This is a translation. In case of discrepancy, the Korean version prevails. 한국어 원문 (Korean original)
This document is based on the Korean text. Translations are provided for convenience. If the Korean text and a translation differ, the Korean text prevails.
In accordance with Article 30 of the Personal Information Protection Act (「개인정보 보호법」), 한라서비스 (Halla Service) (the "Company") establishes and discloses this Privacy Policy as follows in order to protect the personal information of data subjects and to handle related grievances promptly and smoothly.
| Item | Details |
|---|---|
| Business name | 한라서비스 (Halla Service) |
| Representative | KHAN RADION |
| Business registration number | 129-54-00871 |
| Address | 경상북도 경주시 알천남로 54-3, 303호(성건동) |
| Personal information inquiries | privacy@qremenu.com, 010-5721-0224 |
1. "Service" means the QR menu service "QREMENU" that the Company provides through https://qremenu.com.
2. "Member" means an operator of a place of business who has entered into a service agreement with the Company and uses the Admin panel.
3. "Staff" means employees of a Member whom the Member has registered in the Admin panel.
4. "Guest" means a person who uses the menu page via a QR code at a Member's place of business. The Company does not require Guests to sign up and does not collect Guests' names, telephone numbers or email addresses.
5. "Applicant" means a person who has completed the consultation request form on the website.
The Company processes personal information for the following purposes. The Company does not use the processed personal information for purposes other than the following, and if a purpose of use changes, the Company takes the necessary measures, such as obtaining separate consent in accordance with Article 18 of the Personal Information Protection Act.
1. Provision of the Service: displaying the QR menu, receiving and processing Guest orders, receiving and displaying reviews, automatic menu translation, and authentication for Admin panel access
2. Performance and management of the service agreement: management of Plans and Subscription Periods, expiry notices, confirmation of service fee deposits, and refunds
3. Consultation and customer support: contacting Applicants about consultation requests, responding to Support chat inquiries, handling complaints and resolving disputes
4. Security and prevention of misuse: limiting login attempts, limiting excessive requests, and blocking abnormal access
5. Service improvement: compiling visit count statistics that cannot identify individuals
| Data subject | Items processed | Purpose of processing |
|---|---|---|
| Member | Business name, city, region and address, business hours, business telephone number, logo, social media links, Plan, Subscription Period, Member PIN (only the scrypt hash is stored) | Provision of the Service, performance of the service agreement |
| Member | Name of the depositor of the service fee, deposit date, deposit amount, refund account (only in the case of a refund) | Confirmation of deposits, refunds |
| Member, Staff | Registered device information: device ID, device token hash, role, device name ("browser · operating system"), creation time and last use time | Provision of the "Remember PIN" function |
| Staff | Staff name (nickname), Staff PIN (only the scrypt hash is stored) | Authentication for Admin panel access |
| Member, Staff | Order processing log: time, action, order number, table, role and name of the person performing the action | Management of order processing history, dispute resolution |
| Guest | Randomly generated Guest key (16 characters, does not identify an individual), ordered menu items and quantities, special requests (up to 200 characters), table number | Receiving and processing orders |
| Guest | Reviews: star ratings (food, service, atmosphere), tags, favourite menu items, comments (up to 100 characters), table, date written, order number, HMAC value of the Guest key | Receiving and displaying reviews |
| Applicant | Business name, contact details, form of address for the contact person, city, desired Plan, inquiry content (up to 500 characters), language, referral source | Contact for consultation |
| Member | Support chat inquiries and answers, translations, time written | Customer support |
| Member | Questions the AI support bot could not answer (up to 200 characters, with telephone numbers, email addresses and card numbers removed), language, reason | Improvement of support quality |
| All users | IP address (processed in memory only, not stored) | Security, request limiting |
| Guest | Likes (♥): a random identifier generated by the browser (lkid) and the IP address, each as an HMAC value (processed in memory only; the key is replaced every day at 04:00 and the values are deleted within 24 hours; not stored) | Counting likes, preventing duplicates and abuse |
1. Telephone numbers contained in review comments are automatically masked, and links are removed.
2. The Company does not process payment information, such as card numbers or account passwords, in the Service.
3. The Company does not process unique identification information, such as resident registration numbers or alien registration numbers, or sensitive information.
