Privacy Policy

Article 1 (Categories of personal data processed)

1. To operate your account (required, regardless of consent)

1-2. If you use the Service without signing in (guest)

On app versions before 1.2.2 (iOS and Android), you can start using the Service without a social sign-in (from 1.2.2, starting fresh goes through a social sign-in, and an account you started without signing in keeps working after you update the app). In that case the only account data created on the server is an anonymous account and its identifier (for the service operation logs the server platform records for each request, see 1-7); no social provider details or email address are attached to it. From the app versions that include it, a record of consenting to or withdrawing ad performance measurement is also kept with this account (Article 5(6)).

• Photos and videos, face analysis results, and child information are stored only on your device and are never sent to a server. Cloud storage, family sharing, and server sync are not available to guests, and that restriction is enforced by the server. However, usage statistics (Article 6(4)) carry the number of registered child profiles expressed only as a bucket (0, 1, 2, or 3 or more), which goes to the Operator's server (no child information such as a child's name or date of birth is included).
• Capture region names are also created on the device for guests. In that case the coordinates of grid representative points go to the geocoding service of the device's operating system provider (Apple or Google) (Article 3(3), Article 6(2)(3)). They do not go to the Operator's server.
• Accordingly, while you are a guest no consent to original backup or child information sync is requested, and no consent record is created — there is as yet no processing for such a consent to refer to (Article 5). Consent to ad performance measurement (1-8) is recorded for guests too, at the account level, from the app versions that include it, because measurement also applies to guests who consent (Article 5(6)).
• If you link a social account, the same account carries over (the account identifier is preserved); original backup and child information sync are turned on by default upon linking (Article 1(2)(3)). If an account already exists for the social account you link, you are signed in to that existing account and the guest account is discarded; the two accounts are never merged. In that case, your consent to ad performance measurement from your time as a guest is not carried over to that account, and the app versions that include it ask you again (Article 5(6)). Either way, the data stored on your device remains.
• Data that exists only on your device cannot be restored from the server. Deleting the app deletes it too.
• If a guest requests account deletion in the app, deletion starts right away, without the 30-day grace period. No photos or videos are on the server, so what is deleted is the anonymous account data on the server; data stored on your device is not erased (Article 7).
• Guest accounts with no use for 90 days since their last use (opening the app or signing in) are cleaned up on the server (Article 7).

Usage statistics (Article 6(4)) are sent on the same terms for guests to two places — the analytics tool (Google) and the Operator's server — and what can be turned off in the app settings is the same as well (from the app versions that have "Share AI analysis statistics", basic statistics on the Operator's server cannot be turned off in the app — Article 6(4)). Ad performance measurement (1-8) applies to guests on the same terms as well — only if they consent. Error diagnostics (1-3) are sent from guests on the same terms as well.

1-3. Error diagnostics (collected automatically)

When the app terminates unexpectedly or a core operation fails, diagnostic data is sent from the app directly to Google (Firebase Crashlytics) so the cause can be found. The Operator's servers neither collect nor relay this data.

• Values the app attaches — the kind of operation that failed, its cause code and report level, HTTP status, the error code returned by the server, retry count, and approximate connectivity (offline, low data, cellular, Wi-Fi)
• When the app terminates unexpectedly — crash stack traces and exception details, and information about the executable files that make up the app
• Values the diagnostics tool (SDK) attaches automatically — app version and build, operating system version, device model, runtime environment, device state (memory, storage, jailbreak status, screen orientation and the like), installation identifiers (the Crashlytics installation identifier and the Firebase Installation ID), and a session identifier
• If usage statistics (Article 6(4)) are on — the usage flow immediately before an unexpected termination (actions recorded as usage statistics)

The values the app attaches are fixed by the list above, but the values the diagnostics tool attaches automatically are determined by Google (Firebase's privacy information). What is excluded, and how long the data is kept, is set out in Article 6(5). The current app has no setting that turns off error diagnostics on their own (Article 6(3)).

1-4. If you contact us

When you write to us through the contact form on the web (zzazan.ai/en/contact), the following is processed. The app's "Contact us" opens the same page.

• The email address for our reply, and your message
• Device details (device model, OS version, app version) — optional. You can type them in, or, depending on the app version, they are filled in when you open the page from the app's "Contact us"
• Your account ID — it is filled in with the signed-in account's ID when you open the page from "Contact us" in the web service, and, depending on the app version, when you open it from the app's "Contact us". It is used only to find the account you are asking about, and you can delete it before sending
• The inquiry topics you selected

Messages sent through the contact form reach our support team via Google Forms (Google LLC) (Article 6(2)(3)), and are destroyed without delay once the reply is complete (Article 7). Please do not include photos, videos, or information about your child in an inquiry.

If the app's "Contact us" cannot open this page, it opens a pre-filled email in your device's mail app. The recipient (support@zzazan.ai), the subject and, below your message, diagnostic details that help us investigate — app version, operating system version, device model, runtime environment, and a device ID (the IDFV on iOS and the ANDROID_ID on Android — from the app versions that include it, instead the identifier of that device registered on the Operator's server ("Device registration data" in Article 1(1)) and the ID of the logged-in account) — are filled in. The app never sends the email by itself, and you can delete the diagnostic details before sending. Emails you send (your email address, your message, and any diagnostic details you leave in) are used only to handle and answer your inquiry, and are destroyed without delay once the reply is complete (Article 7).

1-5. Other data stored on the server

• Guardian profile — the display name shown to members of shared albums and family groups (optional, up to 40 characters), an avatar color (a single color, not a photo), and a nickname you can set per album (up to 12 characters). The name of your social account is not brought to the server. A per-album profile photo is stored only on your device and is never sent to the server. The guardian profile on the server is deleted once account deletion is complete (Article 6(1), Article 7).
• Family group membership (if you use family groups on the web service) — a family group is a set of accounts that share storage, created and joined on the web service (app.zzazan.ai). We store which family group you belong to, as owner or member, when you joined, and records of the invites made in that group (Article 6(1), Article 7).
• In-app notifications — notices such as someone joining a shared album, photos being shared, a backup finishing, or an account deletion grace period. They carry processing details such as the internal numbers of the other account, the album, the family group, and the photos, counts, and grace-period deadlines or excess storage — never names or email addresses. Read notifications are deleted automatically after 30 days, unread ones after 90 days.
• Data for disconnecting Sign in with Apple (only if you signed in with Apple) — a token issued by Apple, kept encrypted, so that the link with your Apple account can be cut when you delete your account. Once account deletion is complete, we ask Apple to revoke it and delete it (Article 7).

1-6. Cookies on the website (automatic collection devices — sign-in hint and ad performance measurement)

When you sign in to the web service (app.zzazan.ai), we place one cookie in your browser that this site (zzazan.ai) uses to decide whether its page headers show a "My albums" button. The cookie contains nothing that identifies you.

