Privacy Policy

SKIPIKS ("Company") complies with applicable data protection laws, including Korea's Personal Information Protection Act, and processes the personal data of general users of the Service (the skipiks.ai website and the app) as described below. The personal data of Sellers and creators (look partners) is governed by the Seller Privacy Policy and the Creator Privacy Policy respectively.

We process the following items.

Our servers do not collect device model names or advertising identifiers (the app does not request the advertising-ID permission). Google's analytics tools may process device-type information for statistics; see "Cross-border Transfer of Personal Data" and "Cookies and Similar Technologies — Use and Opt-out" below. We do not process resident registration numbers or other unique identifiers, or sensitive data. Children under 14 cannot sign up.

• Sign-up and identification, keeping you signed in, password resets
• Providing the feed, look details, the Filterroom and other features, and personalization (excluding looks you have already seen, applying your language and filter settings)
• Linking products similar to the items in looks and counting product clicks (the basis for settling Sellers' exposure passes and creators' revenue shares, and preventing fraudulent clicks)
• Sending app notifications (if you allow them) and handling launch-notification requests
• Keeping the Service stable by analyzing app errors
• Improving the Service through usage statistics (viewed as aggregate statistics that do not identify individuals)
• Contractual notices such as changes to the Terms or the Service, responding to inquiries, and keeping records of sign-up consent and of rejections of changes to the Terms
• Carrying out the procedure under "Restrictions on Use" in the Terms of Service (notice of the reason, grounds and period, review of explanations and notice of the result, lifting of restrictions) and handling disputes (effective October 29, 2026)
• Complying with legal obligations

We process the following personal data without the data subject's consent on the legal bases below (Article 22(3) of the Personal Information Protection Act).

This processing is limited to what the purpose requires, and you may ask us to stop it as described in "Your Rights and How to Exercise Them". There is currently no processing based on consent. If we start processing that requires consent, such as sending advertising messages, we will ask for your separate consent in advance. We do not process pseudonymized data.

1. Member information (sign-up information and settings): use stops immediately when you delete your account (sign-in sessions are deleted), and it is destroyed as described in "Destruction Procedure and Method" 30 days after deletion.

2. During the 30-day grace period, signing in to the same account restores it, except for an account handled like a deletion because its service agreement was terminated (item 14 — effective October 29, 2026).

3. Service usage records (reactions, the Filterroom, view history, launch-notification requests) and app notification settings: deleted together with member information. You can clear your look view history at any time with "Start over" in the Service.

4. Sign-in sessions: deleted when they expire 30 days after issue, and immediately when you sign out or reset your password.

5. Product click records, share records and app notification delivery records: kept as the basis for settling Sellers' exposure passes and creators' revenue shares and for usage statistics, and deleted automatically — product click records 5 years after the click, and share records and app notification delivery records 1 year after they are recorded. For deleted accounts, the member number is removed from these records earlier, when member information is destroyed, so they can no longer be linked to anyone. Click records that were the basis of creator earnings credited per click under the former model are kept after 5 years only as the basis of those earnings, with the member number, device and connection details removed.

6. App error reports: deleted automatically 90 days after collection.

7. Push tokens: sending stops when you turn notifications off or the token becomes invalid; tokens are deleted when the member account is purged, and tokens of non-member devices are deleted on request and automatically 90 days after notifications are turned off or the token becomes invalid.

8. Password reset codes: cannot be used 30 minutes after they are sent and are deleted when member information is destroyed. Failed sign-in records are cleared when you sign in successfully or reset your password, and deleted when member information is destroyed.

9. Email sending records (password resets, notices of changes to the Terms, etc.): deleted automatically 1 year after sending. If member information is destroyed before then, the recipient address is removed first and only the time, type and result of sending remain.

10. Sign-up records (date, surface, app version), records of consent to the Terms and of notices of and rejections of changes to the Terms: kept to confirm which version of the Terms applies, for disputes and for sign-up statistics; after member information is destroyed they remain only with a member number that can no longer be linked to anyone. Records of notices of and rejections of changes to the Terms are deleted automatically 3 years after the account is deleted.

