Privacy Policy

1. Introduction

This Privacy Policy explains how Vwrap collects, uses, shares, and protects information when you use our website, applications, and services (collectively, the "Service").

Vwrap is operated by Nu-F-O, a sole proprietorship registered in the Republic of Korea. In this Policy, "we," "us," and "our" refer to Vwrap / Nu-F-O.

The Service is available globally, including in the Republic of Korea. Because Vwrap is operated from Korea, all processing is subject to the Korean Personal Information Protection Act (K-PIPA) regardless of where you are located. If you are in the European Economic Area or the United Kingdom, the General Data Protection Regulation (GDPR / UK GDPR) also applies to your data. If you are in the United States, the applicable state consumer-privacy laws also apply to your data. This Policy is governed by the laws of the Republic of Korea, without prejudice to mandatory consumer-protection laws of your home jurisdiction.

By using the Service, you confirm that you have read this Policy and agree to the practices it describes. If you do not agree, please do not use the Service.

2. Information We Collect

We collect the following categories of information:

• Account information. Your email address and the authentication tokens generated by Supabase Auth when you sign up or sign in.
• Generation inputs. Images you upload (selfies, reference thumbnails, product or prop photos), prompts you submit, model and option selections, and the generated outputs returned to you.
• Usage data. Records of which features you use, which AI models you select, credit ledger entries (grants, consumption, reservations, refunds), error logs, and similar operational telemetry.
• Billing data. Subscription state (plan tier, status, renewal dates), Polar order and subscription identifiers, and refund history. Payment-card details are entered directly into Polar's hosted checkout and never reach our servers — Polar is our merchant of record and the controller of payment-instrument data.
• YouTube Data API responses. Public channel and video metadata returned by the YouTube Data API in response to queries you initiate. We do not access private or authentication-gated YouTube data.
• Device and log data. IP address, browser type and version, operating system, referring URL, and request timestamps. Used for security, abuse prevention, and rate-limit enforcement.

We do not knowingly collect government identification numbers, biometric identifiers (beyond the face photographs you voluntarily upload as generation inputs), precise geolocation, or special categories of data as defined under the GDPR.

3. How We Use Your Information

We use your information for the following purposes:

• Provide and operate the Service — render the user interface, store your assets, and return generated outputs.
• Process AI generation requests — send your inputs to the third-party AI providers that produce the outputs you request. See Section 4 for the sub-processor list and each provider's model-training policy.
• Bill subscriptions and credits through Polar as merchant of record. Maintain the credit ledger that records grants, reservations, consumption, and refunds.
• Detect abuse and secure the platform — enforce rate limits, detect automated misuse, investigate suspected fraud or violations of our Terms, and screen every uploaded image and free-form prompt for illegal or prohibited content before it is processed further. See Section 4 for who performs that check.
• Send transactional emails — sign-in links, password resets, billing receipts, plan-change confirmations, and material updates to this Policy. We do not send marketing emails without your prior opt-in.
• Improve the Service — review aggregated, anonymized usage metrics to prioritize features and fix bugs.

4. Service Providers and Sub-Processors (Entrustment of Processing)

Operating the Service requires us to entrust certain personal information to third-party service providers (collectively, "Processors"). Under K-PIPA Article 26 and GDPR Article 28, we disclose each Processor by name, the country where the data is processed, the categories of personal information shared, and the entrusted purpose. All Processors process personal information only on our documented instructions under a written data-processing agreement.

Where face photographs go. When you upload a selfie, the raw image is sent once to OpenAI for an automated safety check, before anything else happens to it. OpenAI returns a safe-or-flagged classification and nothing else; if the image is flagged, the upload is refused. OpenAI does not generate or edit images for us, and under its API terms the image is not used to train its models. After the check passes, the selfie goes to Google (Gemini API), Replicate, or fal.ai for image generation and editing, and to Supabase for object storage. Selfies are never sent to Anthropic, Polar, Vercel, or Fly.io.

