Privacy Policy

Fairrium (“GenToon”, “we”, “us”, or “the Company”) provides the GenToon service (the “Service”) and is the controller of personal data processed through it. This Privacy Policy explains what personal data we collect, why and on what legal basis we process it, who we share it with, how long we keep it, how we transfer it internationally, and the rights you have over your data.

For users in the European Economic Area (EEA), the United Kingdom, and Switzerland, we process personal data in accordance with the EU General Data Protection Regulation (GDPR) and the UK GDPR. For users in California and other U.S. states with applicable privacy laws, the disclosures in the “Your U.S. State Privacy Rights” section apply. Country-specific provisions required under Korean law apply only to users in the Republic of Korea and are set out separately below. If you have any question about this Policy or wish to exercise your rights, contact us at service@gentoon.ai.

1. Categories of Personal Information Collected and Methods of Collection

A. Categories Collected

We do not collect sensitive information such as beliefs, health or sex life. The resident registration number, a unique identifier under Korean law, is collected only for the affiliate settlement and creator payout purposes above and only where the law requires it: for affiliates with separate consent, and for creators living in Korea, under the tax-withholding duty in the Korean Income Tax Act and Article 68(3) of the Enforcement Decree of the Framework Act on National Taxes, only when they first convert earnings to credits or ask for a bank payout (Section 24).

B. Methods of Collection

• Direct input during sign-up and use of the website and mobile app
• Social login via Google, Apple or Kakao OAuth
• Account details supplied by the platform (Meta, TikTok) when you connect a social account
• What an AI assistant (such as ChatGPT or Claude) sends when you connect GenToon to it and use GenToon features there
• Automatic collection during payment through Polar, Toss Payments or app store in-app purchase
• Automatic generation and collection through cookies, local storage and access logs during service use
• Automatic transmission by the analytics SDKs installed in the web and mobile app (Sections 9 and 17)
• Collection during enquiries made by email, the Help page or the business enquiry form

2. Purposes of Processing Personal Information

1. Member management. Identity verification, prevention of unauthorized use, complaint resolution, and delivery of notices
2. Service provision. AI image and script generation, project storage, character management, and community operation
3. Connected AI assistants. Carrying out what you ask for in an AI assistant you connected (setting up, writing, drawing, viewing, exporting, sharing and publishing webtoons), managing the connection and preventing misuse
4. Payment and billing. Subscription payments, credit purchases, refunds, and issuance of tax receipts and invoices
5. Service improvement. Usage statistics and product-usage analysis (Google Analytics, Microsoft Clarity, PostHog), sign-up source measurement (which search, ad or link led to sign-up), error detection (Sentry), and service quality enhancement
6. Affiliate partner settlement. Paying referral earnings and filing withholding tax and payment statements
7. Series reading and subscriptions. Continue reading and read marks, next-episode suggestions, new-episode alerts (for series you subscribe to and series you recently read), series rankings and detection of inflated read counts (Section 22)
8. Cheers. Age checks (19 or older), cheer payments and daily and monthly payment limits, handling reports about cheer messages (Section 23)
9. Creator earnings and payouts. Settling the creator share of cheer and ad revenue, converting earnings to credits and paying to bank accounts, tax withholding and payment statements, and checking account holders (Section 24)
10. App advertising. Serving and measuring ads in the mobile app, and verifying rewarded-ad rewards (credits and cheer stickers) (Section 21)
11. Community comment translation. Translating comments when you tap “Translate”, and automatic translation of other-language comments on a creator's own post (Section 25)
12. Local-time scheduling. Using your device or browser time zone to send notifications and emails at a suitable local time (including not sending promotional messages at night), to set the dates of rewards that follow your local day (such as the second-day gift and weekly goals), and to read the times of your activity correctly when we investigate a service problem
13. Goods sales. Taking orders and confirming payment, sending orders to production and shipping partners and tracking delivery, withdrawals, exchanges and refunds, handling payment disputes and fraudulent payments, order emails, and settling the creator's design fee (Section 26)
14. Additional processing for goods sales. Refusing orders from people under 14 and informing buyers who are minors, counting goods sold through creators' share links by channel, showing sales without identifying buyers and ranking sales, and purchase cards (Section 27)
15. Credit cheers. Moving credits and posting cheer comments, daily limits, credit history, and preventing credits from being moved between several accounts of the same person (Section 28)
16. Business production enquiries. Receiving and answering enquiries, concluding and performing contracts
17. Marketing (optional). Event and benefit notifications (only with prior consent)

