Privacy Policy

1. Categories of Personal Information Collected and Methods of Collection

The Company collects the following personal information in order to provide the Service:

• Mandatory items: social login account information (email address, nickname, profile image), date of birth (age eligibility verification), service usage records, payment records
• Automatically collected items: access IP address and the country of access estimated from it, device information (browser type, OS), service usage records, date and time of access, visit/usage statistics and cookie-based analytics identifiers collected via a web analytics tool (Google Analytics), and sign-up acquisition information (identifiers of the advertising/search source of the visit, referrer page address, and first landing page)
• Methods of collection: automatically collected upon social login (Kakao, Google); automatically generated in the course of using the Service; entered directly during the sign-up consent process (date of birth)

2. Purposes of Collection and Use of Personal Information

• Membership registration and management: identity verification, verification and management of eligibility (including age) to use the Service
• Provision of the Service: AI image generation, gallery management, credit management
• Payment processing: processing of credit purchase payments and refunds
• Improvement of the Service: analysis of usage statistics, enhancement of service quality
• Customer support: responding to inquiries, resolution of disputes
• Prevention of abuse: detection of multiple accounts, prevention of duplicate attendance check-ins

Your personal information is processed only within the scope of the purposes set out above, and is not used for AI model training.

3. Retention and Use Period of Personal Information

Personal information is retained until the User withdraws from membership, and is destroyed without delay after withdrawal. However, information that must be retained under applicable laws, and information that is kept for a set period under internal policy and then destroyed, is retained as follows:

• Records on contracts or withdrawal of subscription: 5 years (Act on the Consumer Protection in Electronic Commerce, etc. — Korean E-Commerce Act)
• Records on payment and supply of goods, etc.: 5 years (Korean E-Commerce Act)
• Records on labeling and advertising: 6 months (Korean E-Commerce Act)
• Records on consumer complaints or dispute handling: 3 years (Korean E-Commerce Act)
• Abuse-prevention records (internal policy): a one-way hash of social account identifiers is retained for 1 year after account deletion to prevent duplicate receipt of one-time benefits upon re-registration, and device identification information (browser fingerprint) is retained until the purpose of collection is achieved to prevent duplicate welcome-credit grants. These are stored only as hashes/fingerprints from which the original information cannot be reconstructed.
• Generation request records (internal policy): the Company securely retains the prompt of an image/video generation request (as entered by the User or as finally composed by the Service) and the failure reason for 30 days from account deletion to identify abuse and to investigate generation errors and disputes, after which they are removed from our systems. Generated content such as images and videos is not retained and is destroyed immediately upon account deletion. (Applies to account deletions on or after October 1, 2026.)

4. Provision of Personal Information to Third Parties

As a general rule, the Company does not provide Users' personal information to third parties. The following cases are exceptions:

• Where the User has given prior consent
• Where required by the provisions of applicable laws, or where an investigative agency so requests for investigative purposes in accordance with the procedures and methods prescribed by law

5. Entrustment of Personal Information Processing and Cross-Border Transfer

The Company entrusts the processing of personal information as set out below in order to provide the Service, and part of such information is transferred overseas:

Prompts and reference images are transmitted to the AI image and video generation providers, and are destroyed immediately upon completion of generation. Personal information transferred overseas is used solely for the purpose of providing the Service, and is managed securely in accordance with the privacy policies of the relevant providers.

For payment processing, personal information is transferred overseas as set out below (Article 28-8 of the Personal Information Protection Act).

• Transferee: Dodo Payments Inc. (current payment processor). The entrustment to Polar Software, Inc. ended on August 31, 2026; no further personal information is transferred to Polar, which retains the payment information transferred up to July 31, 2026 solely for refund and dispute handling and for compliance with statutory retention obligations.
• Items transferred: email address, order/user identifiers, purchased product information
• Country of transfer: United States
• Time and method of transfer: transmitted over HTTPS at the time the User requests payment
• Purpose of use: payment processing, settlement, and refund processing
• Retention and use period: until termination of the entrustment contract (or, where a statutory retention obligation applies, for that period). Polar Software, Inc., whose entrustment has ended, retains the existing payment records until the refund and dispute handling of payments made up to July 31, 2026 is complete and the applicable statutory retention period expires.
• How to refuse and the effect of refusal: if you do not proceed with payment, no personal information is transferred; in that case, you cannot purchase paid credits.

