Privacy Policy
Seven And Creative Inc. ("the Company") complies with the Personal Information Protection Act and related laws of the Republic of Korea, and handles personal information as set out below.
1. Personal information we process
- On sign-up: email address, password (stored encrypted), and, where social login is used, the account identifier passed by that provider
- On paid use: the payment identifier, amount, currency, payment date and payment-method identifier passed by the payment provider
- Generated automatically during use: access date and time, IP address, usage records, and metadata about generation requests and their output
- Content uploaded or generated by the user
The Company does not store full card numbers or card PINs. The payment screen is provided by the payment provider, and the name, address and card details you enter there are not passed to the Company. After payment the Company receives only the items listed above — the payment identifier, amount and the like.
2. Purposes of processing
- Identifying members and providing the Service
- Creating and storing content, and managing credit balances
- Payment, refund and settlement of paid services
- Processing payments and refunds, and preventing fraudulent use of refunds and payments
- Responding to enquiries and handling disputes
- Meeting statutory obligations
3. Retention and use period
As a rule the Company destroys personal information without delay once the purpose of processing is achieved, except for records retained under law (section 4) and the abuse-prevention records of section 4-2, which are kept for their stated periods.
4. Retention required by law
The following records are kept separately from member information and are retained for the stated period even after an account is deleted.
| Record | Period | Legal basis |
|---|---|---|
| Records of contracts and withdrawal of subscription | 5 years | Act on Consumer Protection in Electronic Commerce, Art. 6 and Enforcement Decree Art. 6 |
| Records of payment and supply of goods | 5 years | Same Act |
| Records of consumer complaints and dispute resolution | 3 years | Same Act |
| Access logs | 3 months | Protection of Communications Secrets Act, Art. 15-2 and Enforcement Decree Art. 41 |
On withdrawal of membership, personal information is destroyed without delay. Records subject to the statutory retention above are kept for their period, and during that period a request for destruction may be refused (Personal Information Protection Act, proviso to Art. 21(1) and proviso to Art. 36(1)).
The Company uses those retained records as a basis for judging fraudulent use of refunds and payments. This falls within the purposes stated in section 2.
4-2. Separated retention for abuse prevention
When an account sanctioned for abusive use under Article 8(3) of the Terms is deleted, the Company keeps the following items separately from member records, to prevent the same person from repeating the abuse through re-registration and to respond to disputes.
| Item | Period | Basis |
|---|---|---|
| An irreversibly hashed e-mail identifier | 1 year after deletion | Personal Information Protection Act, Art. 15(1)6 (legitimate interest of the controller) |
| The abuse and sanction record (grounds, measures, damage assessment) | 1 year after deletion | Same provision |
The original e-mail address is not kept; the stored hash is used for no purpose other than blocking re-registration and responding to disputes, and is destroyed without delay when the period ends.
5. Provision to third parties
The Company does not provide personal information to third parties, except where there is a legal basis or where an investigative authority requests it through lawful process.
6. Processing entrusted to others
| Processor | Entrusted work | Country |
|---|---|---|
| Supabase, Inc. | Database, authentication, file storage | United States |
| Google LLC | Generation via AI models, social login | United States |
| OpenAI, L.L.C. | Generation via AI models | United States |
| Beijing Kuaishou Technology Co., Ltd. (Kling AI) | Generation via AI models | China |
| X.AI LLC (Grok) | Generation via AI models | United States |
| Topaz Labs, LLC | Upscaling via AI models | United States |
| Vercel Inc. | Web hosting | United States |
What reaches a generation processor: the prompt you write, and any image or video you upload in that feature. Account information — your name, e-mail and payment details — is not sent. Where uploaded material shows a real person, that person's personal information is sent too, which is why Terms Article 9(3) requires you to warrant that every such person has given explicit consent.
Transfer abroad: because these processors are located outside Korea, personal information is transferred abroad. The items, purposes and retention periods are those of the entrusted work above. A user may refuse the transfer, in which case use of the Service may be restricted.
7. Your rights
You may at any time request access to your personal information, correction of errors, deletion, or suspension of processing.
Account deletion can be requested directly in the Service's settings. Records subject to the statutory retention in section 4, and the abuse-prevention records kept separately under section 4-2, are excluded from a destruction request.
8. Destruction
- Procedure: destroyed without delay once the purpose is achieved. Records retained under law are destroyed once their period ends.
- Method: electronic files are deleted irrecoverably; printed material is shredded or incinerated.
When an account deletion is requested, the Company carries out destruction within five days at most after refund settlement (for a sanctioned account, the individual review under Article 10(8) of the Terms), statutory retention and the separated retention of section 4-2 have been processed.
9. Security measures
- Passwords stored encrypted
- Access rights kept to a minimum and access recorded
- Private storage, delivered through short-lived signed links
10. Data protection officer
For enquiries, complaints or remedies concerning personal information:
- Name: WONHO JO
- Title: Privacy Officer
- Contact: privacy@givemespace.studio
11. Remedies for infringement
- Korea Internet & Security Agency, Privacy Infringement Report Centre (privacy.kisa.or.kr / 118)
- Personal Information Dispute Mediation Committee (kopico.go.kr / 1833-6972)
- Supreme Prosecutors' Office, Cybercrime Investigation (spo.go.kr / 1301)
- Korean National Police Agency, Cyber Bureau (ecrm.police.go.kr / 182)
12. Changes to this policy
Changes are announced at least 7 days before they take effect, or at least 30 days in advance where they are unfavourable to users.