Legal Bases for Processing (EEA / UK Users)

Where the GDPR or UK GDPR applies, we rely on the following legal bases:

• Performance of a contract (Art. 6(1)(b)). To create and maintain your account, provide AI generation, project storage, character management, the community, and to process payments, subscriptions, credit purchases, and refunds. Without this data we cannot provide the Service.
• Legitimate interests (Art. 6(1)(f)). To secure the Service against fraud and abuse, detect and fix errors, maintain access and audit logs, analyse aggregate usage to improve the Service, and to enforce our Terms. We balance these interests against your rights and you may object as described in the “Your Rights” section.
• Consent (Art. 6(1)(a)). For optional marketing communications, which you opt into separately, for new-episode emails, which you opt into separately when you subscribe to a series (Section 22), for app advertising where Google's consent tools apply (Section 21), and for connecting an AI assistant to GenToon (Section 20), which you allow on GenToon's own connection page. You may withdraw consent at any time without affecting prior processing, for example by unsubscribing from emails or, for a connected AI assistant, by disconnecting it in Settings › Connected apps.
• Legal obligation (Art. 6(1)(c)). To retain transaction and tax records, to withhold tax on creator earnings and file payment statements (Section 24), and to respond to lawful requests, where mandatory law requires it.

We do not use your prompts, uploaded reference images, or generated outputs to train AI models. Our AI processors (Google Gemini, Alibaba Model Studio, OpenAI) do not use data sent through paid API calls to train their models, and we do not build a training dataset of our own.

Some decisions in the Service are made automatically, without a human reviewing them individually: whether a referral reward is granted, whether chat access is temporarily suspended after repeated safety-filter violations, whether a generation request is blocked by our content-safety filter, whether a cheer payment is allowed (age checks, the creator's cheer setting, blocks, daily and monthly limits, which may add up several accounts used by one person, linked by sign-up network details and app device identifiers, and whether the sender and the creator appear to be the same person's accounts because they use the same app device or signed up from the same network on the same day), whether a cheer counts as earnings for the creator (it is handled as credits if hashes of the paying device, the payment request's network details or the card appear linked to the creator's own records, or if the creator does not yet meet the criteria), and whether a read counts toward creator ad revenue shares and series rankings (excluding the creator's own reads and reads that look inflated). These are rule-based checks; they do not use profiling models trained on your data. If a decision affects you, you may ask us to explain it, object to it, or have it reviewed by a person, by emailing service@gentoon.ai. We will respond within 15 days for an explanation and within 30 days for a human review.

3. Retention and Use Periods

The Company destroys personal information without delay once the purpose of processing has been fulfilled. However, where retention is required by applicable law, the information shall be securely stored for the prescribed period before destruction.

Where mandatory local law imposes a specific minimum retention period, we keep the relevant records for that period and no longer. Korea-specific statutory retention periods are set out in the Korean-language Policy for users in the Republic of Korea.

Projects, characters and art styles you create through a connected AI assistant are kept and deleted exactly like those you create on the web (“Member information” and the trash rules), and audit records of connecting and disconnecting (the app name and the permissions you granted) are part of the “Service activity records” above and are kept for 1 year. Security records created when reuse of an authorization code or token is detected and the related tokens are revoked (the app name and the number of tokens revoked) are kept to deal with misuse and are excluded from that 1-year deletion.

