Privacy Policy
Three Seven Twelve Inc. (주식회사 쓰리세븐투웰브; brand: Vorn Vuyage; the "Company") complies with the Personal Information Protection Act of Korea and other applicable laws, and publishes this Privacy Policy as follows. This policy applies to the Vorn Vuyage mobile app (iOS app ID 6785587771, Android package com.threeseventwelve.vornvuyage) and the website (vornvuyage.co.kr).
1. Purposes of processing personal information
- Sign-up, sign-in and account management (social sign-in)
- Skin photo analysis and personalized product and ingredient recommendations. Skin analysis is performed by our own model on your device.
- Recognition of cosmetic ingredient labels and review of the recognition results
- UV index information and sunscreen reapplication reminders
- (Only if you give separate consent) Improvement and training of the Company's own skin analysis AI and ingredient-label recognition AI
- Service operation, error handling, responding to inquiries, and prevention of misuse
2. Personal information we process and how we collect it
| Category | Items | How collected | Required or optional |
|---|---|---|---|
| Sign-up and sign-in | Sign-in provider (Apple, Google, Naver, Kakao), the member identifier given by the provider, nickname or name (if the provider gives one), sign-up time, sign-in session information. For Apple sign-in, the Apple refresh token used to unlink the account when you delete it | Received from the provider when you sign in | Required. You must sign in to use Vorn Vuyage. |
| Photos for AI improvement | ① Whole skin photos: face (up to 15 photos per scan from several angles, each showing your whole face), eye area, hands. Whole photos, not fragments, resized to 1280 px wide (JPEG) ② Photos of cosmetic ingredient labels ③ Capture information: body area, scan ID, face angles, app build number, capture and upload times ④ Label recognition results: ingredients read, product name, barcode ⑤ Recognition and upload logs: failure reasons and counts, time taken | Sent by the app when a user who has given consent takes photos. Earlier photos left on the device are also sent if you run 'Upload photos left on this device' in Settings | Optional (separate consent) |
| Photo-use consent records | Whether and when you consented or withdrew, and the link between your pseudonymous ID and your account | When you consent or withdraw | Optional |
| Ingredient-label recognition review | Photo of the ingredient label and the list of text read by the app | Sent to an analysis server operated by the Company when you photograph a label. The photo is not stored; only the recognition result is kept. | When you use ingredient-label scanning |
| Location | Device location coordinates (latitude and longitude) | Sent to the weather data provider (Open-Meteo) when UV information is loaded. Not stored on the Company's servers. | Optional. If you deny location permission, information for Seoul is provided. |
| Automatically generated information | Connection information such as IP address | Processed on the network of our cloud provider (Cloudflare) when you connect to our servers. The Company does not store it separately. | Automatic |
- We do not collect or store passwords or email addresses.
- The following information is stored only on your device and is not sent to the Company's servers: skin analysis results and history, profile (name, skin type, skin concerns), skin diary and routines, list of scanned products, steps, distance, active energy, heart rate, workouts, weight, height and body fat from Apple Health (HealthKit), and step sensor information on Android.
3. Handling of face photos
- Skin analysis is performed by our own model on your device. We do not send photos to our servers for analysis.
- Face photos are sent to our servers only if you give separate consent to 'photo use for AI improvement'. In that case, photos showing your whole face are sent and stored (Section 2).
- Face angles are calculated on your device and, if you have consented, sent together with the capture information.
- The Company does not use face photos to identify or authenticate individuals, does not use them for advertising or marketing, and does not provide or sell them to other companies.
- If you withdraw consent or delete your account, stored photos are deleted immediately (Sections 4 and 5).
4. Retention period
| Item | Period |
|---|---|
| Account information | Until you delete your account (deleted immediately when you do). |
| Sign-in session | Valid for 30 days after issue (deleted when you delete your account). |
| Photos for AI improvement, capture information, recognition results | Until you withdraw consent or delete your account (deleted immediately when you do either). |
| Photo-use consent and withdrawal records | Until you delete your account |
| Ingredient-label recognition review | Photos are discarded as soon as processing is finished. Recognition results are not linked to any account and are used to improve our ingredient dictionary. |
| Location coordinates | Not retained by the Company. Open-Meteo keeps server logs for up to 90 days under its own policy. |
Records that applicable laws require us to keep are stored separately from the service database and destroyed when the retention period ends.
