Privacy Policy
Three Seven Twelve Inc. (주식회사 쓰리세븐투웰브; brand: Vorn Vuyage; the "Company") complies with the Personal Information Protection Act of Korea and other applicable laws, and publishes this Privacy Policy as follows. This policy applies to the Vorn Vuyage mobile app (iOS app ID 6785587771, Android package com.threeseventwelve.vornvuyage) and the website (vornvuyage.co.kr).
1. Purposes of processing personal information
- Sign-up, sign-in and account management (social sign-in)
- Skin photo analysis and personalized product and ingredient recommendations. Skin analysis is performed by our own model on your device.
- Recognition of cosmetic ingredient labels and review of the recognition results
- UV index information, sunscreen reapplication reminders, and reapplication tips near beaches and swimming pools
- Service provision and quality improvement, including AI training (an item of required consent)
- AI training to improve algorithms such as sunscreen reapplication reminders (including health data such as steps and heart rate if you connect a health app or the step sensor; an item of optional consent, asked separately when you connect)
- Service operation, error handling, responding to inquiries, and prevention of misuse
2. Personal information we process and how we collect it
| Category | Items | How collected | Required or optional |
|---|---|---|---|
| Sign-up and sign-in | Sign-in provider (Apple, Google, Naver, Kakao), the member identifier given by the provider, nickname or name (if the provider gives one), sign-up time, sign-in session information. For Apple sign-in, the Apple refresh token used to unlink the account when you delete it | Received from the provider when you sign in | Required. You must sign in to use Vorn Vuyage. |
| Materials for AI improvement and training | Photos taken while using the service (face, cosmetic ingredient label) Recognition results obtained from the photos (ingredient list, product name, barcode, etc.) Capture information and usage records (body area, capture and upload times, reasons for recognition failure, etc.) | Sent automatically by the app while you use the service | Required. If you do not consent to this item, you cannot use Vorn Vuyage. |
| Health and reapplication records for AI improvement and training | If you connect a health app or the step sensor: heart rate, step count, active energy, workout type and time, your resting heart rate calculated on the phone, your age range (10-year band), the kind of device the data came from, and measurement and receipt times Sunscreen reapplication records: the product used (our product or 'other'), water-resistance label, number of sprays, swimming and indoor markers, UV, temperature and humidity values used in the calculation and the interval calculated, reminder scheduling and your reaction (applied, postponed, no response), and algorithm and app versions | Sent by the app in batches while you use the service | Optional (asked separately when you connect a health app or the step sensor). If you do not consent, you can still use Vorn Vuyage; only the health app or step sensor connection is not made. Health data is sent only if you have consented and connected a health app or the step sensor. |
| AI improvement and training consent records | Whether and when you consented or withdrew, the version of the consent text you accepted, and the link between your pseudonymous ID and your account | When you consent or withdraw | Required |
| Ingredient-label recognition review | Photo of the ingredient label and the list of text read by the app | Sent to an analysis server operated by the Company when you photograph a label. The photo is not stored; only the recognition result is kept. | When you use ingredient-label scanning. Separately from this transfer, ingredient-label photos and recognition results are stored as described in the 'Materials for AI improvement and training' row (required consent). |
| Location | Device location coordinates (latitude and longitude) | Sent to the weather data provider when UV information is loaded. Also used to tell whether you are near a beach or a swimming pool, but that check is done only on your device and is not sent to any server. Your current coordinates are also sent to the address lookup function of your phone's operating system (Apple or Google) to show your area name and to tell whether you are in Korea or abroad. Not stored on the Company's servers. | Optional. If you deny location permission, information for Seoul is provided and beach and swimming pool tips are not shown. |
| Automatically generated information | Connection information such as IP address | Processed on the network of our cloud service provider when you connect to our servers. The Company does not store it separately. | Automatic |
- The items in the 'Materials for AI improvement and training' row are stored, with the required consent of every user, to provide and improve our services, including AI training. The items in the 'Health and reapplication records for AI improvement and training' row are stored for AI training to improve algorithms such as sunscreen reapplication reminders, with optional consent asked separately when you connect a health app or the step sensor. They are kept separately under a pseudonymous ID instead of your name until you withdraw consent or delete your account.
- If you were already using Vorn Vuyage, we will ask for the required consent again the next time you open the app. Consent for health data is asked separately when you connect a health app or the step sensor.
- We do not collect or store passwords or email addresses.
- The following information is stored only on your device and is not sent to the Company's servers: skin analysis results and history, profile (name, skin type, skin concerns), skin diary and routines, your year of birth (only your age range is sent), list of scanned products, walking and running distance from your health app, and the date and place number of beach or swimming pool tips shown (a record used to show a tip only once a day for the same place). Weight, height and body fat are not read.
- Health data is used only for AI training to improve algorithms such as sunscreen reapplication reminders. It is not used for advertising or marketing and is not provided or sold to other companies. Location coordinates, place names and photos are not included in these records.
3. Handling of face photos
- Skin analysis is performed by our own model on your device. We do not send photos to our servers for analysis.
- Face photos are sent to our servers not for analysis but to improve our service quality, including AI training. This transfer is an item of required consent, and the photos are kept separately under a pseudonymous ID (Section 2).
- Face angles are calculated on your device and, under the required consent, sent together with the capture information.
- The Company does not use face photos to identify or authenticate individuals, does not use them for advertising or marketing, and does not provide or sell them to other companies.
- If you withdraw consent or delete your account, stored photos are deleted immediately (Sections 4 and 5).