4. Provision of Personal Information to Third Parties

The Company does not provide personal information to third parties without the user's consent. However, the minimum necessary information is shared with the following parties for the purpose of providing the Service.

Personal information may also be disclosed where required by law, such as upon presentation of a warrant by investigative authorities.

For creator earnings we pay after withholding Korean tax, we file payment statements (name, resident registration number or, for creators outside Korea, the taxpayer identification number of their country of residence, amount paid, tax withheld and similar items) with the Korean National Tax Service as the Korean Income Tax Act requires (Section 24).

Sharing with Meta Platforms, Inc. and TikTok Pte. Ltd. happens only if you connect the corresponding social account, and we ask for separate consent that is not bundled with sign-up. You can use every other part of the Service without giving it, and you can withdraw it at any time from the connection screen.

Information is shared with an AI assistant provider only if you connect GenToon to that assistant yourself, and only after you review the permissions that assistant requests on GenToon's own connection page and allow them. What is shared is limited to the results of the GenToon features you run in that assistant; your email address, password and payment details are never shared. How that assistant stores and uses the information is governed by its provider's policy, which the Company does not control. You can use every other part of the Service without connecting, and you can disconnect at any time in Settings › Connected apps to stop any further sharing (Section 20).

5. Entrustment of Personal Information Processing

We entrust the processing of personal information to the following processors in order to operate the Service. Each processor acts only on our instructions and only within the scope of the entrusted work; this is distinct from the disclosures to third parties described in Section 4.

International Data Transfers

We transfer personal information outside the Republic of Korea to the extent necessary to provide the Service. Under Article 28-8(1)3 of the Korean Personal Information Protection Act these transfers are entrustment and storage necessary to perform our contract with you and to improve your experience, and we disclose the details below as that Article requires. Our own AI generation servers run in the Seoul region of the Republic of Korea and are therefore not an overseas transfer, and Korean card payments (Toss Payments) are processed domestically.

Your Rights

Depending on where you live, applicable data-protection law gives you rights over your personal data. Where the GDPR or UK GDPR applies to you, you have the right to:

• Access the personal data we hold about you and obtain a copy.
• Rectify inaccurate or incomplete data.
• Erase your data (“right to be forgotten”), subject to legal retention obligations.
• Restrict processing in certain circumstances.
• Object to processing based on our legitimate interests, and to object to direct marketing at any time.
• Data portability — receive the data you provided to us in a structured, commonly used, machine-readable format, and have it transmitted to another controller where technically feasible.
• Withdraw consent at any time, where processing is based on consent, without affecting the lawfulness of processing before withdrawal.

You can exercise most of these rights directly under Settings > My Account, or by emailing service@gentoon.ai. We will respond without undue delay and within one month of receiving your request; this period may be extended by up to two further months where the request is complex or numerous, in which case we will inform you. We do not charge a fee for a reasonable request, and we verify your identity using your account before acting on a request.

You also have the right to lodge a complaint with your local data-protection supervisory authority (for example, your national authority in the EEA, or the UK Information Commissioner's Office at ico.org.uk). We would, however, appreciate the chance to address your concern first. Additional rights for California and other U.S. state residents are set out in the “Your U.S. State Privacy Rights” section below.

