Vasto Privacy Policy
Effective date: November 10, 2026 · Operator: MorangMarket · Privacy officer: Lee Wooseok (business owner)
1. Information processed by the app
Vasto displays 3D landmarks and augmented reality scenes. It has no separate user account, advertising, advertising tracking, or third-party analytics SDK. The app does not upload camera images, AR spatial information, or viewing and discovery records to the operator’s servers. Network metadata and information you choose to send to support are described separately below. The only information processed on the basis of consent is the performance and app usage records you choose to share in the app (section 2a); all other processing in this policy is carried out without consent on the legal bases stated in each section (Article 22(3) of Korea’s Personal Information Protection Act).
| Feature | Information and purpose | Storage and transmission |
|---|---|---|
| Viewing records and settings | Landmark viewing, discovered stories, music and ambience preferences, to maintain app state | Stored on your device; not automatically sent to the operator |
| Camera and AR | ARKit processes camera images and horizontal surfaces to place models on a table or floor | Processed on your device; not sent to the operator or content server |
| Photos | The app does not ask to read your photo library. When you share a picture of the 3D view and choose "Save Image" in the system share sheet, iOS asks for permission to add to your photo library (add-only) and, if you allow it, saves that one picture. Images used for scene transitions are processed locally | Saved only where you choose; not uploaded to the operator. No photo upload feature |
| Notifications | The app does not ask for notification permission and has no arrival scheduling or reminders. At launch it cancels any arrival notification that an earlier version left scheduled | No operator push server or push token registration |
| Region | Landmark coordinates shown on the map, and the App Store storefront country, read on the device, to hide landmarks that are not offered in some countries | Processed locally. The app does not access your location (GPS) or ask for location permission |
| Errors and downloads | Last loading error, OS version, timestamp and download state for local recovery and error messages | No automatic error uploads; information reaches support if you choose to send it |
| Performance and app usage records | Only if you agree: a summary of device heat and stutter, and how screens and features are used (section 2a) | Sent to the operator's server (Cloudflare) only if you agree. Off by default |
The app does not use health data, step counts or the microphone. Camera permission for AR is optional; you can use standard 3D viewing without it and change permissions in iOS/iPadOS Settings.
The release has no next-day 7 a.m. arrival or waiting step and no notifications. If you update from an earlier version, the app cancels any arrival notification that version left scheduled or already delivered. Records of landmarks you actually visited and stories you discovered stay on your device.
The app uses Apple’s StoreKit to check its installation environment, such as App Store or TestFlight, and landmark purchase access. Section 7 describes purchases and restoration. This does not create a separate operator account or send your Apple Account password to the operator. Apple’s independent processing is covered by the Apple Privacy Policy.
Local app data may be included in Apple or personal device backups according to your backup and restore settings. This is separate from the app uploading data to the operator.
2. Content downloads and network logs
The app requests landmark catalogs, models, images, music and other content over HTTPS. Content delivery uses Cloudflare R2 and a custom domain. Cloudflare may process your IP address, request time and path, response status, transfer size, and device or client information included in network requests. The purposes are content delivery, security and troubleshooting. Camera images and the viewing records are not attached to these requests.
The retained fields, purposes and legal basis, retention period and the operator’s access to access records are as follows.
| Item | Details |
|---|---|
| Retained fields, purposes and legal basis | The operator does not store or export access logs separately (no log export (Logpush) and no R2 data access logging). For each request, Cloudflare processes the IP address, request time and path, response status, transfer size and device or client information to deliver content and the website and to protect the service. Legal basis: delivering content requested by the app, and delivering the website pages a visitor requests, rely on Article 15(1)(4) of Korea’s Personal Information Protection Act (performance of a contract: the app license; the free provision of the requested pages), including the basic security of that delivery. The operator’s review of sampled security records to respond to security issues relies on Article 15(1)(6) (legitimate interests: the minimum connection information needed to protect the service). Where the GDPR applies, delivery relies on Article 6(1)(b) and review of security records on Article 6(1)(f). |
| Retention and deletion | The operator keeps no access logs of its own, so there is no operator retention period. However, the security analytics view in the Cloudflare dashboard keeps records of a sample of requests for up to the last 31 days. We have not found a setting on the operator’s plan that turns these records off or removes IP addresses. Other records processed by Cloudflare are deleted by Cloudflare once they are no longer needed to provide the service under the Cloudflare Customer Data Processing Addendum (DPA). |
| Operator’s access to records | In the Cloudflare dashboard the operator sees aggregate statistics such as request counts, data transferred, country distribution and response status, which Cloudflare produces while delivering app content and the website. The security analytics and security events views also show, for up to the last 31 days, the IP address, country, path, time and browser information of a sample of requests (including requests not handled by security features) and of requests that security features blocked or flagged. The operator uses these only for security response and troubleshooting and does not store them separately. |
2a. Performance and app usage records (only if you agree)
Only if you choose "Share Performance Data" or "Share App Usage" on the in-app consent screen or in Settings do we send the records you chose to the operator's server. The two can be chosen and turned off separately. If you choose neither, nothing is sent and the app works the same.
