Privacy Policy

Article 1 (Purposes and Items of Personal Information Processing)

1. Registration and member management
   • Purpose: identifying users, identity verification, confirming adult status and eligibility, creating and managing accounts, preventing duplicate or fraudulent registration, managing the service agreement, comparison for hide contacts (item 7 below)
   • Items: authentication UID, email address, mobile phone number, whether identity was verified, the verification method used, Korean or foreign national status, adult status, eligibility status, time of verification, anonymous identifier
   • Items processed temporarily when the mobile phone identity verification method is used: name, the mobile phone number confirmed by the identity verification agency, date of birth, gender, and connecting information (CI) and duplicate-registration verification information (DI)
   • Items processed temporarily when the passport or identity card verification method is used: the passport or identity card image, a facial photograph (selfie), liveness footage, name, document number, date of birth, gender, nationality, issuing country, and mobile phone number
   • Basis: formation and performance of the service agreement and, where obligations under applicable law apply, compliance with those obligations

   The mobile phone number is a required item used for identity verification and hide contacts (item 7 below); the Company uses the number confirmed and passed on by the identity verification agency or by Didit. The Company does not store the original name, mobile phone number, or CI/DI; it retains only a comparison value and the anonymous identifier needed to prevent duplicate or fraudulent registration, and destroys the comparison value when account deletion is completed.

   Passport or identity card verification materials (the identity document image, facial photograph, liveness footage, and document number) are processed by Didit, a specialist identity verification provider, and are not stored in the Company’s database. The name, nationality, issuing country, and document number obtained during overseas identity document verification, along with the mobile phone number verified by Didit, are processed temporarily and solely for verifying registration eligibility and preventing duplicate registrations. The Company does not retain these details in their original form and deletes them immediately after processing. If a potential duplicate registration is detected, a staff member will review the case before determining whether registration may proceed. Once the determination is complete, the Company requests Didit to delete the original materials. To confirm the mobile phone number with this method, the number may be passed through Didit to text-message and messaging delivery providers.

2. Provision of profile and matching services
   • Purpose: composing and displaying profiles, recommending users, browsing and filtering, LIKE/PASS, matching, and service personalization
   • Required or default items: nickname, date of birth, profile photos, the visibility of each profile photo (public or private) and their display order, personal preference information and profile information necessary to use the Service
   • Optional items: information the user chooses to enter, such as a self-introduction, additional profile photos, height, lifestyle, interests, preference information, relationship status, and area of activity
3. Automated review of photos (profiles, boards, and chat)
   • Purpose: blocking the display of photos that do not comply with the operating policy, such as sexual content, protecting users, and operating the Service safely
   • Items: images of profile photos, board photos, and photos attached in chat; the review outcome and reason category; and the time of review
   • Basis: formation and performance of the service agreement and the legitimate interest of the Company in protecting users
4. Chat, community, and connection between users
   • Purpose: providing services such as dot messages, matching, 1:1 chat, and community posts and comments, and handling requests for and consent to the disclosure of private photos
   • Items: message contents, posts, comments, time of writing, identifying information of the other party or the posting, records of choices to disclose private photos and of the related consent, records of viewing permissions for each chat room, related service usage records, and the original text of a message before it is edited or deleted (a server-only record not shown to users or the other party)
5. Reporting, blocking, and safe operation of the Service
   • Purpose: preventing impersonation, misappropriation, harassment, and abuse; handling reports and blocks; use restrictions; preventing re-registration; handling disputes and customer inquiries
   • Items: reporting and blocking records, reasons and materials for reports, account and profile identifiers, related postings and messages, enforcement and appeal records, and service usage records
6. Paid services and payment
   • Purpose: checking subscription status, providing paid benefits, purchase restoration, and handling payments, refunds, and disputes
   • Items: account identifiers, purchased products, subscription status, order and transaction identifiers, and information necessary for payment and purchase restoration
7. Optional features
   • FACE verification: confirming that a real face is present, comparing it with the profile photo, and preventing impersonation and photo misappropriation
   • Location information: recommending nearby users, calculating distance, and location-based browsing and filtering
   • Hide contacts: Comparing members’ mobile phone numbers and email addresses with those saved in the device contacts of users who enable this feature, so that matching members and those users are hidden from each other

   For the hide-contacts feature, the Company does not store the original device contact list on its servers, and uses comparison values instead of the original contact details. On the member side, the comparison uses the comparison values of the member’s mobile phone number (item 1 above) and email address. Even if a member has not enabled hide contacts, that member and a user who has enabled it will not be visible to each other if the user’s contacts contain the member’s mobile phone number or email address. The comparison values and comparison results are not disclosed to other users. Comparison values created from contacts (including the phone numbers and email addresses of non-members) are destroyed when hide contacts is turned off or account deletion is completed.

