Privacy Policy
Effective 15 November 2026
This is a translation of the Korean Privacy Policy, provided so you can understand what you are agreeing to. The Korean version is the binding one; where the two differ, the Korean text governs.
Muse Studio (뮤즈스튜디오) (“the Company”) operates FitShotPro (“the Service”) and takes your personal data seriously. This policy sets out what we process, why, and for how long.
1. What we collect, and how
| Data | How it reaches us | Why |
|---|---|---|
| Photographs containing a face | You upload them | To generate the photo |
| IP address | Collected automatically on connection | To cap review submissions and deter abuse |
| Request details (the concept you chose, any text you wrote) | You enter them | To generate the photo |
| Account details (email address, name) | From your social login provider when you sign in | To identify your account, track how many shots you hold and your purchases |
| Mobile number | Typed by you at the payment step | To take payment (required by the payment provider) |
| Usage records (pages visited, browser and device, approximate region) | Collected automatically by Google Analytics | To understand and improve how the Service is used |
| Advertising cookie identifiers and usage records (pages visited, browser and device, approximate region) | Collected automatically by Google through Google AdSense cookies (see section 4) | To show ads and measure how they perform |
Generating a photo and paying for shots both need a social login; without one you can still read what the Service does and what it costs. We do not collect any government identification number, and we never see your card details — those are handled entirely inside the payment provider’s own window.
2. A separate word about face photographs
A photograph containing a face is personal data, because you can be recognised in it. Depending on its resolution and use it may also count as biometric data, which is sensitive personal data, so we ask for separate, explicit consent before you upload anything.
We do not use uploaded photographs to verify or match anyone’s identity, and we do not extract facial features to store or build a database from.
3. How long we keep things
| Data | Retention |
|---|---|
| The photo you upload | Destroyed immediately after generation — never written to our servers |
| The generated result | Not stored on our servers. Kept only on your device |
| IP address (for the review-submission cap) | Deleted automatically after 24 hours |
| Account details (email, name), shots held and history | Kept while you use the Service |
| Payment records | 5 years, as Korean e-commerce law requires |
| Mobile number | Not stored — passed to the payment window only |
| Sign-in session | Expires after 30 days. Deleted immediately when you sign out, and expired records are cleared the next time you sign in |
An uploaded photo exists in memory only for as long as generation needs it, and is never written to disk or to a database. The result does not stay on our servers either.
4. What is stored on your own device
Generated photos are kept in your browser’s storage (IndexedDB) and shown under “My studio”. They exist only on your device and are never sent to our servers. Up to 24 are kept; older ones are removed automatically beyond that. You can delete them at any time with “Clear all” in the Service, or by clearing this site’s data in your browser.
Google Analytics cookies are also stored, to measure how the Service is used. They hold a random identifier that distinguishes one visitor from another; they do not contain your name, contact details or anything else that identifies you directly. Advertising features — Google Signals and ad personalisation — are switched off, so the data Google Analytics collects is not used to advertise to you.
You can refuse cookies in your browser settings, or install Google’s Analytics opt-out browser add-on. Refusing them does not affect generating photos or anything else in the Service.
If you are visiting from the EEA or the United Kingdom, Google Analytics is not loaded at all. Those places require your agreement before a cookie is set, and rather than ask for it we simply do not measure.
Advertising (Google AdSense)
The Service shows Google AdSense ads. Google and its partners may use advertising cookies to show you ads based on your visits to this and other websites (personalised ads) and to measure how ads perform. This information — an advertising cookie identifier, the pages you visit, your browser and device, and your approximate region — is collected by Google directly and handled under Google’s own privacy policy, for as long as Google’s policies provide.
We do not give your face photographs, your results, your account details (email, name) or your payment details to any advertiser, and none of them is used for advertising.
You can turn off personalised ads in Google’s Ad Settings (adssettings.google.com), or refuse cookies in your browser settings. With personalised ads off you may still see ads, but they will not be based on your browsing. For more on how Google uses cookies in advertising, see policies.google.com/technologies/ads.
