Privacy Policy

Fairrium (“GenToon”, “we”, “us”, or “the Company”) provides the GenToon service (the “Service”) and is the controller of personal data processed through it. This Privacy Policy explains what personal data we collect, why and on what legal basis we process it, who we share it with, how long we keep it, how we transfer it internationally, and the rights you have over your data.

For users in the European Economic Area (EEA), the United Kingdom, and Switzerland, we process personal data in accordance with the EU General Data Protection Regulation (GDPR) and the UK GDPR. For users in California and other U.S. states with applicable privacy laws, the disclosures in the “Your U.S. State Privacy Rights” section apply. Country-specific provisions required under Korean law apply only to users in the Republic of Korea and are set out separately below. If you have any question about this Policy or wish to exercise your rights, contact us at service@gentoon.ai.

1. Categories of Personal Information Collected and Methods of Collection

A. Categories Collected

We do not collect sensitive information such as beliefs, health or sex life. The resident registration number, a unique identifier under Korean law, is collected only for the affiliate settlement and creator payout purposes above and only where the law requires it: for affiliates with separate consent, and for creators living in Korea, under the tax-withholding duty in the Korean Income Tax Act and Article 68(3) of the Enforcement Decree of the Framework Act on National Taxes, only when they first convert earnings to credits or ask for a bank payout (Section 24).

B. Methods of Collection

• Direct input during sign-up and use of the website and mobile app
• Social login via Google, Apple or Kakao OAuth
• Account details supplied by the platform (Meta, TikTok) when you connect a social account
• What an AI assistant (such as ChatGPT or Claude) sends when you connect GenToon to it and use GenToon features there
• Automatic collection during payment through Polar, Toss Payments or app store in-app purchase
• Automatic generation and collection through cookies, local storage and access logs during service use
• Automatic transmission by the analytics SDKs installed in the web and mobile app (Sections 9 and 17)
• Collection during enquiries made by email, the Help page or the business enquiry form

2. Purposes of Processing Personal Information

1. Member management. Identity verification, prevention of unauthorized use, complaint resolution, and delivery of notices
2. Service provision. AI image and script generation, project storage, character management, and community operation
3. Connected AI assistants. Carrying out what you ask for in an AI assistant you connected (setting up, writing, drawing, viewing, exporting, sharing and publishing webtoons), managing the connection and preventing misuse
4. Payment and billing. Subscription payments, credit purchases, refunds, and issuance of tax receipts and invoices
5. Service improvement. Usage statistics and product-usage analysis (Google Analytics, Microsoft Clarity, PostHog), sign-up source measurement (which search, ad or link led to sign-up), error detection (Sentry), and service quality enhancement
6. Affiliate partner settlement. Paying referral earnings and filing withholding tax and payment statements
7. Series reading and subscriptions. Continue reading and read marks, next-episode suggestions, new-episode alerts (for series you subscribe to and series you recently read), series rankings and detection of inflated read counts (Section 22)
8. Cheers. Age checks (19 or older), cheer payments and daily and monthly payment limits, handling reports about cheer messages (Section 23)
9. Creator earnings and payouts. Settling the creator share of cheer and ad revenue, converting earnings to credits and paying to bank accounts, tax withholding and payment statements, and checking account holders (Section 24)
10. App advertising. Serving and measuring ads in the mobile app, and verifying rewarded-ad rewards (credits and cheer stickers) (Section 21)
11. Community comment translation. Translating comments when you tap “Translate”, and automatic translation of other-language comments on a creator's own post (Section 25)
12. Local-time scheduling. Using your device or browser time zone to send notifications and emails at a suitable local time (including not sending promotional messages at night), to set the dates of rewards that follow your local day (such as the second-day gift and weekly goals), and to read the times of your activity correctly when we investigate a service problem
13. Goods sales. Taking orders and confirming payment, sending orders to production and shipping partners and tracking delivery, withdrawals, exchanges and refunds, handling payment disputes and fraudulent payments, order emails, and settling the creator's design fee (Section 26)
14. Additional processing for goods sales. Refusing orders from people under 14 and informing buyers who are minors, counting goods sold through creators' share links by channel, showing sales without identifying buyers and ranking sales, and purchase cards (Section 27)
15. Credit cheers. Moving credits and posting cheer comments, daily limits, credit history, and preventing credits from being moved between several accounts of the same person (Section 28)
16. Business production enquiries. Receiving and answering enquiries, concluding and performing contracts
17. Marketing (optional). Event and benefit notifications (only with prior consent)

