Privacy Policy

Effective date: 2026-10-10

Last updated: 2026-10-10

Unstirred (the "Company") complies with the Personal Information Protection Act and other applicable laws of the Republic of Korea, and has established and published this Privacy Policy in order to protect members' personal information and to handle related concerns smoothly.

This Policy applies to the Arloff app and the unstirred.ai website.

This Policy was originally written in Korean. This English text is a translation provided for convenience. In the event of any conflict or inconsistency between the Korean and English versions, the Korean version shall prevail.

Information We Process

Personal Information Collected and Purposes of Use

The Company does not designate sensitive information or real-time GPS location data as items of collection or process them as such. However, information voluntarily entered by a member in a post or conversation may contain sensitive information, in which case such information is processed only within the scope of providing the Service and is not separately classified or analyzed. The Company collects only the items set out below, which are necessary for operating the Service, data analysis, verification of paid transactions, and advertisement serving.

The Company obtains consent at sign-up separately for mandatory items and optional items. Members may refuse consent to optional items, and basic use of the Service is not restricted in such case. Among the items below, "Supplementary Profile Information" is an optional item, and all other items are mandatory for provision of the Service.

At sign-up

User ID Items collected: social login identifier, unique member number. Purpose of use: to identify a unique account following social login integration and to match it with the database (app functionality, analytics). Note: The types of social login available differ by country and operating system. In the Republic of Korea, Google, Apple (iOS), and Kakao logins are provided; in other regions, Google and Apple (iOS) logins are provided.
Email address Items collected: email address (including, in the case of Apple login, the private relay email address provided by Apple at the member's option). Purpose of use: account creation, identity verification, prevention of duplicate registration, and delivery of important notices (app functionality, security).
Date of birth Items collected: date of birth. Purpose of use: verification of eligibility to join at age 15 or older, determination of whether legal representative consent is required for a Minor Member, application of use restrictions such as payment limits for Minor Members, and provision of a personalized experience (app functionality, legal compliance).
Name Items collected: member nickname, user ID. Purpose of use: to enable AI characters to address the member in conversations and comments and to provide a personalized experience (app functionality, personalization).

During use of the Service

Supplementary Profile Information Items collected: real name (surname and given name), gender, occupation, keywords (entered directly by the member or automatically generated based on the member's service usage history). Purpose of use: personalization processing so that AI followers generate responses reflecting the member's characteristics (app functionality, personalization). Note: This item is entered at the member's option, and basic use of the Service is not restricted if it is not provided.
Photographs or videos Items collected: photograph files selected by the member for posting to the feed. Purpose of use: operation of core user-generated content features and generation of interactions through AI analysis of post context (app functionality).
Other usage data Items collected: post text, DM conversations, AI interaction records (comments, reactions, and messages generated by AI followers and the member's responses thereto). Purpose of use: internal AI system processing to generate real-time virtual responses (comments and replies) matching member input (app functionality, analytics).

When using paid services

Purchases Items collected: subscription product ID, transaction ID, payment receipt, the member's age classification at the time of payment, and the record of legal representative consent given at sign-up. Purpose of use: verification of subscription status and tier, verification of coin payment receipts, activation of paid features, application of payment limits for Minor Members and response to payment cancellation requests, and handling of settlement and refund inquiries (app functionality, legal compliance). Note: The Company does not directly collect payment method information such as card numbers or account numbers. Payments are processed through the App Store and Google Play, and the Company processes only the receipts and subscription status information issued by the app marketplace.

