Privacy Policy

Article 1 (Purposes and Items of Personal Information Processing)

The Company processes the minimum personal information necessary to provide the Service.

1. Registration and member management
   • Purpose: identifying users, identity verification, confirming adult status and eligibility, creating and managing accounts, preventing duplicate or fraudulent registration, managing the service agreement
   • Items: authentication UID, email address, whether identity was verified, the verification method used, adult status, eligibility status, time of verification, anonymous identifier, the issuing country (nationality) of the identity document
   • Items processed temporarily when the in-app SMS identity verification method is used: real name, mobile phone number, mobile carrier, and the first seven digits of the resident registration number or foreign registration number
   • Items processed temporarily when the passport or identity card verification method is used: the passport or identity card image, a facial photograph (selfie), liveness footage, document number, date of birth, gender, and issuing country (nationality)
   • Basis: formation and performance of the service agreement and, where obligations under applicable law apply, compliance with those obligations

   When the in-app SMS identity verification method is used, the above information is processed only temporarily while the verification request is transmitted to the identity verification agency, and is not stored in the Company’s database. The original CI/DI values received as the verification result are likewise not stored in the Company’s database; only the anonymous identifier necessary to prevent duplicate or fraudulent registration is used.

   Where the passport or identity card verification method is used, the identity document image, facial photograph, liveness footage, and document number are processed by Didit, a specialist identity verification provider, and are not stored in the Company’s database. The Company receives and retains only the verification outcome and the issuing country (nationality) of the identity document; the document number is used solely to generate the anonymous identifier that prevents duplicate or fraudulent registration and is discarded immediately thereafter. Where a determination cannot be made automatically, Didit reviewers may examine the submitted originals directly, and once the determination is complete the Company requests deletion of the originals held by Didit.

2. Provision of profile and matching services
   • Purpose: composing and displaying profiles, recommending users, browsing and filtering, LIKE/PASS, matching, and service personalization
   • Required or default items: nickname, date of birth, profile photos, the visibility of each profile photo (public or private) and their display order, personal preference information and profile information necessary to use the Service
   • Optional items: information the user chooses to enter, such as a self-introduction, additional profile photos, height, lifestyle, interests, preference information, relationship status, and area of activity
3. Automated review of profile photos
   • Purpose: blocking the display of photos that do not comply with the operating policy, such as sexual content, protecting users, and operating the Service safely
   • Items: the profile photo image, the review outcome, the reason category for that outcome, the version of the review model used, the time of review and, where the outcome is held, the time at which the hold began
   • Basis: formation and performance of the service agreement and the legitimate interest of the Company in protecting users

   The Company does not store the detailed findings generated in the course of automated review; it retains only the minimum outcomes listed in the items above. The detailed procedure for automated review and the rights of users are explained in Article 9.

4. Chat, community, and connection between users
   • Purpose: providing services such as dot messages, matching, 1:1 chat, and community posts and comments, and handling requests for and consent to the disclosure of private photos
   • Items: message contents, posts, comments, time of writing, identifying information of the other party or the posting, records of choices to disclose private photos and of the related consent, records of viewing permissions for each chat room, and related service usage records
5. Reporting, blocking, and safe operation of the Service
   • Purpose: preventing impersonation, misappropriation, harassment, and abuse; handling reports and blocks; use restrictions; preventing re-registration; handling disputes and customer inquiries
   • Items: reporting and blocking records, reasons and materials for reports, account and profile identifiers, related postings and messages, enforcement and appeal records, and service usage records
6. Paid services and payment
   • Purpose: checking subscription status, providing paid benefits, purchase restoration, and handling payments, refunds, and disputes
   • Items: account identifiers, purchased products, subscription status, order and transaction identifiers, and information necessary for payment and purchase restoration

   Original payment instrument data such as credit card numbers is processed by the relevant payment provider, such as the Apple App Store or Google Play, and is not stored by the Company.

