Privacy Policy

Fairrium (“GenToon”, “we”, “us”, or “the Company”) provides the GenToon service (the “Service”) and is the controller of personal data processed through it. This Privacy Policy explains what personal data we collect, why and on what legal basis we process it, who we share it with, how long we keep it, how we transfer it internationally, and the rights you have over your data.

For users in the European Economic Area (EEA), the United Kingdom, and Switzerland, we process personal data in accordance with the EU General Data Protection Regulation (GDPR) and the UK GDPR. For users in California and other U.S. states with applicable privacy laws, the disclosures in the “Your U.S. State Privacy Rights” section apply. Country-specific provisions required under Korean law apply only to users in the Republic of Korea and are set out separately below. If you have any question about this Policy or wish to exercise your rights, contact us at service@gentoon.ai.

1. Categories of Personal Information Collected and Methods of Collection

A. Categories Collected

We do not collect sensitive information such as beliefs, health or sex life. The resident registration number, a unique identifier under Korean law, is collected only for the affiliate settlement purpose above, only where the law requires it, and only with separate consent.

B. Methods of Collection

• Direct input during sign-up and use of the website and mobile app
• Social login via Google, Apple or Kakao OAuth
• Account details supplied by the platform (Meta, TikTok) when you connect a social account
• What an AI assistant (such as ChatGPT or Claude) sends when you connect GenToon to it and use GenToon features there
• Automatic collection during payment through Polar, Toss Payments or app store in-app purchase
• Automatic generation and collection through cookies, local storage and access logs during service use
• Automatic transmission by the analytics SDKs installed in the web and mobile app (Sections 9 and 17)
• Collection during enquiries made by email, the Help page or the business enquiry form

2. Purposes of Processing Personal Information

1. Member management. Identity verification, prevention of unauthorized use, complaint resolution, and delivery of notices
2. Service provision. AI image and script generation, project storage, character management, and community operation
3. Connected AI assistants. Carrying out what you ask for in an AI assistant you connected (setting up, writing, drawing, viewing, exporting, sharing and publishing webtoons), managing the connection and preventing misuse
4. Payment and billing. Subscription payments, credit purchases, refunds, and issuance of tax receipts and invoices
5. Service improvement. Usage statistics and product-usage analysis (Google Analytics, Microsoft Clarity, PostHog), error detection (Sentry), and service quality enhancement
6. Affiliate partner settlement. Paying referral earnings and filing withholding tax and payment statements
7. Business production enquiries. Receiving and answering enquiries, concluding and performing contracts
8. Marketing (optional). Event and benefit notifications (only with prior consent)

Legal Bases for Processing (EEA / UK Users)

Where the GDPR or UK GDPR applies, we rely on the following legal bases:

• Performance of a contract (Art. 6(1)(b)). To create and maintain your account, provide AI generation, project storage, character management, the community, and to process payments, subscriptions, credit purchases, and refunds. Without this data we cannot provide the Service.
• Legitimate interests (Art. 6(1)(f)). To secure the Service against fraud and abuse, detect and fix errors, maintain access and audit logs, analyse aggregate usage to improve the Service, and to enforce our Terms. We balance these interests against your rights and you may object as described in the “Your Rights” section.
• Consent (Art. 6(1)(a)). For optional marketing communications, which you opt into separately, and for connecting an AI assistant to GenToon (Section 20), which you allow on GenToon's own connection page. You may withdraw consent at any time without affecting prior processing — for a connected AI assistant, by disconnecting it in Settings › Connected apps.
• Legal obligation (Art. 6(1)(c)). To retain transaction and tax records and to respond to lawful requests, where mandatory law requires it.

We do not use your prompts, uploaded reference images, or generated outputs to train AI models. Our AI processors (Google Gemini, Alibaba Model Studio, OpenAI) do not use data sent through paid API calls to train their models, and we do not build a training dataset of our own.

Some decisions in the Service are made automatically, without a human reviewing them individually: whether a referral reward is granted, whether chat access is temporarily suspended after repeated safety-filter violations, and whether a generation request is blocked by our content-safety filter. These are rule-based checks; they do not use profiling models trained on your data. If a decision affects you, you may ask us to explain it, object to it, or have it reviewed by a person, by emailing service@gentoon.ai. We will respond within 15 days for an explanation and within 30 days for a human review.