Model-training policy. We select providers that, by contract and in their published API terms, do not use API customer data to train their underlying models. The relevant data-processing addenda are available at: OpenAI DPA, Anthropic DPA, Google Cloud DPA, Replicate Security and DPA, fal.ai Privacy, Supabase DPA, and Polar DPA.

Changes to the Processor list. If we add a new Processor, change the country in which an existing Processor processes your data, or materially change how a Processor is used, we will update this Policy and post a notice at least 30 days in advance. You may delete your account at any time if you object to a Processor change, and your request will be honored within 10 days as described in Section 8.

We do not, under any circumstances, use your Inputs or generated Outputs to train our own machine-learning models.

Facial Images and Biometric Identifiers (BIPA / CUBI)

We do not collect biometric identifiers as defined by the Illinois Biometric Information Privacy Act (BIPA), Texas Capture or Use of Biometric Identifier Act (CUBI), or similar state laws. Our use of facial images is limited to creative image generation at your request and to an automated safety check on the upload, and does not involve creating biometric templates, faceprints, or identifiers for identification purposes.

Photographs you upload as "selfies" are used as visual inputs to AI image-generation models — the same way you would use a reference photograph in a graphics editor — and, once at upload, as the subject of an automated safety check. We do not derive a faceprint, run face-recognition matching against the photo, attach it to any identity database, or use it to recognize you across sessions or other services.

How we handle the upload itself:

• Every upload is safety-checked first. The raw image is sent once to OpenAI's automated moderation endpoint, which returns a safe-or-flagged classification. A flagged image is refused and never reaches an image model or our storage.
• One-off uploads are deleted automatically. By default, a selfie you upload for a single generation is deleted (image bytes and database row) once the generation finishes (success or failure).
• Saving to your Selfie Library is opt-in. If you tick the "Save to my selfies" option before uploading, the selfie persists in your private library and can be reused for future generations. Saved selfies stay until you delete them.
• You can delete saved selfies at any time via the delete button on each selfie in the Selfie Library. Deletion removes both the database record and the underlying storage objects (original and background-removed copies).
• One-time upload acknowledgment. Before your first selfie upload, you confirm a short notice acknowledging that the image is used for creative generation and for the safety check, and is shared with the named providers below. This acknowledgment is recorded with a timestamp on your account.

Where face images go. Every selfie goes to OpenAI once for the safety check described above. After it passes, it is routed to the AI provider that generates or edits the image, which depends on the model you select:

• OpenAI — United States. One automated safety check on the raw upload, before any other processing. It returns a classification only; OpenAI does not generate or edit images for us, and does not use the image to train its models.
• Google (Gemini API) — United States. Image generation, image editing, and triage analysis when a Gemini model is selected.
• Replicate — United States. Image generation and model-hosted editing operations (e.g., Seedream, Qwen Image Edit, background removal, layer detection).
• fal.ai — United States. Fallback image generation and editing for the same model family above.
• Supabase — United States. Encrypted object storage for the upload itself (original and background-removed copies) while the selfie is in use or saved to your Library.

We do not send selfies to Anthropic, or to any provider listed in Section 4 other than the five named above. OpenAI receives the image for the safety check only — not for generation, not for editing, not for embeddings.

What we don't do. We do not sell or share facial images with advertisers or marketers. We do not run face recognition against your selfie or other users' selfies. We do not retain a derived "face vector," faceprint, or biometric template. The processed image stored alongside your Library entry is a background-removed PNG of the same photograph — not a biometric identifier.

5. How We Share Information

Beyond the Processors listed in Section 4, we share your information only as described below. Under K-PIPA Article 17, the categories of third-party recipients and the basis on which we share are:

• YouTube Data API (Google LLC, United States). When you initiate a search or channel lookup, we send your query to the YouTube Data API operated by Google. Public results are returned to us; we do not transmit your account information to YouTube in this flow. Purpose: returning public YouTube channel and video analytics you requested. Retention: query strings are stored in our operational logs for up to 90 days for security and rate-limit enforcement.
• Legal and safety disclosure. We may disclose information when required by valid legal process (including subpoenas, court orders, or government investigation requests under the laws of the Republic of Korea or any other jurisdiction with authority over us), to protect our rights and property, or to prevent imminent harm.
• Business transfers. If Vwrap is acquired, merged, or otherwise reorganized, your information may be transferred as part of the transaction. We will notify you in advance and provide a reasonable opportunity to delete your account before the transfer takes effect.

