Privacy Policy

Version 2026-10-05 · Effective 2026-10-03

The operator of GroomScene protects your personal data under the Korean Personal Information Protection Act and processes only what the Service needs. This policy describes what the Service actually processes. The Korean version governs; this is a translation.

1.What we process and why

Category: Sign-up and sign-in
Data: Email address, password (hashed by the sign-in provider; the Operator cannot see it)
Purpose: Identification, sign-in, email verification, notices
Retention: Until account deletion (within 30 days of the request)

Category: Shop details
Data: Shop name, logo image, watermark contacts (phone number, Instagram / KakaoTalk / Band IDs), notification settings
Purpose: Watermark, settings
Retention: Until account deletion

Category: Photos
Data: Uploaded dog photos (people may appear), background-removed images, finished photos
Purpose: Background removal and AI composition, storage and download
Retention: See “Retention and destruction”

Category: Usage records
Data: Generation records (time, theme, quality, success / failure, processing time, external usage), credit grants and usage, theme favourites / recent use / theme requests
Purpose: Providing the Service, credits, troubleshooting, statistics
Retention: Until account deletion (accounting records kept de-identified)

Category: Abuse prevention
Data: Request times and account identifier
Purpose: Limiting excessive requests
Retention: 24 hours

Category: Free-trial duplicate prevention
Data: Hashes of the email address, business registration number and IP address (the originals are not stored), the time trial credits were granted, trial requests (shop name and one contact line)
Purpose: Preventing repeated trial grants and misuse
Retention: Hashes are kept for 365 days after the grant (IP hashes 30 days) and remain for that period even if you delete the account. Requests are deleted 30 days after a decision (90 days if undecided) or with the account

Category: Notifications (optional)
Data: Browser push address and keys, browser information
Purpose: Photo-ready and credit notifications
Retention: Until you turn notifications off or delete the account

Category: Collected automatically
Data: Access logs (IP address, browser, time)
Purpose: Security, troubleshooting
Retention: The hosting provider’s log retention

Category	Data	Purpose	Retention
Sign-up and sign-in	Email address, password (hashed by the sign-in provider; the Operator cannot see it)	Identification, sign-in, email verification, notices	Until account deletion (within 30 days of the request)
Shop details	Shop name, logo image, watermark contacts (phone number, Instagram / KakaoTalk / Band IDs), notification settings	Watermark, settings	Until account deletion
Photos	Uploaded dog photos (people may appear), background-removed images, finished photos	Background removal and AI composition, storage and download	See “Retention and destruction”
Usage records	Generation records (time, theme, quality, success / failure, processing time, external usage), credit grants and usage, theme favourites / recent use / theme requests	Providing the Service, credits, troubleshooting, statistics	Until account deletion (accounting records kept de-identified)
Abuse prevention	Request times and account identifier	Limiting excessive requests	24 hours
Free-trial duplicate prevention	Hashes of the email address, business registration number and IP address (the originals are not stored), the time trial credits were granted, trial requests (shop name and one contact line)	Preventing repeated trial grants and misuse	Hashes are kept for 365 days after the grant (IP hashes 30 days) and remain for that period even if you delete the account. Requests are deleted 30 days after a decision (90 days if undecided) or with the account
Notifications (optional)	Browser push address and keys, browser information	Photo-ready and credit notifications	Until you turn notifications off or delete the account
Collected automatically	Access logs (IP address, browser, time)	Security, troubleshooting	The hosting provider’s log retention

Your browser re-saves each photo before upload (applying its rotation), so extra photo data such as GPS location is not sent to our servers.

The Service is for dog photos; please avoid uploading people’s faces. If a person appears, the photo is processed only for the purposes and periods above, and faces are never recognised or analysed.

2.Retention and destruction

Finished photos: deleted 90 days after last use (viewing, downloading, sharing).
Background-removed images: deleted 90 days after the last work with that upload (e.g. “Make again”).
Uploaded originals: deleted right after background removal once a photo is made; originals never used are deleted after 7 days.
Photos you delete: removed from the Service at once, and the stored files are deleted right away.
Account deletion request: access stops at once and photos are no longer shown. Within 30 days we destroy the photo files, shop details (contacts, watermark settings, logo) and account data. Credit and generation-cost records are kept de-identified for accounting.

Destruction means irreversible deletion from storage and the database. Expired data is checked and cleaned up automatically every day.

3.Disclosure to third parties

We do not provide your personal data to third parties, except where the law specifically requires it or investigators request it through legal procedures.

4.Processors and international transfers

We entrust the following companies with processing to provide the Service; some process data outside Korea. Transfers happen over encrypted connections (HTTPS) when you use the Service.

