This document is a draft pending legal review. Its contents may change; changes are announced in advance under Article 13.
Article 1. Information we process
[Booking]
Name, email, phone (optional), preferred area / service / date, budget (optional), requests, and a record of the consents you gave (including the time and the browser you used).
[Account] (optional — you can book without one)
Email, password (stored in a form that cannot be reversed), display name, language, marketing opt-in.
[Try-on — your face photo]
The photo you take or choose, the reference style photo, and your email.
We do not keep the original photos. They are used to generate the composite and discarded immediately; only the resulting composite image is stored. That image contains your face.
[Notifications] (only if you allow them in the app)
Device push token, platform (iOS/Android), device language.
[Collected automatically]
IP address (converted to an irreversible form for some features), browser/app information, usage logs. Used to prevent abuse and enforce usage limits.
Article 2. Why we use it
· Taking and confirming bookings, arranging schedules with salons, notifying you of changes
· Creating your account and signing you in; showing your bookings
· Generating hairstyle previews and delivering the result
· Sending you booking status notifications
· Answering enquiries and analysing usage to improve the service
· Preventing abuse and enforcing usage limits
· Marketing messages — only if you opted in separately. Declining does not affect booking-related messages.
Article 3. Transfer abroad
To generate hairstyle previews we send information outside Korea:
· Recipient: Google LLC
· Country: United States
· Items: your face photo, the reference style photo
· Purpose: generating the composite hairstyle image
· When and how: transmitted over HTTPS in real time when you run a try-on
· Retention: not stored by Google; MAKEDOL does not keep the originals
· Google's privacy policy: https://policies.google.com/privacy
If you do not use try-on, this transfer does not happen, and you can still book normally.
Storage, hosting and email delivery may also involve transfers abroad. The specific providers and countries are listed in section 5.
Article 4. How long we keep it
· Booking information: one year from the booking date, after which identifying items are destroyed. The booking record itself (date, status, amount) remains as a basis for statistics and for handling disputes. Because we neither receive nor settle the price of the treatment, we keep nothing for settlement purposes.
· Account information: until you delete your account, then destroyed immediately.
· Try-on result images: deleted — file and all — as soon as you delete your account or request deletion.
· Notification tokens: deleted as soon as you sign out or turn notifications off.
· Marketing consent: destroyed as soon as you withdraw it.
· Because we do not receive payment for treatments, we are not subject to the record-keeping duties for payment and supply under the Act on Consumer Protection in Electronic Commerce. Access logs are kept for three months under the Protection of Communications Secrets Act and then destroyed.
Article 5. Processors
We use the following providers to operate the service.
· Supabase Inc. — database and file storage / Republic of Korea (Seoul) region
· Vercel Inc. — application hosting / Republic of Korea (Seoul) region
· Resend (Plus Five Five, Inc.) — sending notification emails / United States
· Google LLC — hairstyle composition / United States (the same transfer described in section 3)
Our contracts require them to handle personal data securely. If a provider changes, this document is updated.
Article 6. Sharing with third parties
Once your booking is confirmed we share your name, contact details, appointment time and requested service with the partner salon performing it. We always tell you which salon before anything is shared.
Otherwise we do not share your information without your consent, and we never sell it. Disclosure may occur only where lawfully required by an investigative authority.
Once information reaches the salon, the salon becomes a controller in its own right, and later use, storage and destruction are the salon’s responsibility. Our partner terms bind the salon to use it only to serve that booking and to delete it when the booking is done.
Before confirmation neither name nor contact is provided. The screen the salon answers on shows only the requested time, treatment, party size and price.
Because we do not receive payment for treatments, we process no payment or card information at all.
Article 7. Your rights
You may at any time ask to access, correct, delete, or restrict the processing of your personal data.
· In the app: Account settings → Delete account. Processed immediately.
· By email: mook@wadidu.com — we act without delay.
Deleting your account does not cancel an appointment already booked with a salon — that is a commitment made to them. Identifying items such as your name and contact details are destroyed along with the account. If you need to cancel, please tell us first.
Article 8. How we destroy data
Once the retention period ends or the purpose is fulfilled, we destroy the data without delay.
· Electronic files: deleted irrecoverably. For images such as face photos, the file itself is removed from storage first, and the related records afterwards.
· Free-text fields such as names, contact details and requests are cleared rather than masked — we cannot judge what you may have written where.
Article 9. Security measures
· Least-privilege access and access control (database denies by default; access only through our servers)
· Encryption in transit (HTTPS); passwords stored in an irreversible form
· In the app, sign-in credentials are held in the device's secure storage (Keychain/Keystore)
· Access logging and tamper protection
· Usage limits to block automated abuse
Article 10. Children under 14
MAKEDOL does not collect personal data from children under 14 without the consent of a legal guardian. We confirm at booking that you are 14 or older; if you are under 14, a separate guardian consent process is required.
Article 11. Data protection officer
· Officer: CHOI Inmook
· Position: Representative, WADIDU
· Contact: mook@wadidu.com
Please send any questions, complaints or remedy requests about our handling of personal data to the address above; we respond without delay.
· Operator: WADIDU (sole proprietorship) · Representative: Choi Inmook · Business registration no. 274-13-02856
· Address: 699 Gimpo-daero, 11F #1108, Gimpo-si, Gyeonggi-do, Republic of Korea
Article 12. Remedies
You may seek dispute resolution or advice from the following bodies.
· Personal Information Dispute Mediation Committee — +82-1833-6972 / www.kopico.go.kr
· Privacy Infringement Report Centre — +82-118 / privacy.kisa.or.kr
· Supreme Prosecutors' Office, Cybercrime Division — +82-1301 / www.spo.go.kr
· National Police Agency, Cyber Bureau — +82-182 / ecrm.police.go.kr
Article 13. Changes to this policy
We announce any change at least 7 days before it takes effect. Changes that materially affect your rights are announced 30 days in advance.
MAKEDOL is currently a pilot service. What you write when booking is read by the designer handling your appointment on the day.