8. Destruction of Personal Information

1. Personal information shall be destroyed without delay once the retention period has expired or the processing purpose has been achieved.
2. Electronic files: Permanently deleted using methods that prevent recovery.
3. Paper documents: Shredded or incinerated.
4. Account deletion is processed in the following stages.
   • Immediately on deletion — your name, email address, nickname, profile photo, and bio are irreversibly anonymised, and your login account is removed so that you can no longer sign in. Your personal projects are moved to trash.
   • 30 days after deletion — projects, generated images, and uploaded files are permanently erased from storage, sign-up source information (advertising and campaign link details and first-visit information) is erased, and the account identifiers on payment records are removed. The transaction records themselves are kept in de-identified form for the period required by Korean e-commerce law, as set out in Section 3.
   • Connected social accounts — when you disconnect an account we destroy its access token immediately, cancel any posts scheduled at that moment, and ask the platform (Meta, TikTok) to revoke the permissions you granted us. The account identifier, handle and your past publishing records stay in your account so you can see what was published, and are destroyed together with the token when you delete your account. Records of your consent and its withdrawal are retained as evidence that consent was obtained.
   • Browser notifications. When you ask to delete your account we turn off that account's browser notification subscriptions at once, and turned-off subscriptions are deleted after 30 days. The delivery records we keep for all notifications (notification type, time sent and result) are deleted 90 days after sending.
   • Series reading, cheers and creator data. 30 days after you delete your account we erase your reading history and reading positions, series subscriptions, new-episode email consent (except the history of agreeing and withdrawing), records of new-episode alerts we sent, cheer settings, the device identifier and card hashes on cheer payment records and the device details kept for push notifications, and we remove your identifier from read-inflation records or delete those records. Cheer messages may remain anonymised as “Deleted user”, like the community posts and comments below. Creator payout details are handled as described in Section 24, and app advertising records are erased as soon as you ask to delete your account (Section 21).
   • Goods orders. 30 days after you delete your account we erase the orderer's email, contact number, shipping address, delivery note, nickname, IP address and browser information from completed goods orders. For orders that were paid, however, we keep the information needed to identify the parties to the transaction (name, address and email) and the reasons given for refund or exchange requests separately from other data, as Article 6(3) of the Korean E-Commerce Act allows, and destroy them without delay when the legal retention period ends (5 years for transaction records, 3 years for complaint and dispute records). We use that separately kept information only for disputes or requests made under law. Orders still in production, shipping or refund are handled the same way once that process ends, and transaction records such as the order number, amount, payment time and destination country are kept for the retention period in a form that does not identify you.
   • What remains, anonymised — posts and comments you made in the community stay visible so that other people's conversations remain intelligible, attributed to “Deleted user”; a stripped account record is retained solely to keep those posts attached. Projects you shared into a workspace remain with that workspace for its other members. If you want these removed, delete them before closing your account or email service@gentoon.ai.

9. Use of Cookies

The Company uses the following cookies:

The analytics cookies listed above are set automatically as soon as a page loads. We do not display a consent banner beforehand, and we do not currently detect or act on Global Privacy Control (GPC) or Do Not Track signals — see “Legal Bases for Processing” above. You may refuse the storage of cookies through your web browser settings. However, blocking cookies may restrict your ability to use certain features, such as logging in, and on its own it does not stop analytics collection; to stop collection, email service@gentoon.ai.

10. Measures to Ensure the Security of Personal Information

The Company implements the following measures in accordance with applicable data protection laws:

1. Access control. Access to personal information is restricted to the minimum number of authorized personnel, and administrator accounts are managed via UUID-based whitelisting.
2. Encryption. Passwords are stored using one-way hashing, and payment card information is processed by Polar in compliance with PCI-DSS standards. All communications are encrypted using TLS (HTTPS).
3. Security headers. Security headers including HSTS, CSP, and X-Frame-Options are applied to prevent web-based attacks.
4. Access restrictions. CSRF tokens, API rate limiting, and IP-based anomalous access blocking are implemented.
5. Monitoring. Real-time error detection and security event monitoring are performed through Sentry.

Children's Privacy

The Service is not directed to children. You must meet the minimum age required to use online services in your country: at least 13 years old in the United States, and at least the age of digital consent in your country in the EEA and the UK (16, unless your country sets a lower age of 13, 14, or 15). Where applicable law requires it, a parent or guardian must provide or authorise consent. If we learn that we have collected personal data from a child below the applicable age without the required consent, we will delete the account and the data without undue delay. If you believe a child has provided us with personal data, contact service@gentoon.ai.