8. Information that may be generated automatically while the Service is used
   • IP address
   • Device time zone setting
   • Access times and service usage records
   • Device information
   • Operating system and app version
   • Push notification tokens
   • Error, failure, and diagnostic information
   • Technical information necessary for security and the prevention of abuse

   To improve service quality and identify the causes of errors, the Company automatically collects app usage records, error and failure information, and app performance information (Google Firebase), and does not use this information for advertising or to track users.

9. Marketing information

   Where the Company sends marketing information such as events, benefits, and promotions, it may use email addresses, push tokens, and records of marketing consent, only for users who have given separate consent to receive it.

   The Company does not collect advertising identifiers (ADID/IDFA) and does not provide personalised advertising based on behavioural information.

10. Place registration and edit requests, and place reports
    • Purpose: receiving, reviewing, and publishing requests to register a place or edit its information, contacting the requester, checking for duplicate or false requests, and handling place reports
    • Items: account identifiers of the requester, the place information requested (business name, address, business details, public contact channels, etc.), photos submitted with the request, and the reason and details of a report
    • Additional items when requesting as an owner or staff member: the contact person’s name, mobile phone number, and email address, business information (business name and business registration number), and an image of the business registration certificate

    From an approved request, the Company publishes on the place only the place information and photos needed for publication, and does not publish the contact person’s details, the business information, or the business registration certificate image.

Article 2 (Processing of Sensitive Information)

1. Given the nature of the Service, the Company may process information entered directly by users regarding sexual orientation, gender identity, or relationships and preferences, where such information constitutes sensitive information under applicable law.
2. The Company processes sensitive information separately from ordinary personal information and, where required by applicable law, obtains consent separately from consent for other personal information.
3. Sensitive information is used only for the service purposes to which the user has consented, such as user recommendation, matching, and profile provision. However, sensitive information may also be used to handle reports and protect users. If user-submitted content contains sensitive information, it may be shared with the service providers listed in Articles 7 and 8 for operational review, including transfers abroad.
4. Where sensitive information entered by a user in their profile includes items that are disclosed to other users, the Company informs the user that the information may be disclosed. Items whose visibility can be selected may be changed through the profile and visibility settings provided in the Service.
5. During FACE verification, facial information may be processed to confirm that a real face is present and to compare it with the profile photo.
   • FACE verification is an optional feature.
   • The Company does not retain on an ongoing basis the capture data generated during automated verification.
   • Where FACE verification materials have been submitted separately for manual review, they are retained for up to 7 days and then deleted.
   • The photos used as the basis for comparison are the active profile photos of the user, and a photo set to private is also included among those reference photos while it remains active. The visibility setting of a photo determines only what other users can see; it does not determine whether the photo is used for comparison in FACE verification.
6. In the passport/ID verification method, facial feature information (biometric information) is processed to confirm that the submitted face photo shows the same person as the ID photo and a real person, and to prevent duplicate sign-ups.
   • This information is processed by Didit, a specialised identity verification provider; the Company receives only the decision and does not store the face photo or facial feature information.
   • Facial feature information is processed overseas, in Spain, the United States and elsewhere; the details of the transfer are as set out in Article 8.

Article 3 (Collection Methods and Device Access Permissions)

1. The Company collects personal information that the user enters directly, that is generated automatically while the Service is used, or that is received from identity verification agencies, payment providers, and others.
2. To provide service features, the Company may access the following functions of the device.
   • Photos and media: registering profile photos and images within the Service
   • Camera: FACE verification, capturing a passport or identity card for verification, taking photos, and necessary attachment features
   • Microphone (optional): used to record and send voice messages in chat. You do not need to allow this if you do not use voice messages.
   • Location: recommending nearby users and calculating distance
   • Contacts: hide contacts
   • Notifications: matching, message, and service notifications, and marketing information where the user has consented
3. Optional access permissions are operated so that, even if the user does not grant them, the basic Service can still be used apart from the relevant feature.
4. Users may change optional access permissions at any time through their operating system settings.

