Privacy Policy

2.1 Information You Provide

When you create an account, we collect:

• Email address (email+password sign-up)
• Password (stored hashed via Supabase Auth — we never see or store it in plain text)
• If you sign in via Google, Apple, or Microsoft: your name, email, and profile picture as shared by that provider
• Preferred language

We do not receive or store your Google/Apple/Microsoft password.

2.2 Content You Create

• Travel plan itineraries (destinations, stops, notes, transport preferences)
• Saved places and saved plans, organized into folders
• Profile preferences and visibility settings

B4K does not have a reviews or ratings feature. We do not collect star ratings or written reviews of places.

2.3 Information Collected Automatically

• Pages visited, features used, buttons clicked
• Session duration and frequency
• Device type, browser, operating system
• Coarse, IP-derived location (country/region level only — B4K does not use device GPS or the browser Geolocation API anywhere in the app)
• IP address and standard server/API request logs

2.4 Personalization Activity

To rank and surface content relevant to you, we process:

• In-platform search queries
• Places and plans you save or like
• Places and categories you view
• Plans you create and their destinations

This runs on our own infrastructure (Supabase) — it is not shared with third-party advertising platforms and does not involve profiling that produces legal or similarly significant effects on you. You may object at any time (see Section 12).

2.5 Analytics & Behavior Data

• Google Analytics 4 — page views, events, traffic sources
• Microsoft Clarity — heatmaps, session recordings, click patterns, scroll depth
• Sentry — error and crash reports, with IP address, email, and cookies stripped before storage (see Section 9)

Analytics and Clarity data collection only begins after you accept the cookie/analytics consent banner. See our Cookie Policy.

B4K offers AI-assisted travel plan generation. Generating a plan may send your query and relevant context (e.g. destinations, preferences, saved places) to a third-party AI model provider for processing.

AI-generated plans are suggestions only — see the Terms and Conditions for the accuracy disclaimer. We do not use your data to train third-party foundation models beyond what is necessary to generate your response, and we do not knowingly send special-category data (health, financial, etc.) to any AI provider.

If you use B4K’s planning tools without an account, your in-progress plan (“draft”) is stored only in your browser’s local storage — it is not transmitted to or stored on our servers until you create an account and choose to save it. Clearing your browser storage will delete an unsaved guest draft permanently; we cannot recover it.

We use cookies to keep you signed in, remember your language preference, and power analytics. Analytics cookies load only after consent. Full list and preference management: Cookie Policy or Settings → Data & Privacy Consent while signed in.

B4K is operated from South Korea. Our service providers process data in the United States and the European Union. Where we transfer personal information out of the EEA/UK, we rely on Standard Contractual Clauses with the receiving vendor as the transfer safeguard.

We use industry-standard measures including HTTPS/TLS encryption, hashed credential storage, token-based authentication, and access controls. Error monitoring (Sentry) is configured to strip IP address, email, and cookies from crash reports before storage — we don’t need that data to debug, so we don’t collect it there.

No system is completely secure. If you believe your account has been compromised, contact support@b4korea.com immediately.

B4K is not directed at children under 14 and we do not knowingly collect personal information from anyone under 14. If you believe a child has provided us with personal data, contact support@b4korea.com and we will delete it.

You have the right to:

• Access — request a copy of your personal data
• Correction — correct inaccurate data
• Deletion — delete your account and data (Settings → Account → Delete Account)
• Portability — request your data in a portable format
• Objection / restriction — object to processing based on legitimate interest, including personalization

To exercise any right, email support@b4korea.com. We will respond within 30 days (or a shorter period where required by applicable law).

Jurisdiction-Specific Rights

The rights above are the global baseline. If you are located in one of the markets below, applicable local law gives you these additional or more specific rights.

Brazil (LGPD — Lei Geral de Proteção de Dados, Law No. 13,709/2018):

• Confirmation that we are processing your data
• Access to your data
• Correction of incomplete, inaccurate, or outdated data
• Anonymization, blocking, or deletion of unnecessary or excessive data, or data processed in violation of the law
• Portability of your data to another provider
• Deletion of personal data processed with your consent
• Information about which public and private entities we’ve shared your data with
• Information about the possibility of not giving consent, and the consequences of refusing
• Revocation of consent at any time
• Review of decisions made solely through automated processing that affect your interests

We aim to respond to LGPD requests within 15 days, per Brazilian law’s shorter statutory window (rather than the 30-day window above).

Japan (APPI — Act on the Protection of Personal Information):

• Request disclosure of retained personal data we hold about you
• Request correction, addition, or deletion of retained personal data that is inaccurate
• Request suspension of use, erasure, or cessation of provision to third parties, where your data was used beyond its stated purpose, was unlawfully acquired, is no longer needed, or was involved in a data breach

Taiwan (Personal Data Protection Act):

These rights may not be waived or limited in advance by any agreement:

• Inquire about and review your personal data
• Request a copy of your personal data
• Request supplementation or correction of your personal data
• Demand that we stop collecting, processing, or using your personal data
• Request deletion of your personal data

Thailand (PDPA — Personal Data Protection Act B.E. 2562):

• Access your personal data
• Rectification of inaccurate or incomplete data
• Erasure or anonymization of your data — including where you withdraw consent and we have no other legal basis to continue processing
• Object to processing at any time
• Restrict processing
• Receive your data in a portable, structured format
• Withdraw consent at any time — we publish, and will notify you of, the method to do so

We aim to respond to Thai PDPA requests within 30 days, as required by law.

Korea (PIPA — Personal Information Protection Act): B4K is based and operated in the Republic of Korea, so PIPA applies to our processing regardless of your location.

• Be informed of, and access, how we collect, use, and share your personal information
• Request correction or deletion of your personal information
• Request suspension of processing of your personal information
• Request that your data be transferred directly to you or to another controller (data portability)
• Object to decisions made solely through fully automated processing that significantly affect you
• Withdraw consent at any time

EU/UK users: you have the right to lodge a complaint with your local data protection authority.

We have not appointed a Data Protection Officer — our scale and processing do not meet the GDPR thresholds that require one (no large-scale systematic monitoring, no large-scale special-category processing).

Global Privacy Control

B4K does not sell or share personal information in the sense defined by the CCPA/CPRA, so Global Privacy Control signals are not applicable — there is nothing to opt out of that we do in the first place.

Depending on your state of residence, you may have rights to know, delete, correct, and opt out of the sale/sharing of personal information, and to non-discrimination for exercising these rights. We do not sell or share personal information as defined under these laws.

We may update this policy. Material changes will be notified via an in-app notice at least 7 days before taking effect. Continued use after the effective date constitutes acceptance.

B4K — support@b4korea.com
For data-rights requests, include “Privacy Request” in the subject line.