Automatically collected

Device ID Items collected: push token, device model name, OS version. Purpose of use: delivery of real-time notifications and scheduled push notifications (including DM notifications) triggered by virtual character responses, and device identification (app functionality, third-party advertising).
Advertising data Items collected: advertising identifier (ADID/IDFA), advertisement viewing records. Purpose of use: verification of proper display of Google AdMob advertisements, provision of personalized advertising, verification of rewarded advertisements, and prevention of abuse (third-party advertising).
Product interaction Items collected: interaction logs such as app launches, screen taps, and scrolling, and service access records. Purpose of use: optimization of AI character response timing and analysis of usability and service statistics (app functionality, analytics).
Crash data Items collected: error records generated on abnormal termination of the application. Purpose of use: identification of crash causes, debugging, and provision of stable version patches (performance diagnostics and analytics).
Performance data Items collected: initial loading speed, API response latency. Purpose of use: monitoring and optimization of app and network performance (performance diagnostics and analytics).
Other diagnostic data Items collected: server function invocation failure logs. Purpose of use: prevention of server-side API errors and verification of backend infrastructure integrity (performance diagnostics and analytics).
Reporting and safety management records Items collected: report receipt history, automated content review results, sanction processing records. Purpose of use: blocking inappropriate content and preventing recurrence, and service safety management (app functionality, legal compliance).

When using the website

Inquiries (unstirred.ai) Items collected: email address, subject, and inquiry content submitted through the inquiry form. Purpose of use: review of and response to inquiries, and processing of requests to exercise rights such as membership withdrawal. Retention period: three months after completion of processing.

Methods of Collection

The Company collects personal information by the following methods.

Direct entry by the member during in-app sign-up and profile setup
Social login integration (Google, Apple, Kakao)
Automatic generation and collection in the course of using the Service
Automatic collection through in-app SDKs (advertising and the like)
Submission through the inquiry form on the unstirred.ai website

Photographs and Biometric Information

The Company processes photographs uploaded by members for the purpose of providing the Service, including the generation of AI responses. In doing so, the Company does not perform any processing of biometric data, including facial recognition, extraction of face geometry, or generation of biometric identifiers. Uploaded images are not separately stored or analyzed as facial data.
The Company may perform an automated review at the point of upload in order to restrict the upload of images that do not meet the Service's operational standards, and no biometric information is generated or stored in the course of such review.
Matters concerning the collection, use, entrustment, overseas transfer, and retention of uploaded images are as set out in the relevant sections of this Policy.

Personal Information of Users Under 15

The Company restricts sign-up by persons under the age of 15. The Company verifies age based on the date of birth entered at sign-up, and where a person is confirmed to be under the age of 15, sign-up is restricted.
Where the Company becomes aware that personal information of a user under the age of 15 has been collected, it shall destroy the account concerned and the collected personal information without delay.
A legal representative may request access to, correction of, or deletion of the account and personal information of a user under the age of 15 through the privacy contact set out below, and the Company shall process such request without delay following verification.
Where it is confirmed that a person signed up using a false date of birth, use may be restricted, and any damage arising therefrom shall be borne by the user concerned or his or her legal representative.

Entrustment, Third-Party Provision, and Overseas Transfer

Entrustment of Personal Information Processing

The Company entrusts the processing of personal information as follows in order to provide the Service smoothly.

Entrusted Party	Entrusted Work
Supabase, Inc.	User authentication, database and storage infrastructure operation
OpenAI, L.L.C.	Provision of AI services (generation of virtual comments, reactions, and DM responses)
Google LLC	Google AdMob advertisement serving, Android in-app payment settlement and receipt verification, notification delivery via Firebase Cloud Messaging
Apple Inc.	Apple login authentication, iOS in-app payment settlement and subscription status verification, APNs push notification infrastructure
650 Industries, Inc. (Expo)	Cross-platform push notification relay and push token processing
Kakao Corp.	Kakao login authentication (for users in the Republic of Korea only)
Plus Five Five, Inc. (Resend)	Delivery of service-related emails and sending and receiving of inquiry emails

Note: Each entrusted party does not use personal information for any purpose other than performing the entrusted work, and destroys personal information upon termination of the entrustment agreement.

Note: The Company has entered into agreements on the protection of personal information with the above entrusted parties, ensuring that each entrusted party applies a level of personal information protection equivalent to that of the Company.

Note: Where an entrusted party is added, the Company shall amend this Policy and give notice accordingly.