Legal Bases for Processing (EEA / UK Users)

Where the GDPR or UK GDPR applies, we rely on the following legal bases:

• Performance of a contract (Art. 6(1)(b)). To create and maintain your account, provide AI generation, project storage, character management, the community, and to process payments, subscriptions, credit purchases, and refunds. Without this data we cannot provide the Service.
• Legitimate interests (Art. 6(1)(f)). To secure the Service against fraud and abuse, detect and fix errors, maintain access and audit logs, analyse aggregate usage to improve the Service, and to enforce our Terms. We balance these interests against your rights and you may object as described in the “Your Rights” section.
• Consent (Art. 6(1)(a)). For optional marketing communications, which you opt into separately, for new-episode emails, which you opt into separately when you subscribe to a series (Section 22), for app advertising where Google's consent tools apply (Section 21), and for connecting an AI assistant to GenToon (Section 20), which you allow on GenToon's own connection page. You may withdraw consent at any time without affecting prior processing, for example by unsubscribing from emails or, for a connected AI assistant, by disconnecting it in Settings › Connected apps.
• Legal obligation (Art. 6(1)(c)). To retain transaction and tax records, to withhold tax on creator earnings and file payment statements (Section 24), and to respond to lawful requests, where mandatory law requires it.

We do not use your prompts, uploaded reference images, or generated outputs to train AI models. Our AI processors (Google Gemini, Alibaba Model Studio, OpenAI) do not use data sent through paid API calls to train their models, and we do not build a training dataset of our own.

Some decisions in the Service are made automatically, without a human reviewing them individually: whether a referral reward is granted, whether chat access is temporarily suspended after repeated safety-filter violations, whether a generation request is blocked by our content-safety filter, whether a cheer payment is allowed (age checks, the creator's cheer setting, blocks, daily and monthly limits, which may add up several accounts used by one person, linked by sign-up network details and app device identifiers, and whether the sender and the creator appear to be the same person's accounts because they use the same app device or signed up from the same network on the same day), whether a cheer counts as earnings for the creator (it is handled as credits if hashes of the paying device, the payment request's network details or the card appear linked to the creator's own records, or if the creator does not yet meet the criteria), and whether a read counts toward creator ad revenue shares and series rankings (excluding the creator's own reads and reads that look inflated). These are rule-based checks; they do not use profiling models trained on your data. If a decision affects you, you may ask us to explain it, object to it, or have it reviewed by a person, by emailing service@gentoon.ai. We will respond within 15 days for an explanation and within 30 days for a human review.

3. Retention and Use Periods

The Company destroys personal information without delay once the purpose of processing has been fulfilled. However, where retention is required by applicable law, the information shall be securely stored for the prescribed period before destruction.

Where mandatory local law imposes a specific minimum retention period, we keep the relevant records for that period and no longer. Korea-specific statutory retention periods are set out in the Korean-language Policy for users in the Republic of Korea.

Projects, characters and art styles you create through a connected AI assistant are kept and deleted exactly like those you create on the web (“Member information” and the trash rules), and audit records of connecting and disconnecting (the app name and the permissions you granted) are part of the “Service activity records” above and are kept for 1 year. Security records created when reuse of an authorization code or token is detected and the related tokens are revoked (the app name and the number of tokens revoked) are kept to deal with misuse and are excluded from that 1-year deletion.

4. Provision of Personal Information to Third Parties

The Company does not provide personal information to third parties without the user's consent. However, the minimum necessary information is shared with the following parties for the purpose of providing the Service.

Personal information may also be disclosed where required by law, such as upon presentation of a warrant by investigative authorities.

For creator earnings we pay after withholding Korean tax, we file payment statements (name, resident registration number or, for creators outside Korea, the taxpayer identification number of their country of residence, amount paid, tax withheld and similar items) with the Korean National Tax Service as the Korean Income Tax Act requires (Section 24).

Sharing with Meta Platforms, Inc. and TikTok Pte. Ltd. happens only if you connect the corresponding social account, and we ask for separate consent that is not bundled with sign-up. You can use every other part of the Service without giving it, and you can withdraw it at any time from the connection screen.

