Privacy policy
This is an English translation for convenience. The Korean version is the official text and prevails in case of any difference. Read the Korean version.
Notice of amendment (effective 2026-11-25)
Announced 2026-10-26. From 2026-11-25 the following will be added to this policy. Until then the current text applies. Ads appear only on pages where we have actually started showing them after Google’s approval; if no ads are shown on the effective date, no advertising cookies are set.
- New row in the §6 table: Google LLC (contact form in Google’s Privacy Policy) · Ad serving and measurement (Google AdSense) · Advertising cookies and device identifiers, page URLs visited, IP address, browser information · United States and other regions where Google operates · As set by Google’s policies (cookies up to 13 months). You can refuse advertising cookies as described in §9-2 without any limit on using the Service.
- §9, first paragraph: “We do not use advertising or analytics cookies” becomes “On some information pages that show ads (tier guides, hotels by country and similar), Google sets advertising cookies (see §9-2). We do not use analytics cookies.”
- §9, last sentence becomes: “The usage statistics we collect are not used for personalised advertising or for automated decisions that affect you. Ads follow §9-2.”
- New §9-2 (Advertising and behavioural information): To cover running costs, TierStay may show Google AdSense ads on some information pages, not on the map, sign-in or account screens. Third-party vendors, including Google, use cookies to serve ads based on your prior visits to this site and other sites; TierStay itself does not collect or store this information. Google collects advertising cookies and device identifiers, page URLs visited, ad impressions and clicks, IP address and browser and device information when you open a page with ads, for ad serving, personalised advertising, measurement and fraud prevention, and keeps it as set by Google’s policies (advertising cookies up to 13 months). You can opt out of personalised advertising in Google Ads Settings, opt out of other vendors’ personalised ads at aboutads.info, or block third-party cookies in your browser; ads may still appear but will not be based on your visits. Visitors in the EEA, the UK and Switzerland are asked for consent through a Google-certified consent management platform before advertising cookies are used. See How Google uses information from sites that use its services; questions and complaints go to the contact in §11.
TierStay (the “Service”) has established this privacy policy, in accordance with the Personal Information Protection Act (PIPA) of Korea, to protect data subjects’ personal information and to handle related complaints smoothly. No personal information is collected for viewing the map, lists, promotions or tier guide without signing in.
1. Purposes of processing personal information
- Identifying members and keeping them signed in (Google account sign-in)
- Receiving error reports and improvement requests, and informing members in ‘My reports’ of the outcome of checks against official sources
- Preventing misuse, such as repeated submission of the same content or excessive submissions
- Sending advertising information such as the newsletter (only where separate optional consent has been given)
Personal information is not used beyond the purposes above. If a purpose changes, we will notify you in advance and obtain any required consent.
2. Personal information items processed
| Category | Items | How collected |
|---|---|---|
| Required Member | Google account identifier, email address, whether the email address is verified, name, profile picture URL | Received from Google when you sign in with Google (scopes: openid, email, profile) |
| Required Usage records | Date, time and content of consent; sign-in session (cookie); information on the browser that created the session (User-Agent); content of reports sent and the address of the screen they were sent from | Generated automatically while using the Service, or entered directly |
| Optional newsletter | Whether and when consent to receive was given; sending records | When optional consent is given |
We do not process unique identification information such as resident registration numbers, or sensitive information. The Service is not directed at children under 14 and does not knowingly collect their personal information. Usage statistics that cannot identify individuals are described in section 9.
3. Processing and retention periods
- Member information: until you leave. When you leave, it is destroyed without delay.
- Sign-in session: 30 days from issue, or until you sign out or leave.
- Consent to receive the newsletter: until withdrawn or until you leave. We will remind you of your consent every 2 years.
- Reports sent: after you leave, the link to your account is removed so that the sender cannot be identified, and the report is kept as a record of data checks.
- Where laws require retention, information is kept for the period so required.
