Privacy Policy
English edition · Updated November 3, 2026
Morrow Studio, operating Photo Studio, processes information needed to create and deliver your photos as described below.
Operator and privacy contact
Morrow Studio · Representative and privacy contact: Hwang Sin-gu. Business registration number: 856-48-01118. Address: Unit 1903, Building 206, 22 Daebong-ro 43-gil, Jung-gu, Daegu, South Korea. Contact: morrowstudio01@gmail.com.
Information we process
We process uploaded original and reference photos, purpose and background choices, consultation and retouch requests, finished photos and submission times. We do not request phone numbers. You can create and purchase photos without signing in. An optional delivery email and its delivery history are encrypted with photos and deleted according to photo retention. Resend receives the email and private delivery link. Anyone with the link can access the photos; keep it private. Optional Google or Kakao sign-in uses Supabase Auth to process provider account identifiers and, when provided, email and profile information for login and account coupons, not advertising measurement. Kakao nickname, email and profile image are optional; declining them does not prevent login or coupon use. Secure login cookies last up to 30 days. Account information is deleted on account-deletion requests. Coupon issuance and redemption records are stored separately to prevent duplicate rewards and verify payments. Paid completed orders from the current browser can be linked to the signed-in account; access still ends 24 hours after submission. Account-to-order access information is encrypted and cleaned up with the photo retention period. Coupons are valid for 30 days. Signing in alone does not issue an additional coupon. Contact us to request account or coupon data deletion.
Photo protection
Photos, consultation requests and payment records receive additional AES-256-GCM encryption on the server and are stored privately. Each file has a separate encryption key, protected by a server-only secret stored separately from the photo storage. We verify browser access and the required payment status before serving photos. Our server and AI providers process photo content during production; this is not an end-to-end encrypted service. Vercel also provides AES-256 encryption at rest. Vercel’s infrastructure certifications do not mean Photo Studio itself is certified.
Storage and deletion
Access is blocked 24 hours after submission. Expired data is deleted during daily cleanup or on access. Scheduled deletion may take approximately 48 hours after submission and can be delayed by failures. Failed deletion is retried and monitored. External AI providers have separate retention policies. You can delete photos after production. Order access cookies last 24 hours. Clearing browser data removes browser access; a saved private email link can still be used within the access period.
Generation limits
To prevent repeated generation on the same network, we store an identifier derived from your IP using a server secret and the time of use. Raw IP addresses are not stored separately. IPv6 addresses in the same network range are treated together. Limit records are retained during service operation independently of photo deletion. Up to 10 previews can be created without payment per IP, with 10 additional previews for each real payment. Canceled payments do not count. People on the same Wi-Fi share the limit. Photo selection and consultation are not limited.
Usage analytics
We retain a random browser identifier, campaign and device type, visit, consultation, preview and payment stage times, and rendering, input response and layout shift metrics for up to 90 days to improve the service. Photos, original consultation text, phone numbers, raw IP addresses and payment keys are excluded. You can turn analytics off in the footer; browser do-not-track preferences are respected. Transaction records required for payments and refunds are kept separately even when analytics is off.
Payment records
Order numbers, payment identifiers, amounts, payment and refund status and refund reasons are stored separately from photos. Deleting photos does not delete payment records. Payment and refund records are deleted five years after the transaction. They do not include photos or original consultation text.
Advertising measurement
Google, Naver and Meta advertising tools may receive landing-page and campaign information, purchase status, the amount actually paid, currency and an order identifier for deduplication. Cookies may connect ad clicks to purchases. Photos, consultation or retouch text, email addresses, phone numbers and payment authentication credentials are not included in ad events. Automatic advanced matching and automatic event collection are not used. Turning off usage analytics or setting do-not-track stops advertising measurement. Google Ads purchase conversion data may include click identifiers, cookies, access information, the order number and the actual amount and currency (KRW), but not photos, email or payment approval keys. Google’s own privacy and retention policies apply.
Purposes and choices
Photos, references and requests are used for creation, retouching and access verification. Transaction records support payment verification, refunds and disputes. Declining necessary photo processing prevents production but not viewing general information. Email entry and usage analytics are optional and can be declined without losing photo creation or downloads.
Reviews and reward coupons
After downloading a paid finished photo, you may submit a review to receive one 80% coupon per order. Your rating, review content and publication consent do not affect the reward. Review text, rating, consent status, notice version and time, encrypted account identifiers and order links are encrypted separately from photos for one year from submission, for satisfaction analysis, quality improvements and reward verification. Records are deleted when expired or no longer needed; retention of existing reviews is not automatically extended. Download verification records last two days. Publication consent is separate and optional. Reviews are moderated before publication, customer photos are not published, and rewarded reviews are labeled. Contact morrowstudio01@gmail.com for access, correction, deletion or withdrawal. Declining review storage prevents review submission and its coupon, but does not affect purchased photo downloads or retouching.
Optional promotional email
Separate from delivery-link consent, we send event and coupon emails only if you opt in. Email, consent status, time and notice version are encrypted separately from photos for one year or until withdrawal. Declining does not affect photo creation, downloads or delivery emails. Contact morrowstudio01@gmail.com to unsubscribe or request deletion. Existing delivery-email users are not automatically opted in.
External providers and international processing
Vercel hosts the site and private storage. OpenAI analyzes photos for selected recommendations and creates or retouches images from photos and requests. Resend delivers requested email links. TossPayments handles payments and cancellations. Gmail (Google) receives support emails; Google and Kakao sign-in are handled through Supabase Auth. These providers may process data outside South Korea. Photos are sent over encrypted connections for recommendations and creation; emails and private links are sent for delivery. Our 24-hour access period does not define every external provider’s retention period. Processing location, retention and subprocessors follow their policies. Contact the operator with questions or requests to stop processing; stopping necessary external processing may prevent production. Provider privacy policies: Vercel, OpenAI, Resend, Google and TossPayments.
Your rights and deletion requests
Contact morrowstudio01@gmail.com to request access, correction, deletion, restriction of processing or withdrawal of consent. We verify access with the minimum necessary information, such as your order number or private link. Legally retained transaction records may not be deletable immediately; we explain why. You can request photo deletion in the site. Deleted photos cannot be recovered. For users under 14, a legal guardian must submit the order. Submit another person’s photo only with lawful permission.
Support materials and policy updates
Support emails and attachments are used only as needed for support and disputes. Unneeded photo and evidence copies are deleted when the matter is resolved. Legally required records are retained separately for the required period. Changes are described on this page with an updated date; changes requiring additional notice or consent follow that process.