How to Contact Us About Your Data

For any privacy question, to exercise your rights, or to raise a concern, contact our data-protection officer, who also receives access requests and complaints. Under the Korean Personal Information Protection Act this role is held by the representative of the business.

Name

Kim Joong Hwi

Position

Representative, Fairrium

Phone

+82-70-4571-4025

Email

service@gentoon.ai

Users in the Republic of Korea may also apply, free of charge, to the Personal Information Dispute Mediation Committee (www.kopico.go.kr, 1833-6972) or report to the Personal Information Infringement Report Center (privacy.kisa.or.kr, 118) if a request is refused or you disagree with how it was handled.

GenToon does not currently maintain a permanent establishment in the EEA or the UK. If we are required to appoint a representative under Article 27 of the GDPR or UK GDPR, we will update this Policy with their details. In the meantime, EEA, UK, and Swiss users may direct all data-protection requests to service@gentoon.ai, which we monitor as our primary data-protection channel.

Lodging a Complaint

You have the right to lodge a complaint with the data-protection supervisory authority in your country or state of residence. For users in the EEA, this is your national Data Protection Authority; in the UK, the Information Commissioner's Office (ICO) at ico.org.uk; in California, the California Privacy Protection Agency or the California Attorney General. You may also contact us first at service@gentoon.ai and we will work to resolve your concern.

Your U.S. State Privacy Rights (California and Other States)

If you are a resident of California or another U.S. state with a comprehensive privacy law, you may have the right to know what personal information we collect and how we use it, to access and delete your personal information, to correct inaccurate information, to limit the use of sensitive personal information, and to opt out of the “sale” or “sharing” of personal information and of targeted advertising.

We do not sell your personal information for money. Our use of analytics cookies and identifiers (Google Analytics, Microsoft Clarity, PostHog) may be considered “sharing” for cross-context behavioural advertising purposes under California law. To opt out of these analytics cookies, email service@gentoon.ai. These analytics tools do not currently detect or act on Global Privacy Control (GPC) or Do Not Track signals sent by your browser. We will update this Policy if and when we implement signal-based opt-out for analytics.

From October 13, 2026, Google AdSense advertising cookies and identifiers may also constitute “sale” or “sharing” under applicable U.S. state privacy laws. Where Google displays the “Do Not Sell or Share My Personal Information” link, use it to opt out of this advertising processing. That choice does not stop the analytics tools described above; analytics opt-out remains available by email.

Once app advertising launches, sending your advertising identifier, device details and ad interactions to Google to show ads in the GenToon mobile app may also constitute “sharing” for cross-context behavioural advertising. You can opt out through the app's Settings > Privacy > “Ad privacy options” (shown where Google's consent tools apply), by turning off “Allow Apps to Request to Track” on iOS, by deleting your advertising ID on Android, or by emailing service@gentoon.ai. Paid plans do not show ads. See Section 21 for details.

We do not sell or share the personal information of consumers we know to be under 16. We will not discriminate against you for exercising any of these rights. To exercise your U.S. state privacy rights, or to opt out, email service@gentoon.ai with the subject line “U.S. Privacy Request” (or “Do Not Sell or Share”); we will verify your request using your account before responding. You may use an authorized agent to submit a request on your behalf. We will respond within the time required by law (generally 45 days, extendable once where permitted).

