AIdol Privacy Policy
Effective date: 2026-10-10 | Data controller: AIoIA, Inc. | Contact: hi@aioia.ai
1. Personal Data We Collect
The Company may collect the following information to provide the Service.
- Account information: email address, password (stored encrypted), profile information
- Service usage information: access records, device and browser information, logs, cookies and identifiers
- User-generated content: text, images, conversations and prompts, uploaded files
- Payment information (when paid features are used): payment status and transaction identifiers. Sensitive payment data such as card numbers is retained by the payment provider.
- Customer support information: inquiry content, attachments, and response history
2. Purposes of Use
- Member identification, authentication, and account management
- Providing the Service, improving features, and delivering a personalized experience
- Ensuring safety, including fraud detection, content moderation, and security response
- Fee settlement, payment processing, and refunds
- Responding to inquiries and delivering notices
- Legal compliance and handling of disputes
3. Legal Basis for Processing (where applicable)
The Company processes personal data on applicable legal bases, including performance of a contract, compliance with legal obligations, legitimate interests, and the user’s consent.
4. Retention and Destruction
The Company destroys personal data without delay once its purpose has been achieved or the statutory retention period has expired. Where retention is required by law for a certain period, the data is stored securely for that period.
| Retained data | Retention period | Legal basis |
|---|---|---|
| Records on contracts or withdrawal of subscription | 5 years | Act on Consumer Protection in Electronic Commerce |
| Records on payment and supply of goods | 5 years | Act on Consumer Protection in Electronic Commerce |
| Records on consumer complaints or dispute resolution | 3 years | Act on Consumer Protection in Electronic Commerce |
| Records on labeling and advertising | 6 months | Act on Consumer Protection in Electronic Commerce |
| Service access logs | 3 months | Protection of Communications Secrets Act |
| Member account information | Destroyed without delay upon withdrawal | － |
5. Provision to Third Parties and Entrustment of Processing
The Company does not sell users’ personal data to outside parties.
To operate the Service, the Company may entrust the processing of personal data to service providers for purposes such as cloud infrastructure, analytics, payment, and customer support, and may provide personal data to third parties where required by law.
| Entrusted party | Entrusted work | Country |
|---|---|---|
| Google Cloud Platform | Cloud infrastructure, image and video storage | United States |
| Stripe, Inc. | Payment processing and payment method verification | United States |
| OpenAI, L.L.C. | Generation of conversational responses | United States |
| Google LLC (Gemini) | Generation of conversational responses and images | United States |
| Anthropic, PBC | Generation of conversational responses | United States |
| PostHog, Inc. | Service usage analytics | United States |
| Functional Software, Inc. (Sentry) | Error log collection and incident response | United States |
| Google Firebase | Push notification delivery | United States |
Provision to third parties: personal data is not provided to third parties except as required by law.
6. Overseas Transfer (where applicable)
Personal data may be transferred overseas through the use of cloud or external services. The Company applies the protective measures required by applicable law.
The recipients and countries of transfer are as set out in the table in Section 5 above.
- Data transferred: Account information, service usage records, conversation content, generated images, payment identifiers
- Method of transfer: Transmitted over encrypted connections (TLS) at the time of service use
- Retention period: Until the purpose of entrustment is achieved or the entrustment agreement terminates
Data subjects may exercise their rights regarding overseas transfers by contacting hi@aioia.ai.
7. Rights of Users and Legal Representatives
Users may request access to, correction of, or deletion of their personal data, suspension of processing, or withdrawal of consent. The Company will act on such requests without delay to the extent provided by law.
8. Children’s Personal Data
The Company protects the personal data of children below the age prescribed by law and, where necessary, verifies the consent of a legal representative.
9. Cookies and Analytics Tools
The Company may use cookies or similar technologies to provide the Service and analyze usage patterns. Users may refuse the storage of cookies through their browser settings, although some features may then be unavailable.
10. Security Measures
The Company implements reasonable safeguards including access control, encryption, log monitoring, vulnerability assessment, and the principle of least privilege.
11. Data Protection Officer and Contact
Data protection officer: 이소연 (Soyeon Lee) / 대표이사 (CEO)
Contact: hi@aioia.ai
12. Changes to This Policy
This Policy may be amended in line with changes in applicable law or the Service. Material changes will be announced within the Service or on this web page.
13. Governing Law and Jurisdiction
Matters relating to this Policy are governed by the laws of the Republic of Korea and the Seoul Central District Court.
This document is provided as a translation of the Korean original. In the event of any discrepancy between this translation and the Korean version, the Korean version shall prevail.