We do not sell your personal information. We do not share personal information with third parties for their independent advertising or marketing purposes.

6. Data Retention

• Account data — retained while your account is active, and for up to 90 days after deletion to allow recovery and to complete pending billing reconciliation.
• Generation outputs — retained as user-accessible assets for 12 months from creation. After 12 months, outputs are moved to archival storage and are no longer displayed in your library, but may be retained for billing-audit and merchant-of-record record-keeping purposes. After 24 months total, archived outputs are hard-deleted.
• Uploaded selfies — selfies you upload for a single generation are deleted automatically once that generation finishes. Selfies you explicitly save to your Selfie Library are retained until you delete them. See the "Facial Images and Biometric Identifiers" section above for the full handling.
• Other uploaded source media (reference thumbnails, asset uploads) — retained for the duration of your account, subject to per-asset time-to-live policies described in the product. You may delete any uploaded asset at any time from your library.
• Billing logs and credit ledger — retained for seven (7) years in compliance with Korean tax law and Polar's merchant-of-record record-keeping requirements.
• Operational logs (security, error, audit) — typically retained for 90 days, with extended retention for security investigations as needed.

You may request earlier deletion as described in Section 7. We will honor such requests within 30 days, subject to the legal and billing-record retention obligations noted above.

7. Your Privacy Rights

California Residents (CCPA / CPRA)

If you are a California resident, you have the right to:

• Know what categories of personal information we collect, use, share, and disclose.
• Access the specific personal information we have collected about you in the prior 12 months.
• Request deletion of your personal information, subject to legal exceptions.
• Correct inaccurate personal information.
• Limit the use and disclosure of sensitive personal information.
• Opt out of the sale or sharing of personal information for cross-context behavioral advertising. (As noted in Section 5, we do not sell or share personal information for these purposes.)
• Non-discrimination for exercising any of these rights.

You may exercise these rights by emailing support@vwrap.ai. We may need to verify your identity before fulfilling a request. You may also designate an authorized agent to make requests on your behalf, consistent with California regulations.

Other US State Residents

Residents of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Iowa, Indiana, Tennessee, New Jersey, Delaware, New Hampshire, Minnesota, Rhode Island, Nebraska, and other US states with comprehensive privacy statutes have analogous rights to access, correct, delete, port, and opt out of certain processing. To exercise these rights, email support@vwrap.ai.

European Union, EEA, and United Kingdom Residents (GDPR / UK GDPR)

If you are in the EU, EEA, or UK, you have the right to:

• Access the personal data we hold about you.
• Rectify inaccurate or incomplete data.
• Erasure ("right to be forgotten"), subject to legal exceptions.
• Restrict processing in certain circumstances.
• Data portability — receive a machine-readable copy of data you provided.
• Object to processing based on our legitimate interests.
• Withdraw consent at any time where processing is based on consent.
• Lodge a complaint with your national data protection authority.

Our legal bases for processing are: (i) performance of the contract between you and us (necessary to provide the Service); (ii) legitimate interests in operating, securing, and improving the Service; (iii) compliance with legal obligations; and (iv) consent, where required for specific processing.

Republic of Korea Residents (K-PIPA)

Under the Korean Personal Information Protection Act (개인정보보호법), you have the following rights with respect to personal information we hold about you (개인정보 자기결정권):

• Right of access (Article 35) — request a copy of the personal information we hold about you, including what we collect, how we use it, who we share it with, and how long we retain it.
• Right of correction and deletion (Article 36) — request that inaccurate or incomplete personal information be corrected or deleted.
• Right to suspend processing (Article 37) — request that we stop processing your personal information. Where suspension would prevent us from providing the Service, we will explain the impact before suspending.
• Right to data portability (Article 35-2, as amended) — receive a machine-readable copy of personal information you provided.
• Right to withdraw consent — at any time, withdraw consent you previously gave for processing based on consent (including marketing-email consent and biometric-processing consent at selfie upload). Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
• Right not to be subject to automated decisions that significantly affect you (Article 37-2, as amended in 2026) — we do not currently make automated decisions about you with legal or similarly significant effects. If we add a feature that does, we will provide notice and an opt-out as required.

