and bookings, rewards and coupons, reviews, customer support, security |
| Who we provide it to | The restaurant where you join a waitlist or book — Article 6 |
| Who we entrust it to | Social sign-in, email delivery, operational alerts — Articles 4 and 5 |
| Retention | Until you delete your account. Records required by law are kept for the legally required period |
| Contact | Chief Privacy Officer Juyoung Kang · contact@fooding.im |
Our Role
| Information | Our role | Governing document |
|---|---|---|
| Diner and owner member information, waitlist, booking, review and reward records, access logs, inquiries | Personal information controller — we decide the purposes and means | This policy |
| Restaurant information published by owners (name, address, contact number, menus, photos, posts) | Business information published on the Service. Where it contains personal information, such as a sole proprietor's contact number, we process it under this policy | This policy, Terms of Service |
| Diner information a restaurant receives to handle a waitlist or booking | Once provided to the restaurant under Article 6, the restaurant becomes the controller of that information | The restaurant's own practices |
Article 1. Personal Information We Process — Items, Purposes, Legal Bases and Retention
| When | Items | Purpose | Legal basis | Retention |
|---|---|---|---|---|
| Sign-up and sign-in (Kakao, Naver, Google or Apple) | Email, sign-in provider, auto-generated nickname | Identifying members, sign-in | Performance of contract (PIPA Art. 15(1)4) | Until account deletion |
| Sign-up (owner email sign-up) | Email, password (one-way hashed), name, phone number | Identifying members, sign-in, contacting owners about their restaurant | Performance of contract | Until account deletion |
| Profile (optional) | Nickname, bio, profile image, gender, phone number, referral code, address, nationality, preferred language | Showing your profile, linking rewards, language preference | Performance of contract | Until account deletion |
| Phone verification | Phone number, email, verification code, request and expiry time, result | Identity verification, account recovery | Performance of contract | 30 days after verification |
| Password reset | Email, name | Sending the reset email | Performance of contract | 30 days after sending |
| Waitlist (app or kiosk) | Phone number, name (if entered), party size (adults, infants, high chairs), waitlist number, status and notes, consent choices (terms, privacy, provision to third parties, marketing) | Registering, calling and seating waitlist guests; counting visits | Consent (PIPA Art. 15(1)1), performance of contract | 1 year after the last waitlist or reward activity |
| Bookings and visit plans | Member ID, restaurant, planned date and time, party size, visit status | Managing bookings, visit history | Performance of contract | Until account deletion |
| Rewards and coupons | Phone number, points earned and used, coupon redemption time, table number | Earning and using rewards, issuing and verifying coupons | Performance of contract | Until points or coupons expire or account deletion |
| Reviews, comments and reports | Author, rating, review text and photos, visit purpose, comments, report details | Running reviews and community features, handling reports | Performance of contract | Until deleted or account deletion (report records: 3 years after handling) |
| Using the Service | Bookmarks, recently viewed restaurants, restaurant view records, search keywords, in-app notifications, sign-in count and last sign-in time, server access logs such as IP address and access time, error logs | Personalized screens, popular-restaurant rankings, security, fraud prevention, incident response | Legitimate interests (PIPA Art. 15(1)6), performance of contract | Until account deletion (server access logs: 1 year) |
| Current location (if allowed on your device) | Latitude and longitude | Finding nearby restaurants, sorting by distance | Consent (device location permission) | Not stored — used only to handle the request, and kept only in your browser's session storage |
| Registering restaurant devices (tablet or POS) | Device ID, device name, operating system and version, app package and install time, last connection time, device activity log | Connecting and managing restaurant devices | Performance of contract | Until the device is removed or account deletion |
| Owner restaurant management | Staff members of a restaurant and their roles | Managing restaurant permissions | Performance of contract | Until removed from the restaurant or account deletion |
| Marketing and push consent (optional) | Whether you consented, and when | Sending offers and event news | Consent | Until consent is withdrawn or account deletion |
| Agreement to terms | Whether and when you agreed to the Terms of Service and Privacy Policy | Record of consent | Legal obligation | 5 years after account deletion |
| Customer inquiries | Email or KakaoTalk channel conversation, attachments | Responding to inquiries, handling disputes | Performance of contract | 3 years after resolution |
| Paid services (domestic) | Not applicable — we do not currently accept domestic payments. We will amend this policy before introducing them | — | — | — |
| Paid services (overseas) | Overseas payments are collected directly by Paddle (Article 6). We receive only payment status, plan and country | Managing subscription status | Performance of contract | 5 years |
| Access tokens (API) | Not applicable — the Service does not issue access tokens for external tools | — | — | — |
We do not collect resident registration numbers, dates of birth or payment card numbers. You pay for food at the restaurant, directly to the restaurant, and we do not receive that payment information.
