Privacy Policy
2026-07-17
Morigram (the “Company”) establishes and discloses this Privacy Policy pursuant to Article 30 of the Personal Information Protection Act of the Republic of Korea, in order to protect data subjects’ personal information and to handle related grievances promptly and smoothly.
This Policy takes effect on July 17, 2026. The former separate Cookie Policy has been consolidated into Article 9 of this Policy.
Key Processing Summary (Labeling)
| Category | Details |
|---|---|
| Personal data processed | Email address, password, name, etc. (Article 2) |
| Purposes | Membership management, content storage/sharing, payments and settlement, AI features upon request, etc. (Article 1) |
| Outsourcing | BunnyWay d.o.o., Cloudflare, Inc., Toss Payments Co., Ltd. and others (Article 5) |
| Overseas transfers | BunnyWay d.o.o. (Slovenia, etc.), Cloudflare, Inc. (US) and others (Article 6) |
| Privacy inquiries | Privacy Officer Junhee Kang / [email protected] (Article 12) |
* The table above summarizes key points for readability. Please see the full text below for details.
Article 1 (Purposes of Processing)
The Company processes personal information for the following purposes and does not use it beyond these purposes. Where a purpose changes, the Company takes necessary measures such as obtaining separate consent under Article 18 of the Personal Information Protection Act.
- Membership management: confirming intent to join, identification and authentication, maintaining membership, preventing fraudulent use, notices and communications
- Service provision: uploading, storing and sharing content such as photos and videos, managing brands/teams and albums, content delivery, personalized services
- AI features: AI analysis of content (images, etc.) and automatic album/page composition, only when requested by the member
- Paid services and settlement: plan payments, payment method authentication, auto-renewal billing, fee settlement, refunds, payment and expiry notices
- Customer support: responding to inquiries, handling complaints, delivering announcements
- Marketing and advertising (only with consent): information on new services, events and promotional messages
- Service improvement and security: analyzing access frequency, detecting and blocking fraudulent or abnormal access, usage statistics, diagnosing errors and failures (recorded on our own servers) and ensuring service stability
Article 2 (Items Processed and Collection Methods)
| Category | Items collected |
|---|---|
| Sign-up (required) | Email address, password, name (first/last) |
| Sign-up (optional) | Phone number, address |
| Social sign-in | Member identifier, email and profile name provided by the social provider (Google, Naver, Kakao) |
| Paid payments | Payment method information, transaction records, payment identifiers for auto-renewal (billing key, subscription identifier). Sensitive payment data such as card numbers is handled directly by payment processors and is not stored by the Company. |
| Push notifications (optional) | Browser push subscription information (endpoint, public keys) |
| Marketing consent | Consent status for promotional messages and date/time of consent |
| Automatically generated during use | IP address, device information (device type, device identifier, browser/User-Agent), access date/time and logs, cookies, estimated location (country/city/continent), usage records and traffic (bandwidth) usage |
| Content registered by members | Photos and videos uploaded by members and accompanying information (titles, descriptions, tags, etc.). Members are responsible for having the authority to register and publish content containing third parties’ personal information. |
Collection methods: direct input on sign-up and service screens, transfer from providers during social sign-in, and automatic collection during service use (cookies, logs, etc.)
Legal bases: required sign-up items, payment information, automatically generated usage information and member-registered content are processed on the basis of Article 15(1)4 of the Personal Information Protection Act (conclusion and performance of a contract); optional items (phone number, address), push notification information and marketing consent information are processed on the basis of Article 15(1)1 (consent of the data subject).
Article 3 (Processing and Retention Periods)
- Member information: until membership withdrawal (destroyed without delay upon withdrawal). However, to respond to disputes, prevent fraudulent use and respond to lawful requests from investigative authorities, basic account information as of withdrawal is stored separately for 1 year from the withdrawal date and then destroyed.
- Uploaded content: deleted upon withdrawal. However, content with report history may be preserved as evidence within the scope permitted by law, for responding to illegal-content reports and cooperating with investigations.
