Firstage Privacy Policy
Published: August 29, 2026 · Effective: September 29, 2026
Firstage (the "Company") protects your personal information under Korea's Personal Information Protection Act, the Act on the Protection and Use of Location Information, and other applicable laws. This document states what the Company holds, why, and for how long.
1. What We Collect
1.1 When you create an account (required)
The Company receives the following information from the sign-in provider you select.
| Sign-in provider | Information received |
|---|---|
| Account identifier, email address, name, profile photo | |
| Naver | User identifier, email address |
| Kakao | Service user identifier, Kakao Account email |
The Company uses the account identifier and email address to register and sign you in, locate an existing Firstage account, and send important notices. It uses the name and profile photo received from Google to show you in your account and workspaces. Signing in with the same email address lets you continue using the existing Firstage account.
Provider access and refresh tokens issued during sign-in are used only to retrieve the profile and are not stored persistently. The Company does not request or collect your contacts, calendar, files, friends list, gender, age range, birthday, or phone number from a sign-in provider.
1.2 When you use the Service (what you enter or upload)
| Item | Detail |
|---|---|
| Photos | Original files, capture time and capture location (EXIF), camera information |
| Records | Text in journeys, diaries, and comments; places you assign |
| Workspaces | Workspace names, email addresses of people you invite |
| Support | Your message and the email address for our reply |
1.3 When you pay
Order number, amount, payment time, payment method type, and delivery address for photobook orders (name, address, phone). Card numbers and similar payment details are handled by the payment provider and are not stored on the Company's servers.
1.4 Collected automatically
IP address, device type and operating system, browser type, access time, usage records, cookies, and app push tokens. To diagnose errors and improve usage flows, the Company records a sample of screen interactions. Inputs and on-screen text are masked, and profile photos and videos are excluded from the recording.
1.5 Location
| Type | When | What |
|---|---|---|
| Location inside photos | When you upload a photo | The capture coordinates in the photo's EXIF |
| Your device's current location | When you use a feature that needs it (nearby places, proximity notifications), only with device permission | The current coordinates reported by your device |
Your device's current location is used only while that feature is running and is not stored separately. Location inside photos is kept until the photo is deleted. You can turn location permission off in device settings at any time; only features that need location are limited.
2. Why We Process It
- Creating accounts, signing in, verifying identity
- Providing the Service: storing photos, organizing places, recording journeys and diaries, sharing workspaces
- Running AI features (journey drafts, photo sorting, photobook drafts)
- Producing and shipping photobooks, taking payment and issuing refunds
- Publishing to external accounts you have connected
- Responding to support requests and resolving disputes
- Analyzing usage statistics to improve the Service and diagnose errors
- Serving advertising, including personalized advertising where you have consented
The Company does not use your photos or records to train AI models.
3. How Long We Keep It
The rule is erasure without delay once the purpose is fulfilled.
| Data | Period |
|---|---|
| Account information, photos, records | 15 days after account closure (retention period for restoration) — erased within 5 business days after that |
| Records of contracts or withdrawal of purchase | 5 years (E-Commerce Act) |
| Records of payment and supply of goods | 5 years (E-Commerce Act) |
| Records of consumer complaints or disputes | 3 years (E-Commerce Act) |
| Access logs | 1 year (Standards for Safety Measures for Personal Information) |
| Location use and provision records | 6 months (Location Information Act) |
Records kept under law are used only for that purpose and are processed so that you cannot be re-identified within the Service.
4. Disclosure to Third Parties
The Company does not disclose your personal information to third parties, except:
- where you have consented in a specific instance (for example, publishing to an external social account you connected);
- where an investigative authority requires it through lawful process.
5. Processing Entrusted to Others
The Company entrusts the following processing. Each contract sets out the processor's data protection obligations.
| Processor | Work entrusted | Information entrusted |
|---|---|---|
| Cloudflare, Inc. (R2) | Photo file storage | Original photos and display copies |
| Google LLC (Cloud Storage) | Previously stored photo files and backups | Same as above |
| Google (Vertex AI) · Anthropic · OpenAI | Running AI features | Photos and text needed for the feature you ran |
| Paddle.com Market Ltd. | Subscription payment processing | Email address, payment information |
| Google (Firebase Cloud Messaging) · Apple (APNs) | Sending app push notifications | Push tokens |
| Google Analytics · Mixpanel | Usage analytics | Access records, device information |
| Sentry | Error monitoring | Error logs, access records |
| Cloudflare | Blocking automated signups and attacks | IP address |
| OpenStreetMap Foundation (Nominatim) | Turning coordinates into city and country names | Photo capture coordinates (coordinates only, no identifier) |
| Channel Corporation (ChannelTalk) | Customer support | Message content, email address |
| Printing and delivery partners | Photobook production and shipping | Photobook file, recipient name, address, phone |
6. Transfers Outside Korea
The Company's service servers and database are operated by the Company itself, in Korea, at its business address. Account information, records, and photo capture locations are stored on that infrastructure. The following is what is transferred to processors outside Korea beyond that.
