Privacy policy

1. Information collected and how it is collected

① Registration and sign-in (required): name, email address and profile image received from Google or Kakao social sign-in providers.

② Service use (required): facial photos (selfies) uploaded by the user, generated images and package usage records.

③ Profile creation (required): the profile’s gender and age range, used only to tailor styling such as clothing to the person.

④ Payment: order details, including the product, amount and date/time. The Company does not store payment method information such as card numbers; Toss Payments processes it directly.

⑤ Company/team services: invitation email addresses entered by the team administrator.

⑥ Automatic collection: access logs, IP addresses and cookies used to maintain sign-in sessions may be generated or collected while using the Service.

The Company does not collect personal information from children under 14.

2. Purposes of processing

Providing personal AI model training and profile photo generation and retouching

Identifying users, managing accounts and verifying identity

Processing payments and managing purchased package benefits and order history

Sending service notifications, including training completion, and responding to inquiries

Maintaining service stability and preventing misuse

3. Special provisions for facial photos

Uploaded facial photos are processed only for the user’s personal AI model training and image generation. They are not processed as biometric information for identifying or authenticating individuals.

The Company does not use users’ photos to train general-purpose AI models belonging to the Company or third parties.

Users must only upload their own photos or photos of others with lawful consent. Uploads that infringe others’ rights may be restricted under the terms of service.

Access to original photos and training ZIP files held by the Company expires 30 days after upload, and automated deletion jobs clean them up. They are not used as reference photos after expiry. Personal AI models and generated results are stored separately to provide the Service. On a deletion request, we check the scope of processing, including external storage, and communicate the result.

4. Overseas transfers of personal information

To provide the Service, the Company entrusts processing to overseas providers as described below and gives this notice under applicable law. Users may refuse overseas transfers, but doing so prevents use of the Service.

· fal.ai, Inc. (United States) — Data: uploaded photos, personal AI models and generated results. Purpose: AI model training, image generation processing and file storage. Transfer method: encrypted communications (TLS) during service use. Retention: the Company retains originals for 30 days after upload; retention and destruction of data sent to the provider and of external files are checked separately when handling deletion requests.

· Cloudflare, Inc. (United States and global edge locations) — Data: account information and service data. Purpose: service hosting, database operation and security. Retention: until account closure or termination of the processing agreement.

· Google LLC (United States) — Data: image generation and analysis request data. Purpose: supporting image generation processing. Retention: until processing is complete.

· Resend, Inc. (United States) — Data: email addresses and notification contents. Purpose: sending transactional emails, including training completion notifications and invitations. Retention: until sending is complete.

Questions about overseas transfers and requests to refuse them may be submitted using the contact details in section 9.

5. Entrusted processing and third-party disclosures

Domestic processor: Toss Payments Co., Ltd. — payment processing and prevention of payment fraud.

Overseas processors: as listed in section 4.

The Company does not disclose personal information to third parties without user consent, except where permitted by law.

6. Retention and destruction

Account information: after receiving an account closure request and verifying identity, we separate records subject to statutory retention and destroy the remaining information. Requests to close an account or delete photos or models can be submitted using the contact details in section 9.

Uploaded originals and training ZIP files: set to expire 30 days after upload. Personal models: retained until external file cleanup following a profile deletion or account closure request is complete. Generated results: retained in the account until a deletion or account closure request is processed.

Statutory retention: contract, withdrawal and payment records for 5 years; consumer complaints and dispute records for 3 years under the Electronic Commerce Act; access records for 3 months under the Protection of Communications Secrets Act.

Destruction method: electronic files are permanently deleted using methods that prevent recovery. For data held by processors, we instruct the processor to destroy it and verify the destruction.

7. User rights and how to exercise them

Users may request access to, correction or deletion of their personal information, suspension of processing, or withdrawal of consent at any time.

Requests can be submitted using the contact details in section 9. The Company will act without delay within the statutory period and notify the user of the result.

Users may exercise these rights through a legal representative or authorized agent.

8. Security measures

Encryption in transit (TLS) and access controls for stored data

Minimum necessary access permissions and restricted access to administrator accounts

A structure in which payment method information is held by the payment service provider rather than the Company

Notification and reporting procedures required by applicable law in the event of a security incident

9. Privacy officer and contact

Privacy officer: Sanghwa Rhee, Representative, Skyfall Inc.

Contact: inquiry@snapfacepro.com / info@skyfall.studio

For reports or advice about personal information infringements, users may contact the Personal Information Infringement Report Center at privacy.kisa.or.kr or 118 in Korea (no area code).

10. Changes to this policy

Additions, deletions or amendments to this policy will be announced within the Service at least 7 days before taking effect, or 30 days in advance for changes unfavorable to users.