1. Scope

• This policy applies to two services run by Ryokatrip: (1) this link page, which collects links to accommodations and activities, and (2) an auto-reply server that, when someone comments on a Ryokatrip Instagram post, sends that person a DM with a follow-check button, and, if the person taps the button and follows @ryoka.trip, sends the accommodation or activity link by DM.
• We do not offer sign-up and never ask for your name, phone number, or email address.
• Once you follow a link to another site such as Coupang, that site's privacy policy applies.

2. Meta Platform Data and purposes of use

• We use data received from Meta (Instagram) only to reply to comments and send DMs on @ryoka.trip, for the three purposes below. We do not sell it, do not use it for ad targeting or profiling, and do not share it with anyone other than the companies listed in section 6. The link DM contains the link for the post the person commented on, which may be a Coupang Partners affiliate link.
• To send a greeting DM with a follow-check button to a person who commented on a Ryokatrip post, and to reply to that comment.
• To check whether a person who tapped the button follows @ryoka.trip, and to send the link for that post by DM.
• To avoid replying to comments made by the @ryoka.trip account itself, and to avoid sending the same greeting or link for the same post to the same person twice.
• Separately, without using Meta data: to show this link page and count how many times each link is tapped.

3. Information we process

• When someone comments on a Ryokatrip post or taps a button in our DM, Meta (Instagram) sends a notification (webhook) to our auto-reply server. We also receive notifications for comments on posts without auto-reply. The server uses the following:
• Instagram-scoped user ID (IGSID): to tell whether a comment was made by the @ryoka.trip account, to keep the duplicate-prevention record (section 4), and to check whether the person who tapped the button follows us.
• Username: only to tell whether a comment was made by the @ryoka.trip account.
• Comment text: included in the notification but not used. Every comment on a post with auto-reply receives the same greeting.
• Comment ID and media (post) ID: to decide which comment on which post to reply to. The greeting DM is addressed by comment ID to the person who wrote that comment.
• Follow status: only for a person who tapped the button, we ask Meta whether that person follows @ryoka.trip and use the yes/no answer to decide whether to send the link. It is not stored.
• Access logs: when this page or the auto-reply server receives a request, our hosting provider Vercel automatically records the IP address, browser information, time of access, and requested URL.

4. Retention and deletion

• Duplicate-prevention record: to avoid sending the same greeting or link for the same post to the same person twice, we store the user ID (IGSID), media ID, link (block) ID, type of message sent (greeting or link), and the time of recording (just before sending) in a Supabase database (Seoul region). Records are kept for 90 days. Records older than 90 days are deleted while the auto-reply server processes comment or button notifications (at most once an hour per server instance). If no notification arrives or the cleanup is postponed, a record may remain slightly longer than 90 days.
• Username, comment text, comment ID, and follow status are not stored. They stay in server memory only while a notification is being processed and are discarded afterwards.
• Server logs record only which link was sent (link ID) and whether it succeeded. They do not record user IDs, usernames, comment text, or comment IDs.
• Access logs and server logs are kept by Vercel and deleted under Vercel's policy after Vercel's retention period. We do not download or keep separate copies.
• How we delete: duplicate-prevention records are deleted by removing the rows from the database. Data held in memory disappears when processing ends and cannot be recovered. We do not keep personal information in any other file.
• Security: we process only notifications signed by Meta, and all transfers are encrypted with HTTPS. The Instagram access token and the database secret key are kept only in server environment variables and are never logged. The duplicate-prevention table cannot be read or written with the public key.
• You can ask us to delete your record at any time. See the data deletion page (/data-deletion) and section 9.

Data deletion instructions

5. Cookies

• This link page does not set or read cookies and does not use advertising or analytics trackers.
• Link taps are counted without cookies. A tapped link passes once through our counting URL (/api/click), which adds 1 to the count for that link (block) ID. We do not record who tapped, so the counts cannot identify anyone.
• Depending on our settings, the button on a DM link card either goes through this counting URL or goes directly to Coupang. When it goes through the counting URL, only the per-block count is recorded in the same way.
• After you move to Coupang, Coupang may use its own cookies under its own policy. Blocking cookies in your browser does not affect this link page.

6. Disclosure to third parties and international transfer

• We do not sell any information. To run the service, information is transferred only to the three companies below and is not provided to any other third party. Fonts and images on this page are served from our own server, so no access information goes to other external servers.

• How to refuse: if you do not comment on Ryokatrip posts, no comment notifications or DMs are exchanged. You can delete comments you have already made. This link page (including this policy) creates an access log each time it is opened, so if you do not want that, please do not open the page. If you refuse, you will not receive link DMs.

7. Processors

• Processor Vercel Inc.: operating (hosting) the link page and the auto-reply server
• Processor Supabase Pte. Ltd.: storing the auto-reply duplicate-prevention record (database)
• Meta Platforms, Inc. operates Instagram and processes information under its own policies, so it is not our processor. Information transferred to Meta is described in section 6.
• If the processing tasks or processors change, we will announce it in this policy first.

8. Your rights

• You may at any time request access to, correction of, deletion of, or suspension of processing of your information processed by Ryokatrip.
• The only information we keep is the duplicate-prevention record in section 4. We look up the record by the user ID of the Instagram account that made the request; on an access request we tell you its contents, and on a deletion or suspension request we delete it. If you comment again after deletion, you may receive the greeting DM again.
• We cannot delete individual Vercel access logs; they are deleted after Vercel's retention period. Information held by Meta can be managed in your Instagram settings or through Meta's contact channels.

9. How to request data deletion

• (1) Send a DM saying "Data deletion request" to @ryoka.trip on Instagram from the account whose data you want deleted.
• (2) Within 10 days, we delete the duplicate-prevention record for that account's user ID from the database and tell you the result in that DM conversation.
• (3) The conversation history stays on Instagram, and you can delete it yourself. Deleting your comment removes it from Instagram; deleting the DM conversation removes it from your side. If you also want us to delete our side of the conversation and your comments on our posts, say so in your request DM.

Data deletion instructions

10. Privacy officer and contact

• Privacy officer: Ryokatrip operator (료카트립 운영자)
• Contact: Instagram DM to @ryoka.trip

11. Effective date

• This policy takes effect on 2026-11-04. If it changes, we will post the change on this page before it takes effect.