Published and effective: November 9, 2026

1. Purpose of Processing Personal Data

Yiroom ("Company") processes personal data for the following purposes. Data collected will not be used beyond these stated purposes. If purposes change, we will obtain separate consent and take necessary measures.

Membership management: identity verification and authentication for account registration
Service delivery: personal color, skin, body, hair, and makeup analysis and personalized beauty guidance
AI analysis: AI-powered analysis based on user-uploaded images
AI coaching: personalized beauty advice through AI coaching (saved analysis results are used as reference material for consultation responses; original photos from previous analyses are not automatically reused in consultations)
Closet, ingredient analysis, AI avatar, and related features: automatic classification of the clothing photos you register, product ingredient label reading, outfit and routine suggestions, and, at your request, AI avatar creation, avatar outfit try-on, and photo retouching for sharing
Web social features: optional friend connections, activity feeds, and comments
Product recommendations: personalized product suggestions based on analysis results and affiliate services
Service improvement: analysis of usage records, service improvement, and new feature development

2. Categories of Personal Data Collected

The Company collects the following personal data to provide its services:

Required: Email address, password (if you sign up with email), date of birth (for age verification — 18 or older)
Optional: Gender (for personalized recommendations), profile photo, height, weight, nickname
Collected during service use: Images for personal color, skin, body, hair, and makeup analysis and the results of those analyses; AI coach conversation content and photos you share in coaching
When you use additional features: Photos you register in your closet or vanity and the clothing, product, and routine information you enter; product ingredient label photos you submit for analysis; photos used to create an AI avatar or to retouch for sharing, and the generated images
When you contact us: Email address, name (if provided), message content and attachments
When you turn on notifications: Notification settings and web browser push subscription information
Web social features: Friend lists, activity feed posts, comments, and likes. The Yiroom mobile app does not provide social features and does not collect this data.
Automatically collected: Service usage logs, access logs (IP address, browser type), device information (device type, operating system, app version), sign-in records and device identifiers, mobile app error and performance records with an app-installation identifier, affiliate link click records

3. Data Retention Periods

The Company retains and processes personal data within the retention period required by applicable laws or as agreed upon during data collection.

Account information: Destroyed without delay upon account deletion (no recovery grace period). Information that other laws require us to retain is stored separately for the required period.
Accounts that have not completed sign-up verification: An account that has not completed date-of-birth verification within 72 hours after sign-up cannot use the service and is deleted automatically.
Deletion records: To prevent a deleted account from being recreated and to confirm that the deletion was completed, we retain the internal ID, the authentication account identifier, the processing time, and the categories of data destroyed, without a set retention period. These records do not contain your email address, name, photos, or analysis results.
Analysis images and AI avatar images: If you consent to storage, retained for 1 year from the consent date and then destroyed automatically. If you withdraw consent or request deletion earlier, they are destroyed immediately, and they are also destroyed upon account deletion. If a temporary error prevents destruction, we automatically retry. If this does not complete automatically, an operator will review and complete it.
Closet and vanity photos and the information you enter: When you delete an item, its photo is also destroyed, and all of them are destroyed upon account deletion.
Photos used only for AI processing (photos shared in coaching, ingredient label photos, and photos uploaded for retouching): Used only for AI processing and not stored on the Company's servers. Retention by the processing provider follows the international transfer table in Section 5.
AI coach conversations: Stored on our servers so you can resume previous conversations; you can delete them anytime via settings or by request (destroyed upon account deletion)
Web social activity records: Destroyed without delay upon account deletion; information subject to statutory retention requirements is retained separately
Inquiry records: Emails sent to privacy@, contact@, or support@yiroom.app are deleted without delay once the inquiry has been handled. Feedback submitted through the web Help Center is destroyed upon account deletion.
Service usage logs: 3 years

4. Processing of Biometric Data

In accordance with Article 23 of the Personal Information Protection Act (Korea), the Company obtains separate consent when collecting and using biometric data such as facial features and body shape.