Information is shared with an AI assistant provider only if you connect GenToon to that assistant yourself, and only after you review the permissions that assistant requests on GenToon's own connection page and allow them. What is shared is limited to the results of the GenToon features you run in that assistant; your email address, password and payment details are never shared. How that assistant stores and uses the information is governed by its provider's policy, which the Company does not control. You can use every other part of the Service without connecting, and you can disconnect at any time in Settings › Connected apps to stop any further sharing (Section 20).

5. Entrustment of Personal Information Processing

We entrust the processing of personal information to the following processors in order to operate the Service. Each processor acts only on our instructions and only within the scope of the entrusted work; this is distinct from the disclosures to third parties described in Section 4.

International Data Transfers

We transfer personal information outside the Republic of Korea to the extent necessary to provide the Service. Under Article 28-8(1)3 of the Korean Personal Information Protection Act these transfers are entrustment and storage necessary to perform our contract with you and to improve your experience, and we disclose the details below as that Article requires. Our own AI generation servers run in the Seoul region of the Republic of Korea and are therefore not an overseas transfer, and Korean card payments (Toss Payments) are processed domestically.

Your Rights

Depending on where you live, applicable data-protection law gives you rights over your personal data. Where the GDPR or UK GDPR applies to you, you have the right to:

• Access the personal data we hold about you and obtain a copy.
• Rectify inaccurate or incomplete data.
• Erase your data (“right to be forgotten”), subject to legal retention obligations.
• Restrict processing in certain circumstances.
• Object to processing based on our legitimate interests, and to object to direct marketing at any time.
• Data portability — receive the data you provided to us in a structured, commonly used, machine-readable format, and have it transmitted to another controller where technically feasible.
• Withdraw consent at any time, where processing is based on consent, without affecting the lawfulness of processing before withdrawal.

You can exercise most of these rights directly under Settings > My Account, or by emailing service@gentoon.ai. We will respond without undue delay and within one month of receiving your request; this period may be extended by up to two further months where the request is complex or numerous, in which case we will inform you. We do not charge a fee for a reasonable request, and we verify your identity using your account before acting on a request.

You also have the right to lodge a complaint with your local data-protection supervisory authority (for example, your national authority in the EEA, or the UK Information Commissioner's Office at ico.org.uk). We would, however, appreciate the chance to address your concern first. Additional rights for California and other U.S. state residents are set out in the “Your U.S. State Privacy Rights” section below.

8. Destruction of Personal Information

1. Personal information shall be destroyed without delay once the retention period has expired or the processing purpose has been achieved.
2. Electronic files: Permanently deleted using methods that prevent recovery.
3. Paper documents: Shredded or incinerated.
4. Account deletion is processed in the following stages.
   • Immediately on deletion — your name, email address, nickname, profile photo, and bio are irreversibly anonymised, and your login account is removed so that you can no longer sign in. Your personal projects are moved to trash.
   • 30 days after deletion — projects, generated images, and uploaded files are permanently erased from storage, sign-up source information (advertising and campaign link details and first-visit information) is erased, and the account identifiers on payment records are removed. The transaction records themselves are kept in de-identified form for the period required by Korean e-commerce law, as set out in Section 3.
   • Connected social accounts — when you disconnect an account we destroy its access token immediately, cancel any posts scheduled at that moment, and ask the platform (Meta, TikTok) to revoke the permissions you granted us. The account identifier, handle and your past publishing records stay in your account so you can see what was published, and are destroyed together with the token when you delete your account. Records of your consent and its withdrawal are retained as evidence that consent was obtained.
   • Browser notifications. When you ask to delete your account we turn off that account's browser notification subscriptions at once, and turned-off subscriptions are deleted after 30 days. The delivery records we keep for all notifications (notification type, time sent and result) are deleted 90 days after sending.
   • Series reading, cheers and creator data. 30 days after you delete your account we erase your reading history and reading positions, series subscriptions, new-episode email consent (except the history of agreeing and withdrawing), records of new-episode alerts we sent, cheer settings, the device identifier and card hashes on cheer payment records and the device details kept for push notifications, and we remove your identifier from read-inflation records or delete those records. Cheer messages may remain anonymised as “Deleted user”, like the community posts and comments below. Creator payout details are handled as described in Section 24, and app advertising records are erased as soon as you ask to delete your account (Section 21).
   • Goods orders. 30 days after you delete your account we erase the orderer's email, contact number, shipping address, delivery note, nickname, IP address and browser information from completed goods orders. For orders that were paid, however, we keep the information needed to identify the parties to the transaction (name, address and email) and the reasons given for refund or exchange requests separately from other data, as Article 6(3) of the Korean E-Commerce Act allows, and destroy them without delay when the legal retention period ends (5 years for transaction records, 3 years for complaint and dispute records). We use that separately kept information only for disputes or requests made under law. Orders still in production, shipping or refund are handled the same way once that process ends, and transaction records such as the order number, amount, payment time and destination country are kept for the retention period in a form that does not identify you.
   • What remains, anonymised — posts and comments you made in the community stay visible so that other people's conversations remain intelligible, attributed to “Deleted user”; a stripped account record is retained solely to keep those posts attached. Projects you shared into a workspace remain with that workspace for its other members. If you want these removed, delete them before closing your account or email service@gentoon.ai.