Records kept under law are stored separately from other information and used only for that purpose.
| Record | Period | Legal basis |
|---|---|---|
| Records of contracts or withdrawal of offers | 5 years | Act on Consumer Protection in Electronic Commerce |
| Records of payment and supply of goods | 5 years | Act on Consumer Protection in Electronic Commerce |
| Records of consumer complaints or dispute handling | 3 years | Act on Consumer Protection in Electronic Commerce |
| Website visit (sign-in) records | 3 months | Protection of Communications Secrets Act |
Article 2. Restaurant Information and Content
- Restaurant information registered by owners (name, address, contact number, opening hours, menus, photos and posts) is published for diners. We display it on the Service and use it for popular-restaurant rankings and search.
- Reviews and photos written by diners are shown publicly on the restaurant's page and the author's profile, together with the author's nickname. When you delete a review, it disappears from the Service immediately.
- When a restaurant closes or its owner deletes their account, we make the restaurant information private and delete it after 30 days. Copies in backups are removed according to the backup cycle (up to 30 days).
Article 3. AI Features
- The Service provides a generative AI feature: translating menu names and descriptions registered by owners into Japanese and English.
- For translation, we send only menu names and descriptions to the AI processing server. No member or diner personal information is sent. We store the translations as the menu's foreign-language text and show them to diners.
- AI processing runs through the cloud operated by the Company (ZeroCloud). There is no feature for users to connect their own AI provider account or key.
- If an AI translation is inappropriate or wrong, please let us know at contact@fooding.im. We will review it, take action and reply with the outcome.
- Please do not include personal information such as people's names or contact details in menu descriptions.
Article 4. Entrustment of Processing
| Processor | Task |
|---|---|
| Kakao Corp. | Kakao sign-in (authentication), maps (Kakao Map) |
| NAVER Corp. | Naver sign-in (authentication) |
| Google LLC | Google sign-in (authentication) |
| Apple Inc. | Sign in with Apple (authentication) |
| Amazon Web Services, Inc. | Email delivery (Amazon SES), image delivery (Amazon CloudFront) |
| Discord Inc. | Delivering operational alerts to our staff (sign-up, report and coupon redemption alerts) |
| HyperReality Co., Ltd. (in-house cloud "ZeroCloud") | Servers, databases and file storage, email relay, AI translation processing |
| Domestic payment service provider | Not applicable — we do not currently accept domestic payments |
If our processors change, we will amend this policy and notify you.
Article 5. Transfer of Personal Information Overseas
To provide the Service (performance of contract), we store or entrust processing of personal information overseas as follows (PIPA Art. 28-8(1)3). Transfers take place over the network when you use the Service.
| Recipient (contact) | Country | Items | Purpose | Retention | How to refuse, and the effect |
|---|---|---|---|---|---|
| Google LLC (privacy.google.com) | United States | Google sign-in | Until account deletion | Don't use Google sign-in. You can keep using the Service with Kakao or Naver sign-in | |
| Apple Inc. (apple.com/legal/privacy/contact) | United States | Sign in with Apple | Until account deletion | Don't use Sign in with Apple. You can keep using the Service with another sign-in method | |
| Discord Inc. (discord.com/privacy) | United States | Sign-up alerts: name, masked email, member ID / Report alerts: reporter's name, phone number and report details / Coupon alerts: recipient phone number / Email delivery failures: recipient email | Letting our staff review and handle sign-ups, reports and coupon redemptions | Until deleted from the alert channel (up to 1 year) | This transfer is needed for operations and cannot be refused separately. You can ask us to stop the processing at contact@fooding.im |
| Amazon Web Services, Inc. (aws.amazon.com/compliance/contact) | Republic of Korea (Seoul region) — not an overseas transfer | Recipient email, email content | Email delivery | Per AWS policy after sending | — |
Article 6. Provision to Third Parties
We do not provide personal information to third parties except with your consent or where the law specifically requires it. We do, however, provide it as follows.