4. Procedure and method of destruction
Personal information whose retention period has ended or whose processing purpose has been achieved is destroyed without delay. Electronic files are deleted by a method that makes recovery impossible, and when you leave, the email address, name, profile picture and Google account identifier values are deleted. No personal information is kept in paper documents.
5. Provision of personal information to third parties
The Service does not provide personal information to third parties, except where laws make special provision.
6. Outsourcing of processing and overseas transfer
To operate the Service, we outsource the processing of personal information to the companies below. Because their servers are located overseas, personal information is transferred abroad.
| Recipient (contact) | Outsourced task and purpose | Items transferred | Destination country | Retention and use period |
|---|---|---|---|---|
| Cloudflare, Inc. (dpo@cloudflare.com) | Operating the website and database (hosting), visit statistics | All member information, usage records and reports listed in section 2 | United States and other regions where Cloudflare operates | Until you leave or the outsourcing contract ends |
| Plus Five Five, Inc. (Resend) (support@resend.com) | Sending newsletter emails | Email address, name | United States (sending servers in Japan) | The provider’s record retention period after sending, or until the outsourcing contract ends |
| Anthropic, PBC (privacy@anthropic.com) | Reading flights from text pasted into the flight log “Paste text” feature (only when a member runs it) | The text the member pasted | United States | The provider’s API record retention period after processing, or until the outsourcing contract ends (TierStay does not store the text) |
Timing and method of transfer: transmitted over an encrypted network (HTTPS) when you use the Service or when the newsletter is sent.
How to refuse and the effect of refusal: if you do not want your information transferred abroad, you can choose not to join or to leave, and refuse to receive the newsletter. If you refuse, you cannot use features that require sign-in (error reports, My reports) or the newsletter, but you can still view the map, lists, promotions and tier guide.
Google sign-in: when you sign in, we receive the account information in section 2 above from Google LLC. We do not send personal information to Google or outsource processing to it. Google’s processing is governed by Google’s privacy policy.
If an outsourced task or recipient changes, we will notify you without delay through this privacy policy.
7. Rights and obligations of data subjects and how to exercise them
- You may at any time request access to, correction, deletion or suspension of processing of your personal information, and withdraw your consent.
- Directly from the account menu: view ‘My reports’, turn the newsletter on or off, and leave (deletion).
- For any other request, contact us at the address in section 11; we will act within 10 days and inform you of the result. You may also make a request through a legal representative or a person you have authorised; in that case, please also send material that confirms the authorisation.
- You can withdraw from the newsletter immediately, without signing in, using the unsubscribe link in the email.
- Requests may be restricted in cases prescribed by law, such as where other laws require retention or where there is a risk of infringing another person’s rights; we will tell you the reason.
8. Measures to ensure the security of personal information
- Encryption in transit (HTTPS); sign-in session values are stored only as hashes
- Origin checks on requests that change state (CSRF protection); restricted access tokens for administrative functions
- Two-factor authentication on administrative accounts; access rights limited to the operator
- Email addresses are not passed to the automated runner that processes reports
9. Installation, operation and refusal of automatic collection devices (cookies), and usage statistics
We use one essential cookie (ts_session, 30 days) to keep you signed in. We do not use advertising or analytics cookies. You can block cookies in your browser settings, but you will then be unable to sign in.
Visits are counted with Cloudflare Web Analytics, which does not use cookies. It collects the address of the page visited, the previous page (referrer), browser and device type, country and page load speed, and we view these only as visit counts; it does not distinguish or track visitors.
In addition, to improve the Service, we store usage statistics (menus, cities and hotels viewed; chains, tabs and external links clicked; search terms entered; previous site address; device type; country) only as daily totals. Individual visit records, IP addresses, cookies and account information are not stored with them, and the totals are deleted after 400 days. To count a visit only once per browser tab, we place a single marker in storage that is cleared when the tab is closed (sessionStorage). Please do not enter personal information in the search box.
We do not use this information for personalised advertising, and we do not make automated decisions that affect users.
