Privacy Policy

[company name pending] (“the Company”) runs the Picture Me operator site (this website) and the app's license service, and handles operators' personal information as set out below, in line with the Korean Personal Information Protection Act. Information about customers photographed at a booth is covered in section 5, and children under 14 in section 5-1.

1. What we collect

• At sign-up: name, email address, password (stored only in a form that cannot be reversed), the invite code used, the IP address and country at sign-up, and how you first arrived (the other site's address and any UTM values on the link)
• Licenses and machines: the license key, its status, term and number of machines; for each activated machine, the device identifier (a value the app creates), machine name, operating system, app version and activation time
• App heartbeats: the device identifier, the app version and the time sent (stored as the last-seen time)
• Site usage records: the IP address and browser information of login sessions, access times, which app build you downloaded while signed in, changes to the account and license (activation, suspension and so on), and what you send us when you contact us
• Cookies: a session cookie that keeps you signed in, cookies that remember your language and display settings, and a cookie that remembers for 30 days how you first arrived and records it on your account at sign-up. No advertising cookies or other companies' tracking cookies are used; if a visitor-statistics tool is ever added, this policy will say so first.

No payments are taken during the beta, so no payment information is collected. The app does not send camera video or customers' photos to this site.

2. Why we use it

• Sign-up, sign-in, identity checks and invite-code checks
• Issuing licenses, activating machines, managing terms and machine counts, and remote suspension
• Checking app versions and announcing updates
• Preventing misuse and keeping the service secure (sign-in records, request rate limits)
• Understanding what brought you to sign up (how you arrived)
• Answering your questions and emailing important notices about the service (changes to the terms, discontinuation and so on)

We do not use this information for advertising or sell it to anyone.

3. How long we keep it

• Account, license and machine information is kept until you close your account, and deleted without delay when you do.
• Usage records and messages you send us are kept while the account exists and deleted together with it.
• Where a law requires certain information to be kept, it is kept separately for the period that law sets (for example, access records for 3 months under the Protection of Communications Secrets Act).

All traffic is encrypted with HTTPS, and only authorized people can use the admin screens.

4. Third parties and processors

The Company does not provide operators' personal information to third parties, except where a law requires it or the operator has separately agreed.

To run the service, the Company entrusts the following work to others and makes sure they handle personal information safely.

• Cloud infrastructure: Cloudflare, Inc. (United States)
  • Work: running this site, its database and the Picture Me server
  • Items: everything listed in section 1
  • Transfer: sent over encrypted connections (TLS) and stored when you use the service
  • Retention: as in section 3
  • Contact: privacyquestions@cloudflare.com
• Image-generation server: the Picture Me server
  • A server the Company runs on Cloudflare. When you activate a machine, the device identifier and machine name needed to register it are passed to this server.
  • The outside provider that turns customers' photos into AI images is described in the customer privacy policy (section 5).
• Email delivery: [email provider pending]
  • Work: sending sign-up confirmation, password reset and service notice emails
  • Items: name and email address

If you do not want your information transferred abroad, you can choose not to sign up or close your account, but you will then be unable to use the service.

5. Customers' photos

• Customers' phone numbers, photos and AI images taken at a booth are stored on the Picture Me server, which the Company runs. Toward customers, the Company is the personal information controller, and handles their data under the customer privacy policy shown on the kiosk's consent screen and the QR download page.
• Before a photo is taken, the kiosk app explains the processing to the customer and obtains consent. Operators cannot switch off or alter the consent screen, and must not upload photos taken without consent.
• Operators can see the phone numbers and photos of customers photographed in their own shop, in the app, for delivery, reprints and support. The customer policy and consent text say so. Any customer information an operator exports from the app (for example a list of phone numbers) is the operator's own responsibility under the Personal Information Protection Act, and must not be used for anything other than delivering photos or passed on to anyone else.
• A photo travels encrypted from the operator's PC (the kiosk app) to the Picture Me server, through the AI processor, and back to the customer as a print and a QR download. The QR download link stays open for 7 days.
• Customers' phone numbers and photos are kept for 1 year from collection (90 days for children under 14) and then irreversibly deleted.
• This website never receives or stores customers' photos or phone numbers. Retention, processors and customers' rights are explained in the customer privacy policy.

5-1. Photos of children under 14

The following applies in addition whenever a style pack is used to photograph children under 14, such as an elementary school graduation pack.

• Legal guardian's consent: a child's photo and the guardian's phone number are collected only after a legal guardian (parent) has consented. The kiosk app's children's consent screen is written for the guardian to read and accept, and every photo session records which consent text version the guardian accepted. Operators must not take a child's photo on the consent of anyone else (the child, a teacher, and so on).
• What is collected: the guardian's phone number, the child's original photo and AI image, the time of the session, the shop and device identifiers, and the consent time and text version. The child's name, school and grade are not collected. The event text an operator places under the photo (school name, occasion) is entered by the operator and does not identify the child.
• Purpose: delivering the generated photo (QR download, print) and support only. Children's photos are never used for marketing, and no marketing consent is requested.
• Retention: the guardian's phone number and the child's photo and AI image are kept for 90 days from collection and then irreversibly deleted. The QR download link stays open for 7 days.
• Guardian's rights: a guardian may at any time ask to see or delete the child's photo and number, stop processing, or withdraw consent. Tell the privacy officer below the session date, the shop and the phone number used at consent; after verification we act within 10 days.
• Facial data: we do not extract or store facial features from photos, and do not use them to identify or authenticate anyone.

6. Your rights

• You can at any time ask to see, correct, delete or stop the processing of your personal information, and withdraw your consent.
• You can change your name yourself in your account settings. For any other request, or to close your account, email the privacy officer below; it will be handled without delay and within 10 days at the latest.
• A legal representative or someone you have authorized can make a request on your behalf.
• Children under 14 cannot sign up.

7. Privacy officer

• Name: [privacy officer name pending]
• Contact: [email pending] · [phone pending]
• Company: [company name pending] · [business address pending]

To report or get advice about a privacy violation, you can also contact these Korean agencies:

• Personal Information Dispute Mediation Committee: 1833-6972 (www.kopico.go.kr)
• Personal Information Infringement Report Center: 118 (privacy.kisa.or.kr)
• Supreme Prosecutors' Office: 1301 (www.spo.go.kr)
• Korean National Police Agency: 182 (ecrm.cyber.go.kr)

8. Changes to this policy

Changes to this policy are posted on this page at least 7 days before they apply. Changes that matter to your rights, such as what is collected, why it is used or who it is provided to, are also emailed at least 30 days in advance.