11. Usage analytics (Google): kept by Google for the Google Analytics data-retention period we configure.

12. Personal data that other laws require us to keep is stored separately from other personal data for the period set by that law and then destroyed.

13. Restriction records (level, grounds, reason, period, notices, and explanations and their results) (effective October 29, 2026): kept to carry out the procedure under "Restrictions on Use" in the Terms of Service and to handle disputes, and destroyed together with member information.

14. Members whose service agreement is terminated (effective October 29, 2026): when a service agreement is terminated (when the termination takes effect after the explanation period), the account is handled by the same procedure as an account deletion, and member information is destroyed 30 days after that day. Signing in again during that time does not restore the account.

1. We destroy personal data without delay once its retention period has passed or its purpose has been achieved. Accounts deleted more than 30 days ago, and records whose period under "Retention Period" has passed (product click, share, app notification delivery and email sending records and records of notices of and rejections of changes to the Terms), are handled by an automatic purge job that runs once a day.

2. An account deleted more than 30 days ago (including an account handled like a deletion because its service agreement was terminated — effective October 29, 2026) is handled as follows:

• Deleted: sign-in sessions, reactions to looks, the Filterroom, look view history, push tokens, notification settings, launch-notification requests, restriction records (effective October 29, 2026)
• Member account: email, nickname, profile image address, Google account ID, password hash, password reset data, failed sign-in records and language and feed filter settings are erased, and the email field is replaced with a placeholder that belongs to no one. If the same person signs up again, it becomes a new account. The sign-up date, surface and app version and the records of consent to, notices of and rejections of changes to the Terms remain, no longer linked to anyone.
• Kept with the member number removed (settlement and statistics basis): product click records, share records, app notification delivery records, app error reports
• Recipient address removed: email sending records

3. Personal data in electronic form is deleted from the database, or replaced with other values, so that it cannot be recovered. Past states retained by the database recovery feature (Cloudflare D1 Time Travel) can no longer be restored after 30 days. We do not process personal data on paper.

We send no personal data to OpenAI, Inc. AI image-generation, translation and product-comparison requests contain only service content such as look descriptions, product names and images — never emails, nicknames or account identifiers (so OpenAI is not a processor of personal data).

Cross-border transfer basis: under Article 28-8(1)3(a) of the Personal Information Protection Act, we disclose the following in this policy and transfer personal data abroad for the processing and storage that are necessary to conclude and perform the service agreement.

1. Cloudflare, Inc. (storage and processing — personal data is stored in Cloudflare data centers in the United States)

2. Google LLC (sign-in, usage analytics, app push notifications)

3. Resend, Inc. (sending email)

We do not share personal data with third parties except: (1) where you have separately consented in advance, or (2) where a law specifically provides for it or an investigative or other authority requests it through the procedure set by law.

Data sent to Google LLC for usage statistics is processing on our behalf, not sharing with a third party; its details and how to opt out are set out in "Cookies and Similar Technologies — Use and Opt-out". When you tap a product purchase link and move to an external shopping mall, we do not send the mall any information that identifies you.

1. Web: we use the following cookies and browser storage.

2. App: the app uses Google Firebase Analytics (app-instance identifier).

3. Through these tools, device, browser, screen (page) view, event (swipes, likes, shares, product clicks, etc.) and approximate-region data are transmitted to Google LLC. We use this data only for usage statistics and do not send Google directly identifying information such as names, email addresses or member numbers.

4. Opt out — opting out does not restrict use of the Service.

• Web: turning off My Page → Settings & Info → "Usage analytics" stops Google Analytics collection in that browser (the setting is stored in that browser, so turn it off separately in other browsers and devices). Blocking cookies in your browser stops visitor identification (_ga) but hits may still be transmitted. To stop transmission, install Google's Google Analytics Opt-out Browser Add-on (desktop browsers only — not available on mobile browsers).
• App: turning off My Page → Settings & Info → "Usage analytics" (on by default) stops Firebase Analytics collection on that device (from app version 1.0.30; the setting is stored on that device).
• App error reports are sent to our own servers and are sent regardless of this setting to keep the Service stable (not to identify individuals; only a hash of the IP is stored).

