Privacy Policy

Article 1 (Purpose)

Planning Co., Ltd. (the “Company”) establishes this Policy to protect Photio users’ personal information and handle related inquiries in accordance with the Personal Information Protection Act and other applicable laws.

Article 2 (Principles of Personal Information Processing)

The Company processes only the minimum personal information necessary on a lawful basis. Where separate consent is required, the Company obtains it; publication of this Policy or continued use of the service does not constitute consent.

Article 3 (Publication of this Policy)

This Policy is available on the Company’s website home page or a page linked from it.

Article 4 (Amendment of this Policy)

1. The Company may amend this Policy following changes in laws or the service.

2. Changes are announced on the website or by email or similar means at least 7 days before taking effect. Significant changes to users’ rights are announced at least 30 days in advance.

Article 5 (Information for Membership Registration)

Registration requires an email address, password and nickname. A profile photo is optional.

Article 6 (Information for Identity Verification)

The Company collects an email address and name for identity verification.

Article 7 (Information for Payment Services)

1. For payments, recurring payments, cancellations and refunds, the Company processes member IDs, emails, payment-method identifiers (such as billing keys and customer IDs), order and subscription details, payment amounts, currencies, times and statuses, and card display information.

2. For domestic card registration, card numbers, expiration dates, dates of birth and the first two digits of card PINs are transmitted to PortOne and the relevant payment provider. Data entered directly into Stripe or PayPal payment interfaces is processed by that provider; the Company receives payment-method identifiers and payment results.

3. The card numbers, expiration dates, dates of birth and first two digits of card PINs described in paragraph 2 are destroyed without delay after registration and are not kept in operational records. Identifiers needed for subsequent payments, masked card display information and transaction records are retained under Articles 14 and 15.

Article 8 (Information for Cash Receipt Issuance)

When a cash receipt is requested, the Company processes the phone number or cash-receipt identifier and transaction information needed to issue it.

Article 9 (Information for Providing Company Services)

1. To provide requested features, the Company processes member IDs, emails, uploaded, selected and reference images, prompts, questions, conversations, selected options and tools, generated answers and images, and job and conversation identifiers.

2. Submitted feedback includes ratings, reasons, comments, submission times and linked questions, options, images and results. Feedback is optional and is not required to use the basic service.

3. Do not include unnecessary sensitive information or another person’s personal information that you are not authorized to process in questions, images or comments. The Company takes appropriate steps, such as deletion or masking, when it identifies unnecessary personal information.

Article 10 (Information for Service Usage and Detection of Unlawful Activities)

1. To provide and improve the service, resolve errors and prevent abuse, the Company processes usage records. These include job status, upload, regeneration, viewing and download activity, features, tools, models and versions, displayed options, display order and selections, and input types and languages. They also include request and output counts and formats, credit use, errors, event times, waiting and processing durations, and member, conversation, job and result identifiers.

2. Access logs, IP addresses, browser and device information and cookies may be collected automatically during service use. Processing by external analytics and advertising tools is described in Articles 31 and 32.

3. Abuse includes identity or payment-method theft, abnormal high-volume use, fraudulent registration to repeatedly obtain benefits, and other conduct prohibited by law or the Terms of Service.

4. For each image generation or editing request, the Company retains a generation request record: entered text (including the original chatbot request message), instructions sent to the model, feature and model, result image addresses, outcomes, block reasons, safety ratings, provider responses, processing time, and member, project and job identifiers. Records are kept in an access-restricted database and used to investigate abuse and impose usage restrictions, improve the service through error resolution and analysis of failure causes and respond to user inquiries. They are not used for marketing or model training.

Article 11 (Methods of Personal Information Collection)

Personal information is collected through user input and submissions on the website, app or email, records generated automatically during service use, and processing results returned by authentication and payment providers.

Article 12 (Use of Personal Information)

The Company uses personal information for the following purposes and on the following bases.

1. Account management, authentication, payments, settlement, subscriptions and operational notices: entering into and performing contracts and complying with legal obligations.

2. Conversations, image generation and editing, saving, viewing, regenerating and downloading results, and job recovery: performing contracts.

