Privacy Policy
Last updated: April 19, 2026
1. Overview
Planum ("Company") operates Recreto ("Service"). This Privacy Policy explains what personal information we collect when you use our Service, how we use it, and what measures we take to protect it.
- Business name: Planum
- Representative: Hal Choi
- Business registration: 653-16-01798
- Address: 80 Arisu-ro 93da-gil, Gangdong-gu, Seoul, South Korea
- Email: [email protected]
2. Information We Collect
We collect the following personal information when you use our Service.
Required information
| Category | Data collected | Purpose |
|---|---|---|
| Account | Email address, name (Google OAuth or magic link) | User identification, login, service notifications |
| Photos | Selfie photos (facial images), AI-generated photos | AI photo generation and delivery |
| Payment | Payment method info, transaction history, credit usage | Credit purchase processing, refunds, tax compliance |
| Support | Email, name, subject, message content | Customer support and quality improvement |
3. Sensitive Information (Facial Images)
Selfie photos contain facial images that may be considered sensitive biometric data. We handle them as follows.
- Facial images are used solely for AI photo generation.
- They are never used for AI model training.
- Upon account deletion, all data including original selfies and generated photos are deleted within 7 days.
- We obtain separate consent for sensitive data collection at the time of upload.
4. Data Retention Periods
| Category | Retention period | Basis |
|---|---|---|
| Selfie & generated photos | Deleted within 7 days of account deletion | User consent |
| Account info (email, name) | Deleted immediately upon account deletion | User consent |
| Payment & transaction records | 5 years | E-Commerce Act, National Tax Basic Act (Korea) |
| Support inquiry records | 3 years | E-Commerce Act (consumer complaint handling) |
5. Third-Party Data Processors
We use the following third-party processors to operate our Service.
| Processor | Purpose | Data shared | Server location |
|---|---|---|---|
| Replicate | AI image generation | Selfie photo (via presigned URL) | United States |
| Anthropic Claude | AI image analysis | Selfie photo (via URL) | United States |
| Cloudflare R2 | Photo storage | Selfie photos, generated photos | Global CDN |
| Supabase | Database, authentication | Account info, credit history | South Korea (AWS Seoul) |
| Toss Payments | Domestic payment processing (KR) | User ID, order data | South Korea |
| Polar.sh | International payment processing | User ID, order data | United States |
| Resend | Email delivery | Email address | United States |
| Google Analytics | Website analytics (only with consent) | Page views, traffic sources, device and browser information | United States |
| PostHog | Product analytics (only with consent) | Event logs, page paths, and session information | United States |
5-2. AI-Generated Content Notice
- We transmit your uploaded photo to AI models to generate new images. Generated photos are AI-created and are not real photographs.
- AI outputs may differ from the original face, and expression, styling, or background may not match your intent.
- Your uploaded photos are used solely for image generation and are never used to train AI models.
6. International Data Transfers
To provide our Service, personal data is transferred internationally as follows.
- Replicate (US): Selfie photos are sent via presigned URL for AI photo generation.
- Anthropic Claude (US): Selfie photos are sent via URL for image analysis.
- Cloudflare R2 (Global): Photos are stored on a global CDN for storage and delivery.
- Polar.sh (US): User ID and order data are sent for international payment processing.
- Resend (US): Email addresses are sent for email delivery.
- Google Analytics / PostHog (US): Visitor statistics and product usage events are sent to analytics services only when the user consents.
Each processor complies with the data protection laws of their respective jurisdictions. We ensure appropriate safeguards through contractual agreements.
7. Your Rights
Under applicable privacy laws, you have the following rights.
- Right to access: You can request to see the personal data we hold about you.
- Right to correction: You can request correction of inaccurate information.
- Right to deletion: You can request deletion of personal data that is no longer needed.
- Right to restrict processing: You can request a temporary halt to data processing.
- Right to withdraw consent: You can withdraw previously given consent at any time.
To exercise these rights, contact [email protected] or use the privacy request tools in your account page. We handle verified requests in line with applicable law.
You can request a data export or submit a privacy request from your account page. Where GDPR applies, we generally respond within one month.
8. Cookies
We always use essential cookies, and we use analytics cookies only when the user allows them. For details and preference changes, please see our Cookie Policy.
9. Data Destruction Procedures
Personal data past its retention period is destroyed as follows.
- Photo files: Permanently deleted from Cloudflare R2 within 7 days of account deletion. Files cannot be recovered.
- Database records: Completely removed from Supabase.
- Legally required records: Retained separately even after account deletion and destroyed promptly once the retention period ends.
10. Privacy Officer
For all inquiries regarding personal data processing, please contact our Privacy Officer.
- Name: Hal Choi
- Title: CEO
- Email: [email protected]
You may also contact the following organizations for privacy-related complaints or consultations.
- Personal Information Infringement Report Center (privacy.kisa.or.kr / 118)
- Personal Information Dispute Mediation Committee (kopico.go.kr / 1833-6972)
- Supreme Prosecutors' Office Cyber Investigation Division (spo.go.kr / 1301)
- National Police Agency Cyber Bureau (police.go.kr / 182)
11. Changes to This Policy
If we make changes to this policy, we will notify you at least 7 days before the effective date via in-service notice or email. The updated policy takes effect on the announced date.
12. Contact
If you have any questions about this Privacy Policy, please contact us at [email protected].