14. Changes to This Policy

1. This Privacy Policy may be amended due to changes in applicable laws, regulations, or internal policies of the Company.
2. Any amendments will be announced within the Service at least 7 days prior to the effective date of the change.
3. This Policy has been in effect since January 1, 2025. The revision dated May 9, 2026 takes effect on the same date. The revision dated August 1, 2026 (adding Alibaba Cloud and OpenAI as AI processors) takes effect on the same date. The revision dated August 7, 2026 (adding PostHog, Inc. as a product-analytics processor and disclosing the resulting transfer to the European Union) takes effect on the same date. The revision dated September 1, 2026 (social publishing — new collected categories, third-party sharing with and international transfers to Meta Platforms, Inc. in the United States and TikTok Pte. Ltd. in Singapore, and destruction of connection data — the access token on disconnect, everything on account deletion) takes effect on September 8, 2026, seven days after it was posted, in line with paragraph 2 above. The revision dated September 6, 2026 (per-post performance metrics — adding the metrics of published posts to the categories collected, and adding the reading of those metrics to the purpose of sharing with and transferring to Meta Platforms, Inc.) takes effect on September 13, 2026 under the same paragraph.
4. The revision dated September 24, 2026 (connected AI assistants (MCP connector) — new collected categories, collection method and purpose; retention periods for connection records, the connector's session and connector tokens; third-party sharing with and international transfers to the provider of the AI assistant you connect (such as OpenAI, L.L.C., Anthropic, PBC and Anysphere, Inc.); text generation (studio assistant chat and scenarios) added to the work entrusted to OpenAI, L.L.C. and Google; new Section 20) takes effect on the same date. It describes processing that already takes place in the connector feature the Service already offers and specifies the troubleshooting records the Company keeps, and it neither restricts your rights nor adds obligations, so, like the revisions of August 1 and August 7, 2026, it takes effect when posted.
5. The revision dated October 1, 2026 (sign-up source measurement: sign-up source information added to the categories collected and sign-up source measurement to the purposes, the gentoon_utm and gentoon_first_touch cookies disclosed, and the retention period and erasure after account deletion set out) takes effect on October 12, 2026, more than seven days after it was posted, in line with paragraph 2 above. First-visit information is collected from that date; advertising and campaign link details (gentoon_utm) were already used to measure sign-up sources before this revision, which now states them, except for the ad and keyword identifiers and ad position of a Naver search ad, which are new and are recorded from that date.
6. The revision posted on October 16, 2026 takes effect on October 23, 2026, seven days after it was posted, in line with paragraph 2 above (new Section 21 App Advertising (Google AdMob), Section 22 Series Reading History and Subscriptions, Section 23 Cheers and Section 24 Creator Program: Earnings and Payouts; automatic translation of comments on a creator's own post in Section 25; and the related additions to the tables on categories, purposes, retention, third parties, processors and international transfers and to automated decisions). The parts of the same revision that describe processing we were already doing (your device or browser time zone and how we use it, “Translate” for comments and keeping translations, browser notification subscriptions and notification delivery records, and delivery through browser push services) correct our disclosure rather than add new processing, and take effect on the day they were posted, October 16, 2026.
7. The revision posted on October 20, 2026 takes effect on October 27, 2026, seven days after it was posted, in line with paragraph 2 above (new Section 26 Goods Purchases, and the related additions to the tables on categories, purposes, retention, processors (Toss Payments Co., Ltd. and Weebling Co., Ltd.) and international transfers (Printful Inc. and PayPal Pte. Ltd.), and to the deletion of goods order data when you delete your account).
8. The policy revised on October 21, 2026 takes effect on October 28, 2026, 7 days after it was posted, under paragraph 2 (new Section 27, Additional Processing for Goods Sales, and Section 28, Credit Cheers, with rows added to the tables of collected items, purposes, retention periods, international transfers (Printify, Inc.) and cookies (gentoon_goods_ref), and new Section 19, Automated Decisions).
9. 2026年10月26日公告的周邊評價、收藏與通知修訂自2026年11月2日生效，作為之前修訂的獨立補充。

15. 訊息保存政策

本公司依使用者在服務中所傳送之訊息類型，採取不同的保存期限政策。

16. 配合執法機關及政府機關

本公司致力保護使用者個人資料；但若政府機關依正當程序提出合法請求，本公司將在相關法規允許的範圍內予以配合。

17. 產品使用分析（PostHog）

本公司於 GenToon 網站與行動應用程式使用產品分析工具 PostHog，以瞭解服務的使用情形並加以改善。PostHog 於歐盟（德國法蘭克福）的伺服器處理這些資料，因此以下內容屬於個人資料的跨境傳輸。