We will respond to verified requests within 10 days of receipt, in accordance with K-PIPA Article 38. If we cannot complete a request within 10 days, we will notify you of the reason and the expected response time.

If you are dissatisfied with our response, you may contact our Personal Information Protection Officer (개인정보보호책임자) at support@vwrap.ai, file a complaint with one of the Korean authorities listed in Section 10 below, or lodge a complaint with the Personal Information Protection Commission (개인정보보호위원회) at www.pipc.go.kr.

How to Exercise Your Rights

Send your request to support@vwrap.ai from the email address associated with your account, or include sufficient information for us to verify your identity. We will respond within the timelines required by applicable law (generally 10 days for K-PIPA, 30 days for GDPR, 45 days for US state laws). If we deny a request in whole or in part, we will explain why and inform you of any appeal mechanism available under your jurisdiction.

8. International Data Transfers (Cross-Border Transfer)

Vwrap is operated from the Republic of Korea. Because every Processor listed in Section 4 is located outside Korea, your personal information is transferred and processed in those countries. Under K-PIPA Article 28-8 and GDPR Articles 44–49, we disclose the following with respect to cross-border transfers:

• Destination countries. United States (all Processors, including our merchant of record Polar Software, Inc. in Delaware and its payment processor Stripe, Inc.).
• Recipients. Each named Processor in the Section 4 table is the recipient of the categories of data listed in the same row. We do not transfer your personal information to any recipient not listed in Section 4 (except as described in Section 5).
• Purposes. The entrusted purposes listed in the Section 4 table.
• Categories transferred. The data categories listed in the Section 4 table.
• Date and method of transfer. Transfers occur on a continuous basis over encrypted network connections (TLS 1.2 or higher) at the time you take an action that requires the corresponding Processor (for example, uploading a selfie triggers a transfer to OpenAI for the safety check, and then to the AI provider you selected).
• Retention. Each Processor retains transferred personal information for the period required to provide the entrusted service plus the additional period required by its own legal-record obligations (typically up to 30 days for inference requests, up to 7 years for billing records).
• Legal safeguards. For transfers from Korea, we rely on the legal basis under K-PIPA Article 28-8(1) (necessary for performance of the contract with the data subject) and obtain separate consent at signup as required. For transfers from the EEA, UK, or Switzerland, we rely on Standard Contractual Clauses (SCCs), UK International Data Transfer Addendum, or applicable adequacy decisions.
• Right to refuse cross-border transfer. You may refuse cross-border transfer of your personal information, but because every Processor listed in Section 4 is essential to operating the Service, refusal will mean you cannot use the Service. To refuse, do not create an account or, if you have an existing account, delete it as described in Section 7.

9. Data Security and Breach Notification

We protect your information using industry-standard administrative, technical, and physical safeguards, including TLS encryption in transit, encryption at rest for stored data, role- and row-level-security policies on our database, segregated environments for production and development, and access controls limited to the minimum personnel needed to operate the Service.

Breach notification. No system is perfectly secure. If we become aware of a security breach (or, from September 11, 2026, a suspected breach under the K-PIPA March 2026 amendment) affecting your personal information, we will notify:

• You, via email to the address on your account, within 72 hours of becoming aware, in accordance with K-PIPA Article 34 and GDPR Article 34;
• The Personal Information Protection Commission (개인정보보호위원회) via the breach-reporting channel at www.privacy.go.kr within 72 hours, in accordance with K-PIPA Article 34; and
• Any other regulator with jurisdiction over the affected data (including EU supervisory authorities under GDPR Article 33) within the timelines required by applicable law.

