paletti Privacy Policy

Coynoa Inc. ("Company", "we", "us") establishes and publishes this paletti Privacy Policy ("Policy") in accordance with Article 30 of the Personal Information Protection Act of Korea ("PIPA") and Article 31 of its Enforcement Decree, to protect personal information of data subjects ("Users", "you") and promptly handle related concerns.

The Korean version of this Policy is the official, binding text. In case of any inconsistency between the Korean and English versions, the Korean version shall prevail.

We adhere to the following data-protection principles:

• Minimization: We collect only the minimum information necessary to provide the Service.
• Purpose limitation: Collected personal information is used only for the purposes specified in this Policy.
• Retention minimization: Personal information whose purpose has been fulfilled is destroyed without delay.
• No operator viewing: Our personnel process personal information only through automated pipelines and do not directly view User photographs.

Article 1 (Purposes of Processing)

We process personal information for the following purposes. Processed information will not be used for any other purpose, and if the purpose changes, we will obtain separate consent under PIPA Article 18.

1. Provision of the AI personal-color diagnosis service
   • Entrusting the User's photograph to an external AI service provider to generate and deliver a personal-color catalog
   • Email delivery of the resulting catalog and provision of a result page for viewing
2. Identity verification and result delivery
   • Confirming the identity of the diagnosis applicant and recipient by email
   • Delivering the catalog and notification emails
3. Service operation and inquiry handling
   • Handling inquiries and complaints, responding to rights-exercise requests
   • Preventing abuse and resolving disputes
4. Service improvement and statistical analysis
   • Producing pseudonymized or anonymized usage statistics and improving service quality
5. Compliance with legal obligations
   • Preservation and provision of records pursuant to law or lawful requests from investigative agencies
6. (With optional consent) Marketing communications
   • Sending newsletters, new-service announcements, and event information by email to Users who have given marketing consent

Article 2 (Items and Methods of Collection)

1. Mandatory items (required for the Service)

2. Optional items

Declining the optional item does not restrict your access to the core Service.

3. Automatically collected information

4. Methods of Collection

• Direct input or upload through forms on the Service
• Automatic generation and collection during service use (cookies, logs)
• Information provided by payment processors or partners (applicable only if and when paid plans are introduced)

5. Sensitive Information

Photographs processed by the Service are used only for appearance analysis (recognition of color characteristics such as hue, brightness, chroma, and visual features of skin / hair / eyes). They are not used for personal identification or for processing that falls under "biometric information" defined in PIPA Article 23 (i.e., technical processing aimed at identifying a specific individual). We do not use photographs for identity verification, authentication, or biometric matching.

6. Composition of the Result Catalog

The result catalog (Total / Makeup / Hair) automatically generated and delivered by email contains the personal-color classification, recommended palettes, and text/images for makeup and hair styles, together with composite images generated by an external AI service provider from the photograph the User uploaded (which may include the User's face). The catalog, in combination with the recipient's email address and the unique result-page URL, is treated as personal information and is managed under the retention rules in Article 3.

Article 3 (Retention and Use Periods)

We retain personal information only as long as required by law or to fulfill the purposes for which it was collected.

After the periods above, personal information is destroyed without delay pursuant to PIPA Article 21. Result emails remain in the User's mailbox; the Company does not retain copies of sent emails.

Why the retention periods differ between the original photograph and the result catalog: The original photograph becomes unnecessary immediately after AI diagnosis processing and is therefore destroyed after 7 days under the minimization principle. The result catalog, on the other hand, must remain accessible for some time so that the User can view, share, and download it; it is therefore retained for 90 days. The result page is served at a non-guessable unique URL (e.g., a UUID) so that only the User (and any party the User chooses to share the URL with) can access it; the Company additionally applies search-engine-index blocking (noindex) and similar measures to prevent inadvertent exposure.

Article 4 (Children Under 14)

1. We do not process personal information of children under 14. The Service is intended for Users aged 14 or older, and Users represent that they are at least 14 years of age by agreeing to the Terms of Service and this Policy.
2. If a User is found to be under 14, or upon request by a guardian, we destroy that child's personal information without delay.
3. Inquiries regarding children's data may be sent to privacy@paletti.coynoa.com.