7. Optional features
   • FACE verification: confirming that a real face is present, comparing it with the profile photo, and preventing impersonation and photo misappropriation
   • Location information: recommending nearby users, calculating distance, and location-based browsing and filtering
   • Hide contacts: comparison based on contacts in order to reduce the chance of encountering people the user knows

   For the hide-contacts feature, the Company does not store the original device contact list on its servers, and the information needed for comparison is processed in a converted form from which the original cannot readily be identified.

8. Information that may be generated automatically while the Service is used
   • IP address
   • Device time zone setting
   • The country of access inferred from the IP address (aggregated at country level)
   • Access times and service usage records
   • Device information
   • Operating system and app version
   • Push notification tokens
   • Error, failure, and diagnostic information
   • Technical information necessary for security and the prevention of abuse

   To estimate and confirm the country in which a user resides, and thereby determine the range in which the user is shown in the community and in matching, the Company infers the country of access from the IP address observed when the Service is accessed together with the device time zone setting. In this process the IP address and the time zone setting are used only while the country is being determined and are not stored, and location coordinates are not collected. What the Company retains is only an aggregate, compiled weekly, of how many days access occurred from each country; no day-by-day movement record is created. This aggregate is retained for up to 91 days and then deleted, and it is not provided to any third party. The country inference uses GeoLite2 data provided by MaxMind within the Company own servers, and the user IP address is not transmitted externally. (This product includes GeoLite Data created by MaxMind, available from https://www.maxmind.com)

   The Company uses Firebase Analytics and Firebase Crashlytics to improve service quality and to identify the causes of errors; through them, device information, app usage records, and error and failure information are collected automatically.

9. Marketing information

   Where the Company sends marketing information such as events, benefits, and promotions, it may use email addresses, push tokens, and records of marketing consent, only for users who have given separate consent to receive it.

   The Company does not collect advertising identifiers (ADID/IDFA) and does not provide personalised advertising based on behavioural information. Should the Company in future collect advertising identifiers or separate advertising or behavioural information, or introduce third-party advertising tools, it will carry out the notice and consent procedures required by applicable law before processing begins, and will amend and publish this Privacy Policy.

Article 2 (Processing of Sensitive Information)

1. Given the nature of the Service, the Company may process information entered directly by users regarding sexual orientation, gender identity, or relationships and preferences, where such information constitutes sensitive information under applicable law.
2. The Company processes sensitive information separately from ordinary personal information and, where required by applicable law, obtains consent separately from consent for other personal information.
3. Sensitive information is used only for the service purposes to which the user has consented, such as user recommendation, matching, and profile provision.
4. Where sensitive information entered by a user in their profile includes items that are disclosed to other users, the Company informs the user that the information may be disclosed. Items whose visibility can be selected may be changed through the profile and visibility settings provided in the Service.
5. During FACE verification, facial information may be processed to confirm that a real face is present and to compare it with the profile photo.
   • FACE verification is an optional feature.
   • The Company does not retain on an ongoing basis the capture data generated during automated verification.
   • Where FACE verification materials have been submitted separately for manual review, they are retained for up to 7 days and then deleted.
   • The photos used as the basis for comparison are the active profile photos of the user, and a photo set to private is also included among those reference photos while it remains active. The visibility setting of a photo determines only what other users can see; it does not determine whether the photo is used for comparison in FACE verification.
   • A FACE verification result means only that the verification procedure was completed at a particular point in time; it does not guarantee a member's identity, character, conduct, or future trustworthiness.

Article 3 (Collection Methods and Device Access Permissions)

1. The Company collects personal information by the following methods.
   • Provided directly by the user during registration and identity verification
   • Entered or registered directly by the user while creating a profile and using the Service
   • Generated automatically while the Service is used
   • Transferred, to the extent necessary, through partner or processor services used by the user, such as Apple, Google, identity verification bodies, and passport or identity card verification providers; where the in-app SMS identity verification method is used, transmitted by the Company to the identity verification agency using the verification information entered by the user; and where the passport or identity card verification method is used, transmitted to the relevant verification provider using the materials the user captures and submits
   • Submitted directly by the user through customer support, reports, and appeals
2. To provide service features, the Company may access the following functions of the device.
   • Photos and media: registering profile photos and images within the Service
   • Camera: FACE verification, capturing a passport or identity card for verification, taking photos, and necessary attachment features
   • Location: recommending nearby users and calculating distance
   • Contacts: hide contacts
   • Notifications: matching, message, and service notifications, and marketing information where the user has consented
3. Optional access permissions are operated so that, even if the user does not grant them, the basic Service can still be used apart from the relevant feature.
4. Users may change optional access permissions at any time through their operating system settings.

