Draft for legal review — not yet in force

Privacy Policy

개인정보 처리방침 (초안)

What we collect, why, who else sees it, how long we keep it, and how you get it back or deleted.

Draft version 0.1 · Drafted 23 September 2026 · YEPPO AI Inc. (주식회사 예뽀에이아이) · hello@yeppo.ai

1. Who is responsible

YEPPO AI Inc. (주식회사 예뽀에이아이), a Korean corporation with its principal place of business at [ADDRESS, SEOUL, KOREA], business registration number [BUSINESS REGISTRATION NUMBER], is the personal information controller for yeppo.ai and its subdomains (skin, routine, shop) and the Yeppo mobile app.

Privacy officer (개인정보 보호책임자): [NAME, TITLE] · hello@yeppo.ai. Write to that address for anything in this policy.

[REVIEW] Korea's PIPA requires a named privacy officer with contact details, and a Korean-language version of this policy. Appoint the officer and have counsel produce the Korean text before launch. If you have users in the EU or UK, confirm whether an EU/UK representative is required.

2. What we collect

Everyone

• Account: email address and password, or a Google sign-in, handled by our authentication provider. Display name and avatar if you add them.
• Language and the things you save: saved products and articles, cart, routine steps, goals and streak notes.
• Device and usage: pages viewed and actions taken, the campaign or link that brought you (UTM values, referring page), and a shortened, irreversible fingerprint (a one-way hash) of your IP address and browser used for click attribution and rate limiting. We do not store the raw IP address for those records.

Skin analysis and quiz

• Your answers: skin type, concerns, age range, budget preference.
• Analysis results: scores, classified concerns, severity, the recommendation template chosen, and whether the result suggests seeing a dermatologist.

Photographs are not stored. A selfie you submit for analysis is held in memory only long enough to produce those scores, and is then discarded. No copy is written to our storage, and no image is sent to a third party as part of the skin analysis.

Information about your skin is sensitive information under Korean law and health data under European law. We process it only with your separate consent, given when you start an analysis or quiz.

If you shop

• Order contents, amounts and currency, and your shipping address.
• Payment card details go directly to our payment processor. We never receive or store your full card number.

If you apply as a creator (Yeppo Models)

• Your display name, biography, country, chosen categories, values, the brands you will not work with, the languages you speak, and the skin concerns you want to create content about.
• The social handles you give us, and the public profile information we then look up for them: follower and post counts, average likes and comments, engagement rate, profile picture, verification status and the country the account appears to be based in.
• The score we calculate from that information, and its breakdown.
• Content you upload, its title, description and tags, and the automated quality screening result.
• Earnings, payouts and the identifiers our payment provider gives us.
• Where required for payment and tax: your legal name, country of tax residence, tax identification number and any tax form you upload. This is only collected when you are set up for payouts.

[REVIEW] Tax identification numbers (including 주민등록번호) are subject to strict, specific rules under PIPA, which generally forbid collecting a resident registration number without an explicit legal basis. Counsel must confirm the basis, the retention period and the encryption requirements before this data is collected in production.

If you register as a brand

• Company name, business email, website, product categories, and the identifiers our payment processor gives us for your purchases.

3. Why we use it, and on what basis

You can withdraw consent at any time by writing to us. Withdrawing consent for skin information means we stop analysing and delete the results, so the recommendations stop working.

4. Who else processes your information

We use these providers. They act on our instructions and are not allowed to use your information for their own purposes.

We also disclose information where the law requires it, and to a buyer if the business is sold, in which case we will tell you first.

[REVIEW] PIPA requires naming each processor and each recipient outside Korea, with the country, the items transferred and the retention period, and (for overseas transfers) separate consent unless an exception applies. Counsel should convert this table into the prescribed format and confirm each provider's contract terms.

5. Where your information goes

Our providers operate outside Korea, including in the United States and the European Union. When your information is transferred there, we rely on the provider's data-processing terms and standard contractual protections. Ask us and we will tell you which provider holds what.

6. How long we keep it

• Account and profile: while your account exists, then deleted within [30] days of closure.
• Analysis and quiz results: while your account exists, or until you delete them.
• Orders, payouts and tax records: for the period Korean commercial and tax law requires, currently [5] years.
• Creator profile snapshots: 90 days, then deleted automatically.
• Analytics and attribution: [12] months.

[REVIEW] Deletion is now built: “Delete my account” in your settings erases your profile, analyses, routine, saves and creator application, and detaches you from order and payout records kept for tax. Still outstanding: the 90-day snapshot purge exists in SQL but its schedule is switched off, and the other periods above are proposals until the retention jobs run. Confirm the figures with counsel.

7. Your rights

You can ask us to:

• show you what we hold about you, and give you a copy;
• correct anything that is wrong;
• delete your account and your data;
• stop or restrict a particular use, including withdrawing consent;
• explain any decision made automatically about you, such as a creator score, and have a person review it.

Write to hello@yeppo.ai. We answer within 10 days under Korean rules, or one month where European rules apply. If you are unhappy with our answer you can complain to the Personal Information Protection Commission (privacy.go.kr, 국번없이 182) or your local authority.

8. Cookies and what we store in your browser

• Sign-in cookie, so you stay signed in across yeppo.ai and its subdomains.
• Security cookies for social-account connection and for maintenance access.
• Local storage on your device: your language, cart, saved items, quiz and routine progress, a creator application draft, and the identifiers of analyses you ran before signing in. This stays on your device.
• Analytics cookies set by PostHog.

[REVIEW] There is no cookie consent banner today. Analytics cookies generally need prior consent for EU/UK visitors, and Korea requires clear notice and a way to refuse. Decide whether to add a banner or to limit analytics to strictly necessary measurement.

9. Children

Yeppo is for adults. You must be 18 or older to use it. We do not knowingly collect information from anyone under 18, and we delete it if we discover we have.

[REVIEW] Today the 18+ confirmation is only collected in the creator application. Add an age check at sign-up, or narrow this statement to match what the product enforces.

10. How we protect it

Access is restricted to the people who need it, traffic is encrypted in transit, payment details never reach our servers, and analysis photographs are never written to storage. No service can promise perfect security, but we will tell you and the authorities without delay if a breach affects you.

11. Changes

If we change this policy we will post the new version here and, for changes that matter to you, tell you by email or in the app at least [7] days before they take effect.

This draft was prepared from how the Yeppo product works today. It is not legal advice. Korean counsel (변호사) must review it, and every [PLACEHOLDER] must be filled in, before it takes effect.