Privacy Policy

1. Who we are and scope

This policy explains how the AY ENTERTAINMENT handles information about members and visitors at ayfanzone.com. External services reached through links have their own policies. Internal staff employment and work records may also be covered by separate notices and agreements.

2. Information we collect

Account data includes your name, email if provided, a password hash for email accounts, account identifiers, role, optional profile image and fan club preferences. Community data includes comments, requests, reports, replies and files you submit. Reward data includes eligibility, Pieces history, exchange records and delivery or contact details you provide.

Technical information may include sign-in sessions, download history, request timestamps and server access or security logs such as IP address and browser information. Without required information, the related feature may be unavailable. Please do not submit unnecessary personal or sensitive information about others.

3. TikTok sign-in data

Only when TikTok sign-in is enabled and you authorize it, we request user.info.basic and receive your app-specific user ID (open_id), union_id if provided, display name and profile image URL. We store these identifiers and profile details for sign-in and account linking. Your display name and image may initialize a new site profile. We do not receive your TikTok password.

Access and refresh tokens are used only during the server-side sign-in request; we do not persist them or send them to your browser. This integration does not request videos, private messages, contacts or posting permissions. You can manage app authorization in TikTok settings. Site unlinking requires an existing email and password; unlinking on our site and revoking TikTok authorization are separate actions. Contact the team if TikTok is your only sign-in method or you want data deleted.

4. Purposes and legal grounds

We use information to operate accounts, authenticate users, deliver content, moderate comments, handle requests, administer rewards and prevent abuse. Where applicable law requires a legal basis, we rely on performance of the service contract, legitimate interests in security and operation, legal obligations or consent for optional features, as appropriate. You may withdraw consent where it is the basis, without affecting earlier lawful processing.

5. Cookies and browser storage

ay_session is an HttpOnly cookie used to maintain sign-in for up to 7 days. ay_locale and ay_theme remember language and appearance for up to one year; the theme is also saved in localStorage. TikTok sign-in uses a temporary security cookie and a single-use authorization state valid for up to 10 minutes. Some interface preferences and temporary drafts may also use browser storage.

You can clear or restrict cookies and local storage in your browser, which may affect sign-in and saved preferences. Advertising tracking cookies are not currently implemented on the public site. If we introduce tracking that requires consent, we will first provide the necessary information and choices.

6. Visibility and sharing

Approved comments, your name and selected public profile details may be visible to visitors. Private reports and attachments are restricted to the submitting user and authorized staff. Staff and hosting, storage or security providers may access information as necessary to provide the service; delivery details may be shared with a fulfillment provider when you request a reward.

We may disclose information when required by law or necessary to protect rights or respond to security incidents. We do not sell personal information or share it for targeted advertising. TikTok processes authorization requests under its own policy. Opening external links or externally hosted profile images may send request information, such as your IP address, to that provider.

7. Retention and deletion

We retain account information and associated records for as long as needed to provide the service and fulfill the relevant purposes. The cookie and authorization validity periods above do not mean that every server record is immediately deleted on expiry. Security, audit, reward and request records may be retained longer where needed for legal obligations, fraud prevention or disputes.

On a deletion request, we verify identity, assess the relevant data and retention duties, and delete or anonymize it or explain why some data must be kept. Backup copies are removed through backup rotation and are not used in ordinary operation except where restoration is needed.

8. Security and international processing

We use measures including HTTPS, password hashing, protected sessions and role-based access controls. No system can guarantee absolute security. Depending on hosting and external services, information may be processed outside your country of residence, subject to safeguards required by applicable law where necessary. Contact the team for questions about processing locations and relevant safeguards.

9. Your choices and rights

You can edit your profile and, where available, disconnect TikTok in your account. Depending on applicable law, you may request access, correction, deletion, a copy, restriction or objection to processing, withdraw consent, and complain to a data protection authority. Requests may require proportionate identity verification. We respond within the period required by applicable law.

10. Children’s privacy

We do not knowingly collect personal information without required parental consent from children below the age at which such consent is required by applicable law. A parent or guardian who believes information was collected improperly can contact the team. After review, we take appropriate steps, such as restricting access or deleting data, in line with applicable law.

11. Contact and policy changes

Send privacy questions or requests to delete account or TikTok data to AY ENTERTAINMENT at ayentertainment@naver.com, using “Privacy” or “Data deletion” in the subject. Email requests do not require site sign-in and remain available if you cannot access your account. We may require proportionate identity verification to process a request. You can also revoke app authorization in TikTok settings; this is separate from requesting deletion of site data. We communicate material policy changes through site notices or another appropriate method and update the date on this page.