Out of Set Inc. (“Company”) has established this Privacy Policy (the “Common Policy”) to safely process the personal information of its Users.
This Common Policy applies to Airy and all Services provided through it. Where the purpose or scope of personal information processing differs by Service, such matters are separately set out in that Service’s individual privacy policy (“Individual Policy”), which applies together with this Common Policy. In the event of a conflict between this Common Policy and an Individual Policy, the Individual Policy shall prevail with respect to matters concerning that Service.
Article 1 (Purposes of Processing Personal Information)
- Membership Registration and Management: Confirming intent to register, identifying Users, and restricting registration by persons under the age of 14
- Provision of Services: Providing and operating the Services offered by the Company through the Platform. Specific processing purposes for each Service are set out in the applicable Individual Policy.
- Service Improvement: Analyzing usage patterns
- Handling of Inquiries: Receiving inquiries and notifying Users of the results
- Marketing: Where a User has separately consented, providing information regarding new services, events, and similar matters
Where a Service involves additional processing purposes, such as AI model training, such purposes are separately set out in the applicable Individual Policy.
Article 2 (Items of Personal Information Processed and Retention Periods)
1. Items Processed Without Consent (Information Necessary for Performance of Contract)
| Category | Items Processed | Retention Period |
|---|---|---|
| Registration (Google) | Email address, user identifier, name, profile photo | Until withdrawal of membership |
| Service Use | Basic usage records, including access logs | Until deletion or withdrawal |
| Inquiries | Email address, inquiry content | 3 years |
The items processed and retention periods for content generated in the course of using a Service (such as input and output) differ by Service and are set out in the applicable Individual Policy.
2. Items Processed With Consent
Users may freely consent or decline to consent to the processing of personal information for the purposes below, and use of the Service is not restricted if consent is not given. Consent may be withdrawn at any time through the in-service settings menu or by contacting customer support (help@airy.so).
| Category | Items Processed | Retention Period |
|---|---|---|
| Receiving marketing information | Email address | Until consent is withdrawn |
Additional consent-based items, such as those for AI model training, are set out in the applicable Individual Policy.
3. Retention Periods Required by Law
| Legal Basis | Items | Retention Period |
|---|---|---|
| Protection of Communications Secrets Act | Access logs, IP records | 3 months |
Article 3 (User Rights and How to Exercise Them)
A User (or their legal guardian) may at any time request access to, correction or deletion of, suspension of processing of, or withdrawal of consent to the processing of their personal information. Such requests may be made by email (help@airy.so) or through the in-service settings menu, and the Company will take action within 10 days. Where a request is made by an agent, a power of attorney and identity verification are required.
Article 4 (Entrustment of Personal Information Processing)
| Service Provider | Entrusted Task | Information Processed | Retention Period |
|---|---|---|---|
| Amazon Web Services, Inc. | Cloud server, database, and file storage; log management | Account information, usage records, Service-specific content data (see the applicable Individual Policy for details) | Until account deletion or termination of the service agreement |
| Cloudflare, Inc. | Web hosting, CDN, network security | IP address, access records, device information | Until termination of the service agreement |
| Supabase Inc. | Login authentication and token issuance | Email address, user identifier, login records | Until account deletion or termination of the service agreement |
Where an outsourced task or service provider changes, the Company will promptly disclose such change through this Policy. Any processors specific to a particular Service will be separately disclosed in the applicable Individual Policy.
Article 5 (Overseas Transfer of Personal Information)
| Recipient | Recipient Country | Items Transferred | Purpose of Use |
|---|---|---|---|
| Amazon Web Services, Inc. | United States | Account information, usage records, Service-specific content data (see the applicable Individual Policy for details) | Operation of cloud infrastructure |
| Cloudflare, Inc. | United States | IP address, access records, device information | Web hosting and security |
| Supabase Inc. | United States | Email address, user identifier, login records | Login authentication |
Transfers occur from time to time through an encrypted network in the course of Service use, and retention periods are as set out in Article 4. If a User does not consent to such overseas transfer, use of the Service may be restricted.
Article 6 (Destruction of Personal Information)
Where personal information becomes unnecessary due to the expiration of its retention period or the achievement of its processing purpose, it will be destroyed without delay. Electronic files are deleted using methods that prevent recovery, and paper documents are shredded or incinerated. Where retention is required by law, the information is separately stored in a segregated database.
Article 7 (Cookies and Other Automatic Collection Tools)
The Company collects cookies, IP addresses, and device information to analyze Service use and maintain the Service environment. Users may refuse the storage of cookies through their browser settings, in which case certain features may be restricted.
Article 8 (Data Protection Officer)
- Data Protection Officer: Hyeongju Kim (CEO)
- Contact: help@airy.so
Inquiries, complaints, and requests for remedy relating to personal information may be submitted to the above contact, and the Company will respond and take action without delay.
Article 9 (Measures to Ensure the Security of Personal Information)
The Company safely manages personal information through administrative measures (establishing internal management plans and conducting employee training), technical measures (managing access rights, encryption, and operating security programs), and physical measures (controlling access to server rooms and similar facilities).
Article 10 (Relationship Between the Common Policy and Individual Policies)
- Where a User uses more than one Service, this Common Policy and the applicable Individual Policy apply together to each Service.
- Upon the launch of a new Service, the Company will publish the Individual Policy applicable to that Service in advance.
Article 11 (Amendment of the Privacy Policy)
Where this Common Policy or an Individual Policy is amended, the Company will provide notice at least 7 days before the effective date (or at least 30 days before the effective date for material changes to User rights) through an announcement, and will obtain separate consent where necessary.
Effective date: August 31, 2026
This English version is provided for convenience only. In the event of any discrepancy between the Korean and English versions, the Korean version shall prevail.