5. Processors we use
We entrust processing to the following, in order to run the Service.
| Processor | What they do |
|---|---|
| Google LLC | AI image generation (Google Vertex AI) |
| Cloudflare, Inc. | Hosting, blocking automated access, usage limits |
| Google LLC | Usage analytics (Google Analytics) |
| Google LLC | Storing reviews and backing up account records (Google Sheets) |
| PortOne Inc. (주식회사 포트원) | Payment integration and payment records |
| KG Inicis Co., Ltd. (주식회사 케이지이니시스) | Processing payments in Korean won (cards and similar) |
| PayPal Pte. Ltd. | Processing payments in US dollars (PayPal) |
6. Transfer outside Korea
Some of those processors run their servers outside Korea, so your personal data — including your photograph — is transferred abroad. The database holding your account and the shots you hold is an exception: its primary server is in Korea, in Seoul. The notice below still covers it, because the company operating it is incorporated in the United States and may access or replicate from outside Korea.
| Item | Detail |
|---|---|
| What is transferred | The uploaded photo, request details, IP address, usage records, account details (email, name); for a payment in US dollars, the order number, amount and item name |
| Where | The United States and other countries where the processors operate, and Singapore and the United States for PayPal — except the account database, whose primary server is in Korea |
| When and how | Sent over the network at the moment you request a generation, or at the moment you pay in US dollars |
| Who receives it | Google LLC, Cloudflare, Inc., and PayPal Pte. Ltd. (US-dollar payments) |
| Purpose and retention | AI image generation and running the Service, destroyed without delay once processing completes; usage analytics, kept for Google Analytics’ own retention period; showing ads and measuring them, under Google AdSense’s policies; US-dollar payment processing, kept for the period the law requires payment records |
We use a paid API tier so that the photographs sent and the results returned are not used to train or improve those providers’ AI models.
What you enter on PayPal’s own screen — your PayPal account, your card — never reaches us; PayPal handles it under its own privacy policy.
You may refuse this transfer. Generation depends on it, however, so refusing means you cannot use the Service.
7. Disclosure to third parties
Apart from the processors and transfers described in sections 5 and 6, we do not give your personal data to anyone else — except where a law enforcement authority makes a lawful request under statute. Google collecting usage records directly through the advertising cookies in section 4 is not something we hand over, but it happens on this Service, so that section says what is collected and how to refuse it.
8. How data is destroyed
An uploaded photograph ceases to exist in memory the moment generation finishes; no separate deletion step is needed. The IP address used for the usage cap is deleted automatically when the 24-hour expiry set at write time elapses.
9. Your rights
You may ask to access, correct, delete, or suspend processing of your personal data. Because we do not store photographs, there is nothing to retrieve or delete after the fact. Results held on your device can be deleted by you directly from “My studio”.
To exercise these rights, contact: support@fitshotpro.kr
10. How we keep data safe
- All traffic encrypted in transit (HTTPS)
- Photographs never written to our servers — removing the risk of a leak rather than managing it
- Automated access blocked, and usage capped
- Uploaded files validated for format and size
11. Children under 14
You must be 14 or older to use this Service. We do not collect personal data directly from children.
In the kids studio, however, a user who is a child’s parent or legal guardian may upload the child’s photo to make a 100-day or first-birthday portrait, a colouring page and the like. Before that photo is uploaded we ask for the guardian’s consent separately (Personal Information Protection Act, Article 22-2).
- What is processed: a photo showing the child’s face. We ask for nothing else about the child — no name, no date of birth.
- Why: to make the photo the guardian asked for.
- How long: destroyed immediately after generation — never stored on our servers, never used to train AI.
- Transfer abroad: as in section 6.
If we find that a child’s personal data was processed without a guardian’s consent, we destroy it without delay. A guardian may exercise the rights in section 9 on the child’s behalf.
12. Data protection officer
- Officer: the representative
- Contact: support@fitshotpro.kr
To report or seek advice about a privacy infringement in Korea, you can contact the Personal Information Dispute Mediation Committee (1833-6972), the Privacy Infringement Report Centre (118), the Supreme Prosecutors’ Office (1301), or the National Police Agency (182).
13. Changes to this policy
If this policy changes, we will post the change in the Service at least seven days before it takes effect — or 30 days before, where the change materially affects your rights.