The company operating Cinema Forest (the "Service"; see the Business Information page, the "Company") complies with the Personal Information Protection Act of Korea and other applicable laws, and processes personal information as follows.
1. Information We Collect
| Category | Items | How collected |
|---|---|---|
| Account | Email address, name (display name) | Entered at sign-up or provided by your Google account (OAuth) |
| Uploaded content | Images you upload | While using the Service |
| Generation history | Generation requests, generated output, credit usage | Collected automatically while using the Service |
| Payment | Order history, amounts, payment approval details | When purchasing credits (card numbers and other payment-instrument details are processed directly by the payment processor and are not stored by the Company) |
| Automatic | Access logs, browser information | While using the Service |
2. Purposes of Use
- Member identification, sign-up verification, account management
- Providing and improving the Service, including AI image generation
- Processing credit purchases/payments and managing payment history
- Preventing fraudulent use and securing service stability
- Complying with legal obligations (e.g., transaction record retention under the E-Commerce Act)
3. Processing of Uploaded Images (Important)
- Images you upload are transmitted to a third-party AI model, the Google Gemini API, for generation purposes.
- Transmitted images are handled under Google's API data processing policies. The Company does not use uploaded images for any purpose other than generation.
- Uploaded images and output are retained only as long as needed to provide the Service and are then destroyed.
4. Outsourcing and Third-Party Provision
| Processor | Entrusted work |
|---|---|
| Google LLC (Firebase) | Member authentication (sign-in) |
| Google LLC (Gemini API) | AI image generation |
| Toss Payments Co., Ltd. | Payment processing |
The Company does not provide personal information to third parties except with separate consent or a legal basis.
5. Retention Periods
- Personal information is destroyed without delay upon account deletion, except as retained under law:
- Records on contracts and withdrawal of offers: 5 years (E-Commerce Act)
- Records on payment and supply of goods: 5 years (E-Commerce Act)
- Records on consumer complaints and dispute resolution: 3 years (E-Commerce Act)
- Access logs: 3 months (Protection of Communications Secrets Act)
- Uploaded images and output: destroyed once the purpose of provision is fulfilled.
6. Your Rights
- You may request access to, correction of, deletion of, or suspension of processing of your personal information at any time.
- Requests can be made via the in-service settings menu or the contact below; the Company will act within the statutory period.
- You may delete your account in the Service or request deletion by email.
7. Destruction Procedure
- Electronic files: permanently deleted using irreversible methods
- Other records: shredded or incinerated
8. Security Measures
- Minimization and management of access to personal information
- Encryption in transit (HTTPS)
- Retention of access records and prevention of tampering
9. Privacy Officer
- Name: [To be designated]
- Contact: the contact email on the Business Information page
You may direct privacy inquiries, complaints, and remedy requests to the privacy officer. You may also contact the Personal Information Infringement Report Center (privacy.kisa.or.kr, dial 118 in Korea).
10. Changes to This Policy
Changes will be announced in the Service at least 7 days before taking effect.
Addendum
This policy takes effect on July 6, 2026.