Privacy Policy

1. Scope of This Policy

HOMI AI Inc. (the "Company") publishes this Privacy Policy under Article 30 of the Personal Information Protection Act of Korea to explain how personal information is handled and how related complaints are resolved.

This Policy applies to:

• The oowa website, web application, and any future mobile applications
• AI image generation and editing features
• All user inputs, uploaded files, prompts, and generated outputs
• Access records, analytics, and logs collected through the Services

This Policy does not apply to third-party websites or services accessed through oowa.

2. Purposes of Processing

We process personal information only for the purposes below and do not use it for unrelated purposes.

• Account registration and management: identity verification, member services, prevention of misuse, and service notices
• Service delivery: AI image generation and editing, storage and retrieval of your work
• Payments: pass purchases, transaction records, and refunds
• Customer support: handling inquiries and retaining records for dispute resolution
• Service improvement: usage analysis, error diagnosis, and development of new features

3. Information We Collect

Account registration and authentication

• Required: email address, name or nickname, and the account identifier issued by our authentication provider
• Social login: profile information supplied by that provider (email, name, profile image)

While using the Services

• Images and files you upload, prompts you enter, and outputs generated for you
• Usage history, pass usage, and job status information

Payments

• Payment method details, authorization records, transaction dates, and amounts
• Card numbers and equivalent authentication data are handled directly by our payment provider and are not stored by the Company.

Collected automatically

• IP address, cookies, browser and device information, access times, and service usage records
• Behavioral analytics data, collected only where you have consented to analytics cookies
• Where you consent to analytics cookies, a sample of sessions may be recorded as session replay of your interactions with the interface, to help us improve the Services

4. Retention Periods

We retain personal information only for the period permitted by law or consented to at the time of collection.

• Account information: until you delete your account
• Uploaded files and generated outputs: deleted on your request, or within 30 days of account deletion
• Records of contracts and withdrawal of subscription: 5 years (Act on Consumer Protection in Electronic Commerce)
• Records of payment and supply of goods: 5 years (same Act)
• Records of consumer complaints and dispute resolution: 3 years (same Act)
• Records of labelling and advertising: 6 months (same Act)
• Service access logs: 3 months (Protection of Communications Secrets Act)

5. Provision to Third Parties

We process personal information only within the scope stated in Section 2, and disclose it to third parties only where Articles 17 and 18 of the Personal Information Protection Act permit — for example with your consent or under a specific legal provision.

We do not currently provide personal information to third parties on a routine basis.

6. Processors and Overseas Transfers

We engage the following processors to operate the Services, and we supervise their handling of personal information.

• Clerk, Inc. (United States) — authentication and account management
• Amazon Web Services, Inc. (United States) — image and file storage, content delivery
• Vercel Inc. (United States) — application hosting and execution
• Upstash, Inc. (United States) — caching and realtime processing
• Inngest, Inc. (United States) — background job processing
• Google LLC, Anthropic PBC, Fal.ai, OpenRouter (United States) — AI image and text generation
• Mixpanel, Inc. (United States) — usage analytics, where analytics cookies are accepted
• KoreaPortOne Co., Ltd. (Republic of Korea) — payment processing and fraud prevention

For processors located outside Korea, the information required for their service is transferred over the network at the time you use the Services, and the receiving country is the United States. Transferred items are limited to what each processor needs — account identifiers, email addresses, uploaded files and prompts, and access records. Processors retain that information for the duration of their contract with us.

You may refuse the overseas transfer, in which case some or all of the Services will be unavailable. Send any such request to [email protected].

7. Deletion Procedures

When personal information is no longer needed — because the retention period has passed or the purpose has been achieved — we destroy it without delay.

• Procedure: the information is identified and destroyed with the approval of our data protection officer.
• Electronic files: permanently erased by means that prevent recovery or reconstruction.
• Printed material: shredded or incinerated.
• Where law requires retention: the information is separated into dedicated storage.

8. Your Rights and How to Exercise Them

You may exercise the following rights at any time:

• Request access to your personal information
• Request correction of errors
• Request deletion
• Request suspension of processing

Requests may be made in writing or by email, and we act on them without delay. Where you have asked us to correct an error, we do not use or disclose the affected information until the correction is complete.

We do not collect personal information from children under 14. Rights may also be exercised through a legal representative.

9. Security Measures

• Administrative: an internal management plan, minimised access, and training for staff who handle personal information
• Technical: access control for processing systems, access control systems, and encrypted storage of credentials
• In transit: all traffic between you and the Services is encrypted with HTTPS
• At rest: uploaded files and generated outputs are reachable only through signed access URLs
• Physical: reliance on the data centre access controls of our cloud providers

10. Cookies and Analytics

We use cookies to operate the Services. They fall into essential cookies and analytics cookies, the latter active only with your consent.

• Essential cookies: keep you signed in and support security and session management; refusing them may limit use of the Services.
• Analytics cookies: used for usage statistics and for session replay of a sample of visits; you may withdraw consent at any time in the cookie settings within the Services.

You can also refuse or delete cookies in your browser settings, though refusing essential cookies may make parts of the Services difficult to use.

11. Data Protection Officer and Access Requests

We have designated a data protection officer with overall responsibility for personal information processing and for handling complaints and remedies.

• Data protection officer: Taeyoon Kim, Chief Executive Officer
• Contact: [email protected] / +82-70-8019-0702
• Department receiving access requests: Customer Support ([email protected])

You may direct any question, complaint, or request for remedy regarding personal information to the officer above, and we will respond without delay.

12. Registration of Personal Information Files and Impact Assessment

Registration of personal information files and privacy impact assessments apply to public institutions under the Personal Information Protection Act, and therefore do not apply to the Company.

13. Processing Related to AI Features

• Images and prompts you submit are sent to AI processors in order to generate the output you requested.
• We do not use your uploads or generated outputs to train AI models, and we do not permit our processors to use them for training.
• Generated outputs are stored in your account and are deleted through our destruction procedure when you delete them.

14. Remedies for Infringement

You may contact the following bodies for dispute resolution or advice regarding personal information:

• Personal Information Dispute Mediation Committee: 1833-6972 / www.kopico.go.kr
• Privacy Infringement Report Centre: 118 / privacy.kisa.or.kr
• Cybercrime Investigation Division, Supreme Prosecutors' Office: 1301 / www.spo.go.kr
• National Police Agency Cyber Bureau: 182 / ecrm.police.go.kr

15. Changes to This Policy

Where this Policy is amended, we announce the change in the Services at least 7 days before it takes effect, and at least 30 days in advance where the change materially affects your rights.