Privacy Policy

VMAI (the 'Company') values users' personal information and complies with applicable privacy laws. This Privacy Policy explains how your personal information is collected, used, stored, and deleted in the services provided by the Company.

We collect the following personal information to provide our services.

Required Information

• Email address

• Password (stored encrypted)

Optional Information

• Nickname

• Profile picture

Payment Information (when using paid services)

• Payment method information (card type, last 4 digits of card number)

• Payment history and billing records

• Billing country

※ Full card numbers, CVV, and other sensitive payment information are not stored directly by the Company; they are securely processed by our payment processors (Polar, Stripe).

Automatically Collected Information

• IP address

• Browser type and version

• Operating system information

• Access date and time

• Cookie information

• Service usage records

• Subscription and credit usage records

We use the collected personal information for the following purposes.

1. Member Management

• Member registration and identity verification

• Providing member services

• Preventing fraudulent use

2. Service Provision

• Providing AI-based video generation service

• Managing work history

• Customer inquiry response

3. Paid Services and Payment

• Subscription management and payment processing

• Invoice issuance and payment history management

• Refund processing

• Payment-related customer support

4. Service Improvement

• Analyzing service usage

• Developing new services

• Providing personalized services

5. Marketing (with consent)

• New service announcements

• Event and promotion information

• Discount and special offer notifications

We destroy personal information without delay after the purpose of collection and use has been achieved.

Retention Period

• Member information: Until membership withdrawal

• Work history: Until membership withdrawal (or immediately upon user request)

• Service usage records: 3 years

• Payment and subscription records: 5 years (as required by law)

• Credit usage history: 5 years

Retention Required by Law

• Records related to contracts or subscription withdrawal: 5 years

• Records related to payment and supply of goods: 5 years

• Records related to consumer complaints or dispute resolution: 3 years

• Access records: 1 year

In principle, we do not provide users' personal information to third parties. However, exceptions are made in the following cases.

1. When the user has given prior consent

2. When required by law

3. When necessary for service provision (see outsourcing status below)

We outsource personal information processing for service provision as follows.

Personal information may be transferred to these countries in the course of performing outsourced tasks, and each service provider protects personal information in accordance with applicable laws.

Payment Information Processing Notice

Payment information is processed through Polar and Stripe. The Company does not directly store full card numbers, CVV, or other sensitive payment information. Stripe is a PCI DSS Level 1 certified payment service provider.

Users may exercise the following rights at any time.

1. Right of Access: You can verify the status of your personal information processing.

2. Right to Rectification: You can request correction of inaccurate personal information.

3. Right to Erasure: You can request deletion of personal information.

4. Right to Restriction: You can request suspension of personal information processing.

5. Right to Withdraw Consent: You can withdraw consent for marketing communications at any time.

How to Exercise Rights

• Directly modify/delete through the profile settings page in the service

• Subscription management: Manage directly through the subscription settings page in the service

• Email inquiry: [email protected]

Account Deletion Processing

When you request account deletion, all personal information, work history, and generated videos will be deleted. However, payment records and other information required to be retained by law will be stored separately and destroyed after the statutory retention period. Deleted information cannot be recovered.

We take the following measures to protect personal information.

1. Administrative measures: Establishing internal management plans, regular employee training

2. Technical measures:

• Personal information encryption (TLS in transit, AES-256 at rest)

• Password hashing

• Security program installation

• Access rights management

• Payment information tokenization (Stripe)

3. Physical measures: Server room access control (managed by cloud service providers)

The Company designates a Privacy Officer to oversee personal information processing and handle complaints and remedies related to personal information processing as follows.

Privacy Officer

• Email: [email protected]

Billing Inquiries

• Email: [email protected]

This Privacy Policy may be changed in accordance with changes in laws, policies, or security technologies. Changes will be announced through notices within the Service, and the changed policy will take effect 7 days after announcement. For significant changes, individual email notifications may be provided.