Privacy Policy

Fairium (“GenToon”, “we”, “us”, or “the Company”) provides the GenToon service (the “Service”) and is the controller of personal data processed through it. This Privacy Policy explains what personal data we collect, why and on what legal basis we process it, who we share it with, how long we keep it, how we transfer it internationally, and the rights you have over your data.

For users in the European Economic Area (EEA), the United Kingdom, and Switzerland, we process personal data in accordance with the EU General Data Protection Regulation (GDPR) and the UK GDPR. For users in California and other U.S. states with applicable privacy laws, the disclosures in the “Your U.S. State Privacy Rights” section apply. Country-specific provisions required under Korean law apply only to users in the Republic of Korea and are set out separately below. If you have any question about this Policy or wish to exercise your rights, contact us at service@gentoon.ai.

1. Categories of Personal Information Collected and Methods of Collection

A. Categories Collected

We do not collect sensitive information such as beliefs, health or sex life. The resident registration number, a unique identifier under Korean law, is collected only for the affiliate settlement purpose above, only where the law requires it, and only with separate consent.

B. Methods of Collection

• Direct input during sign-up and use of the website and mobile app
• Social login via Google, Apple or Kakao OAuth
• Account details supplied by the platform (Meta, TikTok) when you connect a social account
• Automatic collection during payment through Polar, Toss Payments or app store in-app purchase
• Automatic generation and collection through cookies, local storage and access logs during service use
• Automatic transmission by the analytics SDKs installed in the web and mobile app (Sections 9 and 17)
• Collection during enquiries made by email, the Help page or the business enquiry form

2. Purposes of Processing Personal Information

1. Member management. Identity verification, prevention of unauthorized use, complaint resolution, and delivery of notices
2. Service provision. AI image and script generation, project storage, character management, and community operation
3. Payment and billing. Subscription payments, credit purchases, refunds, and issuance of tax receipts and invoices
4. Service improvement. Usage statistics and product-usage analysis (Google Analytics, Microsoft Clarity, PostHog), error detection (Sentry), and service quality enhancement
5. Affiliate partner settlement. Paying referral earnings and filing withholding tax and payment statements
6. Business production enquiries. Receiving and answering enquiries, concluding and performing contracts
7. Marketing (optional). Event and benefit notifications (only with prior consent)

Legal Bases for Processing (EEA / UK Users)

Where the GDPR or UK GDPR applies, we rely on the following legal bases:

• Performance of a contract (Art. 6(1)(b)). To create and maintain your account, provide AI generation, project storage, character management, the community, and to process payments, subscriptions, credit purchases, and refunds. Without this data we cannot provide the Service.
• Legitimate interests (Art. 6(1)(f)). To secure the Service against fraud and abuse, detect and fix errors, maintain access and audit logs, analyse aggregate usage to improve the Service, and to enforce our Terms. We balance these interests against your rights and you may object as described in the “Your Rights” section.
• Consent (Art. 6(1)(a)). For optional marketing communications, which you opt into separately. You may withdraw consent at any time without affecting prior processing.
• Legal obligation (Art. 6(1)(c)). To retain transaction and tax records and to respond to lawful requests, where mandatory law requires it.

We do not use your prompts, uploaded reference images, or generated outputs to train AI models. Our AI processors (Google Gemini, Alibaba Model Studio, OpenAI) do not use data sent through paid API calls to train their models, and we do not build a training dataset of our own.

Some decisions in the Service are made automatically, without a human reviewing them individually: whether a referral reward is granted, whether chat access is temporarily suspended after repeated safety-filter violations, and whether a generation request is blocked by our content-safety filter. These are rule-based checks; they do not use profiling models trained on your data. If a decision affects you, you may ask us to explain it, object to it, or have it reviewed by a person, by emailing service@gentoon.ai. We will respond within 15 days for an explanation and within 30 days for a human review.

3. Retention and Use Periods

The Company destroys personal information without delay once the purpose of processing has been fulfilled. However, where retention is required by applicable law, the information shall be securely stored for the prescribed period before destruction.

Where mandatory local law imposes a specific minimum retention period, we keep the relevant records for that period and no longer. Korea-specific statutory retention periods are set out in the Korean-language Policy for users in the Republic of Korea.