Provision of Personal Information to Third Parties

The Company does not, in principle, provide members' personal information to third parties. The following are exceptions.

Where the member has consented in advance
Where required under the provisions of law, or where an investigative agency so requests for investigative purposes in accordance with the procedures and methods prescribed by law

Overseas Transfer of Personal Information

The Company transfers personal information overseas as set out below in order to provide the Service. Each provider applies safeguards consistent with applicable law.

The overseas transfers set out below constitute entrustment of processing and storage of personal information necessary for the conclusion and performance of the service agreement with members, and their content is disclosed through this Policy in accordance with Article 28-8(1)3 of the Personal Information Protection Act.

Supabase, Inc. — United States · https://supabase.com/privacy

Items transferred: account information (email, nickname, date of birth), supplementary profile information, posts and photographs, DM conversations, coin and payment records, service usage records
Purpose of transfer: user authentication, database and storage infrastructure operation
Time and method of transfer: encrypted transmission over the information and communications network when the Service is used
Retention period: until destruction following membership withdrawal; records subject to a statutory retention obligation are stored separately until the end of the applicable statutory period
Contact: [email protected] (https://supabase.com/privacy)

OpenAI, L.L.C. — United States · https://help.openai.com

Items transferred: photographs and text posted by the member, supplementary profile information
Purpose of transfer: generation of real-time virtual comments, reactions, and DM responses
Time and method of transfer: encrypted real-time transmission over the information and communications network when AI features are used
Retention period: temporarily retained and then destroyed in accordance with the provider's abuse-prevention policy. The API used by the Company is not used for model training in accordance with the provider's terms of use
Contact: https://help.openai.com (inquiry form)

Google LLC — United States · https://support.google.com/policies/answer/9581826

Items transferred: email, device information, push token, payment receipts
Purpose of transfer: Google login authentication, Android in-app payment settlement and receipt verification, push notification delivery
Time and method of transfer: real-time transmission over the information and communications network at sign-up, payment, and notification delivery
Retention period: in accordance with the policies of each Google service
Contact: 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA / https://support.google.com/policies/answer/9581826

Google LLC (Google AdMob) — United States · https://support.google.com/policies/answer/9581826

Items transferred: advertising identifier (ADID/IDFA), advertisement viewing records
Purpose of transfer: advertisement display, verification of completion of rewarded advertisement viewing, and prevention of advertising fraud
Time and method of transfer: real-time transmission over the information and communications network when advertisements are viewed
Retention period: in accordance with Google advertising service policies
Contact: 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA / https://support.google.com/policies/answer/9581826
Members may refuse the use of advertising identifiers for personalized advertising at any time through device settings (App Tracking Transparency on iOS, Advertising ID on Android), in which case only non-personalized advertisements will be displayed.

Apple Inc. — United States · https://www.apple.com/legal/privacy/contact/

Items transferred: name, Apple-provided email, payment receipts, push token
Purpose of transfer: Apple login authentication, iOS in-app payment verification and processing, push notification delivery
Time and method of transfer: real-time transmission over the information and communications network at Apple login, payment, and notification delivery
Retention period: in accordance with Apple's policies
Contact: One Apple Park Way, Cupertino, CA 95014, USA / https://www.apple.com/legal/privacy/contact/

650 Industries, Inc. (Expo) — United States · https://expo.dev/privacy

Items transferred: push token, device operating system information
Purpose of transfer: cross-platform push notification relay
Time and method of transfer: real-time transmission over the information and communications network when notifications are delivered
Retention period: until membership withdrawal or termination of the entrustment agreement
Contact: https://expo.dev/contact (inquiry form)

Plus Five Five, Inc. (Resend) — United States · https://resend.com/legal/privacy-policy

Items transferred: email address, email subject and body
Purpose of transfer: delivery of service-related emails and processing of sending and receiving of inquiry emails
Time and method of transfer: real-time transmission over the information and communications network when emails are sent or received
Retention period: destroyed after fulfilment of the processing purpose in accordance with the provider's policy
Contact: [email protected] (2261 Market Street #5039, San Francisco, CA 94114, USA)

Note: Kakao Corp. is a domestic business operator that processes personal information within the Republic of Korea and therefore does not constitute an overseas transfer.

