Privacy Policy

주식회사 힐조 (the “Company”) processes personal data lawfully and manages it securely in compliance with the Personal Information Protection Act (PIPA) and related laws of the Republic of Korea. This Policy applies to the FillStory service (the web dashboard manage.fillstory.com, the self check-in pages, and the mobile app (Android and iOS) com.fillstory.app; collectively, the “Service”).

The operator of this Service is 주식회사 힐조. The current Google Play Console publisher is registered as an individual account that distributes the app on the Company’s behalf. Once a corporate account is established, the publisher will be consolidated to the corporation via Play Console’s app Transfer feature.

The Company processes the following personal data.

• Member identification/authentication, identity verification, password reset
• Providing property operation features such as reservations, payments, rooms, door locks, statistics
• Automatically analyzing OTA notifications in the mobile app to register reservations in the system
• Sending check-in/check-out reminder push notifications
• Preventing misuse, resolving disputes, fulfilling legal obligations
• Statistical analysis for service improvement (in non-identifiable form only)

As a rule, the Company destroys personal data immediately upon the data subject’s withdrawal of membership, except in the following cases.

• One year after withdrawal — minimal identifying data (login ID, name, partial contact) is retained for one year to resolve disputes and prevent fraudulent (re-)registration, then destroyed
• Where retention is required by laws such as the Act on Consumer Protection in Electronic Commerce, data is retained for the prescribed period
  • Records on contracts or withdrawal of subscription: 5 years
  • Records on payment and supply of goods: 5 years
  • Records on consumer complaints or dispute resolution: 3 years
• Notification data collected by the mobile app: retained for 30 days after automatic reservation registration is completed, then destroyed (for reprocessing/debugging)

The Company processes personal data only within the scope specified in this Policy and does not provide it to third parties except with the separate consent of the data subject or where required by law.

The Company entrusts the following tasks externally to provide a stable service.

The Company self-operates the service servers (API, DB) and does not entrust them to external clouds (AWS/GCP/Azure, etc.). Cloudflare only relays traffic in transit and does not store body data.

The data subject may exercise the following rights against the Company at any time.

• Request to access personal data
• Request to correct or delete errors
• Request to suspend processing
• Withdrawal of membership

To exercise these rights, contact [email protected] and we will process it without delay (within 10 days). (An in-app/in-web self-withdrawal menu will be provided later; until then, requests are handled by email.)

For details on account and data deletion procedures, please see the Account & Data Deletion page.

Personal data is destroyed without delay once the retention period elapses or the purpose is achieved.

• Electronic files: permanently deleted from the DB in an unrecoverable manner
• Printouts (if any): shredded or incinerated

• Technical — one-way password hashing (BCrypt), enforced HTTPS (TLS 1.2+) in transit, DB access control, regular security patches
• Administrative — minimizing personnel handling personal data, tiered access rights, regular inspections
• Physical — restricted physical access to servers

The Company uses cookies to maintain login sessions and store user preferences. Blocking cookies may limit some features (auto login, user preferences). You can refuse cookie storage in your browser settings.

The permissions requested by the FillStory Android app (com.fillstory.app) and their purposes are as follows.

Since v1.0.0, the READ_SMS, RECEIVE_SMS, and REQUEST_INSTALL_PACKAGES permissions are no longer used, and the in-app auto-update feature has been removed. Updates are provided only through Google Play. Since v1.0.2, FOREGROUND_SERVICE and FOREGROUND_SERVICE_DATA_SYNC have also been removed, and notification collection runs solely on the system-bound NotificationListenerService.

On iOS, the app uses push notifications (APNs/FCM) only and does not use the notification-collection, camera, location, or Bluetooth permissions listed above. It requests no special device permissions beyond push notifications.

If you need to report or consult about an infringement of personal data, you may contact the following organizations (Republic of Korea).

• Personal Information Dispute Mediation Committee: www.kopico.go.kr (1833-6972)
• Privacy Infringement Report Center: privacy.kisa.or.kr (118)
• Supreme Prosecutors’ Office Cyber Investigation: www.spo.go.kr (02-3480-3573)
• National Police Agency Cyber Bureau: ecrm.police.go.kr (182)

This Privacy Policy applies from its effective date. If there are additions, deletions, or corrections due to changes in laws, policies, or security technology, we will announce them on this page at least 7 days before the changes take effect. For significant changes, we will give notice at least 30 days in advance or notify separately.