4. Provision of Personal Information to Third Parties

The Company does not provide personal information to third parties without the user's consent. However, the minimum necessary information is shared with the following parties for the purpose of providing the Service.

Personal information may also be disclosed where required by law, such as upon presentation of a warrant by investigative authorities.

Sharing with Meta Platforms, Inc. and TikTok Pte. Ltd. happens only if you connect the corresponding social account, and we ask for separate consent that is not bundled with sign-up. You can use every other part of the Service without giving it, and you can withdraw it at any time from the connection screen.

5. Entrustment of Personal Information Processing

We entrust the processing of personal information to the following processors in order to operate the Service. Each processor acts only on our instructions and only within the scope of the entrusted work; this is distinct from the disclosures to third parties described in Section 4.

International Data Transfers

We transfer personal information outside the Republic of Korea to the extent necessary to provide the Service. Under Article 28-8(1)3 of the Korean Personal Information Protection Act these transfers are entrustment and storage necessary to perform our contract with you and to improve your experience, and we disclose the details below as that Article requires. Our own AI generation servers run in the Seoul region of the Republic of Korea and are therefore not an overseas transfer, and Korean card payments (Toss Payments) are processed domestically.

Your Rights

Depending on where you live, applicable data-protection law gives you rights over your personal data. Where the GDPR or UK GDPR applies to you, you have the right to:

• Access the personal data we hold about you and obtain a copy.
• Rectify inaccurate or incomplete data.
• Erase your data (“right to be forgotten”), subject to legal retention obligations.
• Restrict processing in certain circumstances.
• Object to processing based on our legitimate interests, and to object to direct marketing at any time.
• Data portability — receive the data you provided to us in a structured, commonly used, machine-readable format, and have it transmitted to another controller where technically feasible.
• Withdraw consent at any time, where processing is based on consent, without affecting the lawfulness of processing before withdrawal.

You can exercise most of these rights directly under Settings > My Account, or by emailing service@gentoon.ai. We will respond without undue delay and within one month of receiving your request; this period may be extended by up to two further months where the request is complex or numerous, in which case we will inform you. We do not charge a fee for a reasonable request, and we verify your identity using your account before acting on a request.

You also have the right to lodge a complaint with your local data-protection supervisory authority (for example, your national authority in the EEA, or the UK Information Commissioner's Office at ico.org.uk). We would, however, appreciate the chance to address your concern first. Additional rights for California and other U.S. state residents are set out in the “Your U.S. State Privacy Rights” section below.

8. Destruction of Personal Information

1. Personal information shall be destroyed without delay once the retention period has expired or the processing purpose has been achieved.
2. Electronic files: Permanently deleted using methods that prevent recovery.
3. Paper documents: Shredded or incinerated.
4. Account deletion is processed in the following stages.
   • Immediately on deletion — your name, email address, nickname, profile photo, and bio are irreversibly anonymised, and your login account is removed so that you can no longer sign in. Your personal projects are moved to trash.
   • 30 days after deletion — projects, generated images, and uploaded files are permanently erased from storage, and the account identifiers on payment records are removed. The transaction records themselves are kept in de-identified form for the period required by Korean e-commerce law, as set out in Section 3.
   • Connected social accounts — when you disconnect an account we destroy its access token immediately, cancel any posts scheduled at that moment, and ask the platform (Meta, TikTok) to revoke the permissions you granted us. The account identifier, handle and your past publishing records stay in your account so you can see what was published, and are destroyed together with the token when you delete your account. Records of your consent and its withdrawal are retained as evidence that consent was obtained.
   • What remains, anonymised — posts and comments you made in the community stay visible so that other people's conversations remain intelligible, attributed to “Deleted user”; a stripped account record is retained solely to keep those posts attached. Projects you shared into a workspace remain with that workspace for its other members. If you want these removed, delete them before closing your account or email service@gentoon.ai.

9. Use of Cookies

The Company uses the following cookies:

The analytics cookies listed above are set automatically as soon as a page loads. We do not display a consent banner beforehand, and we do not currently detect or act on Global Privacy Control (GPC) or Do Not Track signals — see “Legal Bases for Processing” above. You may refuse the storage of cookies through your web browser settings. However, blocking cookies may restrict your ability to use certain features, such as logging in, and on its own it does not stop analytics collection; to stop collection, email service@gentoon.ai.

