powered by Prighter
Effective date: November 10, 2026 (previous versions: November 6, 2026 and September 10, 2026)
Advance notice of changes to this Privacy Policy — the changes below take effect on November 18, 2026, 00:00 Korea Standard Time (UTC+9). The text below this notice is the version in effect now; the new version will be published at this address at that time.
| Item | Now | After the change |
|---|---|---|
| Where AI Portrait generation runs | May run in Singapore, the United States, Belgium or the Netherlands | By your region. Users in the EEA, the UK and Switzerland: Belgium and the Netherlands only, never outside the EU. Other users: Singapore (the United States for the Americas) first and, when busy, another region (the United States, Singapore, the Netherlands or Belgium) |
| How your region is determined | (not stated) | From the app store country of your most recent AI Portrait payment, your profile country, and your device's language region and time zone (any one in the EEA, the UK or Switzerland means the EU). The result, the reasons and where the job ran are kept in the job record |
| Data items listed | Purchase records; device information (app version, language) | Purchase records list the store country of the payment; device information lists the time zone |
| Deleting working copies | Deleted as soon as the job ends | Deleted as soon as the job ends, including when it fails (stated) |
| No use for training | We do not use them for training, advertising or marketing | Our contracts also prohibit service providers from using them to train their own AI or for other purposes (stated) |
| Age check for face features | By your date of birth | You confirm that you are at least the minimum age for your country; we do not ask for your date of birth (matches how the app works) |
No new categories of personal data, new service providers or new transfer countries are added. Contact: colorlovers2@colorloverinc.com
ColorLover Inc., a Delaware corporation (the “Company”), operates the ColorLover service and processes your personal information as described below in compliance with the Korean Personal Information Protection Act and other laws that apply to you.
| Category | Information | When collected |
|---|---|---|
| Account | Email address (when signing up with email), social login account identifier (Kakao, Naver, Google, Apple) | Sign-up and login |
| Profile | Nickname, feed ID, profile and background images, bio, social media links | When entered by the user |
| Personal color | Self-assessment inputs and results (including tone and temperature), customized information (including skin tone and preferences) | When taking an assessment or entering customized information |
| Content | Photos, feeds, reviews, comments, and posts submitted by the user | When content is posted |
| AI Portrait (optional feature) | One face photo, the selected look and type, generated portrait images, consent, purchase and ticket records, and report content (Section 10) | When the AI Portrait feature is used (after separate consent) |
| 3D face scan for eyewear and sunglasses (optional feature) | Still face photos (6 per scan: front, left, right, up, down and a final front view; up to 10 scans), device model, manufacturer, operating system and app version, camera type and capture settings (such as exposure and white balance) and screen brightness, photo quality values (face size, angle, distance and brightness), lighting and ambient brightness, skin color measured by area (cheeks, forehead, jaw and neck) and an undertone estimate, color calibration card results if you use one, and, if you enter them, the light source and indoor or outdoor setting, skin condition (such as tanning or redness), makeup, sunscreen and beauty-filter use, preferred finish and the foundation and shade you use now | When you scan before trying on eyewear or sunglasses (after face information consent) |
| Face information consent | Consent version, time and withdrawal records, and the age-check result (passed or not) with the country and minimum age it used (your date of birth is used only for the age check and is not stored) | When you first use a photo AI feature or the 3D face scan |
| Device | Push notification token (when notifications are enabled), app version and language, device identification information | Automatically while using the app |
| Advertising | Advertising identifier (IDFA — only when the user consents to tracking) | When ATT consent is given |
| The Company’s own advertising | Pseudonymized member value (one-way hash), ad and product identifiers, impression/click/conversion timestamps. When personalized ads are turned on, assessment result codes (season, tone, temperature) | Automatically on impressions, clicks, and conversions of advertising sold directly by the Company (Section 7) |
| Usage records | Service usage and access records, error records | Automatically while using the app |
Photo makeup in the upload editor and camera finds where your face is on your own device to apply colors. Your photo and face information are not sent to our servers and are not stored for this. Only if you choose to post is the finished photo uploaded and handled as your post.