This cookie is not used for advertising, visitor analytics, or tracking on other sites (this site's visit statistics are measured separately, without cookies — 1-9). If you delete this cookie in your browser settings, your use of the web service is not affected; the site's page headers simply do not show the "My albums" button (it is placed again when you open the web service while signed in). The web service keeps your sign-in in your browser's storage, not in a cookie, and clears it when you sign out. So if you block cookies for this site in your browser settings, the browser may block that storage as well, and you may not be able to sign in to the web service.

Ad performance measurement cookie (from when this site's download buttons go through an Airbridge link) — when you tap an App Store or Google Play download button on this site, your browser goes through Airbridge's link address (abr.ge) to the store, and at that point the processor AB180 places one cookie on the abr.ge domain (Article 1(1-8)). It is not a cookie placed by this site (zzazan.ai). The same cookie is also created in the browser that opens an ad using an Airbridge tracking link (Meta and Daangn ads) when you tap it (Article 1(1-8), "When you tap an ad link").

You can refuse this cookie by blocking or deleting cookies in your browser settings. Even if cookies are blocked, tapping a button still sends the other information in 1-8 (such as your IP address) to Airbridge. If you find and install the app directly in the App Store or Google Play instead of using the download buttons, this cookie is not created and the information in 1-8 does not go to Airbridge either. Either way, nothing restricts you from getting the app.

1-7. Information generated and collected automatically while you use the Service (service operation logs)

When the app or the web service sends a request to the Operator's server, the platform of Supabase, the processor entrusted with running the server (Article 6(2)), automatically records the following for each request. These records are separate from the service usage records in the Operator's database (Article 1(1)).

• The time of access
• The IP address, the approximate location estimated from it (country, region, city, postal code, and the like), and the network operator
• Device and browser information (the User-Agent, and the TLS fingerprint — technical characteristics of the encrypted connection)
• The address requested (the path, and request values attached to it, such as internal numbers, paging values, or the one-time authorization code of a Naver sign-in)
• Account identifiers — the account's internal number, the sign-in session identifier, and the sign-in handle (an internal sign-in name made from the sign-in provider's name and a cryptographic hash of the social account identifier; it is the same value for the same social account)
• Authentication records such as signing in, sign-in refreshes, and signing out
• When a database error occurs on the server, part of the values being written to the database at the time (see below)

The records above do not contain the bodies (content) of requests and responses, and input such as a child's name is sent only in request bodies, so it does not appear in the records above. However, when a database error occurs on the server, part of the values being written to the database at the time can remain (the last item above). Raw search terms are not sent to the server. These records are used only for incident response and security (abuse prevention) (Article 2), and are kept for the period set by the retention policy of the processor (Supabase) and then deleted. The processor keeps these records in a separate log system and does not disclose the country where it is stored (Article 6(3)). Deleting your account does not delete these records with it (Article 7).

1-8. Ad performance measurement (Airbridge — from the app versions that include it, on the website, and for ad links)

To measure whether ads (Meta, Google, Daangn and others) and the app download buttons on this site (zzazan.ai) actually led to app installs and sign-ups, the Operator uses the ad performance measurement tool Airbridge (processor: AB180 Inc., Article 6(2)(3)). This is a separate processing from the usage statistics in Article 6(4), and unlike those statistics its purpose is ad performance measurement. The one exception is the iOS app: in the case under "Through the analytics tool, to Google" below, the first-launch record sent as usage statistics is also used for this purpose.

In the app — from the app versions that include the Airbridge measurement tool (SDK), only if you consent to ad performance measurement, the app sends the following from the app directly to Airbridge (not through the Operator's servers).

• App events — installing and opening the app, and signing up (when a new account is created and when a social account is linked to a guest account), with their times
• Device and network information — IP address (from which Airbridge estimates an approximate location — country, province and city), device model, type and manufacturer, operating system name and version, app version, language, country and region settings and time zone, screen size, density and orientation, network operator and connection type (cellular or Wi-Fi), and the device and operating system information the app includes in its requests (User-Agent)
• Values that tell devices apart — a random identifier generated by Airbridge. The iOS app may also send Apple Search Ads' attribution token (AdServices), and the Android app the install referrer information provided by Google Play (Install Referrer — information about the ad or link tapped before the app was downloaded)
• Meta install referrer information (Meta Install Referrer — on the Android app, from the app versions that include it) — if you saw or tapped a Meta ad in the Facebook, Instagram or Facebook Lite app on your device before getting the app, the ad information that app keeps encrypted on the device (the IDs and names of the ad account, campaign group, campaign, ad set and ad, the ad objective, where the ad appeared and whether it was an Instagram ad, and whether you tapped or saw the ad and when). Once the measurement tool is on, the app reads this information and sends it to Airbridge still encrypted, and Airbridge decrypts it with the decryption key the Operator has entrusted to it to determine which Meta ad the install came from

Advertising identifiers (the iOS IDFA, and on Android the Google advertising ID (GAID), OAID, and FAID), the iOS IDFV, and the Android App Set ID are blocked from being sent, and the iOS app shows the operating system's tracking permission request (App Tracking Transparency) only if you consent to ad performance measurement when you first start the app (see "Through the analytics tool, to Google" below); advertising identifiers are not sent even if you allow tracking. Account data such as an account ID, email address, or phone number, photos and videos, and children's information are not sent to Airbridge.

This consent is optional. Through the optional item "Consent to ad performance measurement" on the privacy consent screen shown when you first start the app, the "Ad performance measurement" prompt the app shows once (when you have not chosen yet on this device, or when the consent text has changed since you consented — tapping anything other than consent, or closing it, counts as not consenting), or "Ad performance measurement" in the app settings (off by default), the app tells you about the collection and use of the information above, its transfer abroad (Article 6(3)), and its provision to ad networks (Article 6(1)(3) — on the iOS app, including the processing under "Through the analytics tool, to Google" below) and asks for your consent; not consenting does not disadvantage your use of the Service. From the app versions that include it, this consent is also the condition for sending usage statistics to the analytics tool (Google) — without it, usage statistics go only to the Operator's server (Article 6(4)).The Airbridge measurement tool is turned on only if you check that item, consent in that prompt, or turn on "Ad performance measurement" in the app settings (from the app versions that include it, including doing so on another device used with the same account)— before that the measurement tool is not started, so not even the install event is sent, and it stays off for existing users too until they turn it on. You can withdraw your consent at any time by turning off "Ad performance measurement" on the Privacy & consent screen in the app settings, and withdrawing stops the measurement tool (from the app versions that include it, on every device used with that account — Article 5(6)). Even with your consent, turning off "Share usage statistics" stops sending to Airbridge — it sends only while both your consent and "Share usage statistics" are on (Article 6(4)).

On the website — from when the App Store and Google Play download buttons on this site go through an Airbridge link, tapping a button takes your browser through Airbridge's link address to the store. Airbridge then receives the time you tapped it, your IP address, the information your browser includes in the request (the User-Agent, which contains the names and versions of the browser and operating system and the like, your language setting, and the like), the source values built into the link (a marker that it is this site's download button and a campaign name — the campaign name may carry the route by which you came to this site, for example the download button on a page opened from an Instagram bio link), and the identifier of the cookie AB180 places on the abr.ge domain (ab180ClientId — valid for up to 10 years, 1-6). The download buttons are set not to send the referring address (which page you tapped it on). Because consent cannot be obtained before a button is tapped, this processing relies on the notice in this policy (Article 6(3)). It is used to count installs that came through this site's download buttons separately from installs that came from ads. If you find and install the app directly in the App Store or Google Play instead of using the download buttons, this information does not go to Airbridge.