3. Retention and Use Periods

The Company destroys personal information without delay once the purpose of processing has been fulfilled. However, where retention is required by applicable law, the information shall be securely stored for the prescribed period before destruction.

Where mandatory local law imposes a specific minimum retention period, we keep the relevant records for that period and no longer. Korea-specific statutory retention periods are set out in the Korean-language Policy for users in the Republic of Korea.

Projects, characters and art styles you create through a connected AI assistant are kept and deleted exactly like those you create on the web (“Member information” and the trash rules), and audit records of connecting and disconnecting (the app name and the permissions you granted) are part of the “Service activity records” above and are kept for 1 year. Security records created when reuse of an authorization code or token is detected and the related tokens are revoked (the app name and the number of tokens revoked) are kept to deal with misuse and are excluded from that 1-year deletion.

4. Provision of Personal Information to Third Parties

The Company does not provide personal information to third parties without the user's consent. However, the minimum necessary information is shared with the following parties for the purpose of providing the Service.

Personal information may also be disclosed where required by law, such as upon presentation of a warrant by investigative authorities.

Sharing with Meta Platforms, Inc. and TikTok Pte. Ltd. happens only if you connect the corresponding social account, and we ask for separate consent that is not bundled with sign-up. You can use every other part of the Service without giving it, and you can withdraw it at any time from the connection screen.

Information is shared with an AI assistant provider only if you connect GenToon to that assistant yourself, and only after you review the permissions that assistant requests on GenToon's own connection page and allow them. What is shared is limited to the results of the GenToon features you run in that assistant; your email address, password and payment details are never shared. How that assistant stores and uses the information is governed by its provider's policy, which the Company does not control. You can use every other part of the Service without connecting, and you can disconnect at any time in Settings › Connected apps to stop any further sharing (Section 20).

5. Entrustment of Personal Information Processing

We entrust the processing of personal information to the following processors in order to operate the Service. Each processor acts only on our instructions and only within the scope of the entrusted work; this is distinct from the disclosures to third parties described in Section 4.

International Data Transfers

We transfer personal information outside the Republic of Korea to the extent necessary to provide the Service. Under Article 28-8(1)3 of the Korean Personal Information Protection Act these transfers are entrustment and storage necessary to perform our contract with you and to improve your experience, and we disclose the details below as that Article requires. Our own AI generation servers run in the Seoul region of the Republic of Korea and are therefore not an overseas transfer, and Korean card payments (Toss Payments) are processed domestically.

Your Rights

Depending on where you live, applicable data-protection law gives you rights over your personal data. Where the GDPR or UK GDPR applies to you, you have the right to:

• Access the personal data we hold about you and obtain a copy.
• Rectify inaccurate or incomplete data.
• Erase your data (“right to be forgotten”), subject to legal retention obligations.
• Restrict processing in certain circumstances.
• Object to processing based on our legitimate interests, and to object to direct marketing at any time.
• Data portability — receive the data you provided to us in a structured, commonly used, machine-readable format, and have it transmitted to another controller where technically feasible.
• Withdraw consent at any time, where processing is based on consent, without affecting the lawfulness of processing before withdrawal.

You can exercise most of these rights directly under Settings > My Account, or by emailing service@gentoon.ai. We will respond without undue delay and within one month of receiving your request; this period may be extended by up to two further months where the request is complex or numerous, in which case we will inform you. We do not charge a fee for a reasonable request, and we verify your identity using your account before acting on a request.

You also have the right to lodge a complaint with your local data-protection supervisory authority (for example, your national authority in the EEA, or the UK Information Commissioner's Office at ico.org.uk). We would, however, appreciate the chance to address your concern first. Additional rights for California and other U.S. state residents are set out in the “Your U.S. State Privacy Rights” section below.