Article 4 (Retention and Period of Use)

1. The Company destroys personal information without delay once the purpose of processing is achieved or the service agreement ends.
2. Where account deletion has been requested, a 7-day grace period may be applied so that an account deleted by mistake can be recovered. After the grace period ends, personal information for which there is no statutory or other separate ground for retention is deleted or anonymized.
3. The following information is retained for a set period under applicable law or for the safe operation of the Service.
   • Records on contracts and withdrawal of subscription: 5 years
   • Records on payment and the supply of goods and services: 5 years
   • Records on consumer complaints and dispute resolution: 3 years
   • Records on labelling and advertising: 6 months
   • Records on service access: 3 months
   • Country-level access aggregates used to determine the country of residence: 91 days
   • Safety records such as reports, blocks, abuse, use restrictions, and appeals against enforcement: up to 3 years
   • Verification materials submitted for manual FACE review: up to 7 days
   • Records of automated review determinations for profile photos (outcome, reason category, review model version, time of review): for as long as the photo concerned is retained
   • Photos taken down from the profile as a result of automated review, and the records of the reasons: the minimum period necessary to identify repeated violations and to respond to disputes
   • Records of staff having viewed a photo awaiting review: up to 3 years
   • Records confirming the use and provision of location information: the period set out in applicable law and the Location-Based Services Terms
   • Anonymous identity-verification identifiers and the records linked to them: retained even after account deletion, for the minimum period necessary to prevent duplicate or fraudulent re-registration and to prevent duplicate receipt of sign-up benefits and event rewards
4. Detailed retention and use periods for personal location information follow the separate Location-Based Services Terms.
5. Where a separate retention period is prescribed by law, the information is stored separately and safely for the period prescribed by that law.

Article 5 (Destruction of Personal Information)

1. The Company destroys personal information without delay once it is no longer necessary.
2. Where personal information must continue to be preserved under other laws, the Company stores it separately from other personal information or restricts access to it.
3. Personal information is destroyed as follows.
   • Electronic files and data are deleted by secure means that make recovery or reconstruction difficult.
   • Where paper documents exist, they are destroyed by means that make recovery difficult, such as shredding or incineration.

Article 6 (Provision of Personal Information to Third Parties)

1. As a rule, the Company does not provide users' personal information to third parties.
2. However, the Company may provide the necessary personal information, to the extent permitted by applicable law, in the following cases.
   • Where the user has separately consented to provision to a third party
   • Where there is a special provision in law, or where necessary to comply with a statutory obligation
   • Where an investigative authority, court, or administrative agency makes a request in accordance with the lawful procedures prescribed by applicable law
   • Where otherwise permitted by applicable law, including the Personal Information Protection Act
3. Should a service that provides personal information to third parties be introduced in future, the Company will give advance notice of the recipient, the purpose and items of provision, the retention and use period, and the effect of refusing consent, and will obtain the necessary consent.

Article 7 (Outsourcing of Personal Information Processing)

To provide the Service smoothly, the Company outsources part of the processing of personal information to external specialist providers as follows.

When entering into an outsourcing agreement, the Company includes in the contract the matters necessary to keep personal information safe, such as the prohibition of processing for other purposes, measures to ensure security, management of sub-processing, and supervision and liability, and it manages and supervises the processor's handling of personal information.

Where a processor or the outsourced work changes, the Company will disclose it through this Privacy Policy.

Article 8 (Overseas Transfer of Personal Information)

Because the Company uses the services of overseas providers necessary to provide the Service, such as Firebase, the App Store, Google Play, RevenueCat, FACE verification, automated review of photos (profile, community, and chat attachments), the review of operational matters such as reports and inquiries, and passport or identity card verification, personal information may be processed and stored outside Korea.