1. Methods of collection
1. Entered directly by Members and Staff in the Admin panel
2. Orders and reviews entered directly by Guests on the menu page
3. Entered directly by Applicants in the consultation request form
4. Generated automatically in the course of using the Service (device information, order processing logs, IP addresses)
2. Legal grounds for processing
1. Member and Staff information and Guest order information: where necessary to enter into and perform a contract (Article 15(1)4 of the Personal Information Protection Act)
2. Consultation request information: consent of the data subject (Article 15(1)1 of the same Act). Consent is obtained in the request form.
3. Guest reviews: information written and submitted by the data subject, processed to the extent necessary to provide the review service (Article 15(1)4 of the same Act)
4. IP addresses and security logs: where necessary to achieve the Company's legitimate interests and such interests clearly override the rights of the data subject (Article 15(1)6 of the same Act)
5. Information preserved under laws: where a law contains special provisions (Article 15(1)2 of the same Act)
1. The Company processes and retains personal information within the retention period set by law or the retention period consented to by the data subject.
2. The retention periods for each item are as follows.
| Item | Retention period |
|---|---|
| Closed orders (including Guest key and special requests) | 7 days after the order is closed (up to 400 per place of business) |
| Open orders | Until the order is closed, and 7 days after closing |
| Reasons for order rejection | 2 hours |
| Reviews | 12 months after being written (up to 3,000 per place of business) |
| Consultation requests | 12 months after receipt |
| Order processing logs | 1 year (most recent 5,000 entries per place of business) |
| Registered device information | 90 days after last use |
| Table session cookie (qts) | 3 hours, or up to 12 hours if there is an open order |
| Questions not answered by the AI bot | 30 days (up to 500) |
| Support chat | 1 year (most recent 300 per place of business) |
| Administrator action logs | 1 year (most recent 500 entries) |
| Close of business records | Most recent 400 per place of business. Deleted within 90 days after the service agreement ends or a deletion request is made |
| Member information and Member data (menu, photos, Staff, etc.) | Term of the service agreement. Deleted within 90 days after the service agreement ends or a deletion request is made |
| Deposit and refund records | 5 years (Act on the Consumer Protection in Electronic Commerce (「전자상거래 등에서의 소비자보호에 관한 법률」)) |
| Server backups | Up to 60 days (once daily, most recent 60) |
| Server system logs, web server logs | 30 days |
3. The following information does not contain personal information, so no separate retention period is set for it: sales statistics that cannot identify individuals (retained for 24 months), QR scan and website visit counts (numbers only, retained for 90 days), API usage per place of business, like counts per menu item (numbers only), and the support bot's FAQ.
4. Where preservation is required under relevant laws, the Company preserves personal information for the period set by those laws.
1. Records of contracts or withdrawal of subscription: 5 years (Act on the Consumer Protection in Electronic Commerce)
2. Records of payment and supply of goods and services: 5 years (the same Act)
3. Records of consumer complaints or dispute handling: 3 years (the same Act)
1. The Company destroys personal information without delay once the retention period has passed or the purpose of processing has been achieved.
2. Destruction procedures
1. The Service automatically deletes closed orders, reviews, consultation requests and various logs once the periods in Article 4 have passed.
2. When a Member's place of business is deleted, the Company immediately deletes the accounts, orders, reviews, chats and photos of that place of business.
3. Information remaining in backup files is deleted progressively within 60 days according to the backup retention cycle.
4. Information that must be preserved under laws is stored and managed separately from other information and is destroyed once the preservation period has passed.
3. Destruction methods
1. Electronic files: permanent deletion by a method that prevents recovery or reproduction
2. Paper documents: shredding or incineration
1. The Company processes the personal information of data subjects only within the scope of the purposes in Article 1 and provides it to third parties only in cases falling under Articles 17 and 18 of the Personal Information Protection Act, such as with the consent of the data subject or under special provisions of law.
2. The Company currently does not provide personal information to third parties.
3. Guests' order information and reviews are displayed to the Member of the place of business the Guest used. This results from the Guest using the Service to place an order with and leave a review for that place of business, and under the Terms of Service the Member may not use this information for purposes other than use of the Service.
4. The menu page may contain links to external services such as Naver Map. The Company does not provide Guests' personal information to external services through these links and does not pass on the address of the referring page (referrer). After a user follows a link to an external service, that service's privacy policy applies.