9. Use of Cookies

The Company uses the following cookies:

The analytics cookies listed above are set automatically as soon as a page loads. We do not display a consent banner beforehand, and we do not currently detect or act on Global Privacy Control (GPC) or Do Not Track signals — see “Legal Bases for Processing” above. You may refuse the storage of cookies through your web browser settings. However, blocking cookies may restrict your ability to use certain features, such as logging in, and on its own it does not stop analytics collection; to stop collection, email service@gentoon.ai.

10. Measures to Ensure the Security of Personal Information

The Company implements the following measures in accordance with applicable data protection laws:

1. Access control. Access to personal information is restricted to the minimum number of authorized personnel, and administrator accounts are managed via UUID-based whitelisting.
2. Encryption. Passwords are stored using one-way hashing, and payment card information is processed by Polar in compliance with PCI-DSS standards. All communications are encrypted using TLS (HTTPS).
3. Security headers. Security headers including HSTS, CSP, and X-Frame-Options are applied to prevent web-based attacks.
4. Access restrictions. CSRF tokens, API rate limiting, and IP-based anomalous access blocking are implemented.
5. Monitoring. Real-time error detection and security event monitoring are performed through Sentry.

Children's Privacy

The Service is not directed to children. You must meet the minimum age required to use online services in your country: at least 13 years old in the United States, and at least the age of digital consent in your country in the EEA and the UK (16, unless your country sets a lower age of 13, 14, or 15). Where applicable law requires it, a parent or guardian must provide or authorise consent. If we learn that we have collected personal data from a child below the applicable age without the required consent, we will delete the account and the data without undue delay. If you believe a child has provided us with personal data, contact service@gentoon.ai.

How to Contact Us About Your Data

For any privacy question, to exercise your rights, or to raise a concern, contact our data-protection officer, who also receives access requests and complaints. Under the Korean Personal Information Protection Act this role is held by the representative of the business.

Name

Kim Joong Hwi

Position

Representative, Fairrium

Phone

+82-70-4571-4025

Email

service@gentoon.ai

Users in the Republic of Korea may also apply, free of charge, to the Personal Information Dispute Mediation Committee (www.kopico.go.kr, 1833-6972) or report to the Personal Information Infringement Report Center (privacy.kisa.or.kr, 118) if a request is refused or you disagree with how it was handled.

GenToon does not currently maintain a permanent establishment in the EEA or the UK. If we are required to appoint a representative under Article 27 of the GDPR or UK GDPR, we will update this Policy with their details. In the meantime, EEA, UK, and Swiss users may direct all data-protection requests to service@gentoon.ai, which we monitor as our primary data-protection channel.

Lodging a Complaint

You have the right to lodge a complaint with the data-protection supervisory authority in your country or state of residence. For users in the EEA, this is your national Data Protection Authority; in the UK, the Information Commissioner's Office (ICO) at ico.org.uk; in California, the California Privacy Protection Agency or the California Attorney General. You may also contact us first at service@gentoon.ai and we will work to resolve your concern.

Your U.S. State Privacy Rights (California and Other States)

If you are a resident of California or another U.S. state with a comprehensive privacy law, you may have the right to know what personal information we collect and how we use it, to access and delete your personal information, to correct inaccurate information, to limit the use of sensitive personal information, and to opt out of the “sale” or “sharing” of personal information and of targeted advertising.

