Privacy Policy

[Dermacoa Co., Ltd.] (the “Company”) values the personal information of members and users of the OMNIGRID service (the “Service”) and complies with the Personal Information Protection Act and other applicable laws and regulations.

This Privacy Policy explains how the Company collects, uses, retains, and destroys users’ personal information through the OMNIGRID website and related services operated by the Company.

Article 1. Purposes of Processing Personal Information

The Company processes personal information for the following purposes.

Personal information will not be used for any purpose other than those set out below. If a purpose of use changes, the Company will take necessary measures, such as obtaining separate consent, in accordance with applicable laws and regulations.

1. Membership Registration and Management

• Identifying and verifying members
• Confirming a user’s intention to register
• Creating and managing accounts
• Preventing unauthorized or improper use of the Service
• Responding to member inquiries and delivering notices

2. Provision of the Service

• Providing OMNIGRID features, including AI image generation, text generation, blog post generation, prompt generation, and scenario generation
• Managing the number of permitted AI uses
• Providing and storing generated outputs
• Reviewing each member’s usage history
• Displaying Service status and remaining usage allowance

3. Paid Services and Payment Processing

• Processing payments for paid subscription plans
• Managing recurring payments and subscriptions
• Reviewing payment history
• Processing refunds and subscription withdrawal or cancellation requests
• Reviewing payment errors and duplicate payments
• Tax calculation, settlement, and accounting

4. Customer Support and Complaint Handling

• Receiving and responding to inquiries
• Investigating Service errors
• Processing refund requests
• Responding to usage restrictions and disputes
• Sending announcements and important notices

5. Service Quality Improvement and Statistical Analysis

• Analyzing Service usage statistics
• Analyzing usage by feature
• Analyzing errors and service disruptions
• Improving the Service and developing new features
• Conducting internal reviews to improve the quality of AI-generated outputs

6. Prevention of Improper Use and Security Management

• Detecting abnormal access
• Preventing account sharing and the use of automated programs
• Preventing abuse of the Service
• Screening prompts, uploads, and generation requests for NSFW, sexually explicit, harmful, illegal, or otherwise prohibited content
• Enforcing the Terms of Service and Acceptable Use Policy
• Detecting repeated blocked requests, filter evasion, and attempts to circumvent safety controls
• Recording and reviewing moderation decisions for security, audit, customer support, and dispute-response purposes
• Preventing and responding to security incidents

7. Marketing and Advertising

• Providing information about new services
• Providing information about events and promotions
• Providing information about benefits
• Marketing communications will be sent only where the user has separately consented to receive them.

Article 2. Categories of Personal Information Processed

The Company collects only the minimum personal information necessary to provide the Service.

1. Information Collected During Membership Registration

• Name, email address, password, mobile phone number, member ID, registration date and time, access IP address, and Service usage records

Passwords are stored in encrypted form, and the Company cannot access users’ original plaintext passwords.

2. Information Collected When Paying for Paid Services

The Company may process the following information to handle payments:

• Payer information, purchased plan or product name, payment amount, payment date and time, payment status, subscription status, partial payment-method information, payment approval number, and refund records

However, essential payment-method information, such as complete card or bank account numbers, is processed directly by a payment gateway or digital payment provider.
The Company does not directly store such information.

3. Information Collected Automatically While Using the Service

• Access IP address, cookies, browser information, device information, operating-system information, access date and time, Service usage records, number of AI uses, chatbot usage records, usage by feature, and error logs

4. Information Processed While Using AI Services

When users use AI features, the following information may be processed:

• Prompts entered by the user, uploaded images or files, entered text, generation request details, AI-generated outputs, generation date and time, the chatbot or feature used, information about the AI model used, and records of deductions from the user’s AI usage allowance

Users must not enter or upload, without authorization, materials containing another person’s personal information, sensitive information, likeness, copyrighted works, trade secrets, or similar protected information.

5. Information Processed for Content Safety Moderation

When a user submits an image- or video-generation request, the Company may process the following information before the request is transmitted to an AI generation model:

• The raw prompt submitted by the user and, where necessary, text associated with the request
• A pseudonymous user, request, or generation identifier
• The requested feature, request date and time, moderation request identifier, and related technical logs
• The moderation result or decision, such as allow, flag, deny, blocked, or review required
• Records of warnings, restrictions, repeated blocked requests, and attempts to evade safety controls

Users must not include unnecessary personal information, sensitive information, or another person’s identifying information in a prompt submitted for generation or safety screening.

