1. Scope
BROZ Inc. (the "Company," "we," "us," or "our") publishes this Privacy Policy to protect personal information and respond promptly to privacy concerns under the Personal Information Protection Act of Korea and other applicable law. It applies to everyais studio (the "Service") at studio.everyais.com.
2. Why We Process Information
- confirm registration, authenticate through Firebase, and manage accounts and consent records;
- generate and edit images from prompts and settings and provide job progress, outputs, and history;
- manage Credits, payments, subscriptions, coupons, generated-data retention, and transaction records;
- review and publish eligible free-credit outputs in the gallery and process consent withdrawals;
- handle business inquiries, feature and model requests, support, and service notices;
- measure usage and advertising performance and improve and market the Service where consent or another lawful basis applies;
- detect and prevent abuse, duplicate benefits, security threats, and incidents; and
- comply with legal obligations and handle disputes.
3. Information We Process and How We Collect It
| Category | Information |
|---|---|
| Account and profile | Email, name, Firebase UID and authentication provider; optional account type, company, business number, country, and phone; and records of terms, Credit Pricing Policy, marketing-email, and gallery-publication consent and withdrawal |
| Image generation | Prompts, input images, model, resolution, output count and other settings; generated images, previews, and thumbnails; job state, errors, Credits used, folder names, and timestamps |
| Payment and subscriptions | Order and transaction IDs, amount, currency, status and time, purchased product or subscription, Credit ledger, masked card number and issuer, and encrypted recurring-payment key |
| Inquiries and requests | Company and contact name, email, message, and optional phone, expected volume, funding program, use case, and reference URL |
| Acquisition and marketing | UTM values, ad click IDs (gclid and fbclid), first landing path, referrer and time, coupon code, marketing consent and email-delivery history, and in-service events |
| Automatically collected | IP address, browser, operating-system and device information, access, request and security logs, cookies, time of use, and page information |
4. Retention
| Information | Retention period |
|---|---|
| Account, profile, consent, and generation-job records | Until account deletion or the purpose is complete, except records needed by law or to resolve a dispute |
| Generated images and thumbnails | 30 days after completion for welcome, coupon, and ordinary admin Credits; 365 days for purchased Credits; for subscription Credits, the earlier of 365 days and 30 days after all paid access ends. Mixed settlement uses the longest right actually charged. Gallery Studio publication is exempt while published, subject to consent withdrawal, delisting, or account deletion |
| In-progress previews | Up to 1 day after serving generation progress |
| B2B inquiries and feature requests | 3 years after completion or the separately agreed period |
| First-touch cookie | Up to 90 days in the browser; linked acquisition data until account deletion after signup |
| Welcome-Credit duplicate-prevention record | For the operating life of the Service while abuse and duplicate-grant prevention remains necessary |
| Contract, cancellation, and payment records | 5 years under Korean e-commerce law |
| Consumer complaint and dispute records | 3 years under Korean e-commerce law |
| Access logs | At least 3 months under applicable communications law |
| Marketing consent and withdrawal evidence | For the period required by applicable law or reasonably needed to resolve a dispute |
5. Disclosure to Third Parties
We do not disclose personal information to third parties except with your consent or as permitted by law. The following disclosures occur when necessary to complete a generation or payment you request.
| Recipient | Information | Purpose | Retention |
|---|---|---|---|
| Google LLC (Gemini) | Prompt, input image, and generation settings | AI image generation and editing | For processing and as provided by the provider's policy |
| Hecto Financial Co., Ltd. | Order, amount, purchaser, and payment information needed for authorization | Card and recurring-payment processing | Under applicable electronic-finance law and the provider's policy |
6. Service Providers
| Provider | Processing |
|---|---|
| Google Cloud and Firebase | Authentication, server, database and task-queue operations, and AI image generation |
| Amazon Web Services | Generated-image storage and delivery and service-email delivery |
| Vercel Inc. | Website hosting and deployment |
| Hecto Financial Co., Ltd. | Payment and recurring-payment method processing |
| Cloudflare, Inc. | Bot verification for B2B inquiries |
| Google LLC and Meta Platforms, Inc. | Web analytics, advertising measurement, and conversion analysis when configured |
7. International Transfers
| Recipient and country | Information | Purpose and method | Retention |
|---|---|---|---|
| Google LLC · United States and service-processing regions | Account identifiers, prompts, input images, generation settings, and access information | Encrypted transfer as needed for authentication, AI processing, and cloud operations | For service delivery or under Google's policy |
| Vercel Inc. · United States | IP, device, and access logs | Encrypted transfer on access to deliver the website | For service delivery and under Vercel's policy |
| Cloudflare, Inc. · United States | IP, browser information, and verification token | Encrypted transfer when an inquiry is submitted to verify human use | For verification and under Cloudflare's policy |
| Google LLC and Meta Platforms, Inc. · United States and other regions | Cookies, ad identifiers, page and conversion events | Encrypted transfer on access when analytics or advertising is configured | Under each provider's policy |
9. Optional Gallery Consent
Gallery publication is optional and separate from processing required to provide the Service. If an opted-in User generates an image entirely with free Credits, we may review it and publish the approved image together with its prompt, model, and resolution.
We do not publish an image paid for in whole or part with purchased or subscription Credits. You may withdraw consent at any time in Settings, which removes published and pending entries. Declining or withdrawing does not affect core image-generation access.
10. Your Rights
- request access, portability, correction, deletion, or restriction and withdraw consent;
- withdraw marketing-email and gallery-publication consent in Settings; and
- exercise rights through a lawful representative.
11. Deletion and Security
We delete personal information without undue delay when its retention period expires or its purpose is complete. Electronic files are deleted using methods designed to prevent recovery, paper is shredded or incinerated, and records required by law are segregated.
Our safeguards include encryption in transit, least-privilege access, database access controls, encryption and key management for payment keys, abnormal-request controls, audit logs, private image storage, and expiring signed delivery URLs.
12. Privacy Contact and Remedies
- Privacy officer: Seungyun Kim
- Title: Representative director
- Email: nilk@broz.co.kr
- Phone: +82-10-2798-3438
- Company: BROZ Inc.
- Business registration no.: 288-81-02136
- Address: Suite 503, 5F, 465 Dongdaegu-ro, Dong-gu, Daegu, Republic of Korea
13. Changes to This Policy
We announce additions, deletions, or amendments at least 7 days before they take effect. We provide at least 30 days' notice of a change that materially affects User rights and obtain renewed consent where required.
This Policy takes effect on August 6, 2026.