3. Resolving errors, checking credits and handling inquiries, feedback and complaints: performing contracts and complying with legal obligations.

4. Additional quality analysis of original content, images and feedback linked to an individual requires separate optional consent after notice of the purpose, data and retention period. Refusal does not affect the basic service. Usage trends are analyzed in non-identifying aggregates where possible. This excludes use of the generation request records under Article 10(4) for the purposes specified in that paragraph.

5. Use for promotional or sales purposes and receipt of advertising messages each require separate consent. Consent may be withdrawn at any time, and refusal does not affect the basic service.

6. Generation request records under Article 10(4) are used on a lawful basis to investigate abuse and impose usage restrictions, resolve errors, improve the service and respond to user inquiries.

7. The Company does not use questions, conversations, images, outputs, usage records or feedback to train or fine-tune AI models without separate optional consent.

8. Separate consent is obtained before using inputs, outputs or feedback as promotional examples or public testimonials.

Article 13 (Disclosure of Personal Information to Third Parties)

1. The Company does not disclose personal information for a third party’s independent purposes without a lawful basis. For consent-based disclosures, it obtains consent after explaining the recipient, purpose, data, retention period, right to refuse and consequences of refusal.

2. Disclosures required by law follow the scope and procedures of that law. Outsourcing is described in Article 13-2 and international transfers in Article 31. Independent processing by recipients is distinguished from outsourcing.

Article 13-2 (Outsourced Processing of Personal Information)

1. The Company outsources the following tasks and supervises processors under contracts addressing purpose limitations, security, subprocessing, deletion and oversight. Only information needed for the features used is transmitted.

2. Payment providers’ independent processing for financial services, fraud prevention and legal obligations follows their own policies. Independent processing by Microsoft Clarity is described in Articles 31 and 32.

Article 14 (Retention and Use Period of Personal Information)

1. Personal information is retained for the periods below and destroyed without delay when no longer needed. Statutory retention is described in Article 15.

2. Only the minimum information needed for statutory retention is stored separately and is not used for quality analysis, marketing or model training.

Article 15 (Retention and Use Period of Personal Information According to Laws)

1. Under Article 6 of the Enforcement Decree of the Act on Consumer Protection in Electronic Commerce, records of contracts, withdrawals, payments and supply are retained for 5 years, consumer complaints and disputes for 3 years, and displays and advertisements for 6 months.

2. Personnel access logs for personal-information processing systems are retained for 2 years under Article 8 of the Standards for Ensuring the Safety of Personal Information.

Article 16 (Principles of Personal Information Disposal)

Personal information is destroyed without delay when no longer needed because its purpose has been completed or its retention period has expired. Information retained under law is stored separately.

Article 17 (Processing of Personal Information for Non-Users of the Service)

The retention periods in Articles 14 and 15 also apply to inactive users’ information.

Article 18 (Procedure for Personal Information Disposal)

1. Deletion covers service data, outsourced copies, caches and copies in monitoring tools. The Company identifies the grounds for deletion and follows the approval procedure of the privacy officer.

2. Backups rotate over 7 days with restricted access. Previous deletions are reapplied when backups are restored.

Article 19 (Method of Personal Information Disposal)

Electronic files are deleted using methods that prevent recovery. Paper documents are shredded or incinerated.

Article 20 (Measures for the Transmission of Promotional Information)

1. Advertising messages are sent only with prior consent. The Company stops sending them upon refusal or withdrawal and informs the user of the result.

2. Separate prior consent is obtained for advertising messages sent between 9 p.m. and 8 a.m. the next day.

3. Advertising messages identify the Company, provide contact details and offer a simple opt-out method. The Company does not conceal sender information or obstruct opt-outs.

Article 21 (Access to Personal Information and Withdrawal of Consent)

1. Users and legal representatives may request access, correction, deletion, suspension of processing or withdrawal of consent. Requests may be submitted to the privacy officer in writing, by phone (02-6949-5511) or by email (info@planningo.io). The Company verifies identity and handles requests under applicable law, explaining any legal restrictions.

2. The same contact accepts requests concerning chatbot inputs, outputs, usage records and feedback, and reports of inappropriate AI results.