- Content deletion upon plan expiry: under Article 15 of the Terms of Service, content exceeding the free plan’s limits may be permanently deleted 90 days after the expiry date.
- Session information: signed-in sessions up to 1 year; signed-out sessions automatically destroyed after 48 hours.
- Retention required by law (Republic of Korea):
- Records on contracts or withdrawal of offers: 5 years (Act on Consumer Protection in Electronic Commerce)
- Records on payment and supply of goods: 5 years (same Act)
- Records on consumer complaints or dispute handling: 3 years (same Act)
- Records on display/advertising: 6 months (same Act)
- Sign-in (access) records: 3 months (Protection of Communications Secrets Act)
Article 4 (No Provision to Third Parties; No Sale or Sharing)
The Company processes personal information only within the scope stated in Article 1 and provides it to third parties only where Articles 17 and 18 of the Personal Information Protection Act apply, such as with the data subject’s consent or special legal provisions.
The Company does not sell personal information for monetary or other valuable consideration, nor share it for cross-context behavioral advertising. Users covered by laws such as the California Consumer Privacy Act (CCPA/CPRA) have the right to opt out of sale or sharing (“Do Not Sell or Share”) and may submit requests to [email protected].
Article 5 (Outsourcing of Processing)
| Processor | Outsourced work |
|---|---|
| BunnyWay d.o.o. | Storage, hosting, streaming and delivery (CDN) of uploaded content (photos/videos) |
| Cloudflare, Inc. | Web traffic relay (CDN), security (DDoS protection, etc.), DNS, visitor country detection |
| Toss Payments Co., Ltd. | Domestic (KRW) payment processing, auto-renewal billing and payment method authentication |
| Creem (Armilcustre Holdings Ltd., etc.) | International (USD) payment processing and payment method authentication (Merchant of Record) |
| Resend, Inc. / Google | Sending sign-up, notification and notice emails |
| OpenRouter, Inc. | Relaying content (images) and related text to AI models when AI features are used (only when the member uses AI features) |
In outsourcing contracts, the Company specifies, pursuant to Article 26 of the Personal Information Protection Act, prohibitions on processing beyond the outsourced purpose, technical and administrative safeguards, restrictions on sub-outsourcing, supervision of the processor, and liability for damages, and supervises whether processors handle personal information safely. Changes to the outsourced work or processors are disclosed through this Policy.
Article 6 (Overseas Transfer of Personal Information)
| Recipient | Country | Items | Time and method | Purpose and retention | Contact |
|---|---|---|---|---|---|
| BunnyWay d.o.o. | Slovenia and global CDN locations (e.g., Singapore) | Uploaded content and metadata, IP address, content delivery data | Transmitted over networks at the time of service use | Content storage/hosting/streaming and delivery (CDN) / until end of contract, membership withdrawal or content deletion | [email protected] |
| Cloudflare, Inc. | United States and global points of presence | IP address, access logs, cookies | Transmitted over networks upon access | Traffic relay and security / until purpose achieved | [email protected] |
| Creem operator | Overseas (e.g., United Kingdom) | Information necessary for payment (email, transaction records, payment authentication data) | Transmitted at the time of international payment | International payment processing / statutory retention periods | [email protected] |
| Resend, Inc. | United States | Email address, delivery records | Transmitted at the time of email sending | Email delivery / until purpose achieved | [email protected] |
| OpenRouter, Inc. | United States | Content subject to AI processing (image access URLs) and related text | Transmitted when the member uses AI features | AI analysis / until purpose achieved | openrouter.ai (website) |
Data subjects may refuse overseas transfer except in cases under the proviso of Article 28-8(1) of the Personal Information Protection Act. However, since core functions such as content storage and delivery are provided through overseas infrastructure, refusing overseas transfer may limit use of all or part of the Service. Transfers related to AI features can be avoided by not using AI features.
