Announced 8 October 2026 Β· Effective 15 October 2026
This Privacy Policy explains how Picme ("Picme", "we", "us") processes your personal data when you use the Picme app and website (the "Service"). We are the data controller. This is the English edition of our Korean privacy policy and follows the same structure and section numbering; the Korean edition governs in the event of any discrepancy.
We process personal data for the purposes below, and do not use it for any other purpose.
β We process and retain personal data within the retention period you consented to at collection, or the period required by law.
β‘ The specific periods are as follows.
| Data | Retained for |
|---|---|
| Account registration and management | Until the service agreement ends or you close your account β extended only until settlement where a debt or credit remains outstanding |
| Records of contracts, withdrawal of subscription, payment and supply of goods in e-commerce | 5 years (required by the Act on Consumer Protection in Electronic Commerce) |
| Records of consumer complaints and dispute resolution | 3 years (required by the Act on Consumer Protection in Electronic Commerce) |
| Records of labelling and advertising | 6 months (required by the Act on Consumer Protection in Electronic Commerce) |
| Photo files (uploaded originals, retouched versions, production outputs) and photo review records | 6 months from the order date |
| Input photos and generated results in the image generation menu (discontinued 21 September 2026) | 30 days from the date of generation |
| Photos submitted to the photo spec check menu | 30 days from the date of the check (for the check and for improving its accuracy) |
| Photos attached to a review | For as long as the review is posted (deleted together with the review when you delete it) |
| Photos attached to an enquiry | 3 years after the enquiry is closed (kept as a record of consumer complaints and dispute resolution) |
| Delivery addresses saved to your address book | 3 years from your most recent use, renewed each time you place an order. Deleted immediately when you close your account. Delivery addresses recorded on an order follow the transaction-record retention period above. |
| Service usage records, access logs, in-app screen recordings | 6 months |
β’ Uploaded original photos, retouched versions and image files generated during production are kept for 6 months from the date of service and then deleted in a way that cannot be recovered. However, records of orders, contracts, payments, refunds, supply and dispute resolution that must be retained under applicable law are kept separately from the image files for the period required by law.
β£ Six months after the order date, we minimise the personal data in the remaining order record as follows.
β We provide personal data to a third party only where you have consented, or where Articles 17 and 18 of the Personal Information Protection Act otherwise permit it.
β‘ We currently provide personal data to third parties as follows.
The companies listed in section 4 are processors acting on our instructions, not third parties receiving data for their own purposes.
β To operate the Service we entrust processing as follows.
| Processor | Entrusted work |
|---|---|
| Google LLC | Account authentication, storage of data and photo files, sending notifications, usage analytics and error reporting, assisted judgment for photo review (only photos you submitted for review) |
| PostHog, Inc. | Analysis of service usage behaviour and in-app screen recordings |
| OpenAI, L.L.C. | Drafting automated replies to customer enquiries (message text only; attached photos are not sent), generating automatic replies to reviews, multilingual translation, assisted judgment for photo review (only photos you submitted for review) |
| Korea PortOne Inc. | Payment processing and transaction lookup |
| Toss Payments Corp. | Card and other payment processing |
| Apple Inc. | Account sign-in authentication |
| Korea Post | Delivery of goods |
Which processor receives your photo, and from which menu, is set out menu by menu in section 4-4 below.
β‘ When entering into a processing agreement, in accordance with Article 26 of the Personal Information Protection Act we set out in the contract that the processor may not process personal data beyond the purpose of the entrusted work, together with technical and managerial safeguards, restrictions on sub-processing, supervision of the processor, and liability for damages; and we supervise whether the processor handles personal data safely.
β’ If the entrusted work or the processor changes, we will disclose the change through this policy without delay.
β To provide the Service we transfer personal data outside the Republic of Korea as follows.
| Recipient | Country | Data transferred | When and how | Purpose | Retention |
|---|---|---|---|---|---|
| PostHog, Inc. | United States | Service usage records, device information, IP address, in-app screen recordings | Transmitted over the network while you use the app | Analysis of service usage behaviour | 6 months |
| OpenAI, L.L.C. | United States | Enquiry message text, review text, text for translation, photos submitted for review | Transmitted over the network when an enquiry or review occurs and when a photo review is requested | Generating automated replies and translations, assisted judgment for photo review, image generation | Destroyed immediately after processing |
| Google LLC | United States | Photos submitted for review | Transmitted over the network when a photo review is requested | Assisted judgment for photo review | Destroyed immediately after processing |
| Postal authority of the destination country | Delivery address country | Recipient name, address, contact number | When an international shipment is lodged | Delivery of goods and delivery tracking | Until delivery is completed |
β‘ Under Article 28-8(1) of the Personal Information Protection Act you may refuse these transfers. If you do, some or all of the Service will become unavailable to you.
