Privacy Policy

1. Controller

• Controller: Keuhan Inc., 8 The Green, Suite A, Dover, DE 19901, United States
• Korean payments and customer care: Keuhan Co., Ltd. (주식회사 크한), Seoul, Republic of Korea
• Privacy officer: Choi Wonseok (legal@poremu.ai · +82 1644 4627)
• Support: support@poremu.ai

2. Information we collect

We collect only what the Service needs.

Account (Google sign-in)

• Google account identifier (sub), email address, display name and profile picture URL
• We never see your Google password; access is limited to basic profile and email scopes.

Adult verification

• Republic of Korea (PASS): through the certified identity provider (via keuhan-auth) we receive the connecting information (CI), duplicate-join information (DI), name, date of birth, gender, mobile number and carrier. We store CI and DI only as salted, irreversible hashes, encrypt name and mobile number, and keep only the verification result (timestamp and method) rather than the full date of birth. Plain-text CI/DI is never stored.
• Elsewhere (age attestation): the date of birth you enter and the time you confirmed you are an adult
• Verification data is used solely to gate access to unfiltered models and to prevent duplicate accounts.

Payments

• Payments are processed by Toss Payments. We never collect or store full card numbers, CVC or expiry dates. We keep the billing key issued by Toss, the card brand, the last four digits, and transaction records (order id, amount, time, status).

Service usage

• Prompts, negative prompts, generation options, uploaded input images, outputs (images and videos) and thumbnails
• Credit ledger entries (reserve, capture, refund, top-up, expiry)
• API keys (stored hashed) and API logs (endpoint, status code, time, key id)
• Device and connection data: IP address, browser and OS, country, language and theme preference, cookie identifiers, access logs

Support

• Your email address, the content of your request and any attachments

3. How we use information

• Identify you, keep you signed in and secure your account
• Run generation jobs, deliver results and store them in your library
• Price jobs, process payments, renew subscriptions, auto-recharge, issue refunds, keep tax and accounting records
• Verify age and control access to adult content
• Detect and block prohibited content (minors, real-person deepfakes) and abuse
• Improve quality, respond to incidents and produce aggregated statistics (pseudonymized or anonymized)
• Comply with legal obligations and handle disputes
• Send product updates if you opted in (you can unsubscribe at any time)

4. Legal bases (where applicable)

Performance of a contract (providing the Service, payments); legitimate interests (security, fraud prevention, improvement); legal obligations (tax records, youth protection); your consent (adult verification, marketing).

5. Sharing and processors

We do not sell personal information. We share it only with the parties below, to the extent necessary.

• AI model providers (OpenAI, Google, xAI, Venice, Higgsfield): prompts, input images and options, for generation. Each provider's retention policy applies; where available we enable training opt-out.
• Toss Payments / Keuhan Co., Ltd.: payment authorization, billing-key management, e-commerce record keeping
• PASS identity provider and keuhan-auth: adult verification in Korea
• Amazon Web Services (Seoul region): servers, database, object storage, CDN
• Google: OAuth sign-in
• Law-enforcement agencies and courts when legally required

6. International transfers

We are a US company and our primary infrastructure is in the AWS Seoul region (ap-northeast-2). Some processing — AI model providers, Google sign-in — takes place in the United States and other countries. The data transferred is described in Section 5 and is transferred when you use the relevant feature. We apply appropriate safeguards such as standard contractual clauses. You may object to international transfers, but some features will then be unavailable.

7. Retention and deletion

• Account data: until you delete your account, plus a 30-day recovery window
• Outputs and input images: until you delete them or your account; fully purged from storage and CDN caches within 30 days of a deletion request
• Adult verification (hashed CI/DI, timestamp): 1 year after account deletion, to prevent duplicate and under-age re-registration
• Payment and credit ledger records: 5 years (Korean E-Commerce Act and tax law)
• Consumer complaints and dispute records: 3 years
• Access logs and IP addresses: 3 months, longer only while investigating a security incident
• Records of prohibited-content attempts (prompt, account id): up to 5 years for legal purposes
• Electronic records are destroyed irrecoverably; paper records are shredded.

8. Your rights

You may at any time:

• Access, correct, delete or restrict processing of your personal information
• Withdraw consent (e.g. disable adult verification or marketing emails)
• Request portability (export of your account data and outputs)
• Ask about automated decisions — apart from content-safety filtering we make no automated decisions with legal effect
• Use the Settings page or write to legal@poremu.ai. We act within 10 days after verifying your identity and explain any refusal.
• We do not knowingly collect data from children under 14 (or the applicable age in your country) and delete such data promptly if discovered.

9. Cookies

We use only the cookies below. We do not use advertising or cross-site tracking cookies.

• pm_at, pm_rt: sign-in session (essential)
• pm_locale: language preference (essential)
• pm_theme: light/dark preference (essential)
• You can block cookies in your browser, but sign-in and other essential features will not work.

10. Security

• TLS in transit, encryption at rest (AWS KMS), password-less Google OAuth
• Hashed CI/DI, hashed API keys, no card data on our systems (Toss billing keys)
• Least-privilege access, audited admin access, regular security reviews and an incident-response procedure
• In case of a personal-data breach we notify affected users and the competent authorities without undue delay (within 72 hours in Korea) as required by law.

11. Additional notice for users in Korea

• We regularly assess whether we must designate a domestic representative under Article 39-11 of the Personal Information Protection Act and will publish the details here if so. Customer care in Korea is currently handled by Keuhan Co., Ltd. (support@poremu.ai).
• Reporting and counselling: Personal Information Dispute Mediation Committee (1833-6972), Privacy Infringement Report Center (118), Supreme Prosecutors' Office Cyber Investigation (1301), National Police Agency Cyber Bureau (182)

12. Additional notice for users in the EEA, UK and California

• EEA/UK residents may lodge a complaint with their supervisory authority. California residents may exercise their CCPA rights (know, delete, correct, opt-out of sale/sharing — we do not sell or share personal information for cross-context advertising) by emailing legal@poremu.ai.

13. Changes

We will announce changes 7 days before they take effect (30 days for material changes) in the Service or by email and keep a change history on this page.

14. Contact

Privacy requests and complaints: legal@poremu.ai · General support: support@poremu.ai