Data collected: Facial images for skin and makeup analysis, hair and scalp images for hair analysis, full-body images for body type analysis, images for personal color analysis, and facial photos used to create an AI avatar together with the generated AI avatar images (if you create one)
Purpose: AI-powered skin, body type, personal color, hair, and makeup analysis, and progress tracking; AI avatar creation at your request
Retention: If you consent to image storage, retained for 1 year from the consent date and then automatically destroyed; destroyed earlier upon withdrawal, deletion request, or account deletion (if a temporary error prevents destruction, we automatically retry; if this does not complete automatically, an operator will review and complete it)
Consent method: Collected as a separate, mandatory consent item during sign-up, before any image is captured
Withdrawal: Can be withdrawn anytime via Settings > Privacy
On-device share images: Only when the user explicitly chooses on the results screen, analysis photos are composited into a shareable image entirely on the user's device (browser); during this process the image is never transmitted to or stored on the Company's servers.
AI-generated share images: If you use photo retouching for sharing (web) or AI avatar outfit try-on, photos are sent to Google (Gemini) to create the image. The created images and the photos you upload for retouching are not stored on the Company's servers.

Note: Analysis services are available even without consenting to image storage. However, comparison with previous results (progress tracking) will not be available.

5. Third-Party Data Sharing and Processing Partners

The Company does not share personal data with third parties beyond the stated purposes without prior consent, except in the following cases:

When separate consent has been obtained from the data subject
When required by law or regulation
When necessary for the urgent protection of life, body, or property and the data subject is unable to express consent

AI Analysis and Coaching — Service-Provider Processing

Yiroom uses the paid Google Gemini API for AI analysis and coach responses. Where active Cloud Billing and the Data Processing Addendum (DPA) apply, Google processes images, coach-message inputs, and saved analysis results used as consultation context on Yiroom's instructions as a service provider (processor); we do not classify this as disclosure to Google for its own independent purposes. Processing is governed by the Google Gemini API Terms of Service.

Data Processing Partners

We outsource the processing of personal data as follows to provide the service. If the outsourced tasks or the processors change, we will notify you without delay through this Privacy Policy.

Google Asia Pacific Pte. Ltd. and its affiliates (contracted through Google Cloud Korea LLC): AI image analysis, AI coach responses, automatic clothing photo classification and ingredient label reading, AI avatar creation, avatar outfit try-on, and photo retouching for sharing (Gemini API) — Outside Korea (see table below)
Google LLC: Receiving inquiry emails (Gmail) — Outside Korea (see table below)
Supabase Pte. Ltd. (Singapore): Storing and managing service data and photos (analysis photos and AI avatar images you consent to store, closet and vanity photos) — Republic of Korea (Seoul); operational logs and technical support: see table below
Clerk, Inc.: Sign-up and sign-in authentication and account management — Outside Korea (see table below)
Vercel Inc.: Service hosting and visit and performance statistics — Outside Korea (see table below)
Functional Software, Inc. (Sentry): Mobile app error and performance monitoring — Outside Korea (see table below)
Upstash, Inc.: Usage limits and abuse prevention — Outside Korea (see table below)
ImprovMX Incorporated: Forwarding inquiry emails (privacy@, contact@, support@yiroom.app) — Outside Korea (see table below)

If you turn on web notifications, they are delivered through the push service of your browser provider (for example, Google, Mozilla, or Apple).

Affiliate Services

When you click product recommendation links within the service, you will be redirected to external shopping platforms (e.g., Coupang). Their respective privacy policies apply. Yiroom records affiliate link clicks together with your account identifier within the service (to improve recommendations and confirm conversions), but does not pass any personal identifiers to external partners. Yiroom does not collect any purchase information from external services.

International Transfers to Processing Partners

In the course of providing the service under our contract with you, we outsource processing to, or have personal data stored by, the companies below, and personal data is transferred outside Korea as a result. Legal basis: Article 28-8 (1) 3 (a) of the Personal Information Protection Act (outsourcing and storage necessary to perform the contract, disclosed in this Privacy Policy).

