Privacy Policy
This is an English translation provided for convenience. If it differs from the Korean version (한국어판), the Korean version prevails.
1. What we receive
- Account: the email address, name, and Google account identifier that Google provides when you sign in with Google. We do not receive passwords.
- Payments: the order number, amount, type of payment method, and the transaction number issued by the payment company. Card numbers and bank account numbers are handled by the payment companies (Toss Payments, PayPal) and do not reach us.
- Bank transfer: the depositor name you enter at checkout. If you request a cash receipt (Korea), the mobile number or business registration number used to issue it is passed straight to our deposit-confirmation provider (PayAction); our servers record only which type you requested.
- Refunds: only when a payment cannot be canceled and we refund to a bank account, we receive a refund account (bank, account number, account holder) in the name of the person who paid.
- Usage records: operational records such as request times, the features and models used, credit changes, and connection addresses (IP).
- Work materials: the reference materials you upload, the prompts you enter, and the results you make.
- Checkout confirmation: the version, content identifier and language of the Terms confirmed for an order, and the confirmation time recorded by our server.
2. What we use it for
- To identify your account and sign you in
- To record the credit ledger and process payments and refunds
- To perform generation jobs and keep results in your storage
- To send notices such as credit expiry, changes to rates or terms, and service shutdown
- To prevent misuse and outages and to find their causes
We do not use it for advertising or give it to third parties for advertising purposes.
3. Services we use
We use the services below for sign-in, payments, deposit confirmation, storage, generation and email delivery. They process the information needed for each function.
| Company | Purpose | Information processed |
|---|---|---|
| Google sign-in | Sign-in request information. We receive the email address, name and account identifier you authorize Google to share. | |
| Toss Payments | Domestic payments and refunds | Order number, amount, email, name and other information needed for payment. Card and bank details are handled directly by the payment company. |
| PayPal | International payments and refunds | Order number, amount and transaction information. PayPal collects and processes payment details directly. |
| PayAction 십단콤보(주) | Bank transfer confirmation and cash receipts | Order number, depositor name, amount and deposit deadline, and, if you request a cash receipt, the number used to issue it (mobile number or business registration number). Orders are matched using the deposit notices for our account (depositor name and amount). Cash receipts are issued to the National Tax Service by PayAction through Linkhub (Popbill). |
| Cloudflare | Servers, database and file storage | Account and payment records, reference materials, prompts, results and service usage records. |
| OpenAI | GPT image generation and editing | The prompt, reference images and generation settings for the requested job. |
| Resend Plus Five Five, Inc. | Member email delivery | Recipient email address, message subject and body, and information needed for the notice. |
Depending on the image or video request, we also send the prompt, reference materials and generation settings to the external generation service handling that job. Generation requests do not include your member email or payment information. Personal information you include in prompts or uploaded materials may be transferred as part of those inputs.
Overseas processing and member email
Some services process information on servers outside Korea. Necessary information is transferred over encrypted connections when you use a feature or we send an email. The recipient company for Resend is Plus Five Five, Inc.; it processes and stores email content and delivery records in the United States. Contact: privacy@resend.com.
Resend’s published policy gives a 30-day email and log retention period on standard plans; backups may persist for 7 days. To request deletion or restriction of processing, contact support@denomcp.com. Depending on your request, email notices or the relevant feature may become unavailable. We will explain the scope and outcome.
Provider information: Resend retention · Resend processing agreement · OpenAI API data controls
4. How long we keep it
- Account information and usage records: deletion starts when you choose immediate closure. If you choose deletion in 7 days, data is retained during that recovery window and then deleted automatically. Only the minimum information needed for active jobs, payments or refunds remains until those processes settle.
- Payment, refund and contract records: 5 years. Complaint and dispute records: 3 years. Closure confirmation records (random account identifier and request/deletion times): 5 years. Required records are separated from live accounts and accessible only to authorized staff.
- Access logs: 3 months.
- Reference materials remain until you delete them or close the account. Generated results are retained for 30 days without a paid top-up history, or 180 days with one.
5. Access keys and agent connections
Access keys are used only to identify your account when your agent connects to our service. A key’s original text is shown only at the moment it is issued, and we keep only its hash. If you think a key has leaked, turn it off on the account page and issue a new one.
When you connect an agent by signing in with Google, we record that agent app’s name and its connection and last-use times so that we can show them under “Connected agents” on the account page, and we keep sign-in tokens only as hashes, never in their original form.
6. Your rights
You may request to view, correct, or delete your information, or to stop its processing. Send your request to support@denomcp.com, and we will handle it within 10 business days after verifying your identity. On the account page, you can choose immediate closure or deletion in 7 days. Server-side account information, access keys, reference materials and results are deleted; legally required records are kept separately and automatically removed at the end of their retention period. After a backup restore, closure receipts are applied first to block deleted accounts and remove their restored materials. Retention of sent emails by Resend follows the information in Section 3.
7. How we protect it
All transmissions are encrypted with HTTPS, access keys and sign-in tokens are stored only as hashes, and payment-integration secrets are kept only in the server’s encrypted secret store. Only operators with access rights handle the database and storage.
8. Person in charge and contact
Chief Privacy Officer: 황규연 (Representative). support@denomcp.com · +82-10-2832-1706. When we change this policy, we announce the changes and their effective date on the site. Changes unfavorable to you, such as using information we already hold for a new purpose, are announced 7 days before they take effect; other changes take effect on the day they are announced.