| Item | Details |
|---|---|
| Performance data | Device model, iOS version, app version and distribution channel, date (day only), which landmark, time of day and how long you viewed it in 3D/AR, 3D render scale, the device's thermal state and when it changed, a frame-rate summary (mean, seconds under 50 fps, worst 10-second average), Low Power Mode and charging, why the viewing ended, and a random record number to avoid duplicates |
| App usage data | A random launch number created each time you open the app (including returning from the background), with the order and seconds within that launch, date (day only), app version and channel, a range of days since install (computed from a first-launch date kept only on the device; the date itself is not sent), whether it is the first launch after install, names of screens you opened, landmarks you picked or opened, download results and time ranges, viewing-time ranges, time-of-day changes, AR steps, purchase cards shown and "Collect" taps (purchase results are not processed), sharing and story-card use, and the screen you left the app from. App usage before you agree is not recorded |
| Processed during upload | Your IP address and the request headers that come with the connection (such as device language, and client information with the app name and OS version). The receiving Worker and its database (D1) do not store IP addresses, countries or request headers, and Workers logs are turned off. Because these requests use the same domain, Cloudflare's security analytics still keeps sampled request records (IP address, browser information) for the last 31 days (section 2) |
| Not processed | Name, contact details, location, device identifiers (including advertising identifier and IDFV), any per-install number, photos or camera images, viewing history, purchases or purchase results |
| Purpose | Performance: finding out when each device model gets warm or stutters, to improve performance. App usage: understanding how screens and features are used and where people stop, to improve the app |
| Legal basis | Your consent (Korea PIPA Art. 15(1)(1)). Where the GDPR applies, GDPR Art. 6(1)(a) and consent to access information on your device |
| Retention | One year from storage, deleted daily after that. Records not yet sent are deleted after 30 days or when you withdraw consent |
| Withdrawing consent | Turn off the switch in Settings > Privacy. Sending stops and unsent records on the device are deleted. Stored records contain nothing that identifies you or your device, so we cannot find or delete a particular person's records |
| Children | The consent screen asks people under 14 to leave both off |
3. Information you send to support
When you contact us by email or phone, we use your reply address or contact details, message, and any app/OS version, landmark name, error code or optional attachments you supply to investigate and reply. Do not send national identification numbers, Apple Account passwords or payment card details. Redact unrelated personal information from screenshots.
Legal basis: requests about using or buying the app rely on Article 15(1)(4) of Korea’s Personal Information Protection Act (entering into or performing a contract); other requests rely on Article 15(1)(6) (legitimate interests: answering the request we received). Where the GDPR applies, the bases are Article 6(1)(b) and (f) GDPR respectively.
| Support records | Retention |
|---|---|
| Withdrawal requests and our replies (sender email address, request, date and outcome) | Five years (Enforcement Decree of the Korean Act on the Consumer Protection in Electronic Commerce, Article 6(1)(2)) |
| Contract, payment or supply evidence you attach to a support request, such as order numbers or receipt screenshots | Five years (same Decree, Article 6(1)(2) and (3)) |
| Records of consumer complaints or dispute handling about purchases or use (message, date and outcome) | Three years (same Decree, Article 6(1)(4)) |
| Other support records | One year after we reply (to answer follow-up questions and prepare for disputes; Personal Information Protection Act, Article 15(1)(6)) |
If the same record falls into more than one category, the longer period applies. When the retention period ends, electronic records and attachments are deleted without delay in a manner that prevents recovery, and paper records are shredded. For records kept under a legal obligation, only what the obligation requires is stored separately from other support records and used only for that purpose.
4. Processors, disclosure and international transfers
We do not sell personal information to advertisers or disclose it for advertising tracking. We use Cloudflare for content delivery and website hosting, Cloudflare Email Routing to forward support email to the operator's mailbox, and the operator's mailbox service (Google LLC (Gmail), processed in the United States and other countries where Google operates data centers). Information may be handled as required by a lawful request, within its lawful scope.