When you tap an ad link — when you tap an ad that uses an Airbridge tracking link (Meta and Daangn ads), your browser goes through Airbridge's link address (abr.ge) to the store or to this site. Airbridge then receives the time you tapped the ad, your IP address, the information your browser includes in the request (User-Agent, language setting, and the like), the campaign values built into the link (such as the names of the network, campaign and ad creative), and the identifier of the cookie AB180 places on the abr.ge domain (ab180ClientId — valid for up to 10 years, 1-6). For Daangn ads, it also receives the values Daangn fills into the link — a click identifier, Daangn's ad and request information values (whose content Daangn decides), and whether it is a retargeting ad. Advertising identifiers are not put in the link. Because consent cannot be obtained before an ad is tapped, this processing relies on the notice in this policy (Article 6(3)). If you get the app and consent to ad performance measurement, this record is used to determine which ad the install came from (the app sends to Airbridge only when you have consented and "Share usage statistics" is on — otherwise it does not send). If you find and install the app directly in the App Store or Google Play without tapping an ad, this information does not go to Airbridge.

To ad networks — from when an ad network (Meta, Google or Daangn) is connected to Airbridge, Airbridge provides the app installs and events chosen by the Operator (such as sign-ups) of users who consented to ad performance measurement to that network, which determines whether they came from its own ads and uses them for ad performance measurement and campaign optimization (Article 6(1)(3)). Daangn receives only the Android app events that Airbridge attributed to Daangn ads, and no events from the iOS app (Article 6(1)).

Through the analytics tool, to Google (on the iOS app — from the app versions that include it, once the analytics tool is linked with Google Ads) — if you consent to ad performance measurement when you first start the app, the iOS app then shows the operating system's tracking permission request (App Tracking Transparency) once (it is not shown if you consent later in the app settings or a prompt — that device's first-launch record has already been sent). Only while your consent to ad performance measurement, your permission to track, and "Share usage statistics" are all on, Google uses for ad performance measurement the app's first-launch record sent as usage statistics (Article 6(4)) to the analytics tool (Google Analytics for Firebase) — Google determines whether that install came from its own ads (Google Ads) and uses it for ad performance measurement and campaign optimization (Article 6(1)(3)). The information the analytics tool receives with that record (the analytics tool column of the table in Article 6(4) — such as the app instance identifier, device identifier (IDFV), device model, operating system and app versions, and approximate region) may be used with it. From the app versions that include it, for this determination Google's ad measurement module in the app (on-device conversion measurement), when the analytics tool is first turned on (and again later if the check could not be completed), connects directly to Google's ad servers without going through the analytics tool and checks, using an encrypted query value created on the device, whether the install came from Google Ads. What goes to Google then is the IP address, device and app information (such as the device model, operating system and app versions, language, time zone, and User-Agent), the time the app was first opened, a random installation identifier that this module creates on the device, and that encrypted query value. The result of the check is attached, together with that random installation identifier, to the app's first-launch record and goes to the analytics tool. This module does not use advertising identifiers (IDFA), email addresses, or phone numbers. If any of the three is off, the app tells the analytics tool that advertising use is not allowed, and on-device conversion measurement does not start, so the app does not connect to Google's ad servers. iOS devices without consent to ad performance measurement or permission to track send no usage statistics to the analytics tool at all (their usage statistics go only to the Operator's server — Article 6(4)), so Google does not receive that device's records and does not use them for ad measurement. In no case is it used for personalized advertising or remarketing, and advertising identifiers (IDFA) are not sent even if you allow tracking. You can turn off permission to track at any time in your device settings (Settings › Privacy & Security › Tracking), and not allowing it does not disadvantage your use of the Service. Usage statistics from the Android app are not used for this purpose.

Apple's ad attribution (SKAdNetwork) — from the iOS app versions that include it, when the app is first opened it registers the install with SKAdNetwork, the privacy-preserving ad attribution mechanism Apple builds into the operating system. If you saw an ad that uses this mechanism before getting the app, your device sends that ad network, through Apple, a signal that an install came from that ad (a campaign number and a conversion value). Apple delays and groups this signal and includes no device or account identifier, so neither the Operator nor the network can tell who installed the app. This registration sends nothing to the Operator's server or to Airbridge, and it happens regardless of consent to ad performance measurement. If you have consented to ad performance measurement, the Airbridge measurement tool may change this conversion value according to app events.

Data sent to Airbridge is kept for the term of the contract with the processor (at most 5 years from processing), and is all deleted once 30 days have passed after the contract ends (Article 7). It is not sent linked to your account, so deleting your account does not delete it. However, from the app versions that include it, when you withdraw consent to ad performance measurement or delete your account, each device used with that account sends its own Airbridge random identifier to the Operator's server as a deletion request not linked to the account so that the Operator can ask Airbridge to delete that device's data, and the Operator deletes the identifier after making the request. Data already provided to ad networks follows each network's privacy policy.

1-9. Website access and visit statistics (Cloudflare)

Delivering pages — this site (zzazan.ai), the web service (app.zzazan.ai), and the invitation pages (invite.zzazan.ai) are delivered through the network of our processor Cloudflare (Article 6(2)(3)). Each time you open a page, the IP address your browser sends, the address requested (for invitation pages, the address of the invitation link), the information your browser includes in the request (such as the User-Agent and your language setting), and this site's cookie (1-6) pass through Cloudflare, which uses them to deliver the pages and for security (blocking attacks). In Cloudflare's dashboard, the Operator can only view totals such as request counts and distribution by country, and records of requests blocked by security features (including IP addresses); the Operator does not download or keep these records separately. These records are kept for the period set by Cloudflare's retention policy (Article 7).

Visit statistics — the pages of this site (zzazan.ai) — the home page and information pages such as the privacy policy, the terms of service, and support — carry Cloudflare's visit statistics script (Cloudflare Web Analytics). When you open a page, the script sends Cloudflare the page's address and the address of the page you came from (for both, your browser removes the query string and anything after "#" before sending), the names and versions of the browser and operating system and the device type (from the User-Agent and the like), performance values such as how long the page took to load, and a random number created anew each time a page is opened, and Cloudflare estimates the country of the visit from the IP address of that request. The script does not use cookies or browser storage, and does not create an identifier that recognizes visitors. The Operator views only totals — visits, most-viewed pages, where visitors came from, distribution by country and device, and page speed — and uses them to improve the site. Because consent cannot be obtained before a page is opened, this processing relies on the notice in this policy (Article 6(3)). Cloudflare keeps what it receives as is for 7 days and then reduces it to a sample of about 10% (the Operator can view the most recent 6 months — Article 7). You can block this script (static.cloudflareinsights.com) with your browser's tracking or content blocking features, and blocking it does not affect your use of this site. The web service (app.zzazan.ai) and the invitation pages do not carry this script.