We do not sell your personal information for money. Our use of analytics cookies and identifiers (Google Analytics, Microsoft Clarity, PostHog) may be considered “sharing” for cross-context behavioural advertising purposes under California law. To opt out of these analytics cookies, email service@gentoon.ai. These analytics tools do not currently detect or act on Global Privacy Control (GPC) or Do Not Track signals sent by your browser. We will update this Policy if and when we implement signal-based opt-out for analytics.

From October 13, 2026, Google AdSense advertising cookies and identifiers may also constitute “sale” or “sharing” under applicable U.S. state privacy laws. Where Google displays the “Do Not Sell or Share My Personal Information” link, use it to opt out of this advertising processing. That choice does not stop the analytics tools described above; analytics opt-out remains available by email.

Once app advertising launches, sending your advertising identifier, device details and ad interactions to Google to show ads in the GenToon mobile app may also constitute “sharing” for cross-context behavioural advertising. You can opt out through the app's Settings > Privacy > “Ad privacy options” (shown where Google's consent tools apply), by turning off “Allow Apps to Request to Track” on iOS, by deleting your advertising ID on Android, or by emailing service@gentoon.ai. Paid plans do not show ads. See Section 21 for details.

We do not sell or share the personal information of consumers we know to be under 16. We will not discriminate against you for exercising any of these rights. To exercise your U.S. state privacy rights, or to opt out, email service@gentoon.ai with the subject line “U.S. Privacy Request” (or “Do Not Sell or Share”); we will verify your request using your account before responding. You may use an authorized agent to submit a request on your behalf. We will respond within the time required by law (generally 45 days, extendable once where permitted).

14. Changes to This Policy

1. This Privacy Policy may be amended due to changes in applicable laws, regulations, or internal policies of the Company.
2. Any amendments will be announced within the Service at least 7 days prior to the effective date of the change.
3. This Policy has been in effect since January 1, 2025. The revision dated May 9, 2026 takes effect on the same date. The revision dated August 1, 2026 (adding Alibaba Cloud and OpenAI as AI processors) takes effect on the same date. The revision dated August 7, 2026 (adding PostHog, Inc. as a product-analytics processor and disclosing the resulting transfer to the European Union) takes effect on the same date. The revision dated September 1, 2026 (social publishing — new collected categories, third-party sharing with and international transfers to Meta Platforms, Inc. in the United States and TikTok Pte. Ltd. in Singapore, and destruction of connection data — the access token on disconnect, everything on account deletion) takes effect on September 8, 2026, seven days after it was posted, in line with paragraph 2 above. The revision dated September 6, 2026 (per-post performance metrics — adding the metrics of published posts to the categories collected, and adding the reading of those metrics to the purpose of sharing with and transferring to Meta Platforms, Inc.) takes effect on September 13, 2026 under the same paragraph.
4. The revision dated September 24, 2026 (connected AI assistants (MCP connector) — new collected categories, collection method and purpose; retention periods for connection records, the connector's session and connector tokens; third-party sharing with and international transfers to the provider of the AI assistant you connect (such as OpenAI, L.L.C., Anthropic, PBC and Anysphere, Inc.); text generation (studio assistant chat and scenarios) added to the work entrusted to OpenAI, L.L.C. and Google; new Section 20) takes effect on the same date. It describes processing that already takes place in the connector feature the Service already offers and specifies the troubleshooting records the Company keeps, and it neither restricts your rights nor adds obligations, so, like the revisions of August 1 and August 7, 2026, it takes effect when posted.
5. The revision dated October 1, 2026 (sign-up source measurement: sign-up source information added to the categories collected and sign-up source measurement to the purposes, the gentoon_utm and gentoon_first_touch cookies disclosed, and the retention period and erasure after account deletion set out) takes effect on October 12, 2026, more than seven days after it was posted, in line with paragraph 2 above. First-visit information is collected from that date; advertising and campaign link details (gentoon_utm) were already used to measure sign-up sources before this revision, which now states them, except for the ad and keyword identifiers and ad position of a Naver search ad, which are new and are recorded from that date.
6. The revision posted on October 16, 2026 takes effect on October 23, 2026, seven days after it was posted, in line with paragraph 2 above (new Section 21 App Advertising (Google AdMob), Section 22 Series Reading History and Subscriptions, Section 23 Cheers and Section 24 Creator Program: Earnings and Payouts; automatic translation of comments on a creator's own post in Section 25; and the related additions to the tables on categories, purposes, retention, third parties, processors and international transfers and to automated decisions). The parts of the same revision that describe processing we were already doing (your device or browser time zone and how we use it, “Translate” for comments and keeping translations, browser notification subscriptions and notification delivery records, and delivery through browser push services) correct our disclosure rather than add new processing, and take effect on the day they were posted, October 16, 2026.
7. The revision posted on October 20, 2026 takes effect on October 27, 2026, seven days after it was posted, in line with paragraph 2 above (new Section 26 Goods Purchases, and the related additions to the tables on categories, purposes, retention, processors (Toss Payments Co., Ltd. and Weebling Co., Ltd.) and international transfers (Printful Inc. and PayPal Pte. Ltd.), and to the deletion of goods order data when you delete your account).
8. The policy revised on October 21, 2026 takes effect on October 28, 2026, 7 days after it was posted, under paragraph 2 (new Section 27, Additional Processing for Goods Sales, and Section 28, Credit Cheers, with rows added to the tables of collected items, purposes, retention periods, international transfers (Printify, Inc.) and cookies (gentoon_goods_ref), and new Section 19, Automated Decisions).
9. Sửa đổi đánh giá, yêu thích và thông báo công bố 26 tháng 10, 2026 có hiệu lực 2 tháng 11, 2026, là phần bổ sung riêng cho các sửa đổi trước.