5. Destruction procedure and method
- Personal information whose retention period has ended or whose purpose has been achieved is destroyed without delay.
- Electronic files are deleted in a way that cannot be recovered. Photo files are deleted from storage as soon as deletion is requested.
- Database records remain in our cloud provider's recovery feature (Cloudflare D1 Time Travel) for up to 30 days after deletion and are then permanently deleted.
6. Provision of personal information to third parties
The Company does not provide your personal information to third parties, except with your consent or where the law provides a basis.
7. Outsourcing of processing and transfer abroad
| Recipient (contact) | Country | Items | When and how | Purpose | Retention period |
|---|---|---|---|---|---|
| Cloudflare, Inc. ([email protected]) | The United States and other countries where Cloudflare keeps data | Member information, consent records, photos for AI improvement and capture information listed in Section 2 | Sent over the network (HTTPS) when you use the service | Server operation and data storage | Same as Section 4 |
| Open-Meteo ([email protected]) | Switzerland | Location coordinates | Sent by the app over HTTPS when UV information is loaded | Looking up UV index, temperature and humidity | Server logs for up to 90 days under Open-Meteo's policy |
- How to refuse and its effect: If you refuse the transfer of member information, you cannot use the services that require sign-in. Photos for AI improvement are not transferred if you do not consent or if you withdraw consent. If you deny location permission, location coordinates are not sent and information for Seoul is provided.
- Sign-in providers: Apple (United States), Google (United States), Naver (Korea), Kakao (Korea). You sign in on the screen of the provider you choose, and the Company receives only the information listed in Section 2. When a user who signed in with Apple deletes the account, the Company asks Apple to unlink it.
8. Your rights and how to exercise them
- You may at any time request access to, correction or deletion of your personal information, or suspension of its processing, and you may withdraw your consent.
- Withdrawing photo-use consent: In the app, go to Settings > Image use for AI improvement and turn off the consent toggle or tap 'Delete stored photos'. Stored photos and the linking information are deleted immediately.
- Deleting your account: In the app, go to Settings > Delete account
- Requests by email: [email protected]. To confirm your identity, please tell us your sign-in provider and nickname. We will process your request within 10 days of receiving it and let you know the result.
How to request account deletion
- In the app: You can delete your account directly under Settings > Delete account.
- If you cannot use the app: Send an email to [email protected] with the subject 'Account deletion request', including your sign-in provider and nickname.
- Information deleted: account information, sign-in sessions, photo-use consent records, photos for AI improvement and the linking information.
9. Security measures
- Data in transit is encrypted (HTTPS/TLS).
- Cloudflare D1 and R2, where member information and photos are stored, encrypt data at rest with AES-256.
- We do not receive passwords; we use social sign-in only. Sign-in sessions expire after 30 days.
- Photos for AI improvement are stored under a pseudonymous ID instead of the account identifier, and the link between the pseudonymous ID and the account is managed in a separate table.
10. Children under 14
Vorn Vuyage does not accept sign-ups from children under 14.
11. Automatic collection tools
- The app does not use advertising identifiers or cookies and does not track you across other apps or websites.
- The website does not use visitor analytics tools or forms that collect personal information.
12. Privacy officer
- Name and title: CHO YOUNGJONG (Co-Representative Director)
- Contact: [email protected]
13. Remedies for infringement of rights
If you need to report or get advice about an infringement of your personal information, you can contact the following organizations (in Korea).
- Personal Information Dispute Mediation Committee: 1833-6972 (www.kopico.go.kr)
- Personal Information Infringement Report Center: 118 (privacy.kisa.or.kr)
- Supreme Prosecutors' Office: 1301 (www.spo.go.kr)
- Korean National Police Agency: 182 (ecrm.police.go.kr)
14. Changes to this policy
This policy applies from September 28, 2026. If it changes, we will post a notice on this page before the change takes effect. The previous version (July 2, 2026) is available at https://vornvuyage.co.kr/privacy/2026-07-02/.