5. We do not collect advertising identifiers or serve personalized ads, and apart from the analytics tools above we use no advertising tools that collect behavioral data (ad SDKs, ad pixels, etc.). Members' reactions, view history and filter settings are used only to build the feed within the Service and for the Filterroom.

• Administrative: a designated Privacy Officer; the number of people who can access personal data kept to a minimum
• Technical: encryption in transit (HTTPS/TLS), one-way encrypted password storage (PBKDF2), signature verification of authentication tokens, operator sign-in authentication, a 15-minute sign-in lock after 5 consecutive failed sign-ins (members and operators), and hashing of IP addresses in product click records and app error reports
• Physical: we have no server room of our own; personal data is stored in the data centers of our storage processor Cloudflare (SOC 2 Type II certified) under its physical security controls.

1. You may at any time ask to access, correct or delete your personal data or to stop its processing, and you may withdraw any consent you have given.

2. How to exercise these rights

• My Page: view account information, change language, notification and "Usage analytics" settings, "Delete Account"
• Service screens: change feed filters, "Start over" (deletes your look view history), undo likes and items saved to the Filterroom
• Other requests: email contact@skipiks.ai or call 050-6998-9311

3. You may also make requests through a legal representative or an authorized agent, who must submit a power of attorney.

4. We act within 10 days of receiving a request and tell you the result. If we refuse or only partly grant a request under the law, we will tell you the reason and how to object.

Our feed and product recommendations are suggestions that help you choose; we do not make automated decisions that significantly affect your rights or obligations within the meaning of Article 37-2 of the Personal Information Protection Act.

• We use an external AI service (OpenAI) to generate looks, translate text and compare products, but we do not include users' personal data in those requests (see "Processors").
• We do not use users' personal data to train AI models.
• The "AI-generated" label on looks is displayed on Service screens; its targets and method are set out in "Labeling of AI-Generated Content" in the Terms of Service.
• Look-generation records (request content, model, time) are kept for operating the Service and quality control and contain no personal data.

Officer: 김규태 (대표)
Email: contact@skipiks.ai
Phone: 050-6998-9311

Inquiries, complaints and requests for redress about the processing of personal data can be made through the contacts above, and we will respond and act without delay.

For reports of or advice on personal data infringement, you may contact the following Korean bodies:

• Personal Information Dispute Mediation Committee: 1833-6972 (within Korea), www.kopico.go.kr
• Personal Information Infringement Report Center (Korea Internet & Security Agency): 118 (within Korea), privacy.kisa.or.kr
• Supreme Prosecutors' Office: 1301 (within Korea), www.spo.go.kr
• Korean National Police Agency: 182 (within Korea), ecrm.police.go.kr

When we change this policy, we announce it at the top of this page and at the bottom of the Service introduction page (skipiks.ai/home) at least 7 days before it takes effect. Supplements that contain nothing unfavorable to users (such as describing actual processing in more detail or adding ways to exercise rights) may take effect on the day they are announced. Earlier versions can be traced through the amendment notes below.

Amendment effective October 29, 2026 (notice given October 21, 2026)

Reason: to describe the records kept under "Restrictions on Use" in the Terms of Service (effective October 29, 2026) and how members whose service agreement is terminated are handled. It is announced 7 days before it takes effect.

• Items, purposes and legal basis: added restriction records (level, grounds, reason, period, notices, and explanations and their results).
• Retention and destruction: restriction records are destroyed together with member information. When a service agreement is terminated (when the termination takes effect after the explanation period), the account is handled by the same procedure as an account deletion, and member information is destroyed 30 days after that day (signing in again during that time does not restore the account).

Amendment effective September 30, 2026 (notice given on the effective date)

Reason: to set retention periods for records that were kept without a fixed period. Because it only shortens how long records are kept and reduces no user rights, it takes effect on the day it is announced.

• Retention: product click records 5 years; share, app notification delivery and email sending records 1 year; records of notices of and rejections of changes to the Terms 3 years after the account is deleted.
• Destruction: records past their period are deleted by the automatic purge job that runs once a day.
• Failed sign-in records: with the sign-in limit now also applied to member accounts, the failed sign-in record (count and lock-release time) is listed under items, legal basis, retention, destruction and security measures.