1. Users may refuse the overseas transfer of personal information relating to optional features, or withdraw consent to those features. In that case, use of the relevant optional feature, such as FACE verification, may be restricted.
2. The automated review of profile photos is a safety measure for the protection of users. It applies to every registered profile photo, and the review alone cannot be switched off or refused. A user who does not want this transfer to take place may refuse it by not registering a profile photo, by deleting a photo already registered, or by requesting deletion of the account. However, profile photos are an item necessary in order to use the Service, so a user who does not register one may find it difficult to use all or part of the Service, including profile display and matching.
3. Where a user refuses the overseas processing and storage of personal information that is essential to the operation of the Service, such as Firebase, it may be difficult to provide all or part of the Service normally.
4. The artificial intelligence analysis of operational matters such as reports and inquiries is a first review intended to assist human review. Measures that affect users, such as removal of content or restriction of use, are decided by an authorised person of the Company after reviewing the content, and no measure is executed automatically on the basis of the artificial intelligence analysis alone.

   Where the Company transfers personal information overseas, it implements the measures to ensure security and to protect the rights of data subjects required by applicable law.

Article 9 (Visibility of Profile Photos and Automated Review)

1. Users may set the visibility of each profile photo they register to either public or private.
   • Public photos may be shown to other users within the Service, for example in profiles and in browsing.
   • Private photos are visible only to the user and are not shown to other users until viewing permission arises through the procedure in paragraph 2 below.
   • A private photo cannot be the main photo, and for the operation of the Service the Company may set a minimum number of public photos and a maximum number of private photos.
2. Viewing permission for a private photo is granted to a chat partner only where the user has chosen to disclose the photo to that partner.
   • Where the other party has no private photos, viewing permission is granted to that party once the user chooses to disclose.
   • Where both parties have private photos, viewing permission is granted to each other only where the conversation conditions set by the Company are met and each party has separately chosen to disclose. While only one party has so chosen, the photos of neither party are disclosed.
   • Viewing permission is granted only to that chat partner and is not granted to other users.
   • A user may at any time cancel the choice to disclose and thereby revoke the viewing permission granted to the other party. In that case the viewing permission granted by the other party to the user follows the choice of that other party and is not revoked together.
   • Where a block, an unmatch, or the withdrawal of either party occurs, the viewing permissions of both parties are revoked immediately.
   • The Company determines disclosure on the server and does not provide the address of the photo itself to users who do not have viewing permission.
3. In accordance with Article 2, item 5, private photos are also included among the reference photos used for comparison in FACE verification while they remain active. Visibility settings determine what other users can see; they do not determine the scope of comparison for identity confirmation.
4. When a user registers or modifies a profile photo, or reactivates a deleted photo, the Company carries out automated image review in order to prevent the display of photos that do not comply with the operating policy, such as sexual content. The review applies to both public and private photos.
5. The outcome of the review is handled as follows.
   • A photo determined to raise no issue is displayed as normal.
   • A photo determined to be a clear violation of the operating policy is automatically taken down from the profile so that other users cannot see it, and the Company notifies the user concerned of that fact.
   • Where the determination is not clear, the photo is not deleted; its display is merely suspended, and an authorised member of the Company staff checks it directly and decides whether it may be displayed.
   • Where no determination could be obtained, for example because of a temporary failure, the photo is left with its display suspended and is reviewed again later. The Company does not treat the absence of a determination as a pass.
6. A user who objects to the outcome of automated review may request an explanation or a re-examination from the customer support team in accordance with Article 11. Where such a request is received, a member of staff re-examines the photo and the determination and informs the user of the result.
7. The Company observes the following in the course of review.
   • Images transferred for review are processed only within the scope of the transfer purpose set out in Article 8, and the Company does not request the recipient to store or retain the images separately.
   • The Company does not store the detailed findings of a determination; it retains only the outcome and a minimal reason category.
   • The photos that staff may check directly are limited to photos whose review is suspended; viewing uses an address that expires after a set time, and a record is kept of who viewed the photo and when.
   • Notices regarding a photo that has been taken down do not set out the specific details of the determination.