15. Chính sách lưu trữ tin nhắn

Công ty áp dụng thời hạn lưu trữ khác nhau tùy theo loại tin nhắn được trao đổi trong Dịch vụ.

16. Hợp tác với cơ quan thực thi pháp luật và cơ quan nhà nước

Công ty cam kết bảo vệ thông tin cá nhân của người dùng; tuy nhiên, khi cơ quan nhà nước gửi yêu cầu hợp pháp theo đúng trình tự thủ tục, Công ty sẽ hợp tác trong phạm vi pháp luật hiện hành cho phép.

17. Phân tích sử dụng sản phẩm (PostHog)

Chúng tôi sử dụng PostHog, một công cụ phân tích sản phẩm, trên trang web và ứng dụng di động GenToon để hiểu cách Dịch vụ được sử dụng và cải thiện Dịch vụ. PostHog xử lý dữ liệu này trên các máy chủ đặt tại Liên minh châu Âu (Frankfurt, Đức), do đó nội dung dưới đây là việc chuyển dữ liệu cá nhân ra nước ngoài.

18. Chuyển ảnh đại diện của bạn thành nhân vật webtoon

Khi bạn biến một cuộc trò chuyện thành webtoon, ảnh đại diện của bạn được dùng để chuyển thành nhân vật theo phong cách webtoon (cách điệu). Việc này không nhằm nhận dạng danh tính của bạn, cũng không nhằm trích xuất, lưu trữ hay đối chiếu dữ liệu sinh trắc học. Trong quá trình đó, Công ty lưu giữ hình ảnh nhân vật đã chuyển đổi, đoạn văn bản mô tả ngoại hình mà AI trích xuất để tạo ra hình ảnh đó, và địa chỉ (URL) của ảnh đại diện tại thời điểm tạo; những dữ liệu này được tái sử dụng mỗi khi vẽ lại chính nhân vật đó. Nếu bạn không có ảnh đại diện hoặc quá trình chuyển đổi thất bại, một nhân vật mặc định sẽ được dùng thay thế. Đối với việc phân tích ảnh có chứa khuôn mặt, và việc tin nhắn của những người tham gia khác được gửi tới AI khi biến cuộc trò chuyện nhóm thành webtoon, Công ty xin sự đồng ý riêng cho từng nội dung ngay trong Dịch vụ. Bạn có thể dừng việc sử dụng này bất cứ lúc nào bằng cách thay đổi hoặc xóa ảnh đại diện, hoặc gửi yêu cầu tới service@gentoon.ai để yêu cầu xóa hình ảnh nhân vật và phần mô tả ngoại hình đã lưu.

19. Automated Decisions

Section numbers follow the Korean-language version of this Policy.

In addition to the automated decisions described under "Legal Bases for Processing (EEA / UK Users)" above, the following decisions are made automatically, without a human reviewing them individually. They are rule-based decisions with no human involvement, and they do not use profiling models trained on your data.