Processors and international transfers are described below.
| Item | Details |
|---|---|
| Processors and tasks | Cloudflare, Inc.: website hosting (Pages), landmark content storage and delivery (R2), support email forwarding (Email Routing), receiving and storing performance and app usage records if you agree (Workers and D1, section 2a) / Google LLC (Gmail): support mailbox (the operator’s personal mail account, kept under that service’s terms of service and privacy policy) |
| Overseas recipients and contacts | Cloudflare, Inc. (United States, 101 Townsend St., San Francisco, CA 94107), privacy contact privacyquestions@cloudflare.com, Data Protection Officer dpo@cloudflare.com. Please send requests about this service to the operator first (section 6) / Google LLC (Gmail), contact 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA · privacy questions googlekrsupport@google.com |
| Countries and information transferred | Confirmed countries: the United States (Cloudflare, Inc. and its core data centers), and the United States and other countries where Google operates data centers for the support mailbox. Cloudflare does not publish the other countries of processing. Requests are handled at a nearby data center determined by network routing (the cities with data centers are published on Cloudflare’s network page, but the country handling each request is not), and Cloudflare states that it processes log data in data centers in the United States and Europe without naming the European countries. The Asia-Pacific region is set as the storage location for landmark content, but the country is not published. You can ask Cloudflare about this at privacyquestions@cloudflare.com. Information: IP address, request time and path, response status, device or client information, and support email (sender address, content and attachments) |
| Timing, method, purposes and legal basis | Transferred over the network when the app downloads content, when you visit this website and when you send support email. Purposes: delivering content and the website, service security and forwarding support email. Downloading app content (performing the app license), delivering the website pages a visitor requests (performing the free provision of the requested pages, section 2) and forwarding support email about using or buying the app (steps at your request in entering into or performing a contract, section 3) are overseas processing and storage arrangements needed to enter into and perform a contract with you, so we disclose the above in this policy under Article 28-8(1)(3)(a) of Korea’s Personal Information Protection Act. Inquiries unrelated to using or buying the app fall outside this basis, so to contact us without an international transfer, please use the phone. The safeguards Cloudflare must apply are set out in the Cloudflare Customer Data Processing Addendum (DPA). Where the EU General Data Protection Regulation (GDPR) applies, personal information that Cloudflare processes on the operator’s behalf and transfers to the United States is covered by Cloudflare’s EU-U.S. Data Privacy Framework (DPF) certification under Cloudflare’s Customer Data Processing Addendum (DPA); if that certification lapses, or for transfers to other countries, the Standard Contractual Clauses (SCCs) incorporated in the DPA apply. A copy is available in the Cloudflare Customer DPA. |
| Recipient retention period | Cloudflare keeps information while handling a request and for as long as needed to provide and secure the service under the Cloudflare Customer Data Processing Addendum (DPA). Sampled request records in the security analytics view (IP address, country, path, time and browser information) remain available for up to the last 31 days (section 2). Cloudflare forwards support email without storing its body or attachments (Cloudflare Email Routing documentation, checked 2026/10/27: “Cloudflare will not store or access the emails routed to your inbox”), and keeps forwarding records such as the sender and recipient addresses, subject and delivery result for 31 days. In the operator's mailbox, support email follows the retention period in section 3. |
| Performance and app usage records (if you agree) | Unlike the rows above, the basis is your separate consent (PIPA Art. 28-8(1)(1)), given with "Share Selected" on the in-app consent screen after these items are shown. Recipient: Cloudflare, Inc. (contact above). Countries: the country of the Cloudflare data center that handles the request (not disclosed per request) and the United States; storage is set to the Asia-Pacific region (country not disclosed). When and how: over HTTPS when you open the app after using it. Data: the records you chose in section 2a, plus your IP address during the upload. Purpose and retention: improving performance, screens and features; one year from storage. Refusing: don't agree or turn it off in Settings; nothing else in the app changes |
| How to refuse a transfer and consequences | If you do not want this transfer, you can choose not to download content in the app, not to use this website and not to contact us by email. In that case landmark content cannot be downloaded and we cannot reply by email. Phone inquiries are handled without an international transfer. |
5. Retention, deletion and safeguards
Viewing/discovery records and settings remain on your device. Removing a landmark in the app’s Storage screen removes downloaded content while preserving viewing records and discovered stories. Deleting the app and its app data removes its local stored data. Offloading an app may keep its data. Manage device backups and any copies you saved elsewhere separately.
The operator cannot remotely access or delete your local viewing records. Support records held by the operator are deleted according to the periods above and applicable legal requirements. The operator does not keep access logs separately (section 2). Content uses HTTPS. Access controls, authentication and retention/deletion procedures for support and logging accounts are managed as follows: the accounts that handle support and logs (Cloudflare, the Apple developer account and the operator's mailbox) are used by the operator alone, and support email past its retention period is deleted from the mailbox.
