Privacy Policy
Effective date: 2026-10-17
Petalab Inc. ("we", "us" or the "Company") processes personal information in connection with Yapee (the "Service") in accordance with the Personal Information Protection Act of the Republic of Korea and other applicable laws. This policy explains what we process, why, how long we keep it and what rights you have. Additional information for users outside Korea is in our Regional Privacy Disclosure.
1. What we process, why, and for how long
We process only what we need to provide the Service. To sign up, we ask only for a username and password; we do not collect your email address or phone number.
| Category | Data | Purpose | Retention |
|---|---|---|---|
| Sign-up (required) | Username, password (one-way hashed) | Identify members, sign-in, fraud prevention | Until account closure |
| Profile and settings (optional) | Display name, bio, profile image, language | Show your profile, set the display language | Until you remove it or close your account |
| Additional account details (optional) | Gender, date of birth | Kept for your own account record; not used for age checks, public display or AI requests | Until you remove it or close your account |
| Adult verification | Whether you are an adult, verification time, attempt records | Confirm eligibility | Status until closure; attempt records for 1 year |
| Duplicate reward prevention | A non-reversible value derived from your Korean identity linking code (CI) | One rewards account per person | 1 year after closure |
| Works and conversations | Character and work settings, uploaded images and audio, chat inputs and AI responses, chat personas, notes and memories, comments | Provide the Service, continue conversations | Until you delete them (see section 4 for closure) |
| Reports | Report reason and a copy of the reported content | Handle Usage Policy violations, protect users | 3 years after resolution |
| Blocks | Blocked works and creators | Hide what you have blocked | Until you unblock |
| Support | Inquiry text, attached images, replies | Respond to inquiries, handle disputes | 3 years (Korean E-Commerce Act) |
| Feedback and closure reasons | Ratings, comments, closure reason | Improve the Service | 3 years |
| Paid purchases | Order number, product, amount, payment and refund results | Payments, refunds, statutory records | 5 years (Korean E-Commerce Act) |
| Automatic top-up (if you sign up) | Billing key issued by the payment provider (encrypted) | Run automatic top-ups | Until you cancel or close your account |
| Push notifications (if enabled) | Browser push subscription | Send notifications | Until you turn them off or close your account |
| Original work submissions (if you apply) | Email, contact details, introduction, submitted manuscript | Review and notify results | 1 year after review ends |
| Creator kit (if you apply) | Recipient name, phone number, address, shipping details | Ship the kit | The period you agreed to when applying (90 days by default) |
| Creator cash payouts (if you apply) | Name, Korean resident registration number, bank and account number, copies of ID and bankbook | Payouts, tax withholding, payment statements | 5 years (Korean Framework Act on National Taxes) |
| Collected automatically | IP address, access time, request path, browser information, cookies | Security, troubleshooting, keeping you signed in, blocking excessive requests | Server logs: 14 days |
- You enter card numbers and other payment details directly on the payment provider's screen. We never receive or store them.
- During adult verification, the name, date of birth and CI sent by the verification provider are used only to determine your age and to check for duplicate reward participation. We do not store them as received; for duplicate checks we keep only a non-reversible value derived from the CI.
- Resident registration numbers are processed only for creator cash payouts that require tax withholding and payment statements under the Korean Income Tax Act.
- We do not intentionally collect sensitive information such as beliefs, health or sex life. Please do not enter such information, or anyone else's personal information, in conversations or works.
2. AI processing and training
- To generate AI responses, we send the necessary parts of your chat input, character and work settings, chat persona and notes, and earlier conversation to external AI model providers. We do not send your username or other account identifiers.
- Our AI routing service (OpenRouter) is configured to exclude model providers that collect user data.
- We do not use your conversations or works to train our own AI models without your separate consent.
3. Disclosure to third parties
We do not provide your personal information to third parties, except with your consent, where the law requires it, or where an investigative authority requests it through legal procedures.
4. Account closure and deletion
- When you close your account, we replace your username with a random value, delete your display name, language, gender and date of birth, public profile and adult verification status, and deactivate the account. You are signed out on all devices.
- Your public Characters and Works become private. Manuscripts, conversations and uploaded files remain linked to the deactivated account. Public comments stay visible with the author name replaced by an anonymous name.
- After closure we have no way to verify that a deletion request comes from you, so we may be unable to process it. To delete works or conversations, delete them yourself or contact support before closing your account.