10. Measures to Ensure the Security of Personal Information

The Company implements the following measures in accordance with applicable data protection laws:

1. Access control. Access to personal information is restricted to the minimum number of authorized personnel, and administrator accounts are managed via UUID-based whitelisting.
2. Encryption. Passwords are stored using one-way hashing, and payment card information is processed by Polar in compliance with PCI-DSS standards. All communications are encrypted using TLS (HTTPS).
3. Security headers. Security headers including HSTS, CSP, and X-Frame-Options are applied to prevent web-based attacks.
4. Access restrictions. CSRF tokens, API rate limiting, and IP-based anomalous access blocking are implemented.
5. Monitoring. Real-time error detection and security event monitoring are performed through Sentry.

Children's Privacy

The Service is not directed to children. You must meet the minimum age required to use online services in your country: at least 13 years old in the United States, and at least the age of digital consent in your country in the EEA and the UK (16, unless your country sets a lower age of 13, 14, or 15). Where applicable law requires it, a parent or guardian must provide or authorise consent. If we learn that we have collected personal data from a child below the applicable age without the required consent, we will delete the account and the data without undue delay. If you believe a child has provided us with personal data, contact service@gentoon.ai.

How to Contact Us About Your Data

For any privacy question, to exercise your rights, or to raise a concern, contact our data-protection officer, who also receives access requests and complaints. Under the Korean Personal Information Protection Act this role is held by the representative of the business.

Name

Junghwi Kim

Position

Representative, Fairium

Phone

+82-70-4571-4025

Email

service@gentoon.ai

Users in the Republic of Korea may also apply, free of charge, to the Personal Information Dispute Mediation Committee (www.kopico.go.kr, 1833-6972) or report to the Personal Information Infringement Report Center (privacy.kisa.or.kr, 118) if a request is refused or you disagree with how it was handled.

GenToon does not currently maintain a permanent establishment in the EEA or the UK. If we are required to appoint a representative under Article 27 of the GDPR or UK GDPR, we will update this Policy with their details. In the meantime, EEA, UK, and Swiss users may direct all data-protection requests to service@gentoon.ai, which we monitor as our primary data-protection channel.

Lodging a Complaint

You have the right to lodge a complaint with the data-protection supervisory authority in your country or state of residence. For users in the EEA, this is your national Data Protection Authority; in the UK, the Information Commissioner's Office (ICO) at ico.org.uk; in California, the California Privacy Protection Agency or the California Attorney General. You may also contact us first at service@gentoon.ai and we will work to resolve your concern.

Your U.S. State Privacy Rights (California and Other States)

If you are a resident of California or another U.S. state with a comprehensive privacy law, you may have the right to know what personal information we collect and how we use it, to access and delete your personal information, to correct inaccurate information, to limit the use of sensitive personal information, and to opt out of the “sale” or “sharing” of personal information and of targeted advertising.

We do not sell your personal information for money. We do not knowingly “sell” or “share” personal information as those terms are defined under the California Consumer Privacy Act (CCPA), as amended by the CPRA, except that our use of analytics cookies and identifiers (Google Analytics, Microsoft Clarity, PostHog) may be considered “sharing” for cross-context behavioural advertising purposes under California law. To opt out of these analytics cookies, email service@gentoon.ai. We do not currently detect or act on Global Privacy Control (GPC) or Do Not Track signals sent by your browser; sending one will have no effect today. We will update this Policy if and when we implement signal-based opt-out.

We do not sell or share the personal information of consumers we know to be under 16. We will not discriminate against you for exercising any of these rights. To exercise your U.S. state privacy rights, or to opt out, email service@gentoon.ai with the subject line “U.S. Privacy Request” (or “Do Not Sell or Share”); we will verify your request using your account before responding. You may use an authorized agent to submit a request on your behalf. We will respond within the time required by law (generally 45 days, extendable once where permitted).