• Whether a credit cheer can be sent. Criteria: the sending member's membership period and suspension status; whether the sending and receiving members appear to be accounts of the same person (hash values of sign-up connection information, of attendance device identifiers and of the receiving member's recent web attendance connection information, compared with the connection information of the sending request); total credits sent and received that day. Procedure: Request received → items above compared → if any applies, the cheer is not sent (no credits move).
• Which sales go into "Just sold" and sales rankings. Criteria: whether the buyer is the creator or appears to be the same person as the creator, and whether several buying accounts appear to be the same person (hash values made on the spot from shipping addresses, and hash values of attendance device identifiers); refunds and cancellations; number of different buyers. Procedure: Sales tallied → items above compared → if any applies, excluded from displays and rankings or counted as one person.

If a decision affects you, you may ask us to explain it, object to it, or have it reviewed by a person, by emailing service@gentoon.ai. We will respond within 15 days for an explanation and within 30 days for a human review.

20. Connected AI Assistants (MCP Connector)

Section numbers follow the Korean-language version of this Policy.

1. (1) You can connect GenToon to an AI assistant such as ChatGPT or Claude through the Model Context Protocol (MCP), at https://www.gentoon.ai/api/mcp, and, inside it, set up, write and draw webtoons, look up your saved characters and projects, and export, share or publish the results. A connection is made when you review the permissions the AI assistant requests (view, create, publish) on GenToon's own sign-in and consent page and allow them. The Company never gives your password to the AI assistant.
2. (2) What the Company keeps. The connected app's name, identifier and return address; the permissions you granted; when the connection was made, last used and revoked; the connector's own sign-in session (stored encrypted and deleted as soon as the connection ends); authorization codes and access and refresh tokens (one-way hashes only); audit records of connecting and disconnecting (the app name and the permissions you granted — kept for 1 year as Service activity records, Section 3); and tool-call records for troubleshooting (the feature used, how long it took and whether it succeeded or its error code, the first part of the project identifier, whether it was called from a card view, the first 40 characters of the app name, version, operating system, device model and similar information the AI assistant reports, and a one-way hash of the assistant's conversation identifier). Tool-call records do not contain what you asked for; they are kept not in our database but in the operating logs of our hosting provider (Vercel Inc.) and are deleted when that operating-log retention period ends (at most 30 days). What the AI assistant sends (story topics, dialogue, edit instructions, character descriptions, photos you chose to send and so on) is saved as your projects, characters and art styles and is handled like anything you create on the web.
3. (3) What is passed to the AI assistant. The items listed for “the provider of the AI assistant you connected GenToon to” in Section 4. Your email address, password and payment details are never passed. How the assistant stores and uses that information is governed by its provider's policy (for example OpenAI, L.L.C. for ChatGPT and Codex, Anthropic, PBC for Claude and Claude Code, and Anysphere, Inc. for Cursor). The Company does not request or collect your conversation with the AI assistant; it processes only what the assistant sends to GenToon. Generated images, and photos you send through the connector, are stored at their own addresses (photos never used to create a character or art style are deleted after the period in Section 3), and anyone who has an address can open that image without signing in (the same as images you create on the web).
4. (4) Creating through the connector uses the same credits as on the web, and no payment takes place inside the connector.
5. (5) You can disconnect at any time in Settings › Connected apps. Disconnecting invalidates that connection's tokens immediately and ends and deletes the connector's session, and the connection record is destroyed 30 days later. Each device or app has its own connection, so disconnecting one leaves the others in place; disconnecting every connection listed in Connected apps ends them all. A connection older than 24 hours with no valid token left, and a connection whose connector sign-in session can no longer be renewed, are disconnected automatically, and deleting your account disconnects every connection (retention periods in Section 3).

21. Quảng cáo trong ứng dụng (Google AdMob)

Mục này là bản dịch để tham khảo. Nếu khác với bản gốc tiếng Hàn, bản gốc tiếng Hàn được ưu tiên áp dụng.

Một số màn hình của ứng dụng di động GenToon (quảng cáo có thưởng trong tab nhận credit miễn phí và quảng cáo biểu ngữ ở cuối tác phẩm và trong bảng tin cộng đồng) có thể hiển thị quảng cáo Google AdMob của Google LLC. Các gói trả phí không hiển thị quảng cáo. Mục này áp dụng từ phiên bản ứng dụng có quảng cáo; chúng tôi sẽ thông báo ngày hiệu lực ít nhất 7 ngày trước (xem “Changes to This Policy”).