3. Refusing or withdrawing optional consent does not affect the basic service. Refusing processing necessary to perform the contract may prevent use of the relevant feature. International-transfer refusals are described in Article 31.

Article 22 (Change of Personal Information)

Correction requests may be submitted under Article 21. The Company does not use or disclose the affected information before correction and informs prior recipients of the correction.

Article 23 (User's Obligations)

Users must keep their information accurate and their accounts and passwords secure. They must not misuse others’ personal information or transfer or lend their accounts.

Article 24 (Management of Personal Information by the Company)

The Company protects personal information through technical and administrative measures, including access restrictions, encryption, security checks and staff training.

Article 25 (Handling of Deleted Information)

Information subject to deletion or account-closure requests is handled under Articles 14 and 15, with use restricted to the purpose of retention.

Article 26 (Password Encryption)

Passwords are stored and managed using one-way encryption.

Article 27 (Measures Against Hacking)

The Company uses security software, access controls and encrypted communications to protect personal information against hacking and malicious software.

Article 28 (Minimization of Personal Information Processing and Education)

Access to personal information is limited to necessary personnel, who receive privacy training.

Article 29 (Actions Regarding Personal Information Leaks, Etc.)

Upon learning of a personal-information breach, the Company notifies users and reports to the authorities within the time limits and procedures required by law. Notices include the affected data, timing and circumstances, ways to reduce harm, the Company’s response and remedies, and contact details.

Article 30 (Exceptions to Actions Regarding Personal Information Leaks, Etc.)

Where individual notice is impracticable, such as when contact details are unavailable, the Company provides notice on its website or by other means as required by law.

Article 31 (Protection of Personal Information Transferred Abroad)

1. For international outsourcing and storage necessary to perform a contract, the Company discloses the following information or provides statutory notice under Article 28-8(1)(3) of the Personal Information Protection Act. Transfers requiring separate consent take place after notice and consent. Outsourcing and storage necessary to perform a contract are distinguished from transfers requiring separate consent, such as those for analytics and advertising.

2. Recipient contacts are the privacy and support channels linked in the table. Domestic processing routes are listed separately from international transfers for clarity.

3. To refuse or stop international transfers or withdraw consent, contact info@planningo.io or 02-6949-5511. Refusing image processing, authentication, payments or emails essential to the service may prevent use of the relevant feature. Refusal of optional analytics or advertising consent does not affect the basic service.

Article 32 (User's Choice Regarding Cookie Installation)

1. Cookies and similar automatic collection tools maintain logins and analyze visits and usage. Google Analytics/Tag Manager processes cookies, identifiers, visits, events, access and device information. Microsoft Clarity analyzes clicks, scrolling and masked screen information. Chat output, editing canvases, images and input areas are masked for Clarity collection.

2. Microsoft Clarity acts as an independent controller and may share information with Microsoft Ads based on advertising consent signals. Separate consent is obtained where required for advertising use or disclosure.

3. NAVER Corporation’s analytics and advertising tools process visit and conversion information. Meta Platforms, Inc.’s signup conversion integration processes hashed emails, IP addresses, browser information, advertising cookie IDs, event times and source URLs. Hashed emails are treated as personal information. Google, Kakao and Facebook logins are subject to their providers’ privacy terms. Loading Google Fonts or Stripo external assets in emails may transmit access information.

4. Article 33 explains how to reject or delete cookies. Blocking cookies may restrict login and some other features. Requests to suspend server-side processing or withdraw consent may be submitted under Article 21.

Article 33 (Method for Designating Permission for Cookie Installation)

Users may allow, block or delete cookies in their browser’s privacy, security or cookie and site-data settings. Menu paths vary by browser.

Article 34 (Designation of Company's Personal Information Protection Manager)

1. The privacy officer is Jinwook Shin. Privacy inquiries and complaints may be submitted by phone at 02-6949-5511 or by email at info@planningo.io.

2. For privacy complaints and advice, contact the Personal Information Infringement Report Center (118, https://privacy.kisa.or.kr). For dispute mediation, contact the Personal Information Dispute Mediation Committee (1833-6972, https://www.kopico.go.kr).

Supplementary Provisions

Publication date: November 4, 2026. Effective date: November 4, 2026.