2. If you use original backup (provided by default once a social account is linked)

Original backup is a premise of the Service, provided by default to accounts that have linked a social account. No separate consent screen is shown; consent to this clause is recorded when the account is prepared, and the consent history keeps the screen of origin as "default setting" (Article 5(1)). If you do not want backups, simply do not run one (automatic upload is off by default); nothing below is stored on the server until you back up.

• Original photo and video files, and converted images used for display
• Backup management data (capture time, file size, integrity hash, version history)
• Shared album composition data

Even after you delete backed-up photos and videos, a management record (a deletion marker) remains for each one (Article 7).

Original files keep their capture metadata (EXIF) intact. That may include the capture time, device information, and capture location coordinates. The Operator stores originals exactly as uploaded and does not alter them.

3. If you use child information sync (on by default once a social account is linked — can be turned off in Settings)

Child information sync is on by default for accounts that have linked a social account. No separate consent screen is shown; consent to this clause is recorded when the account is prepared, with "default setting" as the screen of origin (Article 5(1)). A guardian can turn it off at any time on the Privacy & consent screen in the app settings (depending on the app version, the switch is called "Sync person info to server" or "Sync child info to server"), and when it is turned off the items below held on the server stop being used immediately and are deleted without delay (Article 4(4)). Even if no child is registered, the tags on backed-up photos (including capture region names, from the app versions that sync region names to the server) are synced, but no child information or links between photos and the child are synced.

• Your child's name, nickname, date of birth, reference time zone, and relationship to the guardian
• Links between photos and the child, along with tags, place labels, and growth records
• Group child profiles you register in a shared album (the child's display name used in that album) and the child tags you attach to photos (Article 6(1))
• The capture region names of backed-up photos — from the app versions that sync region names to the server (Article 3(3))

3-2. Only if you use a paid subscription

This section applies from when paid subscriptions are sold on the web; until then, the item below is not processed. Paid subscriptions on the web are supplied by the business named as the supplier in the Terms of Service and sold by our payment provider Paddle, which processes payments as the seller (Merchant of Record) of each order (Article 6(1)). The Operator receives and stores the item below through notifications signed and sent by Paddle and through Paddle's lookup service.

The email address, billing details, and payment instrument data needed for payment are entered by you directly in Paddle's checkout and are handled by Paddle under its own privacy policy (Article 6(1)(3)). The Operator does not send your email address or other contact details to Paddle. Paddle's notifications may also carry other data, such as a summary of the payment method (4); the Operator stores only the items in the table above. You can cancel or ask for a refund in the ways set out in the Terms of Service and the Refund Policy — including Paddle's transaction confirmation email, paddle.net, and the Operator's support (support@zzazan.ai) — and refunds are handled by Paddle. A cancellation takes effect at the end of that billing period and a refund as soon as it is processed; your storage quota then returns to the free tier, and subscription and payment records are handled under Article 7.

4. What the Operator does not collect

• Any face recognition data — face feature values, face crop images, and detection coordinates exist only on the user's device and are never transmitted to a server.
• Email addresses from social accounts are neither matched nor stored, and separate social accounts are never merged into one account automatically.
• Social login profile (name, nickname, email, profile photo address) — values the provider (Apple, Google, Kakao, Naver) hands to the app at sign-in. The app stores them only on your device to show on the account screen. During sign-in the provider's sign-in token (which may contain your email and the like) passes through the Operator's server, but the server only turns the account identifier into a hash and discards the rest without storing it. Signing out or deleting the app removes them from the device too.
• Previous values of edited child information — these are not retained in any form, including records and logs.
• Advertising identifiers (the iOS IDFA and the Android advertising ID) — not collected by usage statistics (Article 6(4)), error diagnostics (Article 6(5)), or ad performance measurement (1-8).
• Raw search terms, a child's name and date of birth, and precise location are not written to logs, and raw search terms are not even sent to the server. However, when a database error occurs on the server, part of the values being written to the database at the time can remain in the service operation logs (1-7), and those values are deleted under the retention policy in 1-7.
• Payment instrument data (such as card numbers) — payments for paid subscriptions are processed by our payment provider Paddle as the seller (Merchant of Record) (from when paid subscriptions are sold on the web). The full card number and security code (CVC) you enter in Paddle's checkout are not passed to the Operator, and the Operator neither receives nor stores them. However, the transaction notifications Paddle sends may carry the payment method type, the card brand, the last four digits of the card number, the expiry month and year, and the name on the card; the server discards these values without storing or logging them (3-2).

Article 2 (Purposes of processing)

The Operator does not use personal data for purposes beyond those above, and will obtain consent in advance before changing or adding a purpose. However, personal data may be used without consent within a scope reasonably related to the original purpose of collection (Personal Information Protection Act, Article 15(3)); the Operator decides this based on whether (1) it is related to the original purpose of collection, (2) it is foreseeable in light of the circumstances of collection and processing practices, (3) it does not unfairly infringe your interests, and (4) the necessary safety measures, such as pseudonymization or encryption, have been taken. Even then, the purpose is listed in the table above and announced on this page before it takes effect, as described in Article 11.

Article 3 (Processing of location data)

1. The Operator does not perform real-time location tracking. Your movement history and current position are neither collected nor accumulated. However, service operation logs record the approximate location estimated from the IP address you connect from (country, region, city, postal code, and the like) (Article 1(1-7)), and in ad performance measurement Airbridge receives your IP address and estimates from it an approximate location (country, province and city) (Article 1(1-8)).
2. Capture location coordinates contained in photo originals are retained together with the originals when you back up the originals (Article 1(2)). When a shared album member with download permission downloads an original, these coordinates go with it (Article 6(1)).
3. The name of the capture region (for example "Aewol, Jeju") is determined on the device. The app groups photos taken near each other into a 0.05° latitude/longitude grid (about 5 km) and sends only the coordinates of each grid's representative point to the location-naming service (geocoding) of the device's operating system provider to receive the region name — Apple (Apple Inc., United States) for the iOS app, and Google (through the device's Google Play services — Google LLC, United States) for the Android app (Article 6(2)(3)). This also applies while you use the app without signing in (as a guest). For a signed-in account, coordinates are sent only while child information sync is on. The precise coordinates of individual photos and the photos themselves are not sent, and the region names received are stored on the device. From the app versions that sync region names to the server, the region names attached to backed-up photos are synced to the Operator's server as tags on those photos. What the server stores is the region names from the country level down to the neighborhood level, and which backed-up photos each name is attached to; no coordinates and no photo-group data are sent. Region names of photos that are not backed up stay only on the device. This sync is part of child information sync (Article 1(3)), so it happens only when you are signed in and child information sync is on. The region names on the server are used to find backed-up photos by region and to show the capture region on your own photos when you view them from the cloud, and for photos added to a shared album they are also visible to that album's members (Article 6(1)). When child information sync is turned off, their use stops immediately and they are deleted without delay (Article 4(4)), and they are deleted when account deletion is complete (Article 7). Earlier app versions do not send region names to the server. The Operator's servers do not determine capture regions and keep no location coordinates apart from the original files (2) — the representative coordinates of photo groups the server used to keep, and the place tags the server used to determine and attach, have been deleted (that service operation logs hold the approximate location estimated from the IP address, and can hold part of the values being written to the database when a database error occurred on the server, is covered in Article 1(1-7)). Some app versions also send the same grid points to an old address on the Operator's server, but the server rejects them without reading or storing them.
4. If you allow the device location permission, the photo map screen uses your current position only to choose where the map opens. That position is used on the device alone — it is never stored, never attached to photos, and never sent to a server. If you decline the permission, the map still opens, framed around all of your photos. In the iOS app, the map itself is rendered by Apple Maps built into the device.