Amendment effective September 28, 2026 (notice given on the effective date)

Reason: to describe all processing we actually carry out, correct statements that were inaccurate, and complete the statutory disclosure items. Because nothing in it reduces users' rights, it takes effect on the day it is announced. The amendment announced on September 23, 2026 also only describes processing already under way, so it applies together with this amendment.

• Items: added feed filter (gender, season) settings, the details of product click records, sign-in sessions, password reset codes, app notification settings, email sending records and records of notices of and rejections of changes to the Terms.
• Legal basis: personal data processed without consent is now listed separately with its legal basis. The sign-up screen's approach of deeming you to have agreed to the Privacy Policy was removed together with the amendment to the Terms of Service.
• Retention: added periods for service usage records, sign-in sessions, product click records, password reset codes, email sending records and consent records, and deleted examples of statutory retention that do not apply to general users (5 years under the E-Commerce Act, 3 months under the Protection of Communications Secrets Act).
• Destruction: the destruction procedure and method (what the automatic purge 30 days after account deletion erases and what it keeps, and removal of recipient addresses from email sending records) are now described.
• Processors and cross-border transfer: added Resend, Inc. (U.S.), which sends our emails, and stated the legal basis for transfer abroad (Article 28-8(1)3(a)) and each recipient's contact. Data sent to Google for usage statistics, which had been described under "Third-Party Sharing", is now correctly described as processing on our behalf.
• Cookies: added how to turn usage analytics off with the "Usage analytics" setting on the web and in the app.
• Security, rights and remedies: added security measures, requests through an agent, the 10-day handling period and how to object. The infringement report contact had wrongly been given as the Personal Information Protection Commission at 182 (182 is the police number); this has been corrected and the contacts of four bodies are now listed.
• AI notice: deleted the inaccurate statements that all images are AI-generated, that watermarks contain the model ID, time and content hash (C2PA-compatible roadmap) and that compliance logs are kept for at least 3 years, and replaced them with the processing we actually carry out.

Amendment effective September 30, 2026 (notice given September 23, 2026)

Reason: with the app launch, to list every item we actually process and every cross-border transfer

• Items collected: added email sign-up items, sign-up consent records, the app's push token/app version/language, app error reports (OS, screen route, error content; IP stored only as a hash) and web/app usage analytics; stated that device model names and advertising IDs are not collected.
• Retention: added 90 days for app error reports and when push tokens are deleted.
• Cross-border transfer: added the transfer to Google LLC (sign-in, analytics, app push) with items, purposes, retention and how to refuse.
• Processors: added app analytics and push to Google LLC's tasks and clarified that no personal data is sent to OpenAI.

Business information corrected September 22, 2026

Reason: Mail-order business registration completed (filed September 17, 2026 · Mapo-gu, Seoul)

• Mail-order registration number: 2026-서울마포-2413 is now stated — the item listed as "in progress" in the September 23 amendment below. This supplements a statutory disclosure item rather than changing how personal data is processed, so the effective date is unchanged.

Amendment effective September 23, 2026 (notice given September 16, 2026)

Reason: Business registration completed (opened September 15, 2026) — business identification added and a Privacy Officer designated

• Business information: company name, representative, business registration number, address and hosting provider are now stated. Mail-order business registration is in progress; the number will be added once issued.
• Privacy Officer: the team label was replaced by the representative, 김규태.
• Cross-border transfer: the fact that personal data is stored on Cloudflare, Inc. (U.S.) servers, with the statutory disclosure items, was added under "Storage & Security".

Amendment effective August 29, 2026 (notice given August 22, 2026)

Reason: Introduction of usage analytics (Google Analytics 4)

• Third-party sharing: Disclosed that device, browser, page-view, and event data is transmitted to Google LLC.
• Processors: Added "usage analytics" to Google LLC's purpose.
• Cookies: Added _ga / _ga_<measurement-id> and opt-out instructions.

Analytics actually began operating on September 13, 2026; no data was collected before then (the measurement ID was not configured until that date, even after the August 29 effective date).