14. Changes to This Policy

1. This Privacy Policy may be amended due to changes in applicable laws, regulations, or internal policies of the Company.
2. Any amendments will be announced within the Service at least 7 days prior to the effective date of the change.
3. This Policy has been in effect since January 1, 2025. The revision dated May 9, 2026 takes effect on the same date. The revision dated August 7, 2026 (adding PostHog, Inc. as a product-analytics processor and disclosing the resulting transfer to the European Union) takes effect on the same date. The revision dated September 1, 2026 (social publishing — new collected categories, third-party sharing with and international transfers to Meta Platforms, Inc. in the United States and TikTok Pte. Ltd. in Singapore, and destruction of connection data — the access token on disconnect, everything on account deletion) takes effect on September 8, 2026, seven days after it was posted, in line with paragraph 2 above. The revision dated September 6, 2026 (per-post performance metrics — adding the metrics of published posts to the categories collected, and adding the reading of those metrics to the purpose of sharing with and transferring to Meta Platforms, Inc.) takes effect on September 13, 2026 under the same paragraph.

১৫. মেসেজ সংরক্ষণ নীতি

সার্ভিসের মধ্যে আদান-প্রদান করা মেসেজের ধরন অনুযায়ী কোম্পানি ভিন্ন ভিন্ন সংরক্ষণ মেয়াদ প্রয়োগ করে।

১৬. আইন প্রয়োগকারী ও সরকারি কর্তৃপক্ষের সাথে সহযোগিতা

কোম্পানি ব্যবহারকারীদের ব্যক্তিগত তথ্য সুরক্ষায় প্রতিশ্রুতিবদ্ধ; তবে কোনো সরকারি কর্তৃপক্ষ যথাযথ প্রক্রিয়া অনুসরণ করে বৈধ অনুরোধ জমা দিলে, কোম্পানি প্রযোজ্য আইনে অনুমোদিত সীমার মধ্যে সহযোগিতা করবে।

১৭. পণ্য ব্যবহারের বিশ্লেষণ (PostHog)

সেবাটি কীভাবে ব্যবহৃত হয় তা বোঝা ও উন্নত করার জন্য আমরা GenToon-এর ওয়েবসাইট ও মোবাইল অ্যাপে পণ্য বিশ্লেষণের সরঞ্জাম PostHog ব্যবহার করি। PostHog এই তথ্য ইউরোপীয় ইউনিয়নে (ফ্রাঙ্কফুর্ট, জার্মানি) অবস্থিত সার্ভারে প্রক্রিয়া করে, তাই নিচের বিষয়টি ব্যক্তিগত তথ্যের আন্তর্জাতিক স্থানান্তর।

১৮. আপনার প্রোফাইল ছবি ওয়েবটুন চরিত্রে রূপান্তর

আপনি যখন কোনো কথোপকথনকে ওয়েবটুনে রূপান্তর করেন, তখন আপনার প্রোফাইল ছবি ওয়েবটুন-স্টাইলের চরিত্র তৈরি করতে (স্টাইলাইজেশন) ব্যবহৃত হয়। এটি আপনাকে শনাক্ত করার জন্য কিংবা বায়োমেট্রিক তথ্য নিষ্কাশন, সংরক্ষণ বা মিলানোর উদ্দেশ্যে নয়। এই প্রক্রিয়ায় কোম্পানি তৈরি হওয়া চরিত্রের ছবি, সেটি আঁকার জন্য এআই যে সংক্ষিপ্ত অবয়ব-বর্ণনার লেখাটি নিষ্কাশন করেছে, এবং তৈরির সময়কার প্রোফাইল ছবির ঠিকানা (URL) সংরক্ষণ করে; একই চরিত্র আবার আঁকার সময় এগুলো পুনরায় ব্যবহার করা হয়। প্রোফাইল ছবি না থাকলে বা রূপান্তর ব্যর্থ হলে তার বদলে একটি ডিফল্ট চরিত্র ব্যবহার করা হয়। মুখমণ্ডলসহ ছবির বিশ্লেষণের জন্য এবং গ্রুপ কথোপকথন ওয়েবটুনে রূপান্তরের সময় অন্য অংশগ্রহণকারীদের বার্তা এআই-এ পাঠানোর জন্য পরিষেবার ভেতরেই এগুলোর প্রতিটির ক্ষেত্রে আলাদা আলাদা সম্মতি নেওয়া হয়। আপনি যেকোনো সময় প্রোফাইল ছবি পরিবর্তন বা মুছে, অথবা service@gentoon.ai ঠিকানায় অনুরোধ পাঠিয়ে এই ব্যবহার বন্ধ করতে এবং সংরক্ষিত চরিত্রের ছবি ও অবয়ব-বর্ণনা মুছে ফেলার দাবি জানাতে পারেন।