Article 10 (Processing of Personal Location Information)

1. With the user's consent, the Company may process personal location information in order to recommend nearby users, calculate distance, and provide location-based browsing and filtering.
2. The Company does not disclose exact coordinates, geohashes, or addresses to other users, and provides only processed distance information or location-based recommendation results to the extent necessary to provide the Service.
3. The Company does not continuously collect new location information while the app is not in use.
4. Detailed matters regarding the collection, use, retention, and destruction of personal location information, suspension of use, withdrawal of consent, records confirming use and provision, and the location information manager follow the separate Location-Based Services Terms.

Article 11 (User Rights and How to Exercise Them)

1. Users may exercise the following rights with respect to their personal information at any time.
   • Request access to personal information
   • Request correction of personal information
   • Request deletion of personal information
   • Request suspension of the processing of personal information
   • Withdraw consent to the processing of personal information
   • Request an explanation of, or a re-examination of, a decision made through automated processing, such as the automated review of profile photos
   • Any other rights regarding the protection of personal information recognized under applicable law
2. Users may exercise these rights through the profile, settings, and account management features in the app, or through the customer support team.
3. Members may request account deletion at any time through the app or a method provided by the Company.
4. Where the Company receives a request to correct or delete personal information, it will not use or provide that personal information until the necessary measures are complete, except where applicable law provides otherwise.
5. The Company may confirm that the person exercising a right is the user or a duly authorized representative.
6. Where there is a legitimate ground, such as a legal requirement to retain the personal information, the exercise of certain rights may be restricted. In that case, the Company will explain the reason in accordance with applicable law.
7. Consent to receive marketing information may be withdrawn at any time through the notification and marketing settings in the app or by a method provided by the Company.
8. Rights regarding personal location information and how to exercise them follow the separate Location-Based Services Terms.
9. dot is available only to adults aged 19 or older, and registration by users under 19 is not permitted.

Article 12 (Measures to Ensure the Security of Personal Information)

To prevent the loss, theft, leakage, forgery, alteration, damage, and unauthorized access of personal information, the Company implements the administrative, technical, and physical protective measures required under applicable law.

• Operating an internal management framework for the safe processing of personal information
• Minimizing personal information processing privileges and managing access rights
• Access control for personal information processing systems
• Applying secure communications, including encryption of transmission channels
• Protective processing of necessary identifiers, such as hashing
• Managing key records of personal information processing and access
• Using addresses that expire after a set time when sensitive material such as user photos is viewed, and keeping records of such viewing
• Checking for security vulnerabilities and abnormal access
• Minimizing the number of people and privileges involved in processing personal information
• Operating procedures for response and recovery in the event of an incident and for any necessary notification to users

As a rule, the Company does not store originals of personal information that the Service does not require, and it endeavours to ensure that personal information is not processed beyond the necessary scope.

Article 13 (Privacy Officer and Remedies for Infringement)

The Company has designated a Privacy Officer to oversee personal information processing and to handle users' inquiries, complaints, and remedies relating to personal information.

1. [Privacy Officer]
   • Name: Juhui Kim
   • Role: Personal information policy and operations
   • Email: help@oweav.com

   Users may contact the Privacy Officer or the customer support team regarding personal information inquiries arising from use of the Service, requests for access, correction, deletion, or suspension of processing, complaints, and remedies.

   If you need separate counselling or remedies regarding infringement of personal information, you may contact the following bodies.

   • Personal Information Infringement Report Centre: 118 (no area code)
   • Personal Information Dispute Mediation Committee: 1833-6972 (no area code)
   • National Police Agency: 182 (no area code)

Article 14 (Changes to this Privacy Policy)

1. This Privacy Policy applies from its effective date.
2. Where this Policy is amended due to changes in applicable law, the Service, the manner of personal information processing, or processors, the Company will disclose the changes through the Service or website so that users can review them easily.
3. Where a change materially affects users' rights, separate notice will be given by the method and for the period required under applicable law.

Addendum

This Privacy Policy takes effect on 1 September 2026.