| Recipient | Country | Items | When | Purpose | Retention |
|---|---|---|---|---|---|
| Cloudflare, Inc. | United States | Photo files (originals carry the capture location inside the file) | When a photo is uploaded | File storage | Until the photo is deleted |
| Google LLC | United States | Previously stored photo files, material sent to AI features, access records | Throughout use of the Service | Storage, AI processing, analytics, push | Until the processing contract ends |
| Anthropic PBC | United States | Photos and text needed to run an AI feature | When an AI feature runs | Producing the AI result | Deleted immediately after processing |
| OpenAI, L.L.C. | United States | Photos and text needed to run an AI feature | When an AI feature runs | Producing the AI result | Deleted immediately after processing |
| Paddle.com Market Ltd. | United Kingdom | Email address, payment information | At payment | Payment processing, tax filing | Statutory retention period |
| Mixpanel, Inc. · Functional Software, Inc. (Sentry) · Cloudflare, Inc. | United States | Access records, device information, IP address | Throughout use of the Service | Analytics, error analysis, security | Per each provider's policy |
| Apple Inc. | United States | Push tokens | When app notifications are sent | Push delivery | Until the token expires |
| OpenStreetMap Foundation | United Kingdom | Photo capture coordinates (no account identifier is sent) | When a photo is uploaded | Resolving city and country names | Not retained |
You may refuse these transfers. Refusing storage and AI processing means those features cannot be provided. Send refusals to [email protected].
7. Erasure
- Personal information is erased within 5 business days of the retention period ending or the purpose being fulfilled.
- Electronic files are deleted by means that make recovery impossible; printed material is shredded or incinerated.
- Photo files are deleted from storage, and backups are overwritten in turn on the backup cycle.
8. Your Rights
You may exercise the following rights at any time.
| Right | How |
|---|---|
| Access | Check directly in the Service, or ask at [email protected] |
| Correction | Edit directly on your profile and record screens |
| Deletion | Delete photos and records on screen; close your account to remove everything |
| Suspension of processing | Ask at [email protected] |
| Withdrawal of consent | Device settings (location, notifications) or Service settings; otherwise by email |
Requests received by email are handled within 10 days and the outcome is communicated to you. A legal representative or an authorized agent may also make requests, with documentation showing that authority.
9. Security Measures
- Access to personal information is limited to the minimum staff required, and access is logged.
- Traffic is encrypted with TLS, and storage uses server-side encryption.
- Original photos are reachable only through signed, time-limited links.
- Intrusion prevention and automated-attack blocking are in place.
- Systems that process personal information are checked for vulnerabilities on a regular basis.
10. Cookies
The Service uses cookies to keep you signed in, measure usage, and serve advertising. You can block or delete cookies in your browser settings; blocking them may limit features such as signing in. See the Cookie Policy for details.
11. Children Under 14
The Service is not directed at children under 14 and the Company does not knowingly collect their personal information. If the Company learns that it has, it erases the information without delay.
12. Privacy Officer
For questions, complaints, or remedies concerning personal information, contact us. The Company replies without delay.
- Privacy officer: Hun Seol
- Email: [email protected]
- Address: 204, Gwangmyeong-ro, Jungwon-gu, Seongnam-si, Gyeonggi-do, Republic of Korea
13. Where Else to Turn
If our reply does not satisfy you, these bodies can help.
| Body | Phone | Website |
|---|---|---|
| Personal Information Dispute Mediation Committee | +82-1833-6972 | www.kopico.go.kr |
| Privacy Infringement Report Center | +82-118 | privacy.kisa.or.kr |
| Supreme Prosecutors' Office, Cybercrime Division | +82-1301 | www.spo.go.kr |
| National Police Agency, Cyber Bureau | +82-182 | ecrm.police.go.kr |
14. Changes to This Policy
Changes are announced in the Service at least 7 days before they take effect. Changes unfavorable to users are announced 30 days in advance with a separate notice.
The Korean version of this Policy is authoritative. Where a translation differs in meaning, the Korean version governs.