BAEKIT PRIVACY
Privacy Policy
How BAEKIT collects, uses, retains, and protects personal information and how you can exercise your rights.
Effective October 5, 2026 revision draft
1. Information we process
We process account and authentication details, prompts and uploaded media, generated output, project and usage records, device and security logs, payment transaction metadata, consent records, and support correspondence. Payment processors handle full card details; we do not store full card numbers.
Supported BYOK provider keys can remain on the user's device in local configurations and are not intentionally retained in our server logs or generation history.
Checkout may transmit your phone number to the payment processor; it is not persistently stored in your browser. Consent records contain your account ID, policy version, acknowledgements, language and server timestamp; purchases also record the product, price, cycle and transaction reference, and publication records include the visibility scope.
2. Purposes
We use information for authentication, requested AI processing, project storage, BP accounting, payment and refunds, support, fraud prevention, security, service quality, and legal compliance.
Necessary account and order processing is based on contract performance; statutory records are retained to meet legal obligations. Reading this policy is not blanket consent to marketing or international transfers. Processing requiring separate consent is explained and agreed separately. Registration is unavailable to children under 14.
3. Retention
We delete personal information when its purpose ends or an account is deleted, unless law requires retention. Korean e-commerce records can be kept for five years for contracts and payments, three years for consumer disputes, and six months for advertising records. Account media marked with a two-month retention period is removed after that period.
4. Sharing and processors
We do not sell personal information. Cloudflare, Supabase, PortOne (Korea PortOne Inc., payment integration together with its payment gateways KG Inicis, NHN KCP, and KakaoPay), and an AI provider selected by the user can process only the information needed for hosting, authentication, security, payment, or the requested generation task.
Publishing is optional. Published work, display name, title and caption are public; prompts are public only when separately selected. Removing a post cannot recall copies already saved by others.
5. International transfers
Timing and method: encrypted transfers occur on access, registration or storage for infrastructure, and when you request AI processing for the relevant provider. AI payloads comprise prompts, selected reference media, output and request identifiers, not full payment-card details or account passwords. The model brand may differ from the API processor.
Necessary overseas processing or storage for contract performance requires the disclosures under Article 28-8(1)(3) of Korea's Personal Information Protection Act. Other transfers need a separate lawful basis. This revision draft reflects public policies and service settings; unresolved account-specific countries, subprocessors and retention periods must be confirmed and disclosed before the relevant transfers begin.
You can decline by not starting the selected AI feature, or request suspension/deletion through our privacy contact. Declining AI transfers limits that model; declining essential authentication or storage can prevent account service. Refund, cancellation and privacy requests remain available.
- Supabase Pte. Ltd.: authentication/database storage of account, project, transaction and consent data. Storage depends on the selected project region; support/subprocessors may process in the US, Singapore and other locations. The actual project country needs confirmation. Contract-duration processing and DPA return/deletion procedures apply. Contact: privacy@supabase.io.
- Cloudflare, Inc.: delivery, security, Worker execution and media storage of access/request/file data across its global network, including the US. Actual R2 location and log retention need account verification; DPA deletion procedures apply. Contact: privacyquestions@cloudflare.com.
- Google Cloud (Vertex AI): AI payloads for generation and safety. The global endpoint does not guarantee one country. Training without prior permission is restricted, but safety logs and caches can be retained. We do not promise an unverified zero-retention exemption. Contact and conditions: Cloud DPA and retention documentation.
- BytePlus Pte. Ltd. (ModelArk): AI payloads for generation/safety through the AP endpoint. Official routing can span AP (Johor, Malaysia) and EU (Dublin, Ireland); Singapore-only processing is not promised. Storage countries and safety/support retention require contract confirmation. Contact: BytePlus privacy channel.
- Features & Labels, Inc. (fal): AI payloads for generation/delivery; US and other operating countries. Default input/output and CDN storage can apply; DPA and account settings govern deletion. Immediate deletion is not promised. Contact: support@fal.ai.
- Alibaba Cloud (Model Studio): AI payloads for generation/safety using the Singapore region (ap-southeast-1). Zero retention is conditional and safety exceptions can apply. Contracting entity, exact countries and retention require account verification. Contact: Model Studio privacy channel.
- BYOK connections to OpenAI, xAI or other supported providers transmit request data and the authentication key to the selected provider under the connected account's terms. Additional required country and retention disclosures must precede activation.
6. Your rights
You may request access, correction, deletion, suspension, consent withdrawal, or account deletion by emailing premia.art@gmail.com. We verify identity and respond within the period required by law.
7. Security, deletion, and cookies
We apply access controls, encrypted transmission, least privilege, logging, and security updates. Electronic files are securely deleted when no longer needed. Cookies and local storage support authentication, preferences, security, and service analytics.
Your browser requests display fonts from Google Fonts, which can receive your IP address, browser information and font request details. This external resource request is separate from AI processing. Blocking external fonts falls back to fonts on your device.
8. Privacy contact
Privacy contact: Hong Tae-ui / premia.art@gmail.com / +82-507-1347-5333