18. 將大頭貼轉換為網路漫畫角色

當您將對話製作成網路漫畫時，您的大頭貼會用於轉換（風格化）為網路漫畫風格的角色。此舉並非為識別本人，亦非為擷取、儲存或比對生物特徵資料。本公司於此過程中會儲存轉換後的角色圖像、AI 為生成該角色所擷取的外貌描述文字，以及生成當時大頭貼的位址（URL），並於再次繪製同一角色時重複使用上述資料。若您沒有大頭貼或轉換失敗，將以預設角色替代。就含有臉部的照片之分析，以及將群組對話製作成網路漫畫時其他參與者的訊息傳送至 AI 一事，本公司將於服務內分別取得您的個別同意。您可隨時變更或刪除大頭貼，或來信 service@gentoon.ai 提出請求，以停止上述利用並要求刪除已儲存的角色圖像與外貌描述。

19. Automated Decisions

Section numbers follow the Korean-language version of this Policy.

In addition to the automated decisions described under "Legal Bases for Processing (EEA / UK Users)" above, the following decisions are made automatically, without a human reviewing them individually. They are rule-based decisions with no human involvement, and they do not use profiling models trained on your data.

• Whether a credit cheer can be sent. Criteria: the sending member's membership period and suspension status; whether the sending and receiving members appear to be accounts of the same person (hash values of sign-up connection information, of attendance device identifiers and of the receiving member's recent web attendance connection information, compared with the connection information of the sending request); total credits sent and received that day. Procedure: Request received → items above compared → if any applies, the cheer is not sent (no credits move).
• Which sales go into "Just sold" and sales rankings. Criteria: whether the buyer is the creator or appears to be the same person as the creator, and whether several buying accounts appear to be the same person (hash values made on the spot from shipping addresses, and hash values of attendance device identifiers); refunds and cancellations; number of different buyers. Procedure: Sales tallied → items above compared → if any applies, excluded from displays and rankings or counted as one person.

If a decision affects you, you may ask us to explain it, object to it, or have it reviewed by a person, by emailing service@gentoon.ai. We will respond within 15 days for an explanation and within 30 days for a human review.

20. Connected AI Assistants (MCP Connector)

Section numbers follow the Korean-language version of this Policy.

1. (1) You can connect GenToon to an AI assistant such as ChatGPT or Claude through the Model Context Protocol (MCP), at https://www.gentoon.ai/api/mcp, and, inside it, set up, write and draw webtoons, look up your saved characters and projects, and export, share or publish the results. A connection is made when you review the permissions the AI assistant requests (view, create, publish) on GenToon's own sign-in and consent page and allow them. The Company never gives your password to the AI assistant.
2. (2) What the Company keeps. The connected app's name, identifier and return address; the permissions you granted; when the connection was made, last used and revoked; the connector's own sign-in session (stored encrypted and deleted as soon as the connection ends); authorization codes and access and refresh tokens (one-way hashes only); audit records of connecting and disconnecting (the app name and the permissions you granted — kept for 1 year as Service activity records, Section 3); and tool-call records for troubleshooting (the feature used, how long it took and whether it succeeded or its error code, the first part of the project identifier, whether it was called from a card view, the first 40 characters of the app name, version, operating system, device model and similar information the AI assistant reports, and a one-way hash of the assistant's conversation identifier). Tool-call records do not contain what you asked for; they are kept not in our database but in the operating logs of our hosting provider (Vercel Inc.) and are deleted when that operating-log retention period ends (at most 30 days). What the AI assistant sends (story topics, dialogue, edit instructions, character descriptions, photos you chose to send and so on) is saved as your projects, characters and art styles and is handled like anything you create on the web.
3. (3) What is passed to the AI assistant. The items listed for “the provider of the AI assistant you connected GenToon to” in Section 4. Your email address, password and payment details are never passed. How the assistant stores and uses that information is governed by its provider's policy (for example OpenAI, L.L.C. for ChatGPT and Codex, Anthropic, PBC for Claude and Claude Code, and Anysphere, Inc. for Cursor). The Company does not request or collect your conversation with the AI assistant; it processes only what the assistant sends to GenToon. Generated images, and photos you send through the connector, are stored at their own addresses (photos never used to create a character or art style are deleted after the period in Section 3), and anyone who has an address can open that image without signing in (the same as images you create on the web).
4. (4) Creating through the connector uses the same credits as on the web, and no payment takes place inside the connector.
5. (5) You can disconnect at any time in Settings › Connected apps. Disconnecting invalidates that connection's tokens immediately and ends and deletes the connector's session, and the connection record is destroyed 30 days later. Each device or app has its own connection, so disconnecting one leaves the others in place; disconnecting every connection listed in Connected apps ends them all. A connection older than 24 hours with no valid token left, and a connection whose connector sign-in session can no longer be renewed, are disconnected automatically, and deleting your account disconnects every connection (retention periods in Section 3).