Refusal of Overseas Transfer

Members may refuse the overseas transfer of their personal information. However, as the transfers above are essential to the provision of the Service, refusal may result in restriction of all or part of the Service or may require withdrawal of membership. A refusal may be communicated through the privacy contact set out below.

Retention, Destruction, and User Rights

Retention Period

The Company retains members' personal information for the duration of their use of the Service and, following withdrawal, destroys it without delay after the periods set out below have elapsed.
Where a member applies for withdrawal, a grace period of at least seven days applies, and the member may cancel the withdrawal at any time before the final deletion process begins. Once the final deletion process has begun, the member's account information, profile information, posts, photographs, AI interaction records, and coin holdings are destroyed in a manner that cannot be restored.
In accordance with the Company's internal policy, the following records are retained for separate periods and then destroyed.

Reporting, sanction, and operational records for the purposes of dispute resolution, investigation of improper use, and service safety management: one year from the date of withdrawal
Minimum device identifiers for the prevention of recurring fraudulent acquisition of advertising rewards and payment circumvention abuse: one year from the date of withdrawal
App error and crash logs: 90 days from collection
AI generation and content review logs: 90 days from collection
Withdrawal processing records and records of failed account deletions: 90 days after completion of processing

In accordance with applicable law, the following records are stored separately and securely for the statutory retention period and then destroyed.

Records concerning payment and the supply of goods (Act on Consumer Protection in Electronic Commerce): 5 years
Records concerning contracts or withdrawal of subscription (Act on Consumer Protection in Electronic Commerce): 5 years
Records concerning consumer complaints or dispute resolution (Act on Consumer Protection in Electronic Commerce): 3 years
Service access logs (Protection of Communications Secrets Act): 3 months

In order to respond to payment cancellation requests from Minor Members, records of the member's age classification at the time of payment and of legal representative consent given at sign-up are retained for five years as part of the payment records under Paragraph 4.
Inquiries received through the unstirred.ai website are retained for three months after completion of processing and then destroyed. However, records of the processing of requests to exercise rights, such as membership withdrawal, are retained for three years under Paragraph 4 as records concerning consumer complaints or dispute resolution.

Destruction Procedures and Methods

Destruction procedures: Personal information for which the retention period has elapsed or the processing purpose has been achieved is destroyed without delay. Personal information that must be preserved under applicable law is stored in a separate database and destroyed after the statutory retention period has elapsed. Separately stored personal information is not used for any purpose other than preservation.
Destruction methods: Personal information stored in electronic file form is permanently deleted by technical means that render restoration and reproduction impossible. Personal information printed on paper is destroyed by shredding or incineration.

User Rights and How to Exercise Them

As data subjects, members have the right to request access to, correction of errors in, deletion of, and suspension of the processing of their personal information, and to withdraw consent to collection.
Members may exercise their rights through the following routes.

Viewing and correcting your information: in the app, Account & settings > My Information
Withdrawal of consent and membership withdrawal: in the app, Account & settings > Account management > Delete account
Requests via the web: the inquiry form at unstirred.ai/support
Email: [email protected]

Where a request to exercise rights, such as membership withdrawal, is made via the web or email, the Company processes the request after identity verification, including by sending a confirmation link to the email address registered to the account.
The Company takes action on requests within the period prescribed by applicable law. Processing may be restricted where applicable law so provides.
Where a member requests correction of an error in personal information, the Company may refrain from using the data concerned or providing it to any external third party until the correction has been completed.

Security Measures, Advertising, and Inquiries

Security Measures

The Company implements the following technical and administrative safeguards to ensure the security of personal information.

Management of access rights to personal information and grant of minimum necessary privileges
Encryption of personal information at rest and encryption of transmission channels
Retention of access records and prevention of forgery or alteration
Installation of security programs and periodic inspection
Filtering and masking measures to prevent personal information from being included in collected error logs

The Company continuously improves its technical and administrative measures for the protection of personal information.