Article 4 (Children's personal data)

1. The Service exists so that a guardian can store and share photos and information about their own child. The party who signs up and uses the Service is the guardian (an adult); children do not create accounts themselves.
2. A guardian signing in with a social account, using the app, and registering their child's information themselves (the subject of "Child information sync" — name, nickname, date of birth and the like) is treated as consent of the legal representative. The Operator provides the Service on the premise that the guardian holds legal custody of the child.
3. Child information sync is on by default once a social account is linked, and no separate consent screen is shown (Article 1(3), Article 5(1)). A guardian can turn it off at any time in the app settings, and the remaining features, including photo backup, keep working while it is off. Features that need child information — server search, naming capture regions, and group child profiles in shared albums — do not work while it is off.
4. When a guardian turns child information sync off (withdrawal of consent), child information held on the server — child profiles, links between photos and children, tags (including capture region names synced to the server) and place labels, and the child tags in shared albums — stops being used immediately and is deleted without delay. There is no grace period, and most of it is deleted the moment the switch is turned off. However, the automatic-tag reference lists attached to each backed-up photo are emptied in turn by a server cleanup job that runs every 15 minutes and handles a fixed amount each time. So if you have many photos, or many accounts are waiting for cleanup, emptying them all takes time, and no completion time is set in advance. Even before they are emptied, these references are not used for viewing, search, or sharing.
5. The Operator does not market to children, nor use children's data for profiling or advertising. No child information is sent for ad performance measurement (Article 1(1-8)) either. Face recognition data is never stored on a server.

Article 5 (Consent and withdrawal)

1. Original backup and child information sync are provided by default to accounts that have linked a social account (Article 1(2)(3)); consent to both is recorded without a separate consent screen when the account is prepared, and those records keep "default setting" as their screen of origin. When you turn child information sync off or back on yourself in the app settings, that record carries the settings screen as its origin, which distinguishes it from the default setting. The server rejects consent records that carry no screen of origin.
2. Each consent record retains which screen it was given on and the version of the notice text shown at the time.
3. While you use the Service as a guest (without signing in), no consent regarding server storage is requested and no consent record is created. Once you link a social account, original backup and child information sync are recorded by default under Article 1(2)(3) (Article 1(1-2)). Consent to ad performance measurement, however, is recorded for guests too, from the app versions that include it (Article 5(6)).
4. You may turn child information sync off at any time in the app settings (withdrawal of consent). The app has no withdrawal setting for original backup.
   • Turning child information sync off: child information held on the server stops being used immediately and is deleted without delay (no grace period; for the cleanup of automatic-tag references, see Article 4(4)). (Data on your device and originals already backed up are retained.)
   • Original backup: if you do not want backups, simply do not run one. Originals already backed up are handled under Article 7 when you delete them individually or delete your account. If you want original backup processing to stop, you may request it through the contact in Article 10.
5. When this policy is amended, we announce it on this page as described in Article 11. Because neither original backup nor child information sync has a consent screen, there is no re-consent procedure. If you do not agree with an amendment, you can turn child information sync off in the app settings and request that original backup processing stop through the contact in Article 10.
6. For ad performance measurement (Article 1(1-8)), consent is obtained separately in the app versions that include it — through the optional item "Consent to ad performance measurement" on the privacy consent screen shown when you first start the app, the "Ad performance measurement" prompt the app shows once (Article 1(1-8)), or "Ad performance measurement" in the app settings (off by default). This consent is optional, and not consenting or withdrawing does not disadvantage your use of the Service. The Airbridge measurement tool is not turned on before you consent; you can withdraw at any time by turning off "Ad performance measurement" on the Privacy & consent screen in the app settings, and from then on nothing is sent to Airbridge (data already sent is handled under the retention periods in Article 7, and from the app versions that include it the Operator asks Airbridge to delete the data of each device used with that account — Article 1(1-8)). On the iOS app, once you withdraw this consent or turn off permission to track in your device settings, usage statistics are no longer sent to the analytics tool, so they are not used for Google ad measurement (Article 1(1-8), Article 6(4)). From the app versions that include it, this consent is recorded at the account level in the consent history on the Operator's server (Article 1(1)) — for guests too; the time of consent or withdrawal is the time the server received it, and the version of the notice text and the screen where consent was given are kept with it. Your choice for an account applies to every device you use with that account, so withdrawing on any device stops measurement on all of them. Permission on each device is decided by iOS's tracking permission request (App Tracking Transparency). Earlier app versions store whether you have consented on the device and do not send it to the Operator's server.

Article 6 (Provision to third parties, entrustment, and transfer abroad)

1. Provision to third parties

The Operator does not provide your personal data to third parties. However, family members you yourself invite to a shared album (a "group" in the app) can see the following, as a result of your own choice, and if you buy a paid subscription on the web, the data set out at the end of this section is exchanged with our payment provider Paddle; if you consent to ad performance measurement, the ad performance data set out at the end of this section is provided to ad networks (Meta, Google and Daangn) (from when the network is connected to the ad performance measurement tool — and, from the iOS app to Google, also through the analytics tool).

• Photos and videos — disclosed within the permissions you set (view, download, edit, invite). Members with download permission can download originals, and originals keep their capture metadata (EXIF) such as capture time, device information and capture location coordinates (Article 1(2)). Members with invite permission can invite other people to that album.
• Guardian profile — your display name and avatar color; if you set a nickname for that album, the nickname (Article 1(1-5)).
• Group child profiles — when you register your own child in a shared album (the registration screen first tells you that the name is shown to every member of the group), the album owner and the members with view permission can see one display name for that child, and the photos in that album tagged with that child (a per-child view and photo count). Child tags are added by the person who put the photo in the album; in app versions with album auto-upload, they can also be added automatically to photos that person's device recognizes as that child. The child's nickname, date of birth, relationship, and face data are not shown, and the profile picture of a group child profile is chosen by each member on their own device and never sent to the server. To withdraw the disclosure, delete the profile (its creator can — so can the album owner) or unlink your child. If another member has linked their child to the same profile, the profile stays and only your link is removed. Leaving the album removes your links (a profile left with no links is deleted with them), and turning child information sync off removes your links and the child tags on your photos (Article 1(3)).
• Derived photo tags — object, scene, situation, and media-type tags added by the on-device analysis, and, from the app versions that sync region names to the server, capture region name tags (Article 3(3)). Emotion, relationship, and growth-milestone tags, and tags you typed yourself, are not shown.