The notification will describe the nature of the breach, the categories and approximate number of affected records, the likely consequences, the measures we have taken or propose to take, and a contact for further information.

You are responsible for maintaining the confidentiality of your account credentials. Please notify us immediately at support@vwrap.ai if you believe your account has been compromised.

10. Korean Personal Information Protection (개인정보 보호)

This Section consolidates the disclosures required of a Korean personal-information controller under K-PIPA Article 30 (privacy policy required disclosures) and Article 31 (designation of a Personal Information Protection Officer).

10.1 Personal Information Protection Officer (개인정보보호책임자, CPO)

Under K-PIPA Article 31, we designate the following individual as our Personal Information Protection Officer (개인정보보호책임자), who is responsible for overall management of personal-information protection and for responding to your inquiries, complaints, and requests to exercise your rights:

• Name: EOM TAE HO
• Title: Personal Information Protection Officer (개인정보보호책임자)
• Affiliation: Nu-F-O (operating as Vwrap)
• Email: support@vwrap.ai

Direct any privacy-related inquiry, request to exercise your K-PIPA rights (Section 7), or complaint about our handling of personal information to the CPO at the email above. We will acknowledge receipt within 5 business days and respond substantively within 10 days of receipt of a verified request.

10.2 K-PIPA Article 30 Required Disclosures (Summary)

For your convenience, the following table indexes the K-PIPA Article 30 required disclosures to the corresponding section of this Policy:

10.3 Complaint and Dispute Channels (Korea)

In addition to contacting our CPO, residents of Korea may file privacy-related complaints or seek redress through the following official channels:

• Personal Information Protection Commission (개인정보보호위원회) — www.pipc.go.kr. The supervisory authority for K-PIPA.
• Korea Internet & Security Agency (KISA) — Personal Information Violation Reporting Center (개인정보침해신고센터) — phone 118 (free, no area code) / privacy.kisa.or.kr. Reports infringement of personal information.
• Personal Information Dispute Mediation Committee (개인정보분쟁조정위원회) — phone 1833-6972 / www.kopico.go.kr. Mediates disputes between data subjects and controllers.
• Korean National Police Agency — Cyber Bureau (경찰청 사이버수사대) — phone 182 / ecrm.police.go.kr. For criminal complaints involving personal-information misuse.
• Supreme Prosecutors' Office — Cyber Investigation Division (대검찰청 사이버수사과) — phone 1301 / www.spo.go.kr.

11. Children's Privacy

The Service is not intended for users under the age of 16, and we do not knowingly collect personal information from anyone under 16. Under K-PIPA, processing personal information of children under 14 requires the verifiable consent of a legal representative; we do not offer a workflow that supports such consent and therefore do not accept users under 14. If you are a parent or guardian and believe your child has provided us with personal information, please contact support@vwrap.ai and we will delete the information from our systems.

12. Cookies and Similar Technologies

We use a small number of strictly necessary cookies to keep you signed in. Payments are handled on Polar's hosted checkout, which Polar operates on its own domain. We do not currently use third-party analytics or advertising cookies. See our Cookie Policy for the complete list and for the essential / non-essential categorization required under the July 2025 PIPC Consolidated Guidelines.

13. Changes to This Policy

We may update this Policy from time to time. If we make material changes (for example, adding a new AI sub-processor, expanding the categories of information we collect, or changing how we share information), we will notify you by email at least 30 days before the change takes effect, and update the "Last updated" date at the top of this page. Minor or clarifying changes will take effect when posted.

Continued use of the Service after the effective date of an update constitutes acceptance of the updated Policy.

14. Contact Us

Privacy questions, requests to exercise your rights, or breach notifications should be sent to our Personal Information Protection Officer (개인정보보호책임자) at the contact information in Section 10.1. General operator information:

• Email: support@vwrap.ai
• Operator: Nu-F-O (operating as Vwrap), a sole proprietorship registered in the Republic of Korea

We endeavor to respond to all inquiries within five (5) business days, and to formal rights requests within the timelines required by applicable law (10 days for K-PIPA, 30 days for GDPR, 45 days for US state laws).