Announced 11 August 2026 · Effective 18 August 2026
This Privacy Policy explains how Picme ("Picme", "we", "us") processes your personal data when you use the Picme app and website (the "Service"). We are the data controller. This is the English edition of our Korean privacy policy and follows the same structure and section numbering; the Korean edition governs in the event of any discrepancy.
We process personal data for the purposes below, and do not use it for any other purpose.
① We process and retain personal data within the retention period you consented to at collection, or the period required by law.
② The specific periods are as follows.
| Data | Retained for |
|---|---|
| Account registration and management | Until the service agreement ends or you close your account — extended only until settlement where a debt or credit remains outstanding |
| Records of contracts, withdrawal of subscription, payment and supply of goods in e-commerce | 5 years (required by the Act on Consumer Protection in Electronic Commerce) |
| Order history and photo files | 6 months |
| Customer service logs and photo review records | 6 months |
| Service usage records, access logs, in-app screen recordings | 6 months |
① We provide personal data to a third party only where you have consented, or where Articles 17 and 18 of the Personal Information Protection Act otherwise permit it.
② We currently provide personal data to third parties as follows.
The companies listed in section 4 are processors acting on our instructions, not third parties receiving data for their own purposes.
① To operate the Service we entrust processing as follows.
| Processor | Entrusted work |
|---|---|
| Google LLC | Account authentication, storage of data and photo files, sending notifications, usage analytics and error reporting, automated photo review, image generation from photos† |
| PostHog, Inc. | Analysis of service usage behaviour and in-app screen recordings |
| OpenAI, L.L.C. | Drafting automated replies to customer enquiries, drafting review replies, multilingual translation, automated photo review, image generation from photos† |
| Korea PortOne Inc. | Payment processing and transaction lookup |
| Toss Payments Corp. | Card and other payment processing |
| Apple Inc. | Account sign-in authentication |
| Korea Post | Delivery of goods |
† Applies only if you use the “AI Lab” feature (generating an image from your photo). This feature is not offered in the app at present. If we offer it again, we will update this policy first.
② When entering into a processing agreement, in accordance with Article 26 of the Personal Information Protection Act we set out in the contract that the processor may not process personal data beyond the purpose of the entrusted work, together with technical and managerial safeguards, restrictions on sub-processing, supervision of the processor, and liability for damages; and we supervise whether the processor handles personal data safely.
③ If the entrusted work or the processor changes, we will disclose the change through this policy without delay.
① To provide the Service we transfer personal data outside the Republic of Korea as follows.
| Recipient | Country | Data transferred | When and how | Purpose | Retention |
|---|---|---|---|---|---|
| PostHog, Inc. | United States | Service usage records, device information, IP address, in-app screen recordings | Transmitted over the network while you use the app | Analysis of service usage behaviour | 6 months |
| OpenAI, L.L.C. | United States | Enquiry content, review content, text for translation, order photos | Transmitted over the network when an enquiry or review occurs, and when a photo review or image generation is requested | Generating automated replies and translations, automated photo review, image generation from photos† | Destroyed immediately after processing |
| Google LLC | United States | Order photos | Transmitted over the network when image generation is requested | Image generation from photos† | Destroyed immediately after processing |
| Postal authority of the destination country | Delivery address country | Recipient name, address, contact number | When an international shipment is lodged | Delivery of goods and delivery tracking | Until delivery is completed |
† Applies only if you use the “AI Lab” feature, which is not offered in the app at present.
② Under Article 28-8(1) of the Personal Information Protection Act you may refuse these transfers. If you do, some or all of the Service will become unavailable to you.
Picme does not generate or store biometric information — facial feature points or templates —
for the purpose of identifying or authenticating a face. Uploaded photographs are processed
solely to determine whether they meet the submission requirements of the receiving
institution, and the outcome is stored as rejection-reason codes.
Photo review is carried out in the following order.
① First pass — a rule-based program. On our own servers in Korea we locate
the face in the photograph and compute the head angles (yaw, pitch and roll), shoulder level,
headroom above the crown and a smile measure, then compare each against a fixed threshold.
Photographs that clearly fall outside the criteria are rejected on that comparison alone. The
photograph is not transmitted anywhere outside during this pass.
② Second pass — review by our staff. Photographs the rules cannot decide are
examined by a member of our staff, who selects the rejection reason.
③ Optional server-assisted check. Only for a photograph that is difficult to
judge, and only when a member of our staff explicitly requests it, is the photograph handled
by the processors listed in sections 4 and 4-2. It is never transmitted automatically.
The coordinates and values used in the comparison exist in memory only for the duration of the comparison and are not stored. Photographs are deleted completely from our servers when you delete the order or when the retention period expires.
As a data subject you may exercise the following rights in relation to Picme at any time.
These rights may also be exercised through a legal representative or an authorised agent. Contact us using the details in section 8.
In-app screen recordings may contain images of the screens you interacted with. Before collection we mask the photographs you upload and information that could identify you — delivery address, contact details, refund bank account and the like — so that they are not captured in those recordings.
As a rule we destroy personal data without delay once the purpose of processing has been achieved. The procedure, deadline and method are as follows.
① Picme has overall responsibility for personal data processing, and has designated the following Data Protection Officer to handle complaints and provide remedies in relation to personal data processing.
② You may raise with the Data Protection Officer any enquiry, complaint or request for remedy relating to personal data protection that arises while using the Service. We will respond to and act on your enquiry without delay.
This Privacy Policy applies from its effective date. Where content is added, deleted or corrected in accordance with law or our policy, we will give notice through our announcements from 7 days before the change takes effect.
In accordance with Article 29 of the Personal Information Protection Act we take the technical, managerial and physical measures necessary to secure personal data, and we carry out an internal audit regularly (once per quarter) to ensure that personal data is handled securely.
Related: Terms of Service · Refund Policy