8. Destruction of Personal Information

1. Personal information shall be destroyed without delay once the retention period has expired or the processing purpose has been achieved.
2. Electronic files: Permanently deleted using methods that prevent recovery.
3. Paper documents: Shredded or incinerated.
4. Account deletion is processed in the following stages.
   • Immediately on deletion — your name, email address, nickname, profile photo, and bio are irreversibly anonymised, and your login account is removed so that you can no longer sign in. Your personal projects are moved to trash.
   • 30 days after deletion — projects, generated images, and uploaded files are permanently erased from storage, and the account identifiers on payment records are removed. The transaction records themselves are kept in de-identified form for the period required by Korean e-commerce law, as set out in Section 3.
   • Connected social accounts — when you disconnect an account we destroy its access token immediately, cancel any posts scheduled at that moment, and ask the platform (Meta, TikTok) to revoke the permissions you granted us. The account identifier, handle and your past publishing records stay in your account so you can see what was published, and are destroyed together with the token when you delete your account. Records of your consent and its withdrawal are retained as evidence that consent was obtained.
   • What remains, anonymised — posts and comments you made in the community stay visible so that other people's conversations remain intelligible, attributed to “Deleted user”; a stripped account record is retained solely to keep those posts attached. Projects you shared into a workspace remain with that workspace for its other members. If you want these removed, delete them before closing your account or email service@gentoon.ai.

9. Use of Cookies

The Company uses the following cookies:

The analytics cookies listed above are set automatically as soon as a page loads. We do not display a consent banner beforehand, and we do not currently detect or act on Global Privacy Control (GPC) or Do Not Track signals — see “Legal Bases for Processing” above. You may refuse the storage of cookies through your web browser settings. However, blocking cookies may restrict your ability to use certain features, such as logging in, and on its own it does not stop analytics collection; to stop collection, email service@gentoon.ai.

10. Measures to Ensure the Security of Personal Information

The Company implements the following measures in accordance with applicable data protection laws:

1. Access control. Access to personal information is restricted to the minimum number of authorized personnel, and administrator accounts are managed via UUID-based whitelisting.
2. Encryption. Passwords are stored using one-way hashing, and payment card information is processed by Polar in compliance with PCI-DSS standards. All communications are encrypted using TLS (HTTPS).
3. Security headers. Security headers including HSTS, CSP, and X-Frame-Options are applied to prevent web-based attacks.
4. Access restrictions. CSRF tokens, API rate limiting, and IP-based anomalous access blocking are implemented.
5. Monitoring. Real-time error detection and security event monitoring are performed through Sentry.

Children's Privacy

The Service is not directed to children. You must meet the minimum age required to use online services in your country: at least 13 years old in the United States, and at least the age of digital consent in your country in the EEA and the UK (16, unless your country sets a lower age of 13, 14, or 15). Where applicable law requires it, a parent or guardian must provide or authorise consent. If we learn that we have collected personal data from a child below the applicable age without the required consent, we will delete the account and the data without undue delay. If you believe a child has provided us with personal data, contact service@gentoon.ai.

How to Contact Us About Your Data

For any privacy question, to exercise your rights, or to raise a concern, contact our data-protection officer, who also receives access requests and complaints. Under the Korean Personal Information Protection Act this role is held by the representative of the business.

Name

Kim Joong Hwi

Position

Representative, Fairrium

Phone

+82-70-4571-4025

Email

service@gentoon.ai

Users in the Republic of Korea may also apply, free of charge, to the Personal Information Dispute Mediation Committee (www.kopico.go.kr, 1833-6972) or report to the Personal Information Infringement Report Center (privacy.kisa.or.kr, 118) if a request is refused or you disagree with how it was handled.

GenToon does not currently maintain a permanent establishment in the EEA or the UK. If we are required to appoint a representative under Article 27 of the GDPR or UK GDPR, we will update this Policy with their details. In the meantime, EEA, UK, and Swiss users may direct all data-protection requests to service@gentoon.ai, which we monitor as our primary data-protection channel.

Lodging a Complaint

You have the right to lodge a complaint with the data-protection supervisory authority in your country or state of residence. For users in the EEA, this is your national Data Protection Authority; in the UK, the Information Commissioner's Office (ICO) at ico.org.uk; in California, the California Privacy Protection Agency or the California Attorney General. You may also contact us first at service@gentoon.ai and we will work to resolve your concern.