1. The Company entrusts personal information processing as follows for the smooth provision of the Service.
| Trustee | Entrusted work | Retention and use period |
|---|---|---|
| Vultr (The Constant Company, LLC) | Server hosting: storage of all Service data. The servers are located in the Seoul region, Republic of Korea. | Until the entrustment contract ends |
| Zoho Corporation | Sending, receiving and storing Company email (support@, billing@, privacy@qremenu.com) | Until the entrustment contract ends |
2. When entering into an entrustment contract, the Company specifies in the contract or other documents, in accordance with Article 26 of the Personal Information Protection Act, matters concerning the prohibition of processing personal information beyond the entrusted work, technical and administrative protective measures, restrictions on re-entrustment, management and supervision of the trustee, and liability such as compensation for damages, and supervises whether the trustee processes personal information securely.
3. If the content of the entrusted work or the trustee changes, the Company discloses this without delay through this Privacy Policy.
1. The Company transfers personal information overseas as follows to provide automatic menu translation and support functions.
| Item | Details |
|---|---|
| Recipient | Anthropic, PBC |
| Contact | privacy@anthropic.com |
| Country of transfer | United States |
| Time and method of transfer | Transmitted via information and communications networks (HTTPS encryption) each time a translation or question is processed |
| Items transferred | ① Menu item names (up to 200 characters) and descriptions (up to 400 characters) ② Support chat messages ③ Review comments (up to 100 characters, telephone numbers masked) ④ When the AI support bot is used: Member questions with telephone numbers, email addresses and card numbers removed (up to 500 characters) |
| Purpose of transfer | Multilingual automatic translation, answering support inquiries |
| Retention and use period | In accordance with Anthropic's data retention policy. Data sent via the API is in principle deleted within 30 days and may be retained for up to 2 years where review for usage policy violations is required. |
| Legal basis for transfer | Disclosed in this Policy as a case where entrustment of processing or storage of personal information is necessary to perform a contract with the data subject (Article 28-8(1)3 of the Personal Information Protection Act) |
| How to refuse and consequences of refusal | You may request that the overseas transfer stop by contacting privacy@qremenu.com. In that case, the Company stops providing automatic translation and the AI support bot to the relevant Member, and the Member must enter translations manually. |
2. The Company transfers personal information overseas as follows for the Company's email service.
| Item | Details |
|---|---|
| Recipient | Zoho Corporation |
| Contact | privacy@zohocorp.com |
| Country of transfer | United States |
| Time and method of transfer | Transmitted via information and communications networks (encrypted) each time a data subject sends an email to the Company or the Company sends an email |
| Items transferred | Email address, name (if provided), email body and attachments |
| Purpose of transfer | Sending, receiving and storing Company email |
| Retention and use period | Until the entrustment contract ends or until the Company deletes the email |
| Legal basis for transfer | Disclosed in this Policy as a case where entrustment of processing or storage of personal information is necessary to perform a contract with the data subject and respond to inquiries (Article 28-8(1)3 of the Personal Information Protection Act) |
| How to refuse and consequences of refusal | You may contact the Company via the Support chat or by telephone instead of email. There are no consequences in that case. |
3. Order content, Guest keys, IP addresses, PINs and photos are not transferred overseas.
4. Under its commercial terms, Anthropic does not use data sent via the API to train artificial intelligence models.
1. Cookies: The Company uses only one cookie for technical purposes (qts). This cookie links the orders of a Guest who accessed the Service via a table QR code to that table, and is valid for up to 12 hours (with the HttpOnly, SameSite=Strict and Secure attributes applied). This cookie and the browser storage are strictly necessary to provide the services requested by the user (ordering and staying signed in). The Company processes this information under Article 15(1)4 and 15(1)6 of the Personal Information Protection Act without obtaining separate consent. The cookie does not store a name, contact details or other information that directly identifies an individual.
2. Browser storage (localStorage, sessionStorage)
1. Menu page: language, likes and a random identifier (lkid, which does not identify individuals), Guest key (for writing reviews, 24 hours after ordering), whether a review has been written, shopping cart (deleted when the tab is closed)
2. Admin panel: device token (90 days), screen settings, time new reviews were last checked
3. Website: language setting
3. The Company does not use cookies or external scripts for advertising, analytics or tracking purposes. If the Company intends to use non-essential cookies (such as analytics or advertising cookies) in the future, it will obtain the user's consent through an on-screen notice before using them, and the user may withdraw consent at any time.