Article 4 (Retention and Period of Use)

1. The Company destroys personal information without delay once the purpose of processing is achieved or the service agreement ends.
2. Where account deletion has been requested, a 7-day grace period may be applied so that an account deleted by mistake can be recovered. After the grace period ends, personal information for which there is no statutory or other separate ground for retention is deleted or anonymized.
3. The following information is retained for a set period under applicable law or for the safe operation of the Service.
   • Records on contracts and withdrawal of subscription: 5 years (Article 6 of the Act on the Consumer Protection in Electronic Commerce, Etc. and Article 6 of its Enforcement Decree)
   • Records on payment and the supply of goods and services: 5 years (Article 6 of the Act on the Consumer Protection in Electronic Commerce, Etc. and Article 6 of its Enforcement Decree)
   • Records on consumer complaints and dispute resolution: 3 years (Article 6 of the Act on the Consumer Protection in Electronic Commerce, Etc. and Article 6 of its Enforcement Decree)
   • Records on labelling and advertising: 6 months (Article 6 of the Act on the Consumer Protection in Electronic Commerce, Etc. and Article 6 of its Enforcement Decree)
   • Records on service access: 3 months (Article 15-2 of the Protection of Communications Secrets Act and Article 41 of its Enforcement Decree)
   • Country-level access aggregates collected before 28 September 2026 (collection has stopped): 91 days from collection
   • Safety records such as reports, blocks, abuse, use restrictions, and appeals against enforcement: up to 3 years
   • Verification materials submitted for manual FACE review: up to 7 days
   • Records of automated review determinations for profile, board, and chat photos (the review outcome and reason category, and the time of review): for as long as the photo concerned is retained
   • Photos taken down from the profile as a result of automated review, and the records of the reasons: the minimum period necessary to identify repeated violations and to respond to disputes
   • Records of staff having viewed a photo awaiting review: up to 3 years
   • Original text of chat messages before they are edited or deleted: 30 days from the edit or deletion (up to 3 years, like safety records, if linked to a report or other safety case within that period)
   • Original text of community posts and comments that have been deleted: 30 days from the deletion (up to 3 years, like safety records, if linked to a report or other safety case within that period)
   • Contact person details, business information, business registration certificate images, and original request photos in place requests: 30 days from the end of review (approval or rejection)
   • Place information and photos published after approval: while published (destroyed within 90 days after the place is unpublished and deleted)
   • Hide-contacts comparison values: until hide contacts is turned off or account deletion is completed
   • Records confirming the collection, use, and provision of location information: recorded for each user whose location it is and kept for 190 days (under Article 16 of the Act on the Protection and Use of Location Information and the Location-Based Services Terms)
   • Anonymous identity-verification identifiers and the records linked to them: retained even after account deletion, for the minimum period necessary to prevent duplicate or fraudulent re-registration and to prevent duplicate receipt of sign-up benefits and event rewards

Article 5 (Destruction of Personal Information)

Personal data is destroyed without delay when its retention period ends or its purpose is fulfilled. Data that must be retained by law is kept separately or access is restricted. Electronic data is deleted to prevent recovery; paper records are shredded or incinerated.

Article 6 (Provision of Personal Information to Third Parties)

1. As a rule, the Company does not provide users' personal information to third parties.
2. However, the Company may provide the necessary personal information, to the extent permitted by applicable law, in the following cases.
   • Where the user has separately consented to provision to a third party
   • Where there is a special provision in law, or where necessary to comply with a statutory obligation
   • Where an investigative authority, court, or administrative agency makes a request in accordance with the lawful procedures prescribed by applicable law
   • Where otherwise permitted by applicable law, including the Personal Information Protection Act
3. The Company may provide Apple Inc. or Google LLC with the minimum information necessary for app store refund reviews and payment dispute resolution, including transaction identifiers, whether purchased products and free features were provided, and the Company's position on the refund request.

Article 7 (Outsourcing of Personal Information Processing)

The Company outsources personal information processing as follows to provide the service.

The Company sets out the matters necessary to protect personal information in its outsourcing contracts, manages and supervises outsourcees, and announces any change of outsourcee or outsourced task through this Policy.

Article 8 (Overseas Transfer of Personal Information)

The Company processes and stores personal information overseas as follows to provide the service.

These transfers are made as outsourced processing and storage of personal information for the performance of the service agreement, and the Company takes the protective measures required by applicable laws.