The Company (United States) entrusts the storage and processing of personal information to the service providers below.
| Service provider | Entrusted service | Notes |
|---|---|---|
| Google Cloud (Google LLC) | Cloud servers and data storage (Seoul region) | Overseas servers (United States) may be used during authentication (Firebase) processing. Photos and generated images of the AI Portrait are stored in the Seoul region, and generation may run on GPU servers overseas (Section 10) |
| Google (AdMob) | In-app advertising | The advertising identifier is used when tracking consent is given |
| Google Firebase (Google LLC) | Sign-in authentication, storage of some app feature data (Cloud Firestore), file storage (default bucket) | United States (Firestore nam5 multi-region, default bucket US multi-region) |
Overseas processing for optional features (hair generation and AI beauty analysis)
Users may view and edit their personal information at any time in the app settings and may request deletion of their personal information by deleting their account. Notification and tracking consent may be withdrawn in the device settings. Personalized ads can be turned on or off at any time in My > Settings > Personalized ads (Section 7). Photos and generated images of the AI Portrait can be deleted in My > Settings > AI Portrait library and deletion (Section 10). If you withdraw your face information consent (My > Settings > Face information consent) or your consent for a feature that uses face photos (AI Portrait, hair generation, AI beauty analysis and the 3D face scan for eyewear and sunglasses), the Company stops that processing at once and keeps the photos, scan photos, generated results and analysis results made under that consent separately for 30 days so that you can ask to restore them, and then destroys them. 3D face scan photos are destroyed earlier if 90 days from the scan come first. During this period they are not used for any other purpose; if you ask to restore them within the period, we ask for your consent again and restore them. For users in Indonesia, the default is immediate deletion on withdrawal, and you may choose 30-day retention instead. Posts you published yourself (such as in Explore) must be deleted by you.
When the retention period expires, electronic files are deleted using methods that prevent recovery, and other records are shredded or incinerated.
The Company does not collect personal information from children under the minimum age at which a person may consent to the processing of their personal information without a parent or guardian in the country where they live (for example, 14 in Korea, 13 in the United States and the United Kingdom, 15 in France, 16 in Germany, and 16 when the country is unknown). Features that process or store face information on our servers (photo AI features such as the AI Portrait, AI beauty analysis and hair generation, and the 3D face scan for eyewear and sunglasses) check your date of birth against this age and ask for face information consent before use, and cannot be used below it. Virtual try-on that calculates face information only on your device and does not send it to our servers or store it (real-time makeup, lenses and hair color, on-device photo try-on and similar) can be used without an age check.
Annex — minimum age by country (the same values the server uses for age checks). For other countries, or when the country is unknown, the minimum age is 16.
Privacy officer: Josung Kim (CEO, ColorLover Inc.) · Email: colorlovers2@colorloverinc.com
You can make privacy inquiries, complaints and requests for remedies to the privacy officer (in Korean, too), and the Company responds without delay. Users in Korea may also report or seek advice on privacy infringements to the Personal Information Infringement Report Center (118, privacy.kisa.or.kr), the Personal Information Dispute Mediation Committee (1833-6972, www.kopico.go.kr), the Supreme Prosecutors’ Office (1301) and the Korean National Police Agency (182).
Representative — We value your privacy and your rights as a data subject and have therefore appointed Prighter Group with its local partners as our privacy representative and your point of contact for the following regions: European Union (EU), United Kingdom (UK). Prighter gives you an easy way to exercise your privacy-related rights (e.g. requests to access or erase personal data). If you want to contact us via our representative, Prighter or make use of your data subject rights, please visit the following website: https://app.prighter.com/portal/16876649480
powered by Prighter
You can also contact us directly at colorlovers2@colorloverinc.com. We respond within one month of receiving your request; if a request is complex, we may extend this by up to two further months and will tell you why within the first month. Users in the EU and the UK may lodge a complaint with a supervisory authority, in particular where they live or work or where the alleged infringement took place (in the UK, the Information Commissioner’s Office, ico.org.uk).
The AI Personal Color Portrait (the “AI Portrait”) is an optional feature that creates portrait images for each personal color type from one face photo uploaded by the user, and it is provided through per-type tickets. The following applies only when you use this feature. The Company processes your photo only after obtaining the four required consents in the app (photo processing, retention, confirmation that the photo is your own, and age confirmation). You can still use the rest of the service if you do not consent.
| Information | Purpose |
|---|---|
| One face photo uploaded by the user (a copy from which the server has removed additional data such as location) | Creating and delivering the AI Portrait, safety checks, handling reports and inquiries |
| Generated AI Portrait images (including the AI-generated label) | Delivering results, the library, supporting save and share |
| Selected look (woman or man) and type, and generation job records (status, time, failure reason) | Providing the service, error handling, charging and releasing tickets |
| Consent records (consent version, text hash, consented items, time) | Confirming that consent was given |
| Purchase and ticket records (store transaction number, product, number of tickets, time, usage and refund history) | Verifying payments, granting and charging tickets, revoking tickets on refund, accounting evidence. Payment method details such as card numbers are handled by the app store and are not collected by the Company |
| Report records (reason, text written by the user, outcome) | Handling reports |
| Administrator access and action records (reason, target, time) | Access control and retention of access logs |
| Service provider | Entrusted service | Processing location |
|---|---|---|
| Google Cloud (Google LLC) | Storing photos and generated images, AI Portrait generation (GPU servers), operating the service servers and database | Republic of Korea, Seoul region (asia-northeast3) |
| Google Cloud (Google LLC) | AI Portrait generation (GPU servers) | Singapore (asia-southeast1), United States (us-east4), Belgium (europe-west1), the Netherlands (europe-west4) |
Photos and generated images of the AI Portrait are stored in the Seoul region (Republic of Korea) of the processor above. To deliver portraits as soon as they are ordered, generation may be processed overseas as follows.