4. Retention period
| Item | Period |
|---|---|
| Account information | Until you delete your account (deleted immediately when you do). |
| Sign-in session | Valid for 30 days after issue (deleted when you delete your account). |
| Materials for AI improvement and training (photos and recognition results) | Until you delete your account or withdraw consent (deleted immediately when you do either). |
| Health and reapplication records for AI improvement and training | Until you delete your account, withdraw AI improvement and training consent, or withdraw health data consent (deleted immediately when you do any of these). |
| AI improvement and training consent and withdrawal records | Until you delete your account |
| Ingredient-label recognition review | Photos are discarded as soon as processing is finished. Recognition results are not linked to any account and are used to improve our ingredient dictionary. Improving the ingredient dictionary is part of AI improvement and training. |
| Location coordinates | Not retained by the Company. The weather data provider keeps server logs for up to 90 days under its own policy. |
Records that applicable laws require us to keep are stored separately from the service database and destroyed when the retention period ends.
5. Destruction procedure and method
- Personal information whose retention period has ended or whose purpose has been achieved is destroyed without delay.
- Electronic files are deleted in a way that cannot be recovered. Photo files are deleted from storage as soon as deletion is requested.
- Database records remain in our cloud service provider's recovery feature for up to 30 days after deletion and are then permanently deleted.
6. Provision of personal information to third parties
The Company does not provide your personal information to third parties, except with your consent or where the law provides a basis.
7. Outsourcing of processing and transfer abroad
| Recipient (contact) | Country | Items | When and how | Purpose | Retention period |
|---|---|---|---|---|---|
| Cloudflare, Inc. (privacyquestions@cloudflare.com) | The United States and other countries where Cloudflare keeps data | Member information, consent records, materials for AI improvement and training (photos and recognition results), health and reapplication records for AI improvement and training listed in Section 2 | Sent over the network when you use the service | Server operation and data storage | Same as Section 4 |
| Open-Meteo (info@open-meteo.com) | Switzerland | Location coordinates | Sent by the app when UV information is loaded | Looking up UV index, temperature and humidity | Server logs for up to 90 days under Open-Meteo's policy |
- How to refuse and its effect: If you refuse the transfer of member information, you cannot use the services that require sign-in. Transfer of materials for AI improvement and training is an item of required consent, so if you do not consent or you withdraw consent, you cannot use Vorn Vuyage. Transfer of health and reapplication records is an item of optional consent, so if you do not consent or you withdraw consent, you can still use Vorn Vuyage and only the health app or step sensor connection is not made. If you deny location permission, location coordinates are not sent, information for Seoul is provided, and beach and swimming pool tips are not shown.
- Sign-in providers: Apple (United States), Google (United States), Naver (Korea), Kakao (Korea). You sign in on the screen of the provider you choose, and the Company receives only the information listed in Section 2. When a user who signed in with Apple deletes the account, the Company asks Apple to unlink it.
8. Your rights and how to exercise them
- You may at any time request access to, correction or deletion of your personal information, or suspension of its processing, and you may withdraw your consent.
- Withdrawing AI improvement and training consent: In the app, go to Settings > AI improvement and training consent and tap 'Withdraw consent and delete materials'. Stored photos, recognition results, and health and reapplication records are deleted immediately, and because this consent is required, you cannot use the app until you consent again.
- Withdrawing health data consent: In the app, go to the health data consent row in Settings and tap 'Withdraw health data consent'. Your health app or step sensor is disconnected and stored health and reapplication records are deleted immediately; if you are offline, they are deleted the next time you open the app. Because this consent is optional, you can keep using the app, and we ask for your consent again if you reconnect.
- Deleting your account: In the app, go to Settings > Delete account
- Requests by email: hello@3712.kr. To confirm your identity, please tell us your sign-in provider and nickname. We will process your request within 10 days of receiving it and let you know the result.
How to request account deletion
- In the app: You can delete your account directly under Settings > Delete account.
- If you cannot use the app: Send an email to hello@3712.kr with the subject 'Account deletion request', including your sign-in provider and nickname.
- Information deleted: account information, sign-in sessions, AI improvement and training consent records, materials for AI improvement and training, and health and reapplication records.
9. Security measures
- Data in transit is encrypted.
- Member information and photos are also encrypted at rest.
- We do not receive passwords; we use social sign-in only. Sign-in sessions expire after 30 days.
- Materials for AI improvement and training (photos and recognition results) and health and reapplication records are kept separately under a pseudonymous ID instead of the account identifier.
10. Children under 14
Vorn Vuyage does not accept sign-ups from children under 14.
11. Automatic collection tools
- The app does not use advertising identifiers or cookies and does not track you across other apps or websites.
- The website does not use visitor analytics tools or forms that collect personal information.
12. Privacy officer
- Name and title: CHO YOUNGJONG (Co-Representative Director)
- Contact: hello@3712.kr
13. Remedies for infringement of rights
If you need to report or get advice about an infringement of your personal information, you can contact the following organizations (in Korea).
- Personal Information Dispute Mediation Committee: 1833-6972 (www.kopico.go.kr)
- Personal Information Infringement Report Center: 118 (privacy.kisa.or.kr)
- Supreme Prosecutors' Office: 1301 (www.spo.go.kr)
- Korean National Police Agency: 182 (ecrm.police.go.kr)
14. Changes to this policy
This policy applies from November 6, 2026. If it changes, we will post a notice on this page before the change takes effect. The previous version (September 28, 2026) is available at https://vornvuyage.co.kr/privacy/en/2026-09-28/.