- We delete personal information without delay when its retention period ends or its purpose is fulfilled. Electronic files are deleted so they cannot be recovered. Backup copies become eligible for deletion after 35 days, and previous versions are removed 35 days after that.
- Information we must keep by law is stored separately and used only for that purpose.
5. Service providers (processors)
We use the following service providers. See also Third-Party Service Providers.
| Provider | Service | Status |
|---|---|---|
| Amazon Web Services, Inc. | Servers, database, files, backups and logs (Seoul region) | Active |
| Vercel Inc. | Website hosting and delivery | Active |
| OpenRouter, Inc. and connected model providers | AI response generation | Not yet enabled in production |
| Toss Payments Co., Ltd. | Payment processing | Not yet connected |
| PortOne Inc. and identity verification agencies | Adult verification | Not yet connected |
We send no personal information to providers that are not yet connected until the related feature launches. Before changing or adding a provider, we update this policy and the Third-Party Service Providers page.
6. International transfers
Personal information is transferred outside Korea as described below. These transfers are necessary to perform our agreement with you.
| Recipient | Country | Data | Purpose | When and how | Retention |
|---|---|---|---|---|---|
| Vercel Inc. (privacy@vercel.com) | United States and other countries on the delivery path | IP address, browser information, request content, cookies | Website delivery and hosting | Over the network each time you access the Service | Per Vercel's retention policy after the request is handled |
| OpenRouter, Inc. (privacy@openrouter.ai) and connected model providers | United States and countries where model providers operate | Chat input, character settings, chat persona and notes, earlier conversation | AI response generation | Over the network when you request an AI response | Data collection opt-out configured; subject to each model provider's retention policy |
| Google LLC, Mozilla Corporation, Apple Inc. | United States | Push subscription address and notification ID | Browser push notifications | Over the network when a notification is sent | Per each company's policy |
- If you do not use AI conversations, nothing is sent to OpenRouter. If you do not enable push notifications, nothing is sent to push services.
- OpenRouter and push notifications are currently turned off in production.
7. Your rights
- You may request access to, correction, deletion or restriction of processing of your personal information, and withdraw consent, at any time.
- You can edit or delete your profile, additional account details and conversations in the Service. Send other requests to help@ypee.ai.
- We will verify your identity and respond within 10 days. We may refuse or partially fulfil a request where the law requires us to keep the information or where it could infringe someone else's rights, and we will tell you why.
- You may make a request through a legal representative or authorized agent. Please include a power of attorney.
8. Security measures
- Passwords are stored using one-way hashing.
- Resident registration numbers, bank account numbers, document images and billing keys are additionally encrypted with separate keys.
- All communication uses HTTPS, and storage volumes and backups are encrypted.
- Operational secrets are kept separate from code, and access to personal information is limited to staff who need it.
- Viewing sensitive information in admin tools requires separate permission and is logged.
9. Cookies and similar technologies
We use only cookies that are essential for keeping you signed in, preventing forged requests and remembering your language. We do not use advertising or analytics cookies. Your screen theme and unsent drafts are kept in browser storage. See our Cookie Policy for details and how to refuse them.
10. Minors
The Service is only for people aged 19 or older, and we do not knowingly collect personal information from anyone younger. If we learn that someone under 19 has signed up, we suspend the account and delete their information.
11. Privacy officer and contact
- Chief Privacy Officer: Seomgi, Han (Representative)
- Email: help@ypee.ai
- Phone: +82-70-4286-0788
- Address: 603ho, 6F, 69, Gangnam-daero 94-gil, Gangnam-gu, Seoul, Republic of Korea (Postal code 06131)
Send access requests, questions and complaints about personal information to the contacts above.
12. Remedies in Korea
If you need advice or remedies for a privacy infringement, you may contact the following Korean authorities.
- Personal Information Dispute Mediation Committee: 1833-6972 (www.kopico.go.kr)
- Personal Information Infringement Report Center: 118 (privacy.kisa.or.kr)
- Supreme Prosecutors' Office: 1301 (www.spo.go.kr)
- Korean National Police Agency: 182 (ecrm.police.go.kr)
13. Changes to this policy
We announce changes in the Service at least 7 days before they take effect. For important changes, such as to the data we collect, the purposes of use or disclosures to third parties, we announce them at least 30 days in advance.
If this English version conflicts with the Korean version, the Korean version prevails to the extent permitted by law.