Recipient: OpenAI, L.L.C.
Country: United States
Data: Background-removed dog photo, theme description text
Purpose: AI image composition (dog photo placed into the theme background)
Retention: Per the provider's policy after processing (we request no additional storage)
Contact (website): https://openai.com

Recipient: Features & Labels, Inc. (fal.ai)
Country: United States
Data: Uploaded original photo (passed as a link)
Purpose: Background removal (cutout)
Retention: Per the provider's policy after processing
Contact (website): https://fal.ai

Recipient: Cloudflare, Inc. (R2)
Country: Cloudflare data centers (per the storage location setting)
Data: Uploaded originals, cutouts, result photos, shop logo
Purpose: Storing and delivering photo and logo files
Retention: The retention periods in this policy (up to 90 days; immediately on deletion)
Contact (website): https://www.cloudflare.com

Recipient: Supabase, Inc.
Country: Japan (Tokyo region)
Data: Shop details, email address for sign-in identification and account linking, usage and credit records, photo file references
Purpose: Operating the service database
Retention: Until account deletion (accounting records are kept de-identified)
Contact (website): https://supabase.com

Recipient: Vercel Inc.
Country: United States
Data: Request contents while using the service, access logs (IP address, browser, time)
Purpose: Web hosting and running the server
Retention: While processing a request; access logs per the provider's log retention
Contact (website): https://vercel.com

Recipient: Clerk, Inc.
Country: United States
Data: Email address, password (hashed), sign-in history
Purpose: Sign-up, sign-in, email verification
Retention: Until account deletion (within 30 days of the request)
Contact (website): https://clerk.com

Recipient: National Tax Service of Korea (business status lookup via data.go.kr)
Country: Republic of Korea
Data: Business registration number (sent once when you confirm it; the Operator does not store the original) (Only if you confirm a business registration number)
Purpose: Confirming the business is active (preventing repeated trial benefits)
Retention: Used for the lookup only and not kept by the Operator (lookup records follow the agency’s policy)
Contact (website): https://www.data.go.kr

Recipient: Browser push services (Google, Apple, Mozilla, etc.)
Country: United States and others
Data: Notification text (photo ready, credit notices), browser push address (Only if you turn on notifications)
Purpose: Delivering web push notifications
Retention: Until delivered
Contact (website): https://web.dev/articles/push-notifications-overview

Recipient	Country	Data	Purpose	Retention	Contact (website)
OpenAI, L.L.C.	United States	Background-removed dog photo, theme description text	AI image composition (dog photo placed into the theme background)	Per the provider's policy after processing (we request no additional storage)	https://openai.com
Features & Labels, Inc. (fal.ai)	United States	Uploaded original photo (passed as a link)	Background removal (cutout)	Per the provider's policy after processing	https://fal.ai
Cloudflare, Inc. (R2)	Cloudflare data centers (per the storage location setting)	Uploaded originals, cutouts, result photos, shop logo	Storing and delivering photo and logo files	The retention periods in this policy (up to 90 days; immediately on deletion)	https://www.cloudflare.com
Supabase, Inc.	Japan (Tokyo region)	Shop details, email address for sign-in identification and account linking, usage and credit records, photo file references	Operating the service database	Until account deletion (accounting records are kept de-identified)	https://supabase.com
Vercel Inc.	United States	Request contents while using the service, access logs (IP address, browser, time)	Web hosting and running the server	While processing a request; access logs per the provider's log retention	https://vercel.com
Clerk, Inc.	United States	Email address, password (hashed), sign-in history	Sign-up, sign-in, email verification	Until account deletion (within 30 days of the request)	https://clerk.com
National Tax Service of Korea (business status lookup via data.go.kr)	Republic of Korea	Business registration number (sent once when you confirm it; the Operator does not store the original) (Only if you confirm a business registration number)	Confirming the business is active (preventing repeated trial benefits)	Used for the lookup only and not kept by the Operator (lookup records follow the agency’s policy)	https://www.data.go.kr
Browser push services (Google, Apple, Mozilla, etc.)	United States and others	Notification text (photo ready, credit notices), browser push address (Only if you turn on notifications)	Delivering web push notifications	Until delivered	https://web.dev/articles/push-notifications-overview

These transfers are necessary to provide the Service. To refuse them, stop using the Service and request account deletion; the Service cannot be used without them.

5.Your rights

You may ask at any time to access, correct or delete your personal data, or to stop its processing.
Shop details and watermark contacts can be edited in Settings; photos can be deleted in My Photos.
Account deletion is available under “Request account deletion” in Settings.
Send any other request to the contact below; we act on it without delay and tell you the result.

6.Security measures

All traffic is encrypted (HTTPS).
Sign-in and passwords are handled by a dedicated authentication provider; the Operator does not store passwords.
Admin screens are limited to operator accounts; each shop can reach only its own data and photos.
Photo files are stored under random, hard-to-guess addresses, and uploads are re-checked on the server.

7.Cookies and browser storage

We use only the cookies needed to keep you signed in (the authentication provider’s session cookies). We do not use analytics or advertising cookies or trackers.

Browser storage only remembers whether you closed the “install app” prompt. You can block cookies in your browser, but you will not be able to sign in.

8.Children under 14

The Service is for shop operators and does not accept sign-ups from children under 14.

9.Privacy officer and contact

Operator: 최진수 · This is a free beta before business registration; only the operator is listed.
Privacy officer: 최진수 (Operator)
Email: anajulgae@gmail.com

10.Remedies

For help with a privacy infringement you may contact the following Korean authorities:

Personal Information Dispute Mediation Committee: 1833-6972 (www.kopico.go.kr)
Personal Information Infringement Report Center: 118 (privacy.kisa.or.kr)
Supreme Prosecutors’ Office: 1301 (www.spo.go.kr)
Korean National Police Agency: 182 (ecrm.police.go.kr)

11.Changes to this policy

This policy applies from 2026-10-03. When the data we process or our processors change, we update this policy, announce it in the Service at least 7 days in advance and ask for your consent again.