Recipient: Google Asia Pacific Pte. Ltd. and its affiliates (contracted through Google Cloud Korea LLC)
Contact: googlekrsupport@google.com
Country: Countries where Google or its agents maintain facilities (including the United States)
Data: Images for personal color, skin, body, hair, and makeup analysis; AI coach inputs and photos shared in coaching; saved analysis results used as consultation context; clothing photos you register in your closet; product ingredient label photos for ingredient analysis; photos used for AI avatar creation, avatar outfit try-on, and photo retouching for sharing
Timing & method: In real time over encrypted connections (HTTPS) when you use the relevant feature
Purpose: AI image analysis, AI coach responses, automatic clothing classification and ingredient label reading, and generation of AI avatar, try-on, and retouched images
Retention: Retained by Google for a limited period (55 days under Google's usage policy) solely to detect and prevent policy violations, then deleted; not used to improve Google's products

Recipient: Google LLC (Gmail)
Contact: googlekrsupport@google.com
Country: United States and other countries where Google operates data centers
Data: Inquiry and rights-request emails (sender address and name, content, attachments)
Timing & method: By email, forwarded through ImprovMX when you write to us
Purpose: Receiving and answering inquiries and rights requests
Retention: Deleted without delay once handled (deleted emails are fully removed from Google's systems typically within about 2 months, and from backups within up to 6 months)

Recipient: ImprovMX Incorporated (United States)
Contact: support@improvmx.com
Country: France (receiving); France and the United States (forwarding)
Data: Inquiry and rights-request emails (sender address and name, content, attachments, mail headers) and the sending mail server's IP address
Timing & method: By email when you write to us
Purpose: Forwarding mail sent to our three addresses to our mailbox
Retention: Message content and attachments are deleted as soon as they are delivered; delivery logs are deleted automatically after 7 days

Recipient: Vercel Inc.
Contact: privacy@vercel.com
Country: Eastern United States (Washington, D.C. area)
Data: Request data exchanged while you use the service (uploaded photos and inputs pass through during processing), access information (IP address, browser type), cookieless visit and performance statistics
Timing & method: Whenever you use the service, over encrypted connections
Purpose: Hosting, request processing, visit and performance statistics
Retention: Request logs are deleted automatically within 30 days; visit and performance statistics are kept only in aggregated form that does not identify individuals (visitor hashes are discarded within 24 hours)

Recipient: Clerk, Inc.
Contact: privacy@clerk.dev
Country: United States
Data: Email address, password (if you sign up with email; stored encrypted), sign-in records, session and device information and device identifiers, IP address
Timing & method: At sign-up and sign-in, over encrypted connections
Purpose: Authentication and account management
Retention: Until account deletion (the authentication account is deleted upon account deletion); sign-in and sign-up logs are deleted automatically within 7 days

Recipient: Functional Software, Inc. (Sentry)
Contact: compliance@sentry.io
Country: United States (Iowa)
Data: Mobile app error and performance data (device, OS, app version, and other technical information, the name of the screen where an error occurred, app start and screen response times) and an app-installation random identifier; screenshots and IP addresses are not stored
Timing & method: When an app error occurs or performance is measured, over encrypted connections
Purpose: App error and performance analysis and service stability (generative AI features are not used)
Retention: Deleted automatically 30 days after collection

Recipient: Upstash, Inc.
Contact: privacy@upstash.com
Country: United States (AWS us-east-1)
Data: Account identifier or IP address, request counts and times, AI coach usage counts and AI image generation counts (the identifier for AI coach usage counts is stored as a hash)
Timing & method: In real time with each request
Purpose: Usage limits and abuse prevention
Retention: Deleted automatically when the limit window ends (about 1 minute, within 24 hours, or early the following month)

Recipient: Supabase Pte. Ltd. (Singapore) and its support affiliate Supabase, Inc. (United States)
Contact: privacy@supabase.com
Country: Operational logs: EU data centers; support and security response: countries where support staff are located
Data: Service operation logs (request paths and results, including member identifiers when a member token is sent) and, when we request support or respond to a security incident, stored data to the extent necessary
Timing & method: Logs sent continuously during use; remote access only when we request support or respond to a security incident
Purpose: Service operation, security, and technical support
Retention: Logs deleted automatically within 28 days; stored data remains in Seoul

How to refuse and the effect: You may refuse these transfers by contacting our Data Protection Officer (Section 12) or by deleting your account. Because processing through Vercel, Clerk, Supabase, and Upstash is essential to the service, and mobile app error and performance reporting (Sentry) cannot be turned off separately in the app, refusing these transfers means you will not be able to sign up for or use the service (including the mobile app). If you only wish to refuse the transfer to Google for AI features (analysis, coaching, clothing classification, ingredient label reading, AI avatars, and similar features), do not use those features; they will then be unavailable. If you do not want your inquiry email transferred through ImprovMX and Google, you can use "Feedback / Suggestions" in the web Help Center instead.

