개인정보처리방침Privacy Policy

1.Overview

[운영사명] (the "Company") values users’ personal data and complies with applicable laws, including the Personal Information Protection Act ("PIPA") of the Republic of Korea and the EU General Data Protection Regulation ("GDPR"). This Privacy Policy explains what personal data the Company collects, uses, retains, and destroys in providing LCMD Studio (the "Service").

2.Personal Data We Collect

The Company collects the following personal data to provide the Service.

• Registration information: email address, name (nickname), profile image
• Social login information: account identifier, email, and profile information provided by providers such as Google, Apple, Kakao, and Naver
• Service usage records: generation requests, menus used, settings, and the like
• Uploaded content: images, text, video, and other materials uploaded or entered by the Member
• Payment information: payment method details and transaction records (actual payment is processed through a payment gateway)
• Device, log, and cookie information: IP address, browser/OS information, access date and time, and information collected through cookies and similar technologies

3.Purposes of Collection and Use

The Company uses collected personal data for the following purposes.

• Member identification, verification, and account management
• Provision and operation of the Service, including AI-based visual and content generation
• Responding to customer inquiries and delivering notices
• Processing payment, settlement, and refunds for paid services
• Improving service quality, developing new features, and analyzing usage statistics
• Preventing misuse, ensuring security, and fulfilling legal obligations
• Providing marketing and event information based on user consent

4.Legal Basis for Processing

Where GDPR applies (e.g., for residents of the EU/EEA), the Company processes personal data on the following legal bases (Article 6 of the GDPR).

• Consent (Art. 6(1)(a)): receiving marketing information, collection of optional items, etc.
• Performance of a contract (Art. 6(1)(b)): processing necessary for registration and provision of the Service
• Compliance with a legal obligation (Art. 6(1)(c)): retention and reporting duties under applicable law
• Legitimate interests (Art. 6(1)(f)): service security, prevention of misuse, service improvement, etc.

5.Retention and Use Period

In principle, the Company destroys personal data without delay once the purpose of collection and use has been achieved or the Member withdraws.

However, where applicable law requires retention for a certain period (e.g., records on contracts, withdrawal of subscription, payment, and supply of goods under the Act on the Consumer Protection in Electronic Commerce), the data is retained for the period set by such law and then destroyed.

6.Provision to Third Parties and Outsourcing

The Company does not provide users’ personal data to third parties without consent, except where specifically provided by law. The Company may outsource the following tasks to provide the Service.

• Cloud/infrastructure providers: server hosting and data storage
• AI model/generation engine providers: processing to produce AI Output
• Analytics providers: usage statistics and quality analysis
• Payment gateways (PG): payment and settlement processing
• Customer support and messaging tools: handling inquiries and sending notifications

The Company stipulates data protection matters by contract with its processors and manages and supervises them to ensure personal data is processed safely.

7.International Transfers

In the course of providing a global service, personal data may be stored and processed outside the user’s country depending on the location of cloud infrastructure and the like.

Where an international transfer occurs, the Company puts in place appropriate safeguards such as an adequacy decision or Standard Contractual Clauses (SCCs) as required by the GDPR, and complies with the notice and consent procedures for cross-border transfers under PIPA.

8.Your Rights

Users may at any time request access to, correction of, deletion of, or suspension of processing of their personal data, or withdraw consent to its collection and use.

Users to whom the GDPR applies may additionally exercise the rights of access, rectification, erasure (the right to be forgotten), restriction of processing, data portability, and objection to processing. Rights may be exercised via the contact in this Policy; the Company will act without undue delay in accordance with applicable law and will not disadvantage users for exercising their rights.

9.Cookies and Tracking Technologies

The Company may use cookies and similar technologies to improve user experience, maintain login sessions, and analyze usage.

Users may refuse or delete cookies through their browser settings. However, blocking certain cookies may prevent some features of the Service, such as maintaining login sessions, from functioning properly.

10.Security Measures

The Company takes the following measures for the safe handling of personal data.

• Administrative measures: establishing and implementing an internal management plan, minimizing access privileges, and conducting regular reviews
• Technical measures: encryption of personal data, operation of access control systems, and retention of access logs with protection against forgery and alteration
• Physical measures: access control to server rooms, data storage rooms, and the like

11.Children’s Personal Data

The Service is, in principle, not intended for children under the age of 14 (per the Republic of Korea). In regions where the GDPR applies, personal data of children under the age of 16 (or the age set by the member state) is processed only with the consent of a legal guardian.

If the Company learns that personal data of a child under the applicable age has been collected without guardian consent, it will destroy such data without delay.

12.Privacy Officer

The Company designates a Privacy Officer who oversees personal data processing and is responsible for handling user inquiries, complaints, and remedies, as follows.

• Privacy Officer: [개인정보보호책임자]
• Contact: [contact@이메일]

13.Changes to this Policy

This Privacy Policy may be revised in line with changes in law, policy, or the Service.

When the Policy is revised, the Company will announce the changes and their effective date through the Service, and will provide separate notice for material changes.

14.Inquiries and Remedies

For privacy-related inquiries, please contact [contact@이메일].

If you need to report or consult about a personal data infringement, you may contact the following authorities.

• Personal Information Dispute Mediation Committee (kopico.go.kr)
• Privacy Infringement Report Center (privacy.kisa.or.kr / dial 118)
• Cyber Investigation Division, Supreme Prosecutors’ Office / National Police Agency
• EU/EEA users: you have the right to lodge a complaint with the supervisory authority in your place of residence.