Article 5 (Third-Party Provision)

1. We do not, in principle, provide your personal information to third parties.
2. We may exceptionally provide it in the following cases:
   1. With your separate consent;
   2. Where required by law, or in response to lawful requests by investigative agencies pursuant to statutory procedures.
3. Before any such provision (unless legally mandated and exempt from consent), we will notify you of the recipient, the purpose, items provided, and the retention period, and obtain your consent.

Article 6 (Entrustment of Processing)

For smooth service operation, we entrust certain processing tasks to external specialists. Pursuant to PIPA Article 26, we ensure that the entrustment agreement includes the necessary safeguards and we periodically verify that entrusted parties handle personal information securely.

The specific list of entrusted parties is disclosed through revisions to this Policy. The list may change to reflect operational efficiency, service quality, or security requirements, and we will update this Policy when changes occur. You may request the current list of entrusted parties at privacy@paletti.coynoa.com.

Article 7 (Cross-Border Transfer)

For AI diagnosis processing and cloud infrastructure operations, we transfer your personal information abroad (including entrustment and storage). This transfer is based on PIPA Article 28-8, paragraph 1, item 3, sub-item (a) — entrustment or storage necessary for the conclusion and performance of a contract (the Service) with the data subject — and is made by disclosing the following information in this Policy in advance, without requiring a separate consent.

We implement the protections required by PIPA for cross-border transfers and require entrusted parties to apply equivalent safeguards. If we later switch to a consent-based legal basis for cross-border transfer, we will amend this Policy and clearly notify Users.

Article 8 (Rights Regarding Automated Decisions)

Pursuant to PIPA Article 37-2, we disclose the following:

1. Existence of automated decisions: The Company uses AI models operated by external AI service providers to automatically analyze User photographs and generate personal-color catalogs. No human intervention by Company personnel is involved in this generation.
2. Criteria and procedure:
   • The uploaded photograph is forwarded to the automated pipeline;
   • The external AI model identifies visual features (hue, brightness, chroma, skin / hair / eye tones, etc.) and infers personal-color candidates;
   • The external AI model produces makeup / hair catalog text and images matching the inferred category;
   • The catalog is delivered by email.
3. How personal information is processed: Photographs are processed for color and appearance analysis, not for identification. We do not use photographs for any other purpose (e.g., ad targeting, AI training).
4. Your rights:
   1. Voluntary acceptance of objections — Because the automated decisions in this Service are made based on the data subject's consent (PIPA Article 15(1)(1)), the statutory right to object under PIPA Article 37-2(1) does not directly apply (per the proviso of that paragraph). However, the Company voluntarily accepts objection requests and, absent justifiable reason otherwise, will take reasonable measures such as discontinuing use of the result, reprocessing, or destroying associated data;
   2. Right to explanation — You may request an explanation of the criteria, procedure, and basis used to generate the result;
   3. Right to reprocessing or human review — You may request that the automated decision not be applied or that the matter be reprocessed with human involvement.
5. How to exercise your rights: Send a request to privacy@paletti.coynoa.com together with proof of your data-subject status (e.g., sending from the email address used at diagnosis). Unless there is justifiable reason otherwise, we will take the necessary actions and reply within 10 days of receipt.

Article 9 (Destruction Procedure and Method)

1. Principle: We destroy personal information without delay once the retention period has expired or the purpose has been fulfilled.
2. Timing:
   • Photographs: automatically destroyed by a scheduled job that runs at a fixed time each day, 7 days after diagnosis completion;
   • Email and result catalog: auto-destroyed 90 days after result delivery;
   • Consent records, access logs, abuse records: auto-destroyed after the periods set out in Article 3.
3. Procedure: After the retention period ends, personal information is either destroyed immediately or moved to a separate database / area and retained for the period required by law (if any) before destruction.
4. Method:
   • Electronic files: deleted permanently in a manner that prevents recovery (e.g., permanent deletion in object storage, permanent deletion of database columns / records);
   • Printed records: shredded or incinerated.

