Privacy Policy

1. Categories of Personal Information Collected and Methods of Collection

The Company collects the following personal information in order to provide the Service:

• Mandatory items: social login account information (email address, nickname, profile image), date of birth (age eligibility verification), service usage records, payment records
• Automatically collected items: access IP address, device information (browser type, OS), service usage records, date and time of access
• Methods of collection: automatically collected upon social login (Kakao, Google); automatically generated in the course of using the Service; entered directly during the sign-up consent process (date of birth)

2. Purposes of Collection and Use of Personal Information

• Membership registration and management: identity verification, verification and management of eligibility (including age) to use the Service
• Provision of the Service: AI image generation, gallery management, credit management
• Payment processing: processing of credit purchase payments and refunds
• Improvement of the Service: analysis of usage statistics, enhancement of service quality
• Customer support: responding to inquiries, resolution of disputes
• Prevention of abuse: detection of multiple accounts, prevention of duplicate attendance check-ins

Your personal information is processed only within the scope of the purposes set out above, and is not used for AI model training.

3. Retention and Use Period of Personal Information

Personal information is retained until the User withdraws from membership, and is destroyed without delay after withdrawal. However, where retention is required under applicable laws, the information is retained for the corresponding period:

• Records on contracts or withdrawal of subscription: 5 years (Act on the Consumer Protection in Electronic Commerce, etc. — Korean E-Commerce Act)
• Records on payment and supply of goods, etc.: 5 years (Korean E-Commerce Act)
• Records on labeling and advertising: 6 months (Korean E-Commerce Act)
• Records on consumer complaints or dispute handling: 3 years (Korean E-Commerce Act)
• Communication confirmation data: 12 months (Protection of Communications Secrets Act)
• Abuse-prevention records (internal policy): a one-way hash of social account identifiers is retained for 1 year after account deletion to prevent duplicate receipt of one-time benefits upon re-registration, and device identification information (browser fingerprint) is retained until the purpose of collection is achieved to prevent duplicate welcome-credit grants. These are stored only as hashes/fingerprints from which the original information cannot be reconstructed.

4. Provision of Personal Information to Third Parties

As a general rule, the Company does not provide Users' personal information to third parties. The following cases are exceptions:

• Where the User has given prior consent
• Where required by the provisions of applicable laws, or where an investigative agency so requests for investigative purposes in accordance with the procedures and methods prescribed by law

5. Entrustment of Personal Information Processing and Cross-Border Transfer

The Company entrusts the processing of personal information as set out below in order to provide the Service, and part of such information is transferred overseas:

Prompts and reference images are transmitted to the AI image and video generation providers, and are destroyed immediately upon completion of generation. Personal information transferred overseas is used solely for the purpose of providing the Service, and is managed securely in accordance with the privacy policies of the relevant providers.

6. Destruction of Personal Information

Where personal information becomes unnecessary, such as upon expiry of the retention period or achievement of the purpose of processing, the Company destroys such personal information without delay.

• Person responsible for destruction: the Personal Information Protection Officer
• Time of destruction: upon expiry of the retention period or upon withdrawal from membership
• Method of destruction: electronic files are deleted by a method that renders them irrecoverable, and paper documents are shredded or incinerated.

7. Users' Rights and How to Exercise Them

Users may exercise the following rights at any time:

• Request access to their personal information
• Request correction where there are errors, etc.
• Request deletion
• Request suspension of processing

The above rights may be exercised by email (contact@eclabs.kr) or in writing, and the Company will take the necessary measures within 10 days from the date of the request.

8. Notice on the Use of Cookies and Device Identification Information

• Session cookies: used to maintain the login session.
• Device identification information: a browser-based device identifier (hash value) is collected for the purpose of preventing abuse, such as preventing duplicate attendance check-ins. Only a hash value, which cannot directly identify an individual, is stored, and it is not provided to third parties.

Users may refuse the storage of cookies through their browser settings; however, in such case there may be limitations on the use of the Service.

9. Personal Information Protection Officer

• Name: Yunsung Choi
• Position: Chief Executive Officer
• Email: contact@eclabs.kr

10. Remedies for Infringement of Rights

If you need to report or seek consultation regarding an infringement of personal information, you may contact the following organizations:

• Personal Information Infringement Report Center (KISA) — privacy.kisa.or.kr / 118 (toll-free within Korea; not dialable from overseas)
• Personal Information Dispute Mediation Committee — www.kopico.go.kr / 1833-6972 (toll-free within Korea; not dialable from overseas)
• Supreme Prosecutors' Office, Cybercrime Investigation Division — spo.go.kr / 1301 (toll-free within Korea; not dialable from overseas)
• National Police Agency, Cyber Investigation Bureau — ecrm.police.go.kr / 182 (toll-free within Korea; not dialable from overseas)

11. Data Processing in AI Services

• Prompts and reference images entered by the User are transmitted to external AI service providers for the purpose of AI generation processing.
• Generated content is stored on a CDN (Cloudflare R2) and may be deleted by the User at any time.
• Neither the Company nor the AI service providers use Users' data for AI model training.

12. Measures to Ensure Safety

The Company takes the following measures to ensure the safety of personal information:

• Access control: management of access rights to personal information processing systems
• Retention of access logs: retention of access logs of personal information processing systems for at least one year
• Encryption: passwords and payment information are encrypted in storage and in transmission
• Security measures: technical countermeasures against hacking, viruses, etc.

13. Notification of Personal Information Breach Incidents

Where a leakage of personal information is confirmed, the Company will notify the affected Users within 72 hours of the items leaked, the time of the leakage, the measures Users may take in response, the measures taken by the Company, and contact information for consultation. At the same time, the Company will report the incident to the Personal Information Protection Commission and the Korea Internet & Security Agency.

14. Processing of Pseudonymized Information

The Company does not currently process pseudonymized information.

15. Notice of Changes to the Privacy Policy

Where this Policy is amended, the Company will give notice of the changes through announcements within the Service at least 7 days prior to the effective date of the amendment. Where the amendment is unfavorable to Users, notice will be given at least 30 days in advance.