Your U.S. State Privacy Rights (California and Other States)

If you are a resident of California or another U.S. state with a comprehensive privacy law, you may have the right to know what personal information we collect and how we use it, to access and delete your personal information, to correct inaccurate information, to limit the use of sensitive personal information, and to opt out of the “sale” or “sharing” of personal information and of targeted advertising.

We do not sell your personal information for money. We do not knowingly “sell” or “share” personal information as those terms are defined under the California Consumer Privacy Act (CCPA), as amended by the CPRA, except that our use of analytics cookies and identifiers (Google Analytics, Microsoft Clarity, PostHog) may be considered “sharing” for cross-context behavioural advertising purposes under California law. To opt out of these analytics cookies, email service@gentoon.ai. We do not currently detect or act on Global Privacy Control (GPC) or Do Not Track signals sent by your browser; sending one will have no effect today. We will update this Policy if and when we implement signal-based opt-out.

We do not sell or share the personal information of consumers we know to be under 16. We will not discriminate against you for exercising any of these rights. To exercise your U.S. state privacy rights, or to opt out, email service@gentoon.ai with the subject line “U.S. Privacy Request” (or “Do Not Sell or Share”); we will verify your request using your account before responding. You may use an authorized agent to submit a request on your behalf. We will respond within the time required by law (generally 45 days, extendable once where permitted).

14. Changes to This Policy

1. This Privacy Policy may be amended due to changes in applicable laws, regulations, or internal policies of the Company.
2. Any amendments will be announced within the Service at least 7 days prior to the effective date of the change.
3. This Policy has been in effect since January 1, 2025. The revision dated May 9, 2026 takes effect on the same date. The revision dated August 1, 2026 (adding Alibaba Cloud and OpenAI as AI processors) takes effect on the same date. The revision dated August 7, 2026 (adding PostHog, Inc. as a product-analytics processor and disclosing the resulting transfer to the European Union) takes effect on the same date. The revision dated September 1, 2026 (social publishing — new collected categories, third-party sharing with and international transfers to Meta Platforms, Inc. in the United States and TikTok Pte. Ltd. in Singapore, and destruction of connection data — the access token on disconnect, everything on account deletion) takes effect on September 8, 2026, seven days after it was posted, in line with paragraph 2 above. The revision dated September 6, 2026 (per-post performance metrics — adding the metrics of published posts to the categories collected, and adding the reading of those metrics to the purpose of sharing with and transferring to Meta Platforms, Inc.) takes effect on September 13, 2026 under the same paragraph.
4. The revision dated September 24, 2026 (connected AI assistants (MCP connector) — new collected categories, collection method and purpose; retention periods for connection records, the connector's session and connector tokens; third-party sharing with and international transfers to the provider of the AI assistant you connect (such as OpenAI, L.L.C., Anthropic, PBC and Anysphere, Inc.); text generation (studio assistant chat and scenarios) added to the work entrusted to OpenAI, L.L.C. and Google; new Section 20) takes effect on the same date. It describes processing that already takes place in the connector feature the Service already offers and specifies the troubleshooting records the Company keeps, and it neither restricts your rights nor adds obligations, so, like the revisions of August 1 and August 7, 2026, it takes effect when posted.

15. سياسة الاحتفاظ بالرسائل

تطبق الشركة فترات احتفاظ متباينة بحسب نوع الرسائل المتبادلة داخل الخدمة.

16. التعاون مع جهات إنفاذ القانون والجهات الحكومية

تلتزم الشركة بحماية المعلومات الشخصية للمستخدمين؛ غير أنه في حال تقديم جهة حكومية طلباً مشروعاً وفق الإجراءات القانونية الواجبة، ستتعاون الشركة ضمن نطاق ما يسمح به القانون المعمول به.

17. تحليلات استخدام المنتج (PostHog)

نستخدم PostHog، وهي أداة لتحليلات المنتج، على موقع GenToon الإلكتروني وتطبيق الهاتف المحمول لفهم كيفية استخدام الخدمة وتحسينها. تعالج PostHog هذه البيانات على خوادم تقع في الاتحاد الأوروبي (فرانكفورت، ألمانيا)، ولذلك يُعد ما يلي نقلاً دولياً للبيانات الشخصية.