Article 7 (Rights of Data Subjects and Legal Representatives)
Data subjects may at any time request access, correction, deletion, suspension of processing, or withdrawal of consent. Requests may be made through in-service settings or by email ([email protected]), and the Company acts without delay. Where correction or deletion is requested, the Company does not use or provide the information until completed. Rights may also be exercised through a legal representative or an authorized agent.
Article 8 (Destruction Procedures and Methods)
When personal information becomes unnecessary due to expiry of the retention period or achievement of the processing purpose, the Company destroys it without delay. Electronic files are permanently deleted by technical methods that prevent recovery (including deletion of original content files stored on external storage); paper documents are shredded or incinerated. Information that must be preserved under other laws is moved to a separate database or storage location.
Article 9 (Cookies and Automatic Collection — Cookie Policy)
- The Company uses cookies and similar technologies to keep members signed in, remember settings, enhance security and prevent fraudulent use.
- Types of cookies used:
Type Description Examples / retention Strictly necessary Required for basic functions such as sign-in persistence, session management and security. Refusal may prevent normal use of the Service. Session identifier, sign-in token (signed-in sessions up to 1 year; signed-out sessions 48 hours) Functional Remember user preferences such as language for convenience. Language setting (dk_lang) Analytics May be used for usage statistics and performance analysis. Access/usage statistics cookies - Third-party cookies: cookies from processors responsible for content delivery (CDN) and security (Cloudflare, BunnyWay, etc.) may be set. Public brand pages operated by members may include cookies from analytics tools configured by the brand operator (e.g., Google Analytics); responsibility for such cookies lies with the brand operator and the tool provider.
- The Company does not sell information collected via cookies or similar technologies, nor share it for cross-context behavioral advertising (“Do Not Sell or Share”).
- For users residing in the EU/EEA and the UK, non-essential cookies (such as analytics) are used only with prior consent, which may be withdrawn at any time; strictly necessary cookies may be used without consent.
- Users may allow all cookies, require confirmation, or refuse all cookies via browser settings; refusing strictly necessary cookies may limit use of the Service.
- Chrome: Settings > Privacy and security > Cookies and other site data
- Edge: Settings > Cookies and site permissions > Manage cookies and site data
- Safari: Preferences > Privacy
- Firefox: Settings > Privacy & Security > Cookies and Site Data
Article 10 (Security Measures)
- Administrative: internal management plans, minimizing personnel handling personal information, access authority management
- Technical: one-way encryption of passwords, access control systems, encryption in transit (HTTPS/TLS), signed content access URLs, retention and tamper-prevention of access records
- Physical: access control to data storage systems
Article 11 (Children Under 14)
The Service targets users aged 14 or older and does not allow membership of children under 14. The Company does not collect personal information of children under 14, and destroys such information without delay if discovered.
Article 12 (Privacy Officer)
- Privacy Officer: Junhee Kang
- Contact: [email protected]
Data subjects may direct all privacy-related inquiries, complaints and requests for remedy to the Privacy Officer, and the Company will respond and act without delay.
Article 13 (Remedies for Infringement)
Data subjects may seek dispute resolution or consultation from the following agencies in the Republic of Korea:
- Personal Information Dispute Mediation Committee: 1833-6972 (www.kopico.go.kr)
- Personal Information Infringement Report Center: 118 (privacy.kisa.or.kr)
- Supreme Prosecutors’ Office: 1301 (www.spo.go.kr)
- National Police Agency: 182 (ecrm.police.go.kr)
Article 14 (Changes to this Policy)
This Policy applies from its effective date. Additions, deletions or corrections will be announced on the Service screen at least 7 days before taking effect.
- Enacted and effective June 23, 2026
- Amended and effective July 16, 2026 (processors specifically named; AI features processing and overseas transfers added; Cookie Policy consolidated; retention periods specified)
- Amended and effective July 17, 2026 (key processing summary added; legal bases specified; overseas-transfer contact details specified)