The app has no advertising cookies or advertising identifier tracking. This website does not use cookies, external fonts or advertising requests. The website visit figures the operator sees are aggregates that Cloudflare produces while delivering the website (section 2).
The hosting service that serves the site (Cloudflare, Inc.) may process access logs (section 2), and opening external links may involve the destination’s logs and cookies.
6. Access, correction, deletion and other requests
You or your legal representative can request access, correction, deletion, restriction of processing or withdrawal of consent for personal information handled by the operator. Where the GDPR applies, you also have the right to object to processing based on legitimate interests (review of security records in section 2, support requests unrelated to using or buying the app, section 3). Use the contact details below, put “Privacy rights request” in the subject and identify the records concerned. We verify identity or representation only to the extent necessary and explain the outcome or any legal limitation under applicable law. Do not include an identification document in your initial message. You can withdraw consent for performance and app usage records (section 2a) at any time with the switches in Settings > Privacy.
- Privacy officer: Lee Wooseok (business owner)
- Email: support@vasto.world
- Phone: +82-10-4168-8760
- Address: Unit 106, Bldg 103, 16 Suji-ro 113beon-gil, Suji-gu, Yongin-si, Gyeonggi-do, Republic of Korea
- Help: Support
EU and UK representative
The operator has no establishment in the EU or the UK. A representative in the EU and the UK under Article 27 of the GDPR and the UK GDPR has not yet been designated; once designated, their name and contact details will be listed here. Until then, individuals and supervisory authorities in the EU and the UK can contact the operator directly at support@vasto.world, and we will reply in English.
Information about children under 14
The current app does not ask users to enter their age or create child accounts. Camera/AR data and viewing/discovery state are processed locally as described above, regardless of age. However, a child’s support request or content download may involve personal information in messages or network logs. We therefore do not claim that no information about children under 14 is ever processed.
Under Article 22-2 of Korea’s Personal Information Protection Act, where consent under the Act is required for processing a child under 14’s personal information, consent must be obtained from and verified with the legal representative. Legal representatives may use the contacts above to exercise the child’s privacy rights. Performance and app usage records (section 2a) are based on consent, so the consent screen asks people under 14 to leave both off. The stored records contain nothing that identifies a user.
Privacy complaints and dispute resolution
You can contact the following Korean institutions directly for privacy complaints, advice or dispute mediation. Contacting the operator first is not a prerequisite.
| Institution | Contact / application |
|---|---|
| Personal Information Dispute Mediation Committee | Within Korea: 1833-6972 · Dispute mediation |
| KISA Personal Information Infringement Report Center | Within Korea: 118, without an area code · Reporting and consultation |
The Personal Information Protection Commission’s Privacy Portal also lists these contacts and remedies.
7. Landmark purchases and transaction information
Paid landmarks are individual non-consumable purchases. There are no subscriptions. Apple handles payments, billing and purchase authentication. Neither the app nor the operator receives your payment card number or Apple Account password. Through StoreKit, the app checks product IDs, localized prices, transaction IDs, purchase access and refund/revocation status to grant landmark access and process purchases and restoration.
The app keeps verified transaction identifiers and access states in device memory while the app runs. The app does not separately persist an owned-landmark list or transaction history in UserDefaults, files or its own database. When the app starts or returns to the foreground, it reads the verified transactions supplied by StoreKit on the device again. Apple manages StoreKit's own transaction storage and synchronization.
Purchasing, retrieving products and restoration may communicate with Apple services. When you select Restore purchases, the app requests purchase synchronization from Apple, which may prompt for authentication. The app has no path that sends transaction information or receipts to the operator or landmark content server, no operator receipt-verification server, and no external payment-management SDK. It does not transmit transaction information for advertising or analytics. Content access records and information you send to support are handled separately under sections 2 and 3.
Handling of transaction records that the operator receives separately, such as through Apple reports or support requests: the operator receives only aggregate data such as country, product, quantity and amount through App Store Connect sales and payment reports, and does not receive transaction data that identifies a buyer, such as a name or Apple Account. Order numbers or receipt screenshots you send with a purchase or refund inquiry are kept as contract, payment or supply evidence under section 3 (five years). If server verification, an external SDK or transaction retention is added, this policy will be updated together. Apple's independent processing is covered by the Apple Privacy Policy.
8. Changes and effective date
This policy takes effect on November 10, 2026. Changes and their effective dates will be posted here. We will follow any advance notice or consent procedures required by law.