18. تحويل صورة ملفك الشخصي إلى شخصية ويبتون

عند تحويل محادثة إلى ويبتون، تُستخدم صورة ملفك الشخصي لتحويلها إلى شخصية بأسلوب الويبتون (تحويل أسلوبي). ولا يُستخدم ذلك للتعرّف على هويتك ولا لاستخراج بيانات حيوية (بيومترية) أو تخزينها أو مطابقتها. وفي أثناء هذه العملية تحفظ الشركة صورة الشخصية الناتجة عن التحويل، والنص الواصف للمظهر الذي استخرجه الذكاء الاصطناعي من أجل توليدها، وعنوان (رابط) صورة الملف الشخصي وقت الإنشاء؛ ويُعاد استخدام هذه العناصر كلما أُعيد رسم الشخصية نفسها. وفي حال عدم وجود صورة ملف شخصي أو فشل التحويل، تُستخدم شخصية افتراضية بدلاً منها. ونحصل داخل الخدمة على موافقة منفصلة لكلٍّ من: تحليل صورة تتضمن وجهاً، وإرسال رسائل المشاركين الآخرين إلى الذكاء الاصطناعي عند تحويل محادثة جماعية إلى ويبتون. ويمكنك في أي وقت إيقاف هذا الاستخدام بتغيير صورة ملفك الشخصي أو حذفها، أو بمراسلتنا على service@gentoon.ai لطلب حذف صورة الشخصية المحفوظة ووصف المظهر المحفوظ.

20. Connected AI Assistants (MCP Connector)

Section numbers follow the Korean-language version of this Policy.

1. (1) You can connect GenToon to an AI assistant such as ChatGPT or Claude through the Model Context Protocol (MCP), at https://www.gentoon.ai/api/mcp, and, inside it, set up, write and draw webtoons, look up your saved characters and projects, and export, share or publish the results. A connection is made when you review the permissions the AI assistant requests (view, create, publish) on GenToon's own sign-in and consent page and allow them. The Company never gives your password to the AI assistant.
2. (2) What the Company keeps. The connected app's name, identifier and return address; the permissions you granted; when the connection was made, last used and revoked; the connector's own sign-in session (stored encrypted and deleted as soon as the connection ends); authorization codes and access and refresh tokens (one-way hashes only); audit records of connecting and disconnecting (the app name and the permissions you granted — kept for 1 year as Service activity records, Section 3); and tool-call records for troubleshooting (the feature used, how long it took and whether it succeeded or its error code, the first part of the project identifier, whether it was called from a card view, the first 40 characters of the app name, version, operating system, device model and similar information the AI assistant reports, and a one-way hash of the assistant's conversation identifier). Tool-call records do not contain what you asked for; they are kept not in our database but in the operating logs of our hosting provider (Vercel Inc.) and are deleted when that operating-log retention period ends (at most 30 days). What the AI assistant sends (story topics, dialogue, edit instructions, character descriptions, photos you chose to send and so on) is saved as your projects, characters and art styles and is handled like anything you create on the web.
3. (3) What is passed to the AI assistant. The items listed for “the provider of the AI assistant you connected GenToon to” in Section 4. Your email address, password and payment details are never passed. How the assistant stores and uses that information is governed by its provider's policy (for example OpenAI, L.L.C. for ChatGPT and Codex, Anthropic, PBC for Claude and Claude Code, and Anysphere, Inc. for Cursor). The Company does not request or collect your conversation with the AI assistant; it processes only what the assistant sends to GenToon. Generated images, and photos you send through the connector, are stored at their own addresses (photos never used to create a character or art style are deleted after the period in Section 3), and anyone who has an address can open that image without signing in (the same as images you create on the web).
4. (4) Creating through the connector uses the same credits as on the web, and no payment takes place inside the connector.
5. (5) You can disconnect at any time in Settings › Connected apps. Disconnecting invalidates that connection's tokens immediately and ends and deletes the connector's session, and the connection record is destroyed 30 days later. Each device or app has its own connection, so disconnecting one leaves the others in place; disconnecting every connection listed in Connected apps ends them all. A connection older than 24 hours with no valid token left, and a connection whose connector sign-in session can no longer be renewed, are disconnected automatically, and deleting your account disconnects every connection (retention periods in Section 3).