22. Lịch sử đọc truyện dài kỳ và đăng ký theo dõi

Mục này là bản dịch để tham khảo. Nếu khác với bản gốc tiếng Hàn, bản gốc tiếng Hàn được ưu tiên áp dụng.

Khi thành viên đã đăng nhập đọc các tập của một bộ truyện dài kỳ hoặc đăng ký theo dõi một bộ truyện, chúng tôi xử lý các dữ liệu dưới đây để bạn có thể đọc tiếp và nhận thông báo về tập mới.

23. Cổ vũ (quà tặng và bình luận cổ vũ)

Mục này là bản dịch để tham khảo. Nếu khác với bản gốc tiếng Hàn, bản gốc tiếng Hàn được ưu tiên áp dụng.

Tính năng cổ vũ cho phép người đọc mua vật phẩm cổ vũ (quà tặng credit) do GenToon bán và gửi đến tác phẩm hoặc bộ truyện của một tác giả. Chỉ thành viên từ 19 tuổi trở lên mới được gửi hoặc nhận cổ vũ, và tác giả chỉ nhận được sau khi tự bật tính năng nhận cổ vũ.

24. Chương trình Tác giả: thu nhập và chi trả

Mục này là bản dịch để tham khảo. Nếu khác với bản gốc tiếng Hàn, bản gốc tiếng Hàn được ưu tiên áp dụng.

Với tác giả tham gia Chương trình Tác giả (có điều khoản riêng), chúng tôi quyết toán phần của họ trong doanh thu cổ vũ và doanh thu quảng cáo và chi trả bằng credit hoặc tiền. Để làm vậy, chúng tôi xử lý các dữ liệu dưới đây.

25. Dịch bình luận cộng đồng

Mục này là bản dịch để tham khảo. Nếu khác với bản gốc tiếng Hàn, bản gốc tiếng Hàn được ưu tiên áp dụng.

Khi bạn nhấn “Dịch”, chúng tôi gửi nội dung bình luận đó (tối đa 500 ký tự) và ngôn ngữ đích tới API Gemini của Google LLC để dịch. Bình luận gửi đi để dịch không được dùng để huấn luyện mô hình AI.

Bình luận bằng ngôn ngữ khác trên bài đăng của chính tác giả (bình luận thông thường dài hơn 10 ký tự) và câu trả lời của tác giả cho các bình luận đó có thể được dịch tự động ngay sau khi đăng, dù không ai nhấn gì, và các bản dịch này được ghi chú là dịch tự động.

26. Mua sản phẩm

Mục này là bản dịch để tham khảo. Nếu khác với bản gốc tiếng Hàn, bản gốc tiếng Hàn được ưu tiên áp dụng.

Công ty bán các sản phẩm mang nhân vật và tác phẩm do thành viên tạo ra, và Công ty là bên bán các sản phẩm này. Khi bạn đặt mua sản phẩm, Công ty xử lý dữ liệu cá nhân như sau.

27. Xử lý bổ sung khi bán sản phẩm

Mục này là bản dịch để tham khảo. Nếu khác với bản gốc tiếng Hàn, bản gốc tiếng Hàn được ưu tiên áp dụng.

Liên quan đến việc bán sản phẩm (mục 26), Công ty xử lý dữ liệu cá nhân như sau để kiểm tra độ tuổi khi đặt hàng, đếm số sản phẩm bán qua liên kết chia sẻ của nhà sáng tạo, hiển thị việc sản phẩm đã bán và lập bảng xếp hạng doanh số, hiển thị thẻ mua hàng, và sản xuất một số sản phẩm ở nước ngoài thông qua Printify.

28. Cổ vũ bằng tín dụng

Mục này là bản dịch để tham khảo. Nếu khác với bản gốc tiếng Hàn, bản gốc tiếng Hàn được ưu tiên áp dụng.

Cổ vũ bằng tín dụng cho phép thành viên gửi một phần tín dụng của chính mình, kèm bình luận cổ vũ, tới bài đăng công khai của thành viên khác. Không phát sinh thanh toán, và đây là tính năng khác với cổ vũ (mục 23), khi thành viên mua một vật phẩm cổ vũ rồi gửi đi.

29. Dữ liệu đánh giá, yêu thích và thông báo sản phẩm

Mục này là bản dịch để tham khảo. Nếu khác với bản gốc tiếng Hàn, bản gốc tiếng Hàn được ưu tiên áp dụng.