Firstage Privacy Policy

1.1 When you create an account (required)

The Company receives the following information from the sign-in provider you select.

The Company uses the account identifier and email address to register and sign you in, locate an existing Firstage account, and send important notices. It uses the name and profile photo received from Google to show you in your account and workspaces. Signing in with the same email address lets you continue using the existing Firstage account.

The Company processes the provider access and refresh tokens issued during sign-in only as needed to sign you in and retrieve your profile.

1.2 When you use the Service (what you enter or upload)

1.3 When you pay

The Company collects the order number, amount, payment time, payment method type, and delivery details for photobook orders (name, address, phone). Card numbers and similar payment details are handled by the payment provider and are not stored on the Company's servers.

1.4 Collected automatically

The Service may automatically process your IP address, device type and operating system, browser type, access time, page information needed to diagnose errors, usage records, cookies, and app push tokens. For usage analytics, the Company sends Mixpanel a temporary analytics identifier that changes on page reload, a fixed route category, language, device type, and feature-use events.

1.5 Location

The Company processes your location information only if you have agreed to the Location-Based Service Terms.

When you sort your places by distance, your current location is sent to the Company's servers and used only for sorting, and the Company erases it immediately. You can turn location permission off in your device settings at any time; doing so limits only the features that need your current location. The location of a photo is provided to the members of the workspace where you uploaded it, and to the operators of AI apps connected by you or by members of the same workspace. The Location-Based Service Terms describe the provision of location information and the related notices, your rights, and the location information officer.

1.6 Connecting an AI app (optional)

If you connect Firstage to an AI app such as Claude or ChatGPT, the Company stores the app's name and address, the permissions you granted, and when you connected and last used it. The Company keeps only a verification value for each token issued to the app, never the token itself. Section 4.1 describes what the app receives from Firstage.

• Creating accounts, signing in, verifying identity
• Providing the Service: storing photos, organizing places, recording journeys and diaries, sharing workspaces
• Running AI features (journey drafts, photo sorting, photobook drafts)
• Drafting and editing photobooks at the request of an AI app you allowed to connect
• Producing and shipping photobooks, taking payment and issuing refunds
• Publishing to external accounts you have connected
• Responding to support requests and resolving disputes
• Reviewing public-content safety, handling rights reports and appeals, preventing abuse, and fulfilling statutory duties
• Analyzing usage statistics to improve the Service and diagnose errors

The Company does not use your photos or records to train AI models.

Safety review processes only the minimum necessary items from content submitted for publication or already published and from related information. Inspection of private material is limited to what is necessary for a lawful purpose such as a report, security incident, legal duty, or support you request.

The rule is erasure without delay once the purpose is fulfilled.

Statutory records are separated from ordinary Service data, access-restricted, and used only for their statutory purpose. Report and appeal material is erased without delay after handling ends. If it qualifies as a statutory consumer-dispute record, the three-year period above applies; where a separate statutory preservation duty exists, only the minimum necessary material is kept for the basis and period of that duty.

The same account deletion policy applies to Google, Kakao, and Apple sign-in. Account access and existing sessions are blocked as soon as deletion is requested. Signing in with the same method within 15 days of the request restores the account; the former account cannot be restored after the deadline. The Company erases your own uploaded photos and authored content in personal, shared, and public spaces while preserving other people's content. Paid print orders already in progress continue to fulfillment. Only the minimum necessary material is retained with restricted access and erased when the fulfillment purpose ends.

The Company does not disclose your personal information to third parties, except:

1. where you have consented in a specific instance (for example, publishing to an external social account you connected, or answering a request from an AI app you allowed to connect);
2. where disclosure has a statutory basis. The Company verifies the purpose and scope and discloses only what is necessary for mandatory reporting or a lawful court or authority request. A report alone does not authorize disclosing the reporter's and poster's personal information to each other.

Article 7 of the Location-Based Service Terms governs the provision of location information to workspace members or to AI apps you connect, and the related notices.

4.1 AI apps you connect

When an AI app you allowed on the connection screen makes a request, the Company provides that app with the information below.

If the photobook includes photos another member uploaded that you can see (photos in a shared space or shared with you), the Company also provides their capture time, place, representative capture coordinate (rounded to about 100 m), aspect ratio, and resolution. The Company does not provide the images of photos other members uploaded, or the captions and diary text they wrote. An AI app cannot order, pay, publish, or delete. You can disconnect an app at any time under Connected AI apps in your account settings, and the Company then stops its access immediately. How an AI app processes information it has already received, and whether it uses that information for training, are governed by its operator's policy and your settings.

To operate the Service, the Company entrusts the processing for the relevant functions to the companies below.

When you open an external Kakao Map link, its URL includes the selected public place name and coordinates, or the route's start and end coordinates. Kakao handles the request on its own page, which also receives standard browser request data.

The Company transfers personal information outside Korea as follows, to the extent necessary to provide the Service.

The Company transfers the information provided under Section 4.1 to the country of the AI app's operator (for example, the United States for Anthropic PBC and OpenAI, L.L.C.). Each transfer is encrypted and happens when the app makes a request; the purpose and items are those in Section 4.1, and retention follows each operator's policy. You can refuse this transfer by not connecting an AI app or by disconnecting it, and every other Firstage feature remains available.

You may refuse an overseas transfer. Refusing consent for optional features such as analytics or AI does not prevent use of other features. A feature cannot be provided if you refuse a transfer necessary to perform the contract, such as for sign-in, file storage, security, email, or payment. Use Service settings or support@firstage.ai to refuse or withdraw consent.

1. Personal information is erased within 5 business days of the retention period ending or the purpose being fulfilled.
2. Electronic files are deleted by means that make recovery impossible; printed material is shredded or incinerated.
3. Photo files are deleted from storage, and backups are overwritten in turn on the backup cycle.

You may exercise the following rights at any time.

Requests received by email are handled within 10 days and the outcome is communicated to you. A legal representative or an authorized agent may also make requests, with documentation showing that authority.

• Access to personal information is limited to the minimum staff required, and access is logged.
• Traffic is encrypted with TLS, and storage uses server-side encryption.
• Original photos are reachable only through signed, time-limited links.
• Intrusion prevention and automated-attack blocking are in place.
• Systems that process personal information are checked for security vulnerabilities, and any vulnerabilities found are remediated.

The Service uses cookies and on-device storage for keeping you signed in, security, and usage analytics. You can block or delete cookies in your browser settings; blocking them may limit some features, such as signing in. See the Cookie Policy for details.

Children under 14 cannot create accounts. Photos and records that users upload may contain the faces, names, or locations of other people, including children, and users must have the right to upload and share them (Article 6 of the Terms of Service). A child or the child's legal guardian may ask at support@firstage.ai to access or delete those photos and records or to withdraw them from public view. The Company requests only the minimum information needed to verify identity and authority.

For questions, complaints, or remedies concerning personal information, contact us. The Company replies without delay.

• Privacy officer: Hun Seol
• Location information officer: Hun Seol
• Phone: +82-70-8080-0827
• Email: support@firstage.ai
• Address: Units 504 & 505, No. 121, 61 Dongpangyo-ro, Bundang-gu, Seongnam-si, Gyeonggi-do, Republic of Korea

If our reply does not satisfy you, these bodies can help.

Changes are announced in the Service at least 7 days before they take effect. Changes unfavorable to users are announced 30 days in advance with a separate notice.

The Korean version of this Policy is authoritative. Where a translation differs in meaning, the Korean version governs.