IAIU Account Privacy Policy
Effective date: 2026-11-11
IAI (the "Company") operates the IAIU account and the services that you can sign in to with an IAIU account. This policy explains what personal information the Company collects and why, how it is used, and when it is deleted.
1. Scope
- IAIU account: a sign-in account shared across IAIU services
- Off Season Stay (stay.iaiu.net): brokerage of monthly stays in hotel rooms in Pattaya
- Theory & Proof (tp.iaiu.net): a simulated investment service for education and games (no real orders are placed). Please also see the T&P Privacy Policy (tp.iaiu.net/about/privacy).
2. Information We Collect and How We Use It
IAIU account (common to all services)
| Information collected | Purpose of use |
|---|---|
| Email address, name, profile photo address, and Google account identifier received through Google sign-in (requested scopes: openid, email, profile) | Identity verification, keeping you signed in, notification emails |
| Account ID number | To recognize the same person across services (used instead of email) |
| Consent to the terms, the privacy policy, and being 14 years of age (international age) or older, with the time of consent, document version, and service | Consent records (kept to prove consent) |
| Sign-in device information (browser type, whether the app is installed) and access logs (IP, address, browser) | Sign-in management, security, incident response |
| Sign-in cookie | Keeping you signed in (30 days, extended with use) |
Theory & Proof
| Information collected | Purpose of use |
|---|---|
| Watchlist, screen and chart settings and drawn lines, price alerts, strategy rules and strategy conversation content, simulated trading records | Simulated investment education and game features |
| Your character race data (nickname, virtual funds, lineup, character records, awards) | Race game |
| Notification inbox, web push subscription, public board nickname | Notifications and posting |
| Inquiries and error reports, waitlist email, invitation records | Responding to inquiries, sign-up guidance |
We do not collect payment information.
Off Season Stay
| Information collected | Purpose of use |
|---|---|
| Booking inquiry: name, contact (optional), move-in date, length of stay, number of guests, room type, message, and the time of consent to personal information collection and accommodation provision | Checking accommodation, proceeding with the booking, contact by our staff |
| Consultation chat content | Answering questions, handing over to our staff |
| Accommodation page view counts (totals that do not identify anyone) | Identifying popular accommodations |
3. Information We Send to Others
- Hotels (accommodation providers): When confirming a booking inquiry, we send only the move-in date, length of stay, number of guests, room type, and our staff's notes. Names are masked (for example, Ho**), and email addresses and contact details are not sent.
- AI processing: When Off Season Stay consultation questions and T&P strategy conversations are answered automatically, the text is sent to AI services of Google (Gemini) or Anthropic (Claude). Email addresses and names are not sent. Questions containing personal information are not placed in the "frequently asked answers" that are shown again to other people.
- Except in the cases above and where required by law, we do not give or sell your information to others, and we do not use it for advertising.
- Use of information received through Google sign-in complies with the Google API Services User Data Policy, including the Limited Use requirements (https://developers.google.com/terms/api-services-user-data-policy).
Processing Entrusted to Others and Overseas Transfer
To operate the services, we entrust information processing to the companies below, all of which process it overseas (mainly in the United States). Information is sent over the internet while you use the services and is kept for the retention periods below.
| Recipient (country) | Entrusted task | Information sent |
|---|---|---|
| Oracle (Phoenix, United States) | IAIU account and T&P servers and databases | Account information, T&P usage records |
| Cloudflare (United States and locations worldwide) | Off Season Stay server and database, email sending, connection protection | Booking and consultation records, access information |
| Resend (United States) | Sending IAIU account and T&P notification emails | Email address, email content |
| Google (United States) | Google sign-in, AI responses (Gemini), Android and Chrome push, fonts | Sign-in information, consultation and strategy text, push subscription information |
| Anthropic (United States) | AI responses (Claude, where used) | Consultation text |
| Apple and Mozilla (United States) | Browser push notifications | Push subscription information |
If you do not want your information transferred overseas, you may decline to sign up or withdraw. However, in that case you will not be able to use the services.
4. Retention Period and Deletion
- IAIU account and T&P records: until you withdraw. When you request withdrawal, you are signed out of all devices immediately and your information is permanently deleted after 7 days (cancelled if you sign in again within 7 days). A feature to export your information is available.
- Unfinished T&P strategies: automatically deleted after 30 days. IP addresses used for rate limiting: 1 hour (2 days for conversations without sign-in). Backups: disappear after about 3 months at most.
- Off Season Stay booking records: 5 years after the booking ends (retention of contract and payment records under the Act on Consumer Protection in Electronic Commerce (Korea)). Inquiries that did not lead to a booking: 1 year after the last contact.
- Consent records: 3 years, even after withdrawal, to prepare for legal disputes.
- Access logs: 3 months (Protection of Communications Secrets Act (Korea)).
- Consultation records: 1 year after the last conversation.
- Once any period set separately by law has passed, we delete the information without delay.
- You may request access, correction, deletion, or suspension of processing at any time at support@iaiu.net, and we will handle it without delay.
5. Cookies and Browser Storage
- We use only essential cookies: keeping you signed in (30 days, across all of iaiu.net), forgery prevention, checking that Google sign-in is in progress (10 minutes), and holding a first sign-up while it is completed (10 minutes) — four in total. We do not use visit analytics or advertising tracking.
- Display settings such as your chosen language are stored only in your own browser.
6. Children Under 14 Years of Age
Anyone under 14 years of age (international age) cannot sign up. When signing up, you confirm yourself that you are 14 years of age (international age) or older, and if you are found to be under 14 years of age (international age), your account will be deleted.
7. Security
- All connections are encrypted (HTTPS). Sign-in cookies are set so that other scripts cannot read them.
- Sign-in session values are stored only as converted values (hashes), not as originals.
8. Contact
- Privacy officer: Kim Changmyoung (Representative)
- Email: support@iaiu.net
9. Changes
If this policy changes, we will announce it on this page 7 days before it takes effect. If the change is unfavorable to users, we will announce it 30 days before.
Translated from the Korean original; the Korean version prevails.