Cookies and Automatic Collection

The Company uses cookies and similar technologies as follows:

Clerk login session cookies: Keep you signed in (essential)
Language preference cookie: Stores your language choice when you select one
Vercel Analytics: Collects anonymous visit statistics without using cookies

How to refuse: You can block or delete cookies in your browser settings. Blocking essential cookies may limit features such as sign-in.

Location Data by Platform

On the web, we use approximate device coordinates temporarily for outfit and weather-based advice only after you explicitly allow browser location access. The coordinates are not stored and are used only for an Open-Meteo weather lookup. The Yiroom mobile app does not request device location permission or collect approximate or precise location data.

6. Data Destruction

When personal data is no longer needed due to expiration of retention period or fulfillment of processing purpose, the Company destroys the data without delay.

Electronic files: Securely deleted to prevent recovery or reproduction
Physical records: Destroyed by shredding or incineration

7. User Rights

Users may exercise the following rights regarding their personal data at any time:

Request access to personal data
Request correction of inaccurate data
Request deletion of personal data
Request suspension of data processing

8. Automated Decision-Making and Profiling

The Company uses AI (Google Gemini) to analyze the images you upload and automatically generate profiles and personalized advice about your visual characteristics—personal color, skin, body type, hair, and makeup.

Basis of processing: Visual features such as color, contrast, and shape are extracted from the image and evaluated against academic analysis criteria (e.g., color science and skin physiology).
Procedure: Image transmission, AI feature extraction, application of analysis criteria, and presentation of results, with a confidence level shown alongside each result.
Nature of results: Results are advisory beauty guidance and are not decisions that produce legal or similarly significant effects on your rights or obligations.
Right to object and to an explanation: You may object to automated processing by not using the analysis features. To request an explanation of a result, a re-analysis, or deletion, contact privacy@yiroom.app.

9. Security Measures

The Company implements the following measures to safeguard personal data:

Encryption in transit: All data is transmitted over encrypted HTTPS (TLS) connections.
Encryption at rest: Account information, analysis results, and photos are stored in encrypted cloud storage (Supabase).
Access control: Access is granted under the principle of least privilege, and row-level security (RLS) ensures you can access only your own data.
Access logging: Access to systems that process personal data is logged and protected against tampering.

10. Age Requirement

Yiroom is available only to individuals aged 18 or older, in line with the terms of use of the AI analysis services we use. We confirm age using the date of birth you enter at registration, and we do not store a date of birth that indicates you are under 18. In that case, the account is deleted as soon as you confirm on the notice screen, and an account that has not completed date-of-birth verification is deleted automatically as described in Section 3. If we otherwise learn that we have collected personal information from someone under 18, we will suspend the account and destroy that information without delay. In these cases, the deletion record described in Section 3 is retained in the same way.

11. Account Deletion

Users may delete their account and all associated data at any time through:

Web: Settings > Data Management > Delete Account
App: Settings > Account Management > Delete Account
Email request to privacy@yiroom.app

Upon account deletion, the deletion takes effect immediately without a recovery grace period, and personal data and analysis results are destroyed without delay. If a temporary error prevents destruction, we automatically retry. If this does not complete automatically, an operator will review and complete it. Only information that other laws require us to retain is stored separately for the required period, and deletion records are handled as described in Section 3.

12. Data Protection Officer

The Company has designated a Data Protection Officer to oversee all personal data processing and to address complaints and remedies related to data protection.

Data Protection Officer

Name: Kim Byeong-min (Representative)

Email: privacy@yiroom.app

13. Changes to This Policy

This Privacy Policy is effective as of November 9, 2026. Previous versions are listed below:

Version effective July 12, 2026 – November 8, 2026 (available on request: contact@yiroom.app)
Version effective February 20, 2026 – July 11, 2026
Version effective January 8, 2026 – February 19, 2026
Version effective January 20, 2025 – January 7, 2026

To obtain the full text of a previous version, please contact contact@yiroom.app.