An invite link can be used not only by the person you sent it to but by anyone who has the link until it expires (7 days after it is issued), so please check where you send it. When you cancel a share or revoke a permission, access through the Operator's servers is blocked immediately. However, originals members have already downloaded, and names, child tags, and tags already delivered to members' devices, are not recalled.

Photos you add to someone else's shared album (from the app versions that use this method) — when a member adds photos or videos to someone else's shared album, the originals are stored in the album owner's cloud, not the member's, and count against the album owner's storage. The app tells you this before you add them. The member who added them can only remove them from the album and cannot delete or recall the originals in the album owner's cloud; deleting the originals is up to the album owner. If the member leaves the album or deletes their account, the photos stay in the album owner's cloud; if the album owner deletes their account, they are deleted with it (Article 7). Photos added with earlier app versions stay in the cloud of the person who added them, as now, and are not moved.

Family group member list (from when the feature is offered) — in a family group on the web service (Article 1(1-5)), the owner and members of that group can see one another's display name, avatar color, and time of joining, and who the owner is. The internal account number used to refer to each member is also delivered. Per-member usage, email addresses, and sign-in provider details are not shown, and there is no way to look up other accounts by name. Anyone waiting for account deletion stays on the list as before until the deletion is complete, with no label saying that their account is about to be deleted. Once the deletion is complete, or once someone leaves the family group, they drop off the list right away. To stop other members from seeing you, leave that family group.

Our payment provider Paddle (from when paid subscriptions are sold on the web) — paid subscriptions on the web are supplied by the business named as the supplier in the Terms of Service and sold by Paddle. Paddle, as that business's online reseller, is the seller (Merchant of Record) of each order: it enters into the purchase contract with you and handles payment, tax, and refunds. Paddle processes the data you enter in its checkout for purposes and by means it decides itself, as an independent processor, and describes itself as the party that decides the purposes and means of processing (Controller).

When you start a payment, the Operator shows you the details in 3 below on the web purchase screen and, after obtaining your consent, passes to Paddle the plan you chose and a binding value that links the purchase to this account. If the account has subscribed before, the Operator also passes that account's Paddle customer ID and subscription ID, and uses these values when passing subscription management you request (such as cancellation) on to Paddle (Article 1(3-2)). You enter your email address, billing details, and payment instrument data directly in Paddle's checkout, and the Operator does not send your email address or other contact details to Paddle. Paddle handles this data under its own privacy policy (paddle.com/legal/privacy) and informs the Operator of the subscription status and related details (Article 1(3-2)). Paddle also states that it provides order information to the business named as the supplier in the Terms of Service to the extent necessary to provide the product you requested. The transfer abroad is set out in 3 below.

Ad networks (Meta and Google) (from when the network is connected to the ad performance measurement tool Airbridge) — for users who consented to ad performance measurement, Airbridge provides app installs (including reinstalls), events chosen by the Operator (such as sign-ups), and, when the app was opened through a deep link, that record to the connected network (Article 1(1-8)). This provision relies on the consent to provision to third parties obtained through the optional consent to ad performance measurement, and nothing is provided without it. What goes with them is attribution data such as the type and time of the event and identifiers attached to ad clicks (such as Google Ads' GCLID), and the device and network information the network uses to determine whether the event came from its own ads (such as the IP address, User-Agent, device model, operating system and app versions, language, country, time zone, network operator and screen information) and the random identifier generated by Airbridge may be included as well (the IP address, User-Agent, and operating system and app versions always go to Google). The network determines whether the event came from its own ads, uses it for ad performance measurement and campaign optimization, and processes it under its own privacy policy. Advertising identifiers (the iOS IDFA and the Android advertising ID) are not collected by the app, so they are not passed on. The transfer abroad is set out in 3 below.

Google — through the analytics tool (iOS app) (from the app versions that include it, once the analytics tool is linked with Google Ads) — for iOS devices where you consented to ad performance measurement, allowed tracking, and "Share usage statistics" is on, Google uses the app's first-launch record received by the analytics tool (Google Analytics for Firebase) for ad performance measurement, in which it determines whether the install came from its own ads, and for campaign optimization (Article 1(1-8)). The information the analytics tool receives with that record (such as the app instance identifier, device identifier (IDFV), device model, operating system and app versions, and approximate region — Article 6(4)) may be used with it. From the app versions that include it, the IP address, device and app information (such as the device model, operating system and app versions, language, time zone, and User-Agent), the time the app was first opened, that module's random installation identifier, and the encrypted query value created on the device, which the app's on-device conversion measurement module sends directly to Google's ad servers, are also used for this determination (Article 1(1-8)). This provision relies on the consent to provision to third parties obtained through the optional consent to ad performance measurement, and nothing is provided if you do not consent or do not allow tracking. It is not used for personalized advertising or remarketing, and advertising identifiers (IDFA) are not collected by the app, so they are not passed on. Google processes it under its own privacy policy. The transfer abroad is set out in 3 below.

Daangn ads — Danggeun Market Inc. (from when Daangn ads are connected to the ad performance measurement tool Airbridge) — of the Android app events of users who consented to ad performance measurement, Airbridge provides to Danggeun Market Inc. only those it attributed to Daangn ads (app installs and reinstalls, and events chosen by the Operator, such as sign-ups) (Article 1(1-8)). Events from the iOS app, and events not attributed to Daangn ads, are not provided. This provision also relies on the consent to provision to third parties obtained through the optional consent to ad performance measurement, and nothing is provided without it. What goes with them is attribution data such as the type and time of the event and the campaign values in the Daangn ad's tracking link, and device and network information (such as the IP address and operating system) and the random identifier generated by Airbridge may be included as well. Advertising identifiers are not collected by the app, so they are not passed on. Daangn checks whether the event came from its own ads, uses it for ad performance measurement and campaign optimization, and processes and keeps it for the period set in its own privacy policy (privacy-policy.daangn.com).

2. Entrusted processing

Because the app takes no payments, there is no entrustment to Apple Inc. for in-app purchases (App Store). Our payment provider Paddle, for paid subscriptions sold on the web, is set out in Article 6(1)(3). Converting capture locations to region names takes place now, under Article 3(3).

The Operator confirms, through processing agreements and service terms, that each processor above protects your data at the same level as, or higher than, what this policy promises, before entrusting it with processing.

3. Notice regarding transfer abroad

Your photos and information are stored within the Republic of Korea (Seoul). However, service operation logs (Article 1(1-7)) are kept in a separate log system of the processor (Supabase), and the processor does not disclose the country where they are stored (see the table on service operation logs below). In addition, a global content delivery network (CDN) is used to deliver photos quickly, and in that process transmitted data may pass through, or be temporarily cached at, points of presence outside Korea.

Even cached files are reachable only through requests bearing a temporary address valid for 60 seconds, and the Operator does not store those addresses.

Service operation logs (Article 1(1-7)) are also kept in a log system of the processor whose storage country is not disclosed, so we treat them as possibly transferred abroad and set out the following.