4. How to refuse: users may delete or block cookies and site data in their browser settings. For example, in Chrome, this can be changed under "Settings → Privacy and security → Third-party cookies" or "Site settings". If blocked, the table order linking and "Remember PIN" functions may not be available.
1. The Company does not collect, use or provide behavioural information for targeted advertising.
2. The Company does not process pseudonymised information.
3. The Company does not make fully automated decisions that significantly affect the rights or obligations of data subjects (Article 37-2 of the Personal Information Protection Act).
1. Data subjects may at any time request from the Company access to, correction or deletion of, or suspension of processing of their personal information, or withdraw consent.
2. Rights may be exercised by email (privacy@qremenu.com), in writing or by telephone (010-5721-0224), and the Company takes action and notifies the result within 10 days from the day it receives the request.
3. Rights may be exercised through a representative, such as the data subject's legal representative or a person authorised by the data subject. In this case, a power of attorney must be submitted.
4. The Company does not hold information that can identify Guests. When a Guest exercises rights, please specify the relevant information by the business name, order date and time, table number, order number and similar details.
5. In the following cases, the Company may limit or refuse requests for access, correction or deletion, or suspension of processing, and informs the data subject of the reason.
1. Where a law contains special provisions or where it is unavoidable in order to comply with legal obligations
2. Where there is a risk of harm to the life or body of another person or of unfairly infringing the property or other interests of another person
6. Data subjects must not infringe the personal information or privacy of themselves or others being processed by the Company in violation of relevant laws, such as the Personal Information Protection Act.
Only business operators may enter into a service agreement with the Company. The Company does not knowingly collect personal information of children under 14 years of age. There is no age verification procedure for Guests' use of the menu, and the Company does not collect Guests' names or contact details.
The Company takes the following security measures in accordance with Article 29 of the Personal Information Protection Act.
1. Administrative measures
1. Limiting personal information handlers to the representative
2. Regular review of the Privacy Policy and retention periods
2. Technical measures
1. PINs are stored hashed with scrypt (with salt), and the original values are not stored.
2. Device tokens are stored as HMAC hashes.
3. The number of login attempts and requests is limited, and access is temporarily blocked when the limit is exceeded.
4. Access rights of owners, Staff and administrators are separated, and Staff are given only the minimum information necessary for order processing.
5. All communication channels are encrypted with HTTPS.
6. The servers are operated under a dedicated service account, and access rights to configuration files and backup directories are restricted.
7. Telephone numbers in text entered by Guests are masked, and contact information is removed before overseas transfer.
8. Security updates are applied and security checks are carried out regularly.
3. Physical measures: the servers are operated in the data centre of the hosting provider (Vultr), and physical access control follows the hosting provider's security policy.
1. The Company designates the Chief Privacy Officer as follows to oversee personal information processing and to handle complaints and provide remedies for damage to data subjects.
| Category | Details |
|---|---|
| Name | KHAN RADION |
| Position | Representative |
| Contact | privacy@qremenu.com, 010-5721-0224 |
2. The above Chief Privacy Officer receives and handles requests for access to personal information, inquiries, complaints and remedies for damage.
3. The Company responds to and handles data subjects' inquiries without delay.
To obtain remedies for infringement of personal information, data subjects may apply to the following agencies for dispute resolution or consultation.
| Agency | Contact |
|---|---|
| Personal Information Dispute Mediation Committee (개인정보분쟁조정위원회) | 1833-6972 (no area code), www.kopico.go.kr |
| Personal Information Infringement Report Center (개인정보침해신고센터), Korea Internet & Security Agency (한국인터넷진흥원) | 118 (no area code), privacy.kisa.or.kr |
| Supreme Prosecutors' Office (대검찰청) | 1301 (no area code), www.spo.go.kr |
| Korean National Police Agency (경찰청) | 182 (no area code), ecrm.police.go.kr |
1. This Privacy Policy applies from 10 November 2026.
2. When the Company changes this Policy, it announces the change on the website and in the Admin panel from 7 days before the effective date. If there is a change that is significant to the rights of data subjects, such as adding collected items or changing purposes of use, the Company announces it from 30 days before the effective date.
3. Previous versions of the Privacy Policy can be found below.