Privacy Policy

This English text is provided for convenience. The Korean version prevails in case of any inconsistency.

VoyagerX, Inc. (the "Company") complies with the Personal Information Protection Act of the Republic of Korea and other applicable laws in providing Cubio (the "Service"), and establishes and discloses this Privacy Policy to protect users' personal information.

1. Personal Information Collected and Method of Collection

The Company collects the following personal information in order to provide the Service.

1. Account and identification information: the email address and Google account identifier received from Google when you sign in with a Google account; the username you enter in the Service
2. Service usage records: access timestamps; generation request records (time, AI model used, cost incurred, Credits deducted); records of Cube creation, publishing and deletion; records of key in-service actions (event analytics)
3. Information you enter or provide: prompts you enter; photos (image files) you provide for generation; AI-generated results (figures, backdrops, 3D meshes, Cubes and their composition data); comments, likes, follows and similar activity; content and attachments you submit in inquiries — including any personal information contained therein
4. Automatically collected and operational information: IP address, cookies, device and browser information, error and job-processing logs

Personal information is collected when you enter it during sign-up and use, when it is provided through Google sign-in, or automatically during use of the Service. The Company does not collect date of birth, phone number, postal address or payment information.

The Company does not itself collect or store advertising measurement information. Through the Meta Pixel that the Company installs in the Service for advertising performance measurement, Meta Platforms, Inc. directly collects and processes behavioral data such as advertising identifiers (cookies), IP address, device/browser information, page URLs and in-service milestone events; see Section 10 for details.

2. Purposes of Processing

The Company processes personal information only for the following purposes:

1. Identifying and managing members; restricting use where a violation of the minimum-age requirement (14) is identified
2. Providing and operating the Service: generating content from prompts and photos; storing, publishing and sharing Cubes; generating link-preview thumbnails; providing comments, likes, follows and other interaction features
3. Managing generative-AI usage: applying daily Credit limits per user and Service-wide; cost accounting; preventing abuse (multiple accounts, automated access, etc.)
4. Improving stability and quality: error analysis, usage statistics and metrics, improvement of generation quality
5. Handling reports of harmful content and enforcing the Content Policy
6. Responding to inquiries (including verifying reported errors and improving the Service) and delivering notices
7. Advertising performance measurement (Section 10)

3. Legal Basis

The Company collects and uses the information in Section 1, items 1–4 without separate consent to the extent necessary to perform the service agreement with you, under Article 15(1)(iv) of the Personal Information Protection Act. The advertising measurement tool (Section 10) can be refused by the user, and refusal does not restrict use of the Service.

4. Retention Period

1. The Company retains personal information until the purpose of collection is achieved or until account deletion requested by the user is completed.
2. When you request account deletion through the channel in Section 7, the Company, after verifying the request, deletes account information, photos you provided, Generated Content, Posts, Comments and other account-linked data within a reasonable period. Comments and likes left on other users' Posts may be deleted or anonymized after removing author identification.
3. Generation request records (Section 1, item 2) are de-identified and retained for 6 months after account deletion for cost accounting and abuse verification, then destroyed.
4. Notwithstanding the above, information required to be preserved by law is retained for the period prescribed by that law.
5. Personal information and data such as Generated Content may be destroyed upon change, suspension or termination of the Service.

5. Provision to Third Parties

The Company does not provide personal information to third parties, except where required by law or with the user's separate consent.

6. Outsourcing and Cross-Border Transfer

1. The Company outsources part of its processing to external providers to deliver the Service reliably. The providers below are located abroad or process personal information abroad, so personal information is transferred overseas.
2. Under Article 28-8(1)(iii) of the Personal Information Protection Act, the Company discloses the following through this Policy and transfers personal information overseas to the extent of outsourcing/storage necessary to perform the agreement with you.

1. Data such as the prompts, photos and Generated Content you enter may be transmitted to the generative-AI providers above (OpenAI, fal.ai); after processing, such data is either not retained separately or is handled under each provider's policies.
2. You may refuse cross-border transfer; however, because these providers are essential to the Service, refusal means the Service cannot be used. Refusal and account deletion can be requested via the channel in Section 7.
3. The Company stipulates the matters necessary for safe management of personal information when outsourcing, in accordance with the Act, and discloses changes to providers or outsourced tasks through this Policy.