Article 3. Processing and Retention Periods

The Company processes and retains personal information for the retention and use periods prescribed by applicable laws or for the periods agreed to by users when their personal information was collected.

1. Member Information

• Retention period: Until membership is terminated
• However, information will be retained for the applicable period where retention is required under relevant laws and regulations.

2. Service Usage Records

• Retention period: Up to three years after membership termination
• Purpose of retention: Responding to customer inquiries, preventing improper use, verifying Service operation records, and responding to disputes

3. AI Generation Request Records and Outputs

• Retention period: Until the purpose of providing the Service is fulfilled or the member requests deletion
• However, information may be retained for a certain period where necessary for technical backups, prevention of improper use, dispute response, or compliance with statutory retention obligations.

4. Content Safety Moderation Records

• Retention period: Until the content-safety screening, enforcement, security, customer-support, or dispute-response purpose has been fulfilled
• Moderation records may be retained within the retention period applicable to Service usage records or AI generation request records where reasonably necessary to prevent repeated abuse, establish or defend legal claims, or comply with applicable law.
• Information processed by an external moderation provider is retained in accordance with the applicable agreement, the provider’s published policy, and applicable law.

5. Payment and Refund Records

The following records may be retained for the periods specified under the laws governing electronic commerce and other applicable laws:

• Records concerning contracts or withdrawal of offers: Five years
• Records concerning payments and the supply of goods or services: Five years
• Records concerning consumer complaints or dispute resolution: Three years
• Records concerning labeling and advertising: Six months
• Communications confirmation data, including access logs: For the period prescribed by applicable laws and regulations

Article 4. Provision of Personal Information to Third Parties

The Company processes users’ personal information only within the scope of the purposes specified in Article 1 and, in principle, does not provide users’ personal information to third parties.

However, personal information may be provided in the following circumstances:

• Where the user has provided prior consent
• Where specifically required or permitted by law
• Where a lawful request is made by an investigative authority, court, or other competent authority
• Where provision to a relevant service provider is necessary within the scope required to provide the Service or process payments

When the Company provides personal information to a third party, it will provide advance notice of the recipient, purpose of provision, categories of information provided, and retention and use period, and will obtain consent where required.

Article 5. Entrustment of Personal Information Processing

The Company may entrust the processing of personal information to the following external service providers to facilitate the provision of the Service.

• Hostinger Entrusted services: Website hosting, server operation, and email services Retention and use period: Until termination of the outsourcing agreement
• Google Cloud / Google AI Entrusted services: AI API integration and the provision of image generation, text generation, TTS, and related features Retention and use period: Until the purpose of providing the Service is fulfilled or the outsourcing agreement is terminated
• OpenAI Entrusted services: AI API integration and the provision of image and text generation features Retention and use period: Until the purpose of providing the Service is fulfilled or the outsourcing agreement is terminated
• Creem / Armitage Labs OÜ Entrusted services: Merchant-of-record and payment-related services, subscription and refund processing, and pre-generation content-safety moderation for AI image and video requests Retention and use period: Until the relevant processing purpose is fulfilled, the applicable agreement is terminated, or the retention period required under applicable law or the provider’s published policy expires
• Make Entrusted services: Processing automation scenarios and transmitting and integrating usage data Retention and use period: Until the purpose of providing the Service is fulfilled or the outsourcing agreement is terminated
• Email Delivery Service or SMTP Provider Entrusted services: Sending announcements, authentication emails, and customer notices Retention and use period: Until termination of the outsourcing agreement

When entering into an outsourcing agreement, the Company manages and supervises the service provider as necessary to ensure that personal information is processed securely in accordance with applicable privacy laws.

If any listed service provider is not actually used, the relevant entry may be removed from this Privacy Policy.

Article 6. Cross-Border Transfers of Personal Information

The Company may use external AI APIs, cloud services, or automation service providers located outside Korea to provide the Service.

In this process, prompts entered by users, uploaded images, generation request details, and similar information may be transferred overseas or processed on servers located outside Korea.