21. App 內廣告（Google AdMob）

本條為參考譯文。如與韓文原文不一致，以韓文原文為準。

GenToon 行動 App 的部分畫面（「免費領取」分頁的獎勵廣告、作品結尾與社群動態中的橫幅廣告）可能會顯示 Google LLC 提供的 Google AdMob 廣告。付費方案使用者不會看到廣告。本節自包含廣告的 App 版本起適用，生效日期將至少提前 7 天公告（請參閱「Changes to This Policy」）。

22. 連載閱讀紀錄與系列訂閱

本條為參考譯文。如與韓文原文不一致，以韓文原文為準。

已登入的會員閱讀連載的某一話或訂閱某個系列時，我們會為了「繼續閱讀」和新章節通知處理以下資訊。

23. 應援（禮物與應援留言）

本條為參考譯文。如與韓文原文不一致，以韓文原文為準。

應援是讀者購買我們販售的應援商品（點數禮物）並送給作者的作品或系列的功能。只有年滿19歲的會員之間才能贈送與接收應援，且作者必須自行開啟「接收應援」後才能收到。

24. 創作者計畫：收益結算與支付

本條為參考譯文。如與韓文原文不一致，以韓文原文為準。

對於參加創作者計畫（另有條款）的作者，我們會結算其應援收益與廣告收益的分潤，並以點數或現金支付。為此，我們處理以下資訊。

25. 社群留言翻譯

本條為參考譯文。如與韓文原文不一致，以韓文原文為準。

點選「查看翻譯」時，我們會把該留言內文（最多500個字元）與目標語言傳送到 Google LLC 的 Gemini API 進行翻譯。為翻譯而傳送的留言不會用於訓練 AI 模型。

作者本人貼文下的其他語言留言（超過10個字元的一般留言）以及作者對這些留言的回覆，即使沒有人點選，也可能在發布後立即自動翻譯，譯文會標示為自動翻譯。

26. 周邊購買

本條為參考譯文。如與韓文原文不一致，以韓文原文為準。

本公司販售印有會員所創作角色與作品的周邊，周邊的販售方為本公司。您訂購周邊時，本公司依下列方式處理個人資料。

27. 周邊販售的附加處理

本條為參考譯文。如與韓文原文不一致，以韓文原文為準。

本公司就周邊販售（第26條），為了下單時的年齡確認、創作者的分享連結、販售顯示與販售排行、購買卡以及透過Printify在海外製作，依下列方式處理個人資料。

28. 點數應援

本條為參考譯文。如與韓文原文不一致，以韓文原文為準。

點數應援是會員將自己的一部分點數連同應援留言一起送到其他會員公開貼文的功能。不會產生付款，與購買應援商品後送出的應援（第23條）是不同的功能。

29. 周邊評價、收藏與站內通知的個人資料處理

本條為參考譯文。如與韓文原文不一致，以韓文原文為準。