01Privacy principles
RainbowCompany (the “Company”) values the personal information of SCANPANG app and website users and complies with applicable law, including Korea's Personal Information Protection Act. This Policy explains the data processed, its purposes, retention and destruction, user rights, and contact channels.
The Company processes only the minimum information needed to provide the Service. If a purpose changes and additional consent is required, users are informed and consent is obtained in advance.
02Data, purposes, and retention
Information includes details users provide when signing in or contacting us, and information processed by devices or service servers while using features.
| Category / data | Purpose | Retention and use period |
|---|---|---|
| Google sign-in User identifier, email address, display name, sign-in provider information | Member identification, sign-in, access management | Until account closure or deletion |
| Authentication information Sign-in sessions, access and refresh tokens | Maintaining sign-in status and secure authentication | Until session expiry, sign-out, or account deletion |
| Location and sensor information Latitude, longitude, altitude, device orientation and motion, location accuracy | Nearby place queries, map display, AR positioning | During processing needed to provide the feature. Data included in operational logs follows the log retention criteria below. |
| Camera and AR information Camera images and visual or sensor information needed to recognize the environment | AR display and Google ARCore positioning | During AR session processing. See Section 3 for Google's processing. |
| Connection and error information IP address, request time, device and app environment, error details, request and response records | Troubleshooting, security, and prevention of misuse | Until troubleshooting or security purposes are fulfilled. Statutory retention periods apply where required. |
| Inquiries and rights requests Email address, inquiry details, identity verification information needed for processing | Answering inquiries and handling access, correction, deletion, and other rights requests | Until the inquiry or rights request is resolved. Where disputes or statutory retention duties apply, until those grounds end. |
The Company does not collect Google account passwords. The information Google provides and the scope of consent can be reviewed on the sign-in screen.
Information subject to statutory retention duties is stored separately for the period required by law and is not used for other purposes.
03Camera, location, and Google ARCore
SCANPANG shows real spaces through the camera and uses location and device orientation to place nearby locations in the AR view. Location or search-area information needed to query nearby places is sent to SCANPANG servers.
This app uses Google's Google Play Services for AR (ARCore). To provide ARCore Geospatial sessions, Google processes camera, location, and other sensor data. Data needed for positioning may be sent to Google servers.
How Google handles AR data ↗Google's data processing is subject to the Google Privacy Policy and AR service information. Camera images are not guaranteed to be processed only on the device. Avoid unnecessarily including other people's personal information or private spaces when using AR.
Users may stop using AR or withdraw camera and location permissions on their device. Withdrawing permissions may limit related AR and nearby place features.
04Device permissions
- Camera: Live camera view, environment recognition, and AR content display
- Location: Nearby place searches and AR positioning based on current location
- Device sensors: AR positioning and view adjustment using motion and orientation
- Network: Sign-in, place information queries, and AR service communication
Permission requests include guidance from the operating system and app. You can change permissions in device Settings → Apps → SCANPANG → Permissions. Denying permission does not itself result in a penalty; only features that need it are limited.
05External services and processing
The Company uses the following external services for authentication and AR features. These services process data within the scope of the features they provide. Where processing is outsourced, the Company applies safeguards required by law, including contractual arrangements, management, and supervision.
| Provider / service | Features and data processed |
|---|---|
| Google LLC Google sign-in, ARCore Geospatial | Google sign-in authentication and account information; AR positioning using camera, location, and sensor data |
| Supabase Authentication service | Member authentication and management of user identifiers, email addresses, display names, and sign-in sessions |
| Vercel Inc. Website hosting | Webpage delivery and hosting operations data, including access IP addresses, request times, and request records |
The Company does not sell personal information. Apart from processing needed for external features, disclosure to third parties occurs only where there is a legal basis or within the scope of separate user consent.
06Overseas processing and transfers
Using global services such as Google sign-in or ARCore may involve processing authentication or AR sensor information on overseas servers. Details and policies can be found in Google's official privacy information.
Where personal information is transferred overseas, the Company provides legally required information about the recipient, country, data, purpose, timing and method, retention period, and how to refuse the transfer. It establishes the necessary legal basis and safeguards. Transfers requiring consent are subject to separate consent before transfer.
Users may avoid related features, withdraw permissions, or ask the Company to stop processing personal information or delete their account. Refusing overseas processing needed for a feature may limit sign-in or AR functionality.
07Destruction of personal information
The Company destroys personal information without delay when retention expires or the processing purpose is fulfilled and the data is no longer needed. Where law requires retention, only the required information is stored separately and destroyed when the retention grounds end.
Electronic files are deleted so they cannot be restored. Paper documents, if any, are shredded or incinerated. Sign-in information stored on a device can be removed by signing out or deleting app data. Server-side account deletion must be requested separately.
08User rights and requests
Users may request access, correction, deletion, suspension of processing, or withdrawal of consent for their personal information. Requests may be sent to contact@rainbowcp.net. After verifying identity, the Company handles requests under the procedures required by applicable law.
Rights may also be exercised through a legal representative or authorized agent. The Company requests only the minimum information needed for verification and does not ask for passwords or verification codes.
If a request cannot be fulfilled in whole or in part due to statutory restrictions or retention duties, the Company explains the reason.
09Account and personal information deletion request
You may request deletion of your account and related personal information even if you have uninstalled the SCANPANG app or can no longer access it.
- Use the deletion request link below or email contact@rainbowcp.net.
- Use the subject “SCANPANG account and personal information deletion request” and include the email address you registered with and the information you want deleted.
- After verifying identity, the Company deletes the account, authentication information, and personal information linked to the account without delay and reports the outcome.
Uninstalling the app or disconnecting Google does not delete your account from SCANPANG servers. Deleting your Google account is a separate process handled by Google. If information must be retained by law, the Company explains the retained data, reasons, and period to the requester.
10Security measures
The Company applies necessary administrative and technical measures to protect personal information, including limited access permissions, protection of authentication information, encrypted communication, security updates, and oversight of personnel handling personal information.
If a security incident or personal information breach is confirmed, the Company provides legally required notifications and reports and takes steps to minimize harm.
12Privacy officer and contact
- Operator
- RainbowCompany
- Privacy officer
- Yang Jun-mo, Director
- Contact email
- contact@rainbowcp.net
- Website
- https://www.scanpang.com
For privacy complaints or dispute resolution, you may contact the Personal Information Infringement Report Center or the Personal Information Dispute Mediation Committee.
13Policy changes and effective date
This Privacy Policy takes effect on September 30, 2026. Changes and their effective dates are announced on the website or in the app. Material changes requiring consent are separately notified and consent is obtained.
Questions about these documents or the service?
contact@rainbowcp.net ↗