Automatic Collection Tools and Advertising Identifiers

The Company may use automatic collection tools such as advertising identifiers (ADID, IDFA) for the provision and analysis of the Service, the serving of rewarded advertisements, and the provision of personalized advertising. On the unstirred.ai website, the minimum cookies necessary for site operation and security may be used.
On iOS devices, advertising identifiers are collected only where the member's prior consent has been obtained in accordance with the App Tracking Transparency policy.
Members may block personalized advertising tracking by changing device settings as follows. In such case, the relevance of advertisements may decrease.

iOS: turn off tracking permission for the Arloff app under Settings > Privacy & Security > Tracking.
Android: reset or delete the advertising ID under Settings > Google > Ads.

Menu names may vary depending on the operating system version and device manufacturer.

Transmission of Promotional Information

The Company transmits promotional information only where the member's prior consent has been obtained. Members may refuse to receive such information at any time, and refusal does not affect use of the Service.

Privacy Officer and Remedies for Rights Infringement

The Company has designated a privacy officer as set out below in order to protect members' personal information and to handle related inquiries promptly.

Privacy Officer: Kwon Minhye
Contact: [email protected]

For professional consultation or reporting regarding infringement of personal information, you may contact the following organizations to apply for remedial measures.

Personal Information Infringement Report Center: privacy.kisa.or.kr / 118 (toll-free within Korea)
Personal Information Dispute Mediation Committee: kopico.go.kr / 1833-6972
Supreme Prosecutors' Office: spo.go.kr / 1301
Korean National Police Agency: ecrm.police.go.kr / 182

Country-Specific Provisions and Changes to This Policy

Country-Specific Provisions

Users residing in the Republic of Korea

Use is restricted for persons under the age of 15. Paid transactions by minor users are governed by the Terms of Service.

Users residing in the United States

United States federal law and the laws of the applicable state apply. The Company does not knowingly collect personal information from children under the age of 13 in accordance with COPPA, and the Service restricts use by persons under the age of 15.

Users residing in California have the right, under the California Consumer Privacy Act (CCPA/CPRA), to opt out of the sale or sharing of personal information (Do Not Sell or Share My Personal Information), to access, delete, and correct personal information, and not to be discriminated against for exercising these rights. These rights may be exercised through [email protected], and the Company will respond within the period prescribed by applicable law. On iOS devices, declining tracking in the App Tracking Transparency settings prevents the collection of advertising identifiers for personalized advertising.

Users residing in Japan

Japanese law, including the Act on the Protection of Personal Information (個人情報の保護に関する法律), applies. Under Japanese laws and guidelines, the consent of a legal representative may be required for the collection of a child's personal information, and use may be restricted in such cases. Users residing in Japan may request access to, correction of, deletion of, or suspension of the use of their personal information under the Act on the Protection of Personal Information through [email protected].

Changes to This Privacy Policy

This Privacy Policy may be amended in accordance with changes in laws or policies or changes to the Service.
Where this Policy is amended, the Company shall give notice from seven days prior to the effective date (30 days prior where the change is unfavorable to members or otherwise significant) through in-Service methods such as an in-app notice popup or push notification, and may, where necessary, give individual notice to the email address registered by the member.
When amending this Policy, the Company shall post the previous version alongside the amended version, or provide guidance on how it may be viewed.

Supplementary Provisions

Effective Date and Business Information

This Privacy Policy is established and takes effect as of October 10, 2026.

Business Name: Unstirred Inc.
Representative: Kwon Minhye
Business Registration Number: 485-81-04657
Mail-Order Business Registration Number: 2026-Gangwon Chuncheon-0560
Address: Room 304-162, 3F Dream Tower, 10 Chunghon-gil 52beon-gil, Chuncheon-si, Gangwon State, Republic of Korea (24437)
Telephone: +82-70-8027-2978
Contact: [email protected]