1. Scope

This policy covers the SO:LAB portal, MOSAIC, Culture Gap (문화틈), NewsLens and the portfolio on solabstudio.com. DocuMind has its own privacy policy because it handles accounts and uploaded documents. LIGHT:GO pre-registration has its own notice on its sign-up screen. NEXT:24, Jaksim (작심) and TurnPoint have their own privacy policies because they handle accounts. Terms of use are set separately in the SO:LAB Terms of Service.

2. Across all services

• The services this page covers have no accounts and never ask for your email or phone number. A MOSAIC friend invite only takes a display name if you choose to give one.
• Access logs (IP address, time, URL, browser details) are kept for security and abuse prevention and deleted after 14 days. IP addresses are held in memory for a few minutes for rate limiting.
• Legal basis: requests you make (Culture Gap prompts, NewsLens articles, MOSAIC answers and invites) are processed to provide the service under the terms (PIPA Art. 15(1)(4)); access logs and rate limiting follow our security duty (Art. 29); visit statistics and usage totals rely on our legitimate interest in improving the service (Art. 15(1)(6)) and can be refused as described in section 4.
• Settings such as theme and language stay in your browser's storage.
• Visit statistics come from Cloudflare Web Analytics, which uses no cookies and does not identify you.
• Portal analytics. The SO:LAB home page (solabstudio.com) uses Google Analytics 4 through Google Tag Manager. It records pages viewed, how you arrived, device and browser type, approximate location (country and city), scrolling and outbound link clicks, together with a random identifier stored in cookies (_ga, _ga_RWS5W76X00). We use it only for aggregate statistics; Google signals and ad personalisation are off and advertising storage is always denied.

3. By service

• MOSAIC. Your picks, the taste scores computed from them and your language are sent to our server to write the AI taste read and song line. Unless you use a friend invite, answers are not stored; only the generated text stays in memory for up to 24 hours. Share cards are drawn on your device.
• MOSAIC friend invites. Creating an invite stores your language, picks and (if given) display name on our server. Opening the share-card sheet creates such an invite as the compare link sent with your card, and reuses it while your picks are the same; a friend who finishes the test through the link adds their picks, language and optional display name to it. Each side sees only scores and the match, never the other's picks, and anyone with the link can see the inviter's display name. Invites and their results are deleted 30 days after creation. Tapping Share also copies the link to your device's clipboard. The device that created the invite keeps the list and a result key in mosaic.invites.
• MOSAIC drop votes. A drop vote stores your pick and the country Cloudflare reports, plus a hash of a random ID made on your device (mosaic.voter) so each device votes once. To stop vote stuffing, your IP address is held in server memory for up to 24 hours and never written to disk. Results show the overall split and count; a country appears only once it has 20 votes. When a drop ends, individual votes are deleted and only country totals remain.
• MOSAIC usage totals. Visits, test starts and finishes, opening the share sheet, sharing, saving the image, copying the link, and invites created, opened and completed each add 1 to that day's total. Visits are also counted by the channel tag on links we post (?s=), and visits, finished tests, shares and completed comparisons by the country Cloudflare reports. No identifier, IP address or pick is stored; only the daily numbers remain.
• Culture Gap. Your request text and filters (area, genre, budget, companion or accessibility needs) are sent to NVIDIA to interpret and recommend. Event search uses only those filters; nearby places are found from the chosen venue's coordinates. We never use your device location. Requests are not stored; nearby results are cached in memory for 5 minutes. Please do not type personal details into requests.
• NewsLens. The article text or URL you submit is analysed: the content goes to NVIDIA, and claim sentences go to Naver Search, Google Fact Check Tools, GDELT and Crossref for cross-checking. Each analysis is stored with the article's title, text and URL so you can reopen it by link, and anyone with the link can view it. No IP address or identifier is stored with it. Recent analyses are also listed in your browser (newslens:history).
• Portfolio. A static page that stores only your theme setting.

4. Cookies and advertising

Some MOSAIC screens show Google AdSense ads. Google and other third-party vendors use cookies to serve ads, limit repeats and prevent fraud. We request non-personalised ads, but cookies may still be used for these purposes. See how Google uses information from ads. You can block cookies in your browser, turn off personalised ads in Google Ad Settings, and, in the US, opt out at aboutads.info. The SO:LAB home page sets Google Analytics cookies (_ga, _ga_RWS5W76X00, up to 2 years); block them in your browser or install the Google Analytics opt-out add-on. SO:LAB sets no other cookies of its own; Cloudflare may set strictly necessary security cookies. Behavioural data from analytics and ads is used only for statistics, frequency capping and fraud prevention; we never share it or use it for personalised ads.

5. Service providers and international transfers

Oracle hosts our servers in Osaka, Japan. Cloudflare (US and global) carries traffic. NVIDIA (US) runs the AI models. Google (US) provides portal analytics (Google Analytics, Tag Manager), serves MOSAIC ads and fonts, and runs the Fact Check Tools search. Apple (US) serves album art. Naver, Kakao and the Korea Culture Information Service (public data portal) are in Korea; GDELT and Crossref are in the US. Searches and AI requests are sent by our server, so they do not carry your IP address. We do not sell your information. Retention on our side is listed in section 6; recipients keep data under their own policies. Privacy contacts: Oracle (oracle.com data privacy inquiry form), Cloudflare dpo@cloudflare.com, NVIDIA privacy@nvidia.com, Google googlekrsupport@google.com, Apple privacyoffice_korea@apple.com. To avoid a transfer, skip the AI features (NVIDIA) or block analytics and ad cookies (Google); hosting (Oracle) and traffic delivery (Cloudflare) cannot be refused while using the service.

6. Retention

Access logs: 14 days. Portal analytics: user- and event-level data deleted by Google after 2 months, cookies up to 2 years. Rate-limit IPs: minutes in memory (up to 24 hours for drop-vote abuse checks, never on disk). MOSAIC AI text: up to 24 hours in memory. MOSAIC invites and results: 30 days from creation. MOSAIC usage totals: daily numbers only, nothing that identifies you. MOSAIC drop votes: until the drop ends, then country totals only. Culture Gap nearby results: 5 minutes. NewsLens analyses: until you ask us to delete them, and up to 14 more days in server backups.

7. Children

We do not collect information that identifies anyone, and we request non-personalised ads only.

8. Your rights and contact

Privacy officer: 장재경, support@solabstudio.com (general questions and collaboration: contact@solabstudio.com). You may ask to access, correct, delete or stop the processing of your information. For a NewsLens analysis, send its result link; for a MOSAIC invite, send the invite link. Because we keep no accounts, tell us when you visited and from which device. We will post any changes here with a new effective date.