Delivering this site, the web service, and the invitation pages, and measuring this site's visit statistics (Article 1(1-9)), also involve the following transfer abroad.

Google's tools (Google Analytics for Firebase and Firebase Crashlytics) are also used for usage statistics and error diagnostics, which involves the following transfer abroad.

Inquiries submitted through the web contact form are likewise transferred abroad, as follows.

To determine capture region names (Article 3(3)), the following transfer abroad also takes place.

In addition, from when paid subscriptions are sold on the web, buying a paid subscription involves the following transfer abroad to our payment provider Paddle (Article 6(1)).

In addition, from the app versions that include it (where you consent to ad performance measurement), on the website and for ad links, ad performance measurement (Article 1(1-8)) involves the following transfer abroad.

In addition, if you consent to ad performance measurement, from when an ad network is connected to the ad performance measurement tool, reporting performance to ad networks (Article 6(1)) involves the following transfer abroad.

In addition, if you consent to ad performance measurement and allow tracking on the iOS app, from when the analytics tool is linked with Google Ads, Google's ad performance measurement (Article 6(1)) involves the following transfer abroad.

4. Additionally

Product usage statistics are sent to two places — the analytics tool (Google Analytics for Firebase) and the Operator's server. The app sends the same items to both (except that, of the "app state buckets" in the table below, the bucket for the number of registered child profiles is sent only to the Operator's server, and the Android app's install source is read by the analytics tool itself and exists only there; from the app versions that include it, the app sends to the analytics tool only from devices where you consented to ad performance measurement (on iOS, also allowed tracking), and other devices' usage statistics go only to the Operator's server — Article 1(1-8)), and the Operator uses the statistics received by its server as a basis for decisions on improving the Service. Statistics for the analytics tool (Google) are sent directly from the app to Google.

Ad performance measurement is a separate processing from these usage statistics. Which ad an app install or sign-up came from is measured separately with Airbridge, only if you consent to ad performance measurement (Article 1(1-8)). There is one exception — on the iOS app, the first-launch record of devices where you consented to ad performance measurement, allowed tracking, and "Share usage statistics" is on is used by Google to determine whether the install came from its own ads (Article 1(1-8), "Through the analytics tool, to Google"). Other iOS devices do not send to the analytics tool, so Google has no records of them for this measurement. However, on the Android app, the analytics tool (Google) reads by itself the install source Google Play reports when it is first turned on (from the app versions that include it, after you consent to ad performance measurement) (utm values such as the campaign name and medium, and, if you installed after tapping a Google ad, its click identifier) and attaches it to the usage statistics — this is the analytics tool's default behavior, not something the app reads and sends separately, and it is not sent after you turn off "Share usage statistics". The Operator views it only as aggregates such as installs per network, does not send it to ad networks or use it to choose who sees ads, and does not join it with the ad performance measurement (Airbridge) records. Other usage statistics are not used for that measurement.

What an irreversible account-based identifier is. Statistics sent to the Operator's server do not contain the raw account identifier. Instead, only a value made by transforming the account identifier in a way that cannot be reversed is stored, and the secret used for that transformation is kept outside the database where the statistics are stored. So the stored statistics alone cannot be used to identify a particular user.

What app state buckets are. They express the state of the app at the moment a statistic is created only as a few buckets — photo access permission status (full access, limited access, denied, not yet asked), the bucket for the number of registered child profiles (0, 1, 2, 3 or more), and the form of shared album participation (none, only albums you created, only albums you joined, both). No child information such as a child's name or date of birth is included, and the bucket for the number of registered child profiles is not sent abroad (to Google). On the Operator's server these values remain only in individual events and are not included in per-user aggregates.

Retention

Usage statistics sent to the Operator's server fall into two kinds — AI analysis statistics, which are the "aggregate diagnostics of the on-device AI analysis" in the table above (including analysis progress), and basic statistics, which are all the other items. "Share AI analysis statistics" under Privacy & consent in the app settings ("Share usage statistics" in earlier app versions — in this notice, "Share usage statistics" refers to both names) can be turned off at any time in the app settings, and once it is off, all sending to the analytics tool, including the IDFV, and sending of AI analysis statistics to the Operator's server stop immediately. AI analysis statistics left in the app that had not yet been sent to the Operator's server are discarded without being sent (from basic statistics left in the app, only analysis progress is removed). Turning this setting off also stops sending for ad performance measurement (Article 1(1-8) — where consented).

From the app versions that have "Share AI analysis statistics", basic statistics are sent to the Operator's server regardless of this setting — to see the usage flow needed to run and fix the Service — and are stored, as above, only with an irreversible account-based identifier. With this setting off, basic statistics do not go to the analytics tool (Google) either. In earlier app versions, turning this setting off also stops all sending to the Operator's server. Basic statistics cannot be turned off in the app; if you want their processing suspended, you can request it at the contact in Article 10 — on receiving the request, the Operator's server stops accepting usage statistics from that account, and the usage statistics already received from that account are unlinked from the account in the same way as on account deletion below (Article 8). Counts not linked to any account ("Pre-login counts" and "In-app survey answers" below) cannot be attributed to anyone, so this request cannot stop or delete them.

When you delete your account (including guest accounts cleaned up for lack of use), the statistics about you stored on the Operator's server are unlinked from the account so that they can no longer be attributed to you (the value made from your account is replaced with a random value that belongs to no one). Statistics handled this way are deleted automatically once the retention period above has passed. Records used to count resent statistics only once are not linked to any account and are deleted automatically 37 days after the day they were received.

Pre-login counts (from the iOS and Android app versions that include it) — before you log in (after a fresh install or after logging out, until the login result), the app sends only the following two kinds of information to the Operator's server. The web service does not send them.

• Pre-login steps — the app was opened · the introduction was finished · the introduction was skipped · the login screen appeared
• Login results — success · failure · cancelled (which login service you chose is not sent)

These contain no account identifier, no irreversible account-based identifier, and no device identifier. The Operator's server only adds them up as daily counts by date (Korea time), platform (iOS · Android), app version, and the items above, and keeps no individual records. So these counts cannot tell who or which device sent them, and they are not joined with your account or usage statistics after you log in. When a request reaches the server, service operation logs (including the IP address — Article 1(1-7)) are left as with any other request, but the Operator does not use them to regroup these counts by device or person. These counts are used only to improve the pre-login flow, not for advertising, marketing, or payment or permission decisions, and they are kept without a time limit (the table above, Article 7).

Pre-login counts are basic statistics and cannot be turned off in the app. From the app versions that have "Share AI analysis statistics", they are sent even if that setting is off. Earlier app versions send them by default (on) from a freshly installed or reinstalled device (including one whose app data was cleared), and do not send them from a device where "Share usage statistics" has already been turned off (for example, if you turned it off and then logged out). Counts already added up cannot be attributed to anyone, so they cannot be singled out and deleted.

In-app survey answers (from the iOS and Android app versions that include it) — the app may show a short survey once to users who have updated the app. The app sends to the Operator's server only that the survey appeared, was closed, or was finished (including whether you opened "send feedback") and, if you answer, the survey edition, the question, and the option you chose; text you write yourself is not received. Not answering the survey does not disadvantage your use of the Service.