7. Your Rights and How to Exercise Them

1. You may at any time request access to, correction or deletion of, or suspension of processing of your personal information.
2. You can change your username in the Service's settings screen and delete your works-in-progress, Posts and Comments directly within the Service.
3. Other requests (account deletion, deletion of provided photos, access requests, etc.) may be sent to the email below. The Company may request the minimum information needed to verify that the requester is the account holder (e.g., correspondence from the sign-in email) and processes requests without delay in accordance with applicable law.
   • Privacy contact: privacy@voyagerx.com
4. You may withdraw consent to collection and use by deleting your account.

8. Destruction

1. The Company destroys personal information without delay once the retention period expires or the purpose is achieved.
2. Electronic files are deleted using methods that make recovery impossible.

9. Security Measures

The Company implements reasonable technical and managerial safeguards required by law, including access control (including row-level database access control), owner-only access to photos you provide, encryption in transit (HTTPS) and protection of authentication tokens.

10. Cookies and Automatic Collection Tools

1. The Company uses cookies to keep you signed in and to provide the Service.
2. You may refuse cookies in your browser settings; some features such as sign-in may then be limited.
3. The Company installs the Meta Pixel to measure advertising performance. Through it, Meta collects advertising identifiers (cookies), IP address, device/browser information, page URLs and in-service milestone events (sign-up, first post, etc.). You may block cookies in your browser or opt out of personalized ads in Meta Ad Preferences; refusing advertising cookies does not restrict use of the Service. This behavioral data is not processed on the Company's behalf; it is collected and processed directly by Meta Platforms, Inc. (United States) under its own privacy policy.

11. Notice on Public Content and User Input

1. User Content such as published Cubes and the prompts used to generate them, Comments and usernames may be disclosed to other users and the public (and may be used by other users for Remix); published Cubes can be viewed via link by anyone, including people who are not signed in.
2. Original photos you provide for generation are not disclosed to other users and are accessible only to you. Publishing a Cube generated from a photo, however, makes that Generated Content public.
3. Prompts, provided photos and generation results are stored as work records linked to your account and may be used for error analysis and quality improvement.
4. The Company does not pre-screen all User Content by human review. Generation may be refused under the generative-AI providers' safety policies, and the Company reviews reported content.
5. You must not enter or post another person's personal or sensitive information, or another person's photo, without that person's consent.

12. Notice to Users Residing in the United States

1. The Service is operated from the Republic of Korea. Personal information of U.S. residents is transferred to and processed in the Republic of Korea (Supabase and Google Cloud Seoul regions) and the countries listed in Section 6.
2. The Company does not knowingly collect personal information from children under 13 (COPPA). The Service is available only to persons aged 14 or older; if the Company learns it has collected information from a child under 13, it deletes it without delay. Parents or guardians may request deletion at privacy@voyagerx.com.
3. The Company does not sell your personal information and does not share it with third parties except for advertising measurement as described above.
4. U.S. residents may request access, correction or deletion in the same manner as Section 7.

13. Privacy Officer

The Company has designated a Privacy Officer to oversee personal information processing and to handle users' inquiries and complaints.

• Privacy Officer: Sedong Nam / CEO
• Contact: privacy@voyagerx.com

14. Remedies

Users in Korea may seek dispute resolution or counseling from: Personal Information Dispute Mediation Committee (privacy.go.kr / 1833-6972); Personal Information Infringement Report Center (privacy.kisa.or.kr / 118); Supreme Prosecutors' Office Cyber Investigation (1301); National Police Agency Cyber Bureau (ecrm.police.go.kr / 182).

15. Changes to This Policy

This Policy may be amended in response to changes in law or the Service; changes are announced within the Service.

• Announced: August 27, 2026
• Effective: August 28, 2026

This Policy is written in Korean with an English translation provided for reference. The Korean text prevails in case of inconsistency.