Privacy Policy

BigSmile values your personal data and does its utmost to keep it safe. This policy explains how we collect, use, share and protect personal data through our website and services.

1. Personal data we collect

We may collect the following.

• Account data: the email address, name, profile picture and unique account identifier provided when you sign in with Google
• Profile data: the name, phone number, country or region, preferred language and introduction you enter yourself
• Payout data: the bank name, account holder and account number you enter so that revenue can be paid to you
• Submission data: the idea title, description and reference links, attachments, electronic signature image and record of your acceptance of the agreement
• Enquiry data: the name, email, phone number, subject and message you enter in the contact form
• Technical data: IP address, browser type, device information, access logs, cookies and similar technologies

2. How we collect it

• Information passed to us with your consent when you sign in through Google (OAuth)
• Information you enter directly by submitting an idea, an enquiry or your profile
• Automatic collection technologies such as cookies and browser local storage (remembering your language, keeping you signed in)

3. Why we use it

• Identifying members and maintaining the signed-in state
• Receiving and reviewing idea submissions and communicating their progress
• Concluding and performing the revenue share agreement and paying settlements
• Responding to enquiries and handling requests
• Providing and maintaining the service and improving the website
• Meeting legal obligations and protecting rights, safety and property

4. Processors and disclosure

We entrust the processing of personal data as follows in order to provide the service.

• Google LLC (Firebase): member authentication (Firebase Authentication), data storage (Cloud Firestore), file storage (Cloud Storage) and website hosting (Firebase Hosting)

We may otherwise disclose personal data where:

• it is required by law or lawfully requested by an investigating authority;
• it is necessary to prevent imminent danger to the life, body or property of a user or a third party; or
• the business is transferred through a merger, acquisition or asset transfer (we will notify you in advance).

5. Retention and destruction

• Account and profile data: destroyed without delay when you delete your account.
• Submission, agreement and signature records: retained for five years after the agreement ends, to perform the revenue share agreement and in case of dispute.
• Settlement records: retained for the period required by applicable law, including Korea's Act on Consumer Protection in Electronic Commerce.
• Enquiry records: retained for three years after the enquiry is resolved.

Personal data past its retention period is destroyed without delay by a method from which it cannot be recovered.

6. How we protect it

We take the following measures to protect personal data from unauthorised access, disclosure, alteration or destruction.

• HTTPS encryption across all communications
• Server-side access control rules restricting data access — submissions and payout details are readable only by you and the administrator
• Keeping administrator accounts to a minimum and managing access records

That said, no method of transmission over the internet or electronic storage can be guaranteed to be 100% secure.

7. Your rights

You may exercise the following rights under applicable law.

• Request access to your personal data and a copy of it
• Correct inaccurate information — you can edit it yourself on the “Account settings” page
• Request deletion — you can delete your account yourself on the “Account settings” page
• Request restriction of processing, or object to it
• Request data portability
• Withdraw consent

To exercise these rights, please use the contact details at the end of this policy. We will act without delay and inform you of the outcome.

8. Cookies and local storage

We use cookies and browser local storage to keep you signed in and to remember your language preference. You can control these in your browser settings, though some features such as signing in may then be limited.

9. Children's data

Our service is not directed at children under 14 and we do not knowingly collect their personal data. If you believe a child's data has been collected, please contact us immediately and we will delete it without delay.

10. Third-party links

Our website may contain links to third-party sites such as app stores. We are not responsible for the content or privacy practices of those sites, so please review their own policies when you visit them.

11. International transfers

Because we use Google LLC's Firebase services, your information may be processed and stored on servers outside your country, including in the United States. Appropriate safeguards are applied in accordance with this policy and applicable law.

12. Changes to this policy

This policy may be revised in line with changes to applicable law or to the service. Where the change is significant we will post it on the website together with a new “last updated” date.