10. Sending advertising information
The newsletter is sent only where optional consent has been given, is marked “(광고)” [“(Advertisement)”] in the subject line, and is not sent between 9 p.m. and 8 a.m. the next day. When we process consent to receive, refusal or withdrawal, we will inform you of the result.
11. Chief privacy officer
Position: TierStay operator · Contact: help@tierstay.com
Please send enquiries, complaints and requests for remedies relating to the processing of personal information to the contact above. We will respond and deal with them without delay.
12. Remedies for infringement of rights
- Personal Information Infringement Report Center (privacy.kisa.or.kr, 118 without area code)
- Personal Information Dispute Mediation Committee (www.kopico.go.kr, 1833-6972)
- Supreme Prosecutors’ Office (www.spo.go.kr, 1301), Korean National Police Agency (ecrm.police.go.kr, 182)
13. Changes to this privacy policy
If this policy changes, we will announce it on the site 7 days before the change takes effect (30 days before for changes that are significant to users’ rights).
- Effective 2026-09-27 (first version)
- Amended 2026-10-20: personal flight logs and “Paste text” (processing by Anthropic and transfer abroad, credit records) added
- Amended 2026-10-21: optional display in the member statistics top 10 added
- Amended 2026-10-22: optional nickname display in the member statistics top 10 added
- Amended 2026-10-23: optional “My cards” (card products, networks and mobile payment services you use) added
- To take effect 2026-11-25 (announced 2026-10-26): advertising (Google AdSense) and behavioural information notice added (§6, §9, §9-2)
Personal flight logs
Flight logs are optional and stored separately from hotel records. Members may store local departure dates, airports, flight numbers, airlines, status and optional local times, UTC offsets, aircraft, seats, purpose and notes until record or account deletion. Guest drafts stay in this browser localStorage until verified transfer on login. Sharing requires a separate explicit choice and publishes only routes, airports and totals, excluding today/future travel, exact dates and times, seats, notes and account identity. Anyone with the link can view it. Expiry, revocation, record changes or account deletion close the link. External downloaded copies cannot be recalled. Completed flights that ended before today are included in the all-member totals on “Member stats · Flights” (member and flight counts by airport, route, airline and country, and total distance); dates, times, flight numbers, seats, notes and account details are not used. When you use “Paste text”, the pasted text is sent to Anthropic (Claude) to read the flights; TierStay does not store it. Candidates are saved only when you review and apply them. This feature uses credits: we keep the credit balance and its history (time and reason) and a call log (model, token counts and cost, without the text). On account deletion, credit data is deleted and the call log is unlinked from the member.
Member statistics top 10
“Member statistics” shows the top 10 members by hotels visited, counted from records saved to accounts. Only members who turn on the option in the ranking card on “My hotels” (optional, off by default) appear with their rank and their unique hotel, country and city counts rounded down into ranges such as “120+ hotels”; everyone else in the top 10 appears only as “Private”. A member who shows their record may also turn on “Show my nickname too” (optional, off by default) to show the nickname set on “My hotels”; turning off the record display turns this off as well. Names, email addresses, hotel lists, dates and loyalty tiers are never shown. The ranking is set once a day (Korean date), and appears only when at least 50 members have saved hotel visits. You can turn the option off at any time in the same place; turning it off or deleting your account removes you within a few minutes, and the time you turned it on is erased. A changed or hidden nickname is updated within a few minutes. External copies cannot be recalled.
My cards
“My cards” is optional. Members may store, as separate account data, the card products they hold (entries in the TierStay payment-method list), each card’s network (Visa, Mastercard and so on), an optional card tier, the mobile payment services they use (such as Naver Pay) and when each was added. We do not collect card numbers, the last four digits, expiry dates, payment history or payment-service account details. The record is used only to pick events the member can use on the credit card “Travel events” page; it is not used for member statistics, rankings or public data and is not shared with card issuers or payment companies. A visitor’s selection stays only in this browser’s localStorage until it is confirmed as saved to the account after sign-in. It is deleted when the member removes it or deletes the account.