1. Users may refuse overseas transfers. However, refusing transfers necessary to operate the service may make all or part of the service difficult to use, and optional features such as FACE verification or profile photo review can be refused by not using the feature or not registering photos.
2. Artificial intelligence analysis assists review by an authorised person, and measures adverse to users are decided only after that person has checked them.

Article 9 (Visibility of Profile Photos and Automated Review)

Users choose each photo’s visibility. Public photos may be shown to other users. Private photos are visible only to a chat partner to whom the user chooses to disclose them. Access is revoked on withdrawal, blocking, unmatching, or account deletion.

When a user registers, modifies, or reactivates a profile photo, attaches a photo to a board post, or sends a photo in chat, the Company carries out automated image review to prevent the display of photos that do not comply with the operating policy, such as sexual content.

1. The outcome of the review is handled as follows.
   • A photo that raises no issue is displayed as normal.
   • A photo that clearly violates the policy is not displayed, and the Company notifies the user.
   • A photo whose determination is unclear, or for which no determination could be obtained, has its display suspended; an authorised member of staff checks it, with the assistance of artificial intelligence analysis where necessary, and decides whether it may be displayed.
2. Under Article 11, users may request an explanation or a re-examination of an automated review outcome; a member of staff re-examines it and informs the user of the result.
3. The Company retains only the outcome and a minimal reason category, and images transferred for review are processed only within the transfer purpose set out in Article 8.

Article 10 (Processing of Personal Location Information)

With consent, the Company uses location information for nearby member recommendations, distances, and filters. See the Location-Based Services Terms for the collection scope, retention periods, and rights.

Article 11 (User Rights and How to Exercise Them)

1. Users may exercise the following rights with respect to their personal information at any time.
   • Request access to personal information
   • Request correction of personal information
   • Request deletion of personal information
   • Request suspension of the processing of personal information
   • Withdraw consent to the processing of personal information
   • Request an explanation of, or a re-examination of, a decision made through automated processing, such as the automated review of profile photos
   • Any other rights regarding the protection of personal information recognized under applicable law
2. Users may exercise these rights through the profile, settings, and account management features in the app, or through the customer support team.
3. Members may request account deletion at any time through the app or a method provided by the Company.
4. Where the Company receives a request to correct or delete personal information, it will not use or provide that personal information until the necessary measures are complete, except where applicable law provides otherwise.
5. The Company may confirm that the person exercising a right is the user or a duly authorized representative.
6. Where there is a legitimate ground, such as a legal requirement to retain the personal information, the exercise of certain rights may be restricted. In that case, the Company will explain the reason in accordance with applicable law.
7. Consent to receive marketing information may be withdrawn at any time through the notification and marketing settings in the app or by a method provided by the Company.

Article 12 (Measures to Ensure the Security of Personal Information)

To prevent the loss, theft, leakage, forgery, alteration, damage, and unauthorized access of personal information, the Company implements the following protective measures in accordance with applicable law.

• Operating an internal management framework and minimizing the people and privileges involved in processing personal information
• Access control for personal information processing systems
• Encryption of transmission channels and protective processing of identifiers, such as hashing
• Managing records of personal information processing and access
• Security checks and procedures for response and notification in the event of an incident

Article 13 (Privacy Officer and Remedies for Infringement)

The Company has designated a Privacy Officer to oversee personal information processing and to handle users' inquiries, complaints, and remedies relating to personal information.

1. [Privacy Officer]
   • Name: Juhui Kim
   • Role: Personal information policy and operations
   • Email: help@oweav.com

   Users may contact the Privacy Officer or the customer support team regarding personal information inquiries arising from use of the Service, requests for access, correction, deletion, or suspension of processing, complaints, and remedies.

   If you need separate counselling or remedies regarding infringement of personal information, you may contact the following bodies.

   • Personal Information Infringement Report Centre: 118 (no area code)
   • Personal Information Dispute Mediation Committee: 1833-6972 (no area code)
   • National Police Agency: 182 (no area code)

Article 14 (Changes to this Privacy Policy)

1. This Privacy Policy applies from its effective date.
2. Where this Policy is amended due to changes in applicable law, the Service, the manner of personal information processing, or processors, the Company will disclose the changes through the Service or website so that users can review them easily.
3. Where a change materially affects users' rights, separate notice will be given by the method and for the period required under applicable law.

Addendum

This Privacy Policy takes effect on 15 October 2026.