Privacy Policy

TourNomi ("we") prioritizes the protection of user personal data worldwide. This policy complies with GDPR, CCPA/CPRA, PIPEDA, PIPA, APPI, LGPD, PDPA, UK GDPR, and Australian Privacy Act.

• Email address (authentication & OTP) • Password (encrypted storage) • GPS coordinates & device timezone (weather & time display, not stored) • IP address & access logs (security purposes) • Travel preference data (personalized recommendations, optional)

• Service provision: GDPR Art. 6(1)(b), PIPA Art. 15, APPI Art. 15 • Authentication & security: GDPR Art. 6(1)(f), PIPA Art. 15 • Marketing (optional): GDPR Art. 6(1)(a), PIPA Art. 18, CCPA §1798.135 • Legal obligation: GDPR Art. 6(1)(c), PIPA Art. 15

• Data disposed within 30 days after account deletion (except legal retention) • Location data not stored, disposed immediately • Access logs: retained 3 months then disposed • Legal retention: per tax and related laws

• Open-Meteo: Weather API (GPS coordinates) • BigDataCloud: Reverse geocoding (GPS coordinates) • Google/Apple/Facebook/Microsoft: OAuth social login • No other third-party sharing without consent

Under GDPR Arts. 15-22, CCPA §1798.100-130, PIPA Arts. 35-38, APPI Art. 33, LGPD Art. 18, PDPA Art. 21: • Access and rectify your personal data • Delete your data (right to erasure / right to be forgotten) • Data portability • Restrict and object to processing • Opt out of marketing at any time

Supervisory authorities: • EU: National DPA • UK: ICO (ico.org.uk) • US: State Attorney General • Korea: PIPC (pipc.go.kr) • Japan: PPC (ppc.go.jp) • Brazil: ANPD • Australia: OAIC (oaic.gov.au) Contact: privacy@tournomi.com

We (Medifun) are registered as a Location Information Service Provider under Article 5 of the Act on the Protection, Use, etc. of Location Information (South Korea). • Registration Authority: Korea Communications Commission (KCC) • Purpose of location data collection: Display of local weather, timezone, and time difference • Retention: Not stored; processed and immediately disposed • Users may withdraw consent for location data collection at any time; processing ceases immediately upon withdrawal. • Location data complaints: May be filed with the PIPC (pipc.go.kr) or the KCC.