• Google LLC (Destination countries: the United States and other countries in which Google operates) Transferred information: Prompts, uploaded images, generation request data, and certain usage records Purpose of transfer: Providing AI generation features, TTS features, and cloud processing Retention and use period: Until the purpose of providing the Service is fulfilled or for the period specified in the provider’s policies
• OpenAI, L.L.C. (Destination countries: the United States and other countries in which OpenAI operates) Transferred information: Prompts, uploaded images, generation request data, and certain usage records Purpose of transfer: Providing AI image and text generation features Retention and use period: Until the purpose of providing the Service is fulfilled or for the period specified in the provider’s policies
• Armitage Labs OÜ (Creem) (Destination countries: Estonia and other countries in which Creem or its service providers process data) Transferred information: For content-safety moderation, raw prompts submitted for AI image or video generation, pseudonymous user or request identifiers, moderation request metadata, and related generation-request information; for payment services, name, email address, billing country, purchased product or plan, subscription status, transaction and refund information, and other information required to process the purchase Purpose of transfer: Merchant-of-record, payment, subscription, refund, tax, and fraud-prevention services; pre-generation content-safety screening; prevention of prohibited or abusive use; and compliance with Service and payment-provider policies Timing and method of transfer: Encrypted electronic transmission when the user enters checkout or submits an applicable generation request Retention and use period: Until the purpose of processing is fulfilled or for the period specified in the applicable agreement, the provider’s published policy, or applicable law
• Make or Automation Service Provider (Destination countries: countries in which the overseas service is operated) Transferred information: Email address, name, usage records, and feature usage history Purpose of transfer: Automation processing, usage log management, and spreadsheet integration Retention and use period: Until the purpose of providing the Service is fulfilled or the outsourcing agreement is terminated
• Hostinger International or Relevant Affiliates (Destination countries: countries in which the overseas service is operated) Transferred information: Account information, access records, and website data Purpose of transfer: Website hosting and server operation Retention and use period: Until termination of the outsourcing agreement

Where a cross-border transfer is necessary, the Company will provide information about the recipient, destination country, categories of information transferred, purpose of transfer, and retention and use period in accordance with applicable laws and regulations.

Users may refuse a cross-border transfer. However, doing so may restrict access to certain Service features that require integration with an external AI API or cloud service.

Article 7. Procedures and Methods for Destroying Personal Information

When the retention period for personal information expires or the purpose of processing has been fulfilled, the Company will destroy the relevant personal information without undue delay.

1. Destruction Procedures

• After the applicable purpose has been fulfilled, users’ personal information is transferred to a separate database, retained for a certain period in accordance with internal policies and applicable laws, and then destroyed.
• Personal information that must be retained by law is stored separately for the period prescribed by the applicable law.

2. Destruction Methods

• Personal information in electronic-file form is deleted using methods that prevent its recovery or restoration.
• Personal information printed on paper is destroyed by shredding or incineration.
• Due to their technical characteristics, backup data may not be capable of immediate deletion. Such data will be securely managed through separate access restrictions and destroyed when the applicable retention period expires.

Article 8. Rights of Data Subjects and Legal Representatives and How to Exercise Them

Users may exercise the following rights against the Company at any time:

• Request access to personal information, request correction of personal information, request deletion of personal information, request suspension of processing, request membership termination, and withdraw consent to receive marketing communications

Users may exercise their rights through the My Page section of the Service, the customer support center, or an email inquiry.

When the Company receives a user’s request, it will take action without undue delay in accordance with applicable laws and regulations.
However, deletion may be restricted for information that must be retained by law.

With respect to the personal information of a child under 14 years of age, the child’s legal representative may request access, correction, deletion, or suspension of processing.

Article 9. Processing Personal Information of Children Under 14

In principle, the Company does not provide the Service to children under 14 years of age.

If the Company must collect personal information from a child under 14 years of age, it will obtain consent from the child’s legal representative and collect only the minimum personal information necessary.

A legal representative may request access to, correction or deletion of, or suspension of the processing of the child’s personal information.

Article 10. Installation and Operation of Automatic Data Collection Technologies, Including Cookies, and How to Refuse Them

The Company may use cookies to provide users with a better Service.

1. Purposes of Using Cookies

• Maintaining login status, authenticating members, improving ease of use, analyzing access frequency and usage statistics, maintaining security and preventing improper use, and providing customized services

2. How to Refuse Cookies

Users may refuse or delete cookies through their browser settings.

• Chrome: Settings → Privacy and security → Cookies and other site data
• Safari: Settings → Privacy → Block cookies
• Edge: Settings → Cookies and site permissions → Manage and delete cookies and site data

However, refusing cookies may restrict access to login, payment, or certain Service features.

Article 11. Processing of Behavioral Information

The Company does not currently collect or use users' behavioral information, or provide such information to third parties, for the purpose of online behavioral advertising.