These contain no account identifier, no irreversible account-based identifier, and no device identifier, and they are sent separately from your account even after you log in. The Operator's server only adds them up as daily counts by date (Korea time), platform (iOS · Android), app version, and the items above, and keeps no individual answers. So these counts cannot tell who answered what. When a request reaches the server, service operation logs (including the IP address — Article 1(1-7)) are left as with any other request, but the Operator does not use them to regroup answers by device or person. These counts are used only to fix and improve the Service, not for advertising or marketing, and they are kept without a time limit (the table above, Article 7). This sending happens only when a survey appears and when you answer, regardless of "Share usage statistics", and counts already added up cannot be singled out and deleted. So that the same survey is not shown again, only "this edition of the survey was shown" is recorded on the account (without the answers or the time — Article 1(1)).

5. Error diagnostics (Firebase Crashlytics)

Error diagnostics are likewise sent from the app directly to Google; the Operator's servers neither collect nor relay them.

Article 7 (Retention period and destruction)

Destruction method: electronic files are deleted irrecoverably, and the actual files in storage are deleted as well (including a step that verifies their absence afterwards).

Lifetime of face recognition data stored on your device

As stated in Article 1, face feature values and related face recognition data exist only on your device and are never sent to the server. Face recognition data is used for the face analysis feature that groups your photos by person. Its lifetime on the device is as follows.

• Face recognition data is deleted together with the app when you delete the app. It may, however, be included in device backups you have set up (such as iCloud) or in transfers of your data to a new device; keeping or deleting those copies is managed by you and the provider of that feature.
• If you withdraw consent to face analysis in the app settings, the face recognition data on the device is deleted along with it. If some of it cannot be deleted, the app tells you and lets you delete it again.
• From the app versions that include it, if you do not open the app for 24 months, the face recognition data on the device is deleted the next time you open the app.
• Deleting a child profile does not delete the face recognition data stored on the device. The face analysis feature groups your photos by person within the scope of your consent regardless of child profiles, so deleting a profile does not end that purpose, and photos reconnect immediately if you register the same child again.
• To delete all face recognition data on the device right away, withdraw consent to face analysis or delete the app. The device's operating system removes all of the app's local data when the app is deleted.

For users in the United States — face recognition data

Some U.S. state laws treat face geometry derived from photos as a biometric identifier. With your consent to face analysis, the app creates face feature values from the faces in your photos on your device and uses them to group your photos by person. Because the Operator does not receive this data, we do not sell, lease, trade, or otherwise provide or disclose it to anyone. This data is deleted from your device right away if you withdraw consent to face analysis or delete the app, and, from the app versions that include it, the next time you open the app if you have not opened it for 24 months. This section is the retention schedule and the guidelines for permanently destroying this data.

Article 8 (Your rights and how to exercise them)

You may do the following at any time.

• Access and correct your personal data (directly in the app)
• Turn child information sync off (withdraw consent) (app settings) — original backup has no withdrawal item in the app settings and follows Article 5(4)
• Withdraw consent to ad performance measurement (turn off "Ad performance measurement" on the Privacy & consent screen in the app settings — from the app versions that include it, Article 5(6)) · on the iOS app, turn off permission to track (device Settings › Privacy & Security › Tracking)
• Delete photos and restore them within 30 days — "Empty trash" deletes them permanently right away
• Delete your account (cancellable during the 30-day grace period; guest accounts are deleted right away, with no grace period; for the records that remain after deletion, see Article 7)
• Sign out — signing out in the app signs out that device only. To end sign-in on every device at once, use "Sign out of all devices" in the account settings of the web service (app.zzazan.ai) — this ends the sign-in sessions of every device signed in to that account, including the phone apps (once the web service is open). If you cannot use the web service, contact us at the address below
• Request that processing be suspended — processing you can turn off in the app settings (child information sync, Share usage statistics (sending to the analytics tool and AI analysis statistics on the Operator's server), consent to ad performance measurement) can be stopped right in the app; for other processing (basic statistics on the Operator's server, original backup processing, and the like), send the request to the address below. If you request suspension of the processing of basic statistics, usage statistics from that account are no longer accepted, and those already received are unlinked from the account (Article 6(4)). Counts not linked to any account (pre-login counts and in-app survey answers) cannot be attributed to anyone, so they cannot be stopped or deleted (Article 6(4))

For requests that are hard to complete inside the app, contact us at the address below and we will act without delay and report back.

• Exercising rights through a representative — the rights above can also be exercised through a legal representative or a person you have authorized. In that case, please send a document that shows the authorization (such as a power of attorney) with the request.
• Children under 14 — a child's legal representative may request access to, correction, deletion, or suspension of processing of the child's personal data. In this Service, the guardian who registered a child's information can correct or delete it directly in the app (Article 4); requests that are hard to complete in the app are received at the address below.
• Objections — if we refuse a request or carry it out only in part, we will tell you why and how to object. Objections are received at the address below.

Article 9 (Security measures)

• All data is separated per account, and access to anything other than your own data is blocked at the database level (deny-by-default).
• Social account identifiers and the actor information in service usage records (Article 1(1)) are stored only as hashes, so the originals cannot be reconstructed.
• Usage statistics on the Operator's server never contain the raw account identifier; only a value transformed so that it cannot be reversed is stored, and the secret used for that transformation is kept outside the database where the statistics are stored (Article 6(4)).
• File access is possible only through temporary addresses with a short validity period, and revoking a permission blocks access already in progress.
• Connections are encrypted, and server access rights are limited to the minimum scope.

Article 10 (Privacy contact)

• Chief Privacy Officer: Inseong Kim (title: Operator; privacy department: the Zzazan team)
• Chief Privacy Officer contact: privacy@zzazan.ai
• Privacy inquiries and rights requests: privacy@zzazan.ai
• Service inquiries: support@zzazan.ai

If you need advice about an infringement of your personal data, you may contact the following Korean authorities.

• Korea Internet & Security Agency, Privacy Infringement Report Center (privacy.kisa.or.kr / 118)
• Personal Information Dispute Mediation Committee (kopico.go.kr / 1833-6972)
• Supreme Prosecutors' Office, Cyber Investigation Division (spo.go.kr / 1301)
• Korean National Police Agency, Cyber Bureau (ecrm.police.go.kr / 182)

Article 11 (Changes to this policy)

When we change this policy, changes that add to the personal information we process or its purposes, add provision to third parties, entrustment or transfers abroad, or reduce your rights are announced on this page at least 7 days before the effective date (30 days for material changes). Changes that reduce processing, refine wording without changing its meaning, or update matters unrelated to processing, such as contact details, take effect on the day they are posted on this page. In either case, changes are communicated through the revision history on this page; because neither original backup nor child information sync has a consent screen, there is no re-consent procedure (Article 5(5)).

During the notice period, we also show a notice of revision (notice date, effective date, and what changes) at the top of this page, and publish the full text of the revised policy at zzazan.ai/en/privacy/next.