Privacy Policy
AIRSNAP (the "Company") protects the personal information of data subjects and establishes and discloses this Privacy Policy under Article 30 of the Personal Information Protection Act to handle related grievances promptly and smoothly.
Article 1 (Purposes of Processing Personal Information)
The Company processes personal information for the following purposes and does not use it for other purposes. If the purpose changes, the Company takes necessary measures such as obtaining separate consent under Article 18 of the Personal Information Protection Act.
- Website membership registration and management — verifying intent to join, identifying and authenticating the individual, age verification and protection of minors, maintaining and managing membership, preventing misuse, and various notices.
- Provision of goods or services — shoot booking, contract/billing notices, photo file delivery, physical delivery of goods/USB, online album/content provision, and identity verification.
- Personalized services and marketing — guidance on tailored shoot courses/events/benefits based on member attributes such as age and gender, and development/improvement of new services (only for members who consented to marketing).
- Grievance handling — verifying the complainant's identity, confirming complaints, contacting/notifying for fact-finding, and notifying results.
Article 2 (Processing and Retention Period)
① The Company processes and retains personal information within the retention/use period under the law or the period consented to by the data subject.
② The processing and retention periods are as follows.
- Website bookings and customer management: [4] years from the contract date (an internal standard considering re-retouching, after-service, and grievance handling given the nature of photography services)
- Photo originals: retained for 2 months from the shoot date, then automatically destroyed due to storage capacity (re-delivery not possible afterward)
- Final retouched photos (2nd selection): retained even after the originals are destroyed
- Retention under the Act on Consumer Protection in Electronic Commerce, etc.:
- Records of contracts or withdrawal of subscription, payment, and supply of goods: 5 years
- Records of consumer complaints or dispute handling: 3 years
- Records on labeling/advertising: 6 months
③ However, if an investigation for a violation of relevant laws is underway or a claim/debt relationship remains, the information is retained until its conclusion.
Article 3 (Provision to Third Parties)
① The Company provides personal information to third parties only where Article 17 of the Personal Information Protection Act applies, such as the data subject's consent or special legal provisions.
② For service provision such as assigning an outsourced photographer, it may be provided only to the minimum necessary extent with prior consent.
- Items provided (e.g.): name of the person to be photographed, mobile number, shoot-related information (location, date, time)
- Retention/use period: until completion of the relevant photography service
Article 4 (Entrustment of Processing)
① The Company entrusts personal-information processing tasks as follows for smooth operations.
| Trustee | Entrusted Task |
|---|---|
| Vercel Inc. | Website hosting and server operation |
| Amazon Web Services (AWS) | Encrypted storage of personal information and database operation |
| Cloudinary | Storage of photo/media files and CDN delivery |
| Solapi (Nurigo Co., Ltd.) | KakaoTalk Alimtalk / SMS sending |
| Kakao / Google | Social login (simple authentication) processing |
| PortOne | Mobile identity-verification processing (when introduced) |
② Upon concluding an entrustment contract, the Company specifies in the document, under Article 26 of the Personal Information Protection Act, matters such as prohibition of processing beyond the purpose, technical/managerial protection measures, restrictions on re-entrustment, management/supervision of the trustee, and liability including damages, and supervises the trustee.
③ If the entrusted task or trustee changes, it is disclosed without delay through this policy.
Article 5 (Rights/Obligations of Data Subjects and Legal Representatives and How to Exercise Them)
① The data subject may at any time request access to, correction of, deletion of, or suspension of processing of their personal information.
② Rights may be exercised in writing, by phone, email, etc., and the Company acts without delay.
③ Upon a request for correction/deletion, the Company does not use or provide the relevant personal information until completion.
④ Rights may also be exercised through a legal representative or an authorized person.
Article 6 (Items of Personal Information Processed)
- Required items for membership registration: name (legal name), gender, date of birth, mobile number, email, password
- Optional items for membership registration: delivery address (postal code, address, address detail) — collected only when physical delivery of goods/USB is needed
- When booking/using the service: booker's name, name and contact of the person(s) to be photographed (e.g., groom/bride), shoot-related information (location, date, time), whether a pet accompanies, and requests
- At payment: payment-method information is handled securely through the payment gateway (e.g., Toss Payments); the Company retains only the minimum transaction data needed for approval, cancellation, and refund
- For social login: account identifier, name (nickname), email, gender, date of birth, and mobile number provided by Kakao/Google. The connecting information (CI) provided via Kakao Login is used only to check whether an existing member is the same person (duplicate-registration check) and does not replace a separate identity-verification (real-name) service
- If mobile identity verification is introduced (separate process): should it be introduced in the future, items such as name, date of birth, mobile number, carrier, encrypted connecting information (CI), and duplicated-join verification information (DI) would be collected via an identity-verification agency; this is separate from the CI received via Kakao Login
- Automatically generated/collected during use: access IP, cookies, service usage records, and device/browser information
Article 7 (Destruction of Personal Information)
① When personal information becomes unnecessary due to the lapse of the retention period or achievement of the processing purpose, it is destroyed without delay.
② Where it must be preserved under other laws, it is moved to a separate database or stored in a different location.
③ Electronic files are permanently deleted by an unrecoverable method, and paper documents are shredded/incinerated.
Article 8 (Measures to Ensure Safety of Personal Information)
- Managerial: establishing and implementing an internal management plan, regular staff training
- Technical: managing access rights to the processing system, access control, encryption of unique identifiers/personal information (AES-256, etc.), one-way password hashing (bcrypt/argon2), installation of security programs
- Physical: access control to storage areas
Article 9 (Installation/Operation of Automatic Collection Devices and Refusal)
① The Company may use cookies to provide customized services.
② The data subject may allow or block cookies through web/mobile browser settings (blocking may limit the use of some services).
Article 10 (Personal Information Protection Officer)
- Personal Information Protection Officer: Name Son Se-han / Title CEO / Contact airsnap@naver.com
- The data subject may direct inquiries, complaints, or damage relief regarding personal information protection arising during service use to the above officer, and the Company answers/handles them without delay.
Article 11 (Request for Access to Personal Information)
The data subject may request access under Article 35 of the Personal Information Protection Act to the person in charge below.
- Reception/handling: Name Son Se-han / Contact airsnap@naver.com
Article 12 (Remedies for Infringement of Rights)
- Personal Information Dispute Mediation Committee: 1833-6972 (www.kopico.go.kr)
- Personal Information Infringement Report Center: 118 (privacy.kisa.or.kr)
- Supreme Prosecutors' Office: 1301 (www.spo.go.kr)
- National Police Agency: 182 (ecrm.police.go.kr)
Article 13 (Methods of Collecting Personal Information)
- Website booking form (online form)
- Social login (Kakao/Google) integration
- Automatic collection via identity-verification service (when introduced)
Article 14 (Effect and Amendment of the Privacy Policy)
① This policy applies from July 1, 2026.
② Change history: Enacted on July 1, 2026.
AIRSNAP · air-snap.com