| Recipient | Country | Items | Purpose | Retention |
|---|---|---|---|---|
| The restaurant (business owner) where you joined a waitlist, booked, redeemed a coupon or earned rewards | Republic of Korea | Phone number, name (if entered) or nickname, party size, waitlist or booking status, visit count, reward and coupon history | Calling and seating waitlist guests, confirming bookings, applying rewards and coupons | 1 year after the waitlist or booking is completed (viewable in the restaurant's management screen) |
| Paddle.com Market Limited | United Kingdom | Email, country, payment method details, billing address, payment and refund history | Payment and tax processing as Merchant of Record for overseas payments | Per Paddle's privacy policy |
- We ask for your consent to provide information to the restaurant when you join a waitlist or book. If you don't consent, you can't join that restaurant's waitlist or book there, but other features (finding restaurants, reading reviews, etc.) remain available.
- We ask for your consent to provide information to Paddle on the overseas checkout screen. If you don't consent, you can't use overseas payment.
Article 7. Destruction of Personal Information
- We destroy personal information without delay once the retention period ends or the purpose is achieved.
- Electronic files are deleted so they cannot be recovered; paper documents are shredded or incinerated.
- After account deletion, we keep the information for 30 days so the account can be restored if it was deleted by mistake, and then destroy it. Records required by law are kept separately for the periods in Article 1.
Article 8. Cookies and Similar Technologies
- The Service uses essential cookies (or browser storage) to keep you signed in and show your most recent sign-in method. If you choose a language yourself, we remember that choice in a cookie for 1 year.
- The Service does not currently use web analytics or advertising trackers. If we introduce them, we will amend this article and notify you.
- Map screens load Kakao Map, and Kakao receives the connection information needed to serve the map.
- You can refuse cookies in your browser settings. If you refuse essential cookies, you will not stay signed in.
- Chrome: Settings → Privacy and security → Third-party cookies
- Safari: Settings → Privacy
Article 9. Children Under 14
The Service does not accept sign-ups from children under 14. If we learn that an account belongs to a child under 14, we delete it without delay.
Article 10. Your Rights and How to Exercise Them
- You may at any time request access to, correction or deletion of, suspension of processing of, or portability of your personal information, and you may withdraw your consent.
- You can change your profile, personal details and notification consent yourself in the app's Settings. For account deletion and other requests, use "Delete account" or "Contact support" (KakaoTalk channel) in Settings, or email contact@fooding.im, and we will act within 10 days.
- Guest waitlist users without an account can make requests through the restaurant where they joined the waitlist, or at contact@fooding.im, by giving their phone number.
- You may also exercise your rights through a representative (a legal guardian or an authorized person), who must submit a power of attorney.
- You cannot request deletion of information that other laws require us to keep.
Article 11. Automated Decisions
We do not make decisions that significantly affect your rights or obligations by fully automated means. When we restrict an account or review because of suspected misuse or a report, a person reviews it.
Article 12. Security Measures
- Administrative: an internal management plan, minimal access rights, regular reviews
- Technical: access control, encryption in transit (HTTPS), one-way hashing of passwords, blocking access to other restaurants' and members' information, retention of access logs
- Physical: access control to servers and storage locations
Article 13. Chief Privacy Officer
- Chief Privacy Officer: Juyoung Kang (CEO)
- Email: contact@fooding.im
- Phone: +82-507-0178-7546
Article 14. Remedies
If you need advice or dispute resolution regarding a privacy violation, you can contact the following Korean authorities.
- Personal Information Infringement Report Center (KISA): privacy.kisa.or.kr / 118 (in Korea)
- Personal Information Dispute Mediation Committee: www.kopico.go.kr / 1833-6972
- Supreme Prosecutors' Office Cyber Investigation Division: www.spo.go.kr / 1301 (in Korea)
- Korean National Police Agency Cyber Bureau: ecrm.police.go.kr / 182 (in Korea)
Article 15. Changes to This Policy
- This Privacy Policy takes effect on 2026-10-12.
- When this policy changes, we announce it on the Service 7 days before it takes effect. Changes that significantly affect your rights, such as collecting new items or providing information to third parties, are announced 30 days in advance, and we ask for your consent again where required.
- Earlier versions are available under "Previous versions" at the bottom of this page.