β Facial information we collect. Picme does not generate or store biometric
information β facial feature points, templates or embeddings β for the purpose of identifying
or authenticating a face. The app has no face recognition feature. What we process is the
photo file itself, which you chose and uploaded yourself.
β‘ Purpose of use. Uploaded photographs are processed solely to edit and print
them to the specification you selected (dimensions, background, framing) and to determine
whether they meet the submission requirements of the receiving institution. The outcome is
stored as rejection-reason codes (e.g. insufficient lighting, face too large); facial
measurements are not stored.
β’ Third-party sharing and storage location. Photo files are kept in cloud
storage operated by Google LLC under a contract in Picme's name, and no one other than Picme
can access them. Which processor receives your photo, and from which menu, is set out menu by
menu in section 4-4 below. The coordinates and values our staff refer to when judging the
specification are computed on our own servers, exist in memory only for the duration of the
comparison, and are neither transmitted outside nor stored.
β£ Retention period. Order photos and review records are kept for 6 months from
the order date, results of the (discontinued) image generation menu for 30 days from generation, and photos submitted to the spec check
for 30 days from the date of the check (see section 2). If you request deletion in the app, photo
files are deleted immediately (except for the records retained by law under section 6).
β€ How to delete. In the app, open My Picme > Privacy management
and choose "Delete personal data" or "Delete account". Photo files and delivery
information stored on our servers are deleted, and order history is no longer shown. Photos in
your cart can be removed individually from the cart screen. Requests sent to
help@picme.kr are also handled within 5 days. If you have a paid order that is still being produced or shipped, deletion does not proceed so that printing and delivery can be completed; you can request it again once delivery is complete.
β₯ Records that remain after deletion. Records of contracts, withdrawal of
subscription, payment and supply of goods must be retained under the Act on Consumer Protection
in Electronic Commerce. These are not destroyed on a deletion request and are kept for the
periods stated in paragraph 2 (proviso to Article 21(1) of the Personal Information Protection
Act). Within those records we mask the middle digits of the phone number and delete the
detailed address, the raw payment-gateway response and the refund account number, so
that only the minimum needed to evidence the transaction remains.
β¦ Review procedure. Photo review is carried out in the following order.
- First pass β a rule-based program. On our own servers in Korea we
locate the face in the photograph and compute the head angles (yaw, pitch and roll), shoulder
level, headroom above the crown and a smile measure, then compare each against a fixed
threshold. Photographs that clearly fall outside the criteria are rejected on that comparison
alone. The photograph is not transmitted anywhere outside during this pass.
- Second pass β review by our staff. Photographs the rules cannot
decide are examined by a member of our staff, who selects the rejection reason.
- Assisted β server review. Only for photographs you have submitted
for review, an assisted judgment to support our staff's decision is handled by the processors
listed in sections 4 and 4-2 (Google LLC and OpenAI, L.L.C.). Photographs not submitted for
review are not transmitted. The
assisted judgment is reference material only; the final decision is made by our staff.
The app takes photos from you in the five menus below (4-4-3 is retained only for the discontinued menu). A photo can come from your photo library or from the in-app camera in the Capture tab; each item applies the same way in both cases. The first time you use each menu, the app shows you the corresponding item and opens the photo picker only after you have confirmed and consented. If you do not consent, only that menu becomes unavailable; all other features remain available.
As a data subject you may exercise the following rights in relation to Picme at any time.
These rights may also be exercised through a legal representative or an authorised agent. Contact us using the details in section 8.
In-app screen recordings may contain images of the screens you interacted with. Before collection we mask the photographs you upload and information that could identify you β delivery address, contact details, refund bank account and the like β so that they are not captured in those recordings.
When you first open the iOS app and reach the Home screen, the app asks once, through Apple’s App Tracking Transparency framework, whether you allow tracking. We do not collect the advertising identifier (IDFA), and every feature works the same whether you allow it or not. You can change this at any time in Settings > Privacy & Security > Tracking on your device.
As a rule we destroy personal data without delay once the purpose of processing has been achieved. The procedure, deadline and method are as follows.
β Picme has overall responsibility for personal data processing, and has designated the following Data Protection Officer to handle complaints and provide remedies in relation to personal data processing.
β‘ You may raise with the Data Protection Officer any enquiry, complaint or request for remedy relating to personal data protection that arises while using the Service. We will respond to and act on your enquiry without delay.
This Privacy Policy applies from its effective date. Where content is added, deleted or corrected in accordance with law or our policy, we will give notice through our announcements from 7 days before the change takes effect.
In accordance with Article 29 of the Personal Information Protection Act we take the technical, managerial and physical measures necessary to secure personal data, and we carry out an internal audit regularly (once per quarter) to ensure that personal data is handled securely.
Related: Terms of Service Β· Refund Policy