If the Company processes behavioral information for behavioral advertising or similar purposes in the future, it will provide prior notice through this Privacy Policy of the categories of information collected, the collection methods, purposes of use, retention period, and the methods available to users for opting out.

Article 12. Measures to Ensure the Security of Personal Information

The Company implements the following measures to ensure the security of personal information:

• Administrative measures: Minimizing the number of personnel handling personal information, establishing an internal management plan, conducting regular security reviews, and managing access privileges for personal information
• Technical measures: Storing passwords in encrypted form, applying SSL-secured communications, restricting access privileges, deploying security software, retaining and reviewing access records, and implementing measures to prevent external intrusion
• Physical measures: Restricting access to servers and data storage locations and managing the storage and disposal of important materials

Article 13. Protection of Personal Information When Using AI Services

Due to the nature of an AI-based SaaS service, the Company may process prompts entered by users, uploaded images, and generated outputs. Users must comply with the following requirements:

• Users must not enter another person’s personal information without authorization.
• Users must not enter unnecessary personal information such as resident registration numbers, bank account numbers, card numbers, health information, or other sensitive information.
• Users must not upload or use another person’s face, likeness, voice, name, or contact information for generation without authorization.
• The Company may review AI generation request records for Service operation, prevention of improper use, customer support, and incident handling.
• The Company does not guarantee the accuracy or legality of AI-generated outputs or that such outputs do not infringe third-party rights.

Automated Content Safety Screening

To prevent NSFW, sexually explicit, harmful, illegal, or otherwise prohibited content, the Company may screen a prompt before sending it to an AI image- or video-generation model. A pseudonymous identifier and limited request metadata may be processed together with the prompt for auditing and abuse-prevention purposes.

A safety system may automatically classify a request as allowed, flagged, denied, blocked, or requiring review. A flagged or denied request may be automatically rejected and will not be transmitted to the generation model. If the safety-screening service is unavailable or returns an unexpected error, the Company may temporarily suspend the generation request rather than process it without screening.

This automated decision determines only whether the requested generation will be processed. It does not make a legal or similarly significant decision about the user. A user may contact customer support to request information about, or review of, a restriction, except where disclosure is limited for security, legal, or abuse-prevention reasons.

Passing a safety check does not guarantee that an output is lawful, accurate, non-infringing, or compliant with all platform rules. Users remain responsible for reviewing generated outputs before using or distributing them.

The Company endeavors to ensure that information entered by users and generated outputs are processed securely.

Article 14. Additional Use and Provision of Personal Information

The Company may additionally use or provide personal information without the user’s consent where permitted by applicable law and within a scope reasonably related to the original purpose of collection. In such cases, the Company considers the following factors:

• Whether the additional use or provision is related to the original purpose of collection
• Whether the additional use or provision is reasonably foreseeable in light of the circumstances in which the personal information was collected or established processing practices
• Whether it unfairly infringes upon the user’s interests
• Whether necessary security measures, such as pseudonymization or encryption, have been implemented

Article 15. Chief Privacy Officer

The Company designates a Chief Privacy Officer to oversee personal information processing and to handle user complaints and provide remedies in connection with personal information processing.

• Chief Privacy Officer Information
• Name: [Jun Heon Kim]
• Position: Representative
• Email: [sc35445682@gmail.com]
• Contact: [010-3544-5682]

For privacy-related inquiries, complaints, or requests for remedies, please use the contact information above.

Article 16. Requests for Access to Personal Information

Users may request access to their personal information through the Chief Privacy Officer or customer support center. The Company endeavors to process requests for access promptly.

• Department Responsible for Personal Information Access Requests
• Department: Operations Team
• Email: [sc35445682@gmail.com]
• Contact: [010-3544-5682]

Article 17. Remedies for Infringement of Rights

Users may contact the following institutions for remedies or consultation regarding damage caused by a personal information infringement:

• Personal Information Infringement Report Center
• Personal Information Dispute Mediation Committee
• Cyber Investigation Department of the Supreme Prosecutors’ Office
• Cyber Investigation Department of the Korean National Police Agency

These institutions are independent of the Company and may provide assistance separately from the Company’s internal privacy complaint-handling procedures.

Article 18. Amendments to This Privacy Policy

This Privacy Policy may be amended due to changes in applicable laws and regulations, the Company’s Service policies, or the integration structures of external AI APIs and payment services. If the Company amends this Privacy Policy, it will provide notice of the changes and their effective date through a website announcement or the Service interface.

• Announcement Date: August 6, 2026
• Effective Date: August 6, 2026