6. Destruction of Personal Information

Where personal information becomes unnecessary, such as upon expiry of the retention period or achievement of the purpose of processing, the Company destroys such personal information without delay.

• Person responsible for destruction: the Personal Information Protection Officer
• Time of destruction: upon expiry of the retention period or upon withdrawal from membership
• Method of destruction: electronic files are deleted by a method that renders them irrecoverable, and paper documents are shredded or incinerated.

7. Users' Rights and How to Exercise Them

Users may exercise the following rights at any time:

• Request access to their personal information
• Request correction where there are errors, etc.
• Request deletion
• Request suspension of processing

The above rights may be exercised by email (hello@lilit.kr) or in writing, and the Company will take the necessary measures within 10 days from the date of the request.

8. Notice on the Use of Cookies and Device Identification Information

• Session cookies: used to maintain the login session.
• Analytics cookies: cookies set by Google Analytics (such as _ga) are used to analyze visit and usage statistics. They are not essential to the Service, and their collection may be refused via the method below.
• Acquisition analytics cookie: to analyze, in statistical form, which advertisement, search, or external page a visit came from, acquisition source information is stored in a first-party cookie (lilit_attr, retained for 30 days) on the first visit, and is kept once as part of the sign-up record upon registration. It is not provided to third parties, is not stored when the analytics opt-out below is enabled, and is destroyed upon account deletion.
• Device identification information: a browser-based device identifier (hash value) is collected for the purpose of preventing abuse, such as preventing duplicate attendance check-ins. Only a hash value, which cannot directly identify an individual, is stored, and it is not provided to third parties.

Users may refuse the storage of cookies through their browser settings; however, in such case there may be limitations on the use of the Service. Collection of analytics cookies may be refused (opt-out) at any time via the ‘Analytics data collection’ setting on the My Page, with no impact on the use of the Service.

9. Personal Information Protection Officer

• Name: Yunsung Choi
• Position: Chief Executive Officer
• Email: hello@lilit.kr

10. Remedies for Infringement of Rights

If you need to report or seek consultation regarding an infringement of personal information, you may contact the following organizations:

• Personal Information Infringement Report Center (KISA) — privacy.kisa.or.kr / 118 (toll-free within Korea; not dialable from overseas)
• Personal Information Dispute Mediation Committee — www.kopico.go.kr / 1833-6972 (toll-free within Korea; not dialable from overseas)
• Supreme Prosecutors' Office, Cybercrime Investigation Division — spo.go.kr / 1301 (toll-free within Korea; not dialable from overseas)
• National Police Agency, Cyber Investigation Bureau — ecrm.police.go.kr / 182 (toll-free within Korea; not dialable from overseas)

11. Data Processing in AI Services

• Prompts and reference images entered by the User are transmitted to external AI service providers for the purpose of AI generation processing.
• Generated content is stored on a CDN (Cloudflare R2) and may be deleted by the User at any time.
• Neither the Company nor the AI service providers use Users' data for AI model training.

12. Measures to Ensure Safety

The Company takes the following measures to ensure the safety of personal information:

• Access control: management of access rights to personal information processing systems
• Retention of access logs: records of changes to personal information made through administrator functions are retained for at least one year
• Encryption: passwords and payment information are encrypted in storage and in transmission
• Security measures: technical countermeasures against hacking, viruses, etc.

13. Notification of Personal Information Breach Incidents

Where a leakage of personal information is confirmed, the Company will notify the affected Users within 72 hours of the items leaked, the time of the leakage, the measures Users may take in response, the measures taken by the Company, and contact information for consultation. At the same time, the Company will report the incident to the Personal Information Protection Commission and the Korea Internet & Security Agency.

14. Processing of Pseudonymized Information

The Company does not currently process pseudonymized information.

15. Notice of Changes to the Privacy Policy

Where this Policy is amended, the Company will give notice of the changes through announcements within the Service at least 7 days prior to the effective date of the amendment. Where the amendment is unfavorable to Users, notice will be given at least 30 days in advance.