Article 10 (Data Subject Rights and How to Exercise Them)

1. You may exercise the following rights with respect to the Company at any time:
   1. Access — Request to view how your personal information is processed;
   2. Correction / deletion — Request to correct errors or delete your information;
   3. Suspension of processing — Request the Company to stop processing your information;
   4. Withdrawal of consent — Withdraw consent to collection, use, provision, cross-border transfer, marketing, etc.
2. Methods of exercise:
   • Email: privacy@paletti.coynoa.com;
   • Unsubscribe link in marketing emails: click the "Unsubscribe" link included in marketing / promotional emails.

Marketing email labeling: Pursuant to Article 50 of the Information and Communications Network Act, marketing emails we send carry "(광고)" ("Advertisement") in the subject line and include the sender's name and contact information and a one-click unsubscribe link in the body. Sending between 9 PM and 8 AM the following morning requires separate consent.

3. We may verify your identity before acting on a rights request.
4. We will respond to your request and inform you of the outcome within 10 days of receipt.
5. The legal representative of a child under 14 may exercise these rights on the child's behalf.
6. You are responsible for entering accurate information when using the Service. Using another person's information without authorization may result in service restrictions and may be punishable under applicable law.

Article 11 (Cookies and Other Automatic Collection Devices)

We use cookies and similar technologies to provide personalized services and advertising.

1. Purposes of cookies

2. Refusing cookies

You can configure your browser to accept all cookies, prompt before storing a cookie, or refuse all cookies.

• Chrome: Settings → Privacy and security → Cookies and other site data
• Safari: Preferences → Privacy → Block all cookies
• Edge: Settings → Cookies and site permissions
• Firefox: Settings → Privacy & Security → Cookies and Site Data

Refusing cookies may impair certain features (personalized advertising, analytics-driven improvements).

3. Opting out of personalized ads

You may change advertising personalization settings here:

• Google Ads Settings: https://adssettings.google.com/
• Korean Digital Advertising Association: https://digitalad.or.kr/

Article 12 (Security Measures)

Pursuant to PIPA Article 29 and Article 30 of its Enforcement Decree, we take the following security measures:

1. Administrative measures
   • Establishment and execution of an internal personal-information management plan;
   • Regular personal-information protection training for personnel;
   • Policy prohibiting Company personnel from directly viewing original photographs — personnel process photographs only through automated pipelines and review only outputs (text and metadata).
2. Technical measures
   • Minimization of access privileges to personal-information processing systems and role-based access control;
   • Encryption in transit (TLS 1.2 or higher) and encryption at rest (server-side encryption in object storage, column-level encryption in databases);
   • Retention of access logs and protection against tampering;
   • Installation and updates of security software, periodic vulnerability assessments.
3. Physical measures
   • Data center access controls operated by the cloud infrastructure provider (relying on entrusted-party security measures).

Article 13 (Privacy Officer)

We have appointed a Privacy Officer to oversee personal-information processing and to address complaints and remediation requests.

Privacy Officer

• Name: Privacy Officer Name
• Department / Position: Operations / Team Lead
• Email: privacy@paletti.coynoa.com

You may direct any privacy-related inquiries, complaints, or remediation requests arising from your use of the Service to the Privacy Officer. We will respond and take action without undue delay.

Article 14 (Grievance Channels)

You may seek dispute resolution or consultation regarding privacy violations through the following Korean agencies:

If you are dissatisfied with the Company's actions under PIPA Articles 35 (access), 36 (correction / deletion), and 37 (suspension of processing), you may also file an administrative appeal with the Personal Information Protection Commission or the Central Administrative Appeals Commission.

Article 15 (Changes to this Policy)

1. This Policy takes effect on 2026-06-01.
2. Where this Policy is amended, we will give notice on the Service at least 7 days before the effective date. For changes that materially affect data-subject rights, we will give notice at least 30 days before and may additionally notify you by reasonable means such as the email you provided.
3. Previous versions of this Policy can be located as follows.

Supplementary Provisions

This paletti Privacy Policy takes effect on 2026-06-01.