Overseas use during authentication (Firebase) is as described in Section 4. Payments in the app stores are processed by Apple and Google; at purchase, the store receives an account-binding value derived one-way from the user identifier, and the Company queries the store servers to verify transactions and check refunds.
We announce changes in the app and on our website at least 7 days before they take effect (30 days for important changes such as a change of operating company or new overseas transfers), with a before-and-after comparison.
This Section applies when the EU General Data Protection Regulation (GDPR) or the UK GDPR applies to our processing of your personal information. The controller is ColorLover Inc. (contact: colorlovers2@colorloverinc.com). Our EU and UK representatives are listed in Section 9.
| Purpose | Legal basis (Article 6 of the GDPR and the UK GDPR) |
|---|---|
| Creating and managing your account, signing you in, and providing the features you choose (personal color assessments, customized content, Explore, reviews, comments, bookings and subscriptions) | Performance of our contract with you (Art. 6(1)(b)) |
| Processing purchases and subscriptions and keeping transaction records required by law | Contract (b); legal obligation (c) |
| Keeping the service secure, preventing fraud and abuse, handling reports and moderating content | Our legitimate interests in operating a safe service (f) |
| Answering your inquiries and requests to exercise your rights | Contract (b); legal obligation (c) |
| Replicating the service database to regional servers and backups (Section 4) | Contract (b); our legitimate interests in service continuity (f) |
| Face-photo features (AI Portrait, AI beauty analysis, hair generation and the 3D face scan for eyewear and sunglasses) | Your explicit consent (Art. 6(1)(a), and Art. 9(2)(a) to the extent face information is special category data). You can withdraw it at any time; withdrawal does not affect processing before it |
| Age check before face-photo features | Legal obligation (c); our legitimate interests in protecting children (f) |
| Personalized advertising using your assessment result codes (Section 7) | Your consent (a), given by turning on Personalized ads |
| Contextual advertising sold directly by the Company and aggregated ad measurement (Section 7) | Our legitimate interests in funding the free service (f) |
| Third-party advertising (Google AdMob) and advertising identifiers | Your consent through the consent prompt (a). Without consent, only non-personalized ads are shown |
| Push notifications | Your consent (a), given in your device settings |
| In-app usage analytics | Your consent (a), only if you turn on analytics in the app |
| Service quality improvement and statistics from server usage and error records | Our legitimate interests (f) |
Where we rely on legitimate interests, we have balanced them against your rights, and you may object at any time (Art. 21). We do not process face photos on the basis of legitimate interests, and we do not use them to verify or identify you, to train AI models or for advertising. We do not make decisions that produce legal or similarly significant effects on you solely by automated processing.
In addition to the rights in Section 5, you have the rights of access, rectification, erasure, restriction of processing, data portability and objection, and the right to withdraw consent at any time. Send requests to colorlovers2@colorloverinc.com or to our representative. We answer within one month, extendable by two months for complex requests. You may complain to a supervisory authority (in the UK, the Information Commissioner’s Office). Account information is needed to use the service; face photos and advertising information are optional, and refusing them only makes those features unavailable.
The Company is established in the United States and uses Google Cloud and Google Firebase (Google LLC) as processors. Your personal information is therefore processed in the places listed in Sections 4 and 10: the Republic of Korea (main database, photos and generated images), the United States, Singapore and, for some processing, Belgium and the Netherlands. AI beauty analysis runs on Google Vertex AI in the global location, where Google chooses the processing region. We protect these transfers as follows:
Photos and generated images are stored only in Seoul; overseas GPU and AI servers keep only working copies that are deleted when processing ends. You can ask for a copy of these safeguards at colorlovers2@colorloverinc.com or through our representative.
Company: ColorLover Inc. (a Delaware corporation) · Representative: Josung Kim
Address: 800 North State Street, Suite 304, Dover, Delaware 19901, United States
Contact: colorlovers2@colorloverinc.com