Effective date: 2026-10-06.
OnNori is TEAMKBKIM’s AI image preview and editing service. Nori is a service unit usable within OnNori, not a cash-withdrawal or general remittance facility.
This Policy explains how TEAMKBKIM (KIM KYUNG BO) processes information for OnNori. Privacy requests may be sent to cs@onnori.com.
Depending on the features used, we process account and authentication identifiers; required and optional consent records; invitation and Nori gift status; purchase, payment-reference, refund, chargeback, and Nori ledger records; uploaded images and generated results; feature selections and processing status; support communications; and limited device, request, security, integrity, and error records. A third-party checkout may collect payment credentials directly; OnNori retains the references and outcome needed to reconcile the transaction rather than full card credentials.
For AI labeling, each result file's metadata records that it was generated by AI, the provider (OnNori), and a result identifier. The result identifier is a request number assigned by our servers and does not contain your name, email address, OnNori ID, or other information that directly identifies you. If you share a result file, this metadata may travel with it.
If you sign in with Google or Apple, we receive the account identifier and email address provided by that sign-in provider. If you choose Hide My Email with Sign in with Apple, we receive an Apple relay address instead of your personal email address. OnNori does not request your name through Sign in with Apple; you are shown by the OnNori ID you set during signup. If you sign in with Google, the profile name from your Google account may be stored in the account record of our authentication service (Firebase Authentication), but OnNori does not use it on service screens or in OnNori's own server account records.
Images may depict identifiable people. Image and pose processing supplies the requested result and is not used to verify legal identity or identify a person biometrically.
We collect information from users, authentication and payment providers, invited counterparties, devices, and service operations. We use it to create and protect accounts; verify required consent and feature eligibility; process images and deliver results; operate the atomic and idempotent Nori ledger; prevent duplicate charges, credits, and debits; provide support; investigate abuse; comply with law; and establish or defend legal claims.
We do not sell personal information, share it for cross-context behavioral advertising, or use it for targeted advertising or cross-service tracking.
Optional AI Metadata Consent is separate from required consent, unchecked by default, and requires affirmative opt-in. Current optional collection is disabled. If enabled under a valid consent version, the dataset is limited to the exact eight categories stated in the separate consent: feature identifier; generation tier; immutable model version; immutable pipeline version; success or failure status; coarse nonidentifying error category; bucketed processing time; and nonidentifying quality score.
It excludes source, generated, and intermediate images; pixels; image URLs or storage paths; raw prompts; free text; account UID, name, email, phone, IP address, advertising identifiers; biometric templates; embeddings or hashes usable to reconstruct or locate an image; and raw provider responses, stacks, or request identifiers. It is not authorized for unrelated model training, targeted advertising, sale or advertising sharing, cross-service tracking, or biometric identification. Identifiable optional metadata is retained no longer than 30 days. Consent-decision evidence is stored separately from the optional dataset.
Declining or withdrawing has no effect on account activation, ordinary generation, or Purchased Nori. Withdrawal stops new optional collection and triggers deletion or irreversible de-identification of existing identifiable optional metadata within the disclosed period, subject only to a narrow lawful hold.
Google Firebase Authentication supports account authentication; Google Cloud Firestore, Cloud Storage, and Cloud Run support account, consent, Nori ledger, private image/result storage, and server processing. AI generation includes fal (Features & Labels, Inc.) as an external generation processor. When you request a generation, OnNori sends fal the pre-processed image (for example, with the background removed) and the information needed for generation, and fal processes this in the countries where fal operates its servers, including the United States. The specific countries of processing and the details of retention and safeguards are governed by fal's own policies, available in fal's published Privacy Policy (https://fal.ai/legal/privacy-policy) and Terms of Service. This is separate from optional quality-metadata analysis.
Processing copies of input images sent to fal are retained and deleted under fal’s applicable contracts and policies. OnNori configures the output files generated on fal to expire after one hour; this does not guarantee complete deletion of fal’s internal operational records and backups within that same period. Generated results are stored privately, configured so that only authorized requests can access them.
OnNori limits this processing to what is necessary to perform the contract and does not warrant that the external processor's retention policies are identical to OnNori's own.
We use Resend to send the single account-deletion-completion notice from no-reply@notice.onnori.com; replies and inquiries go to cs@onnori.com. We send Resend the recipient email address and a minimal notice containing deletion completion, a summary of legally retained records, and our contact details. It contains no name, payment details, advertising, or sign-in link, and uses no open or click tracking. Resend stores and processes message content and delivery records in the United States.
Resend retains email and logs for 30 days and backups for 7 days, with storage in the United States. These periods are separate from OnNori's email-address deletion rule. Selecting a sending region does not change U.S. storage. The Resend retention policy (https://resend.com/security/gdpr) and applicable contract govern provider retention and exceptions; we do not promise identical retention or immediate complete deletion by the provider. Notices to an address obtained through Hide My Email with Sign in with Apple pass through Apple's private email relay.
International processing requires an appropriate legal basis and safeguards. This document does not promise that every processing operation is in Korea, that all service providers have identical retention terms, or that accepting these Terms authorizes unrelated model training. Where live payment is offered, the actual checkout handles payment credentials and OnNori processes the references and outcomes needed for reconciliation.
We delete uploaded photos and processing copies no later than seven days after upload. Viewing or reuse does not extend that period. The same limit covers unused uploads, data left after an unsuccessful upload, abandoned generation, confirmed failure, and an unknown outcome. Preprocessed images and processing bundles are deleted when that generation ends with a stored result or confirmed failure. They may be kept as needed to finish an incomplete result (up to 24 hours) or retrieve an external processing result (up to two hours after submission), without exceeding seven days after upload. Data referenced by an active request is protected while that request is processed, but the absolute limit is not extended. A photo with less than one hour remaining cannot start a new generation; you must upload it again.
Generated results have a separate retention clock. The generation server (E) deletes its final result as soon as storage in the service store (B) is confirmed, and in any event within seven days of its first storage in E. Incomplete results are kept for up to 24 hours from first capture. B makes a result available for download and recovery for up to seven days from its first receipt; viewing or downloading does not extend this period. If Nori settlement remains unresolved, B may retain the result image with restricted access for settlement checks for up to 30 days from its first storage, after which the image is deleted even if settlement remains unresolved. This exception does not extend download availability or the seven-day limit for uploaded originals. A separate storage feature does not automatically extend that original-photo limit or promise permanent result storage.
Image-free operational evidence about generation is kept for 30 days after closure. Minimal records preventing duplicate execution are kept while the account exists and deleted with the account. They contain only pseudonymous identifiers, binding values, attempt numbers, status, and timestamps, not images, original request content, or provider result URLs. These are not necessarily anonymous records. If settlement remains unresolved when you delete your account, photos and ordinary account data follow their deletion schedule; only the necessary minimal settlement records are separately pseudonymized and retained until resolution. The temporary email address and Apple token follow the short limits in the account-deletion-completion paragraph below. Expiry alone does not automatically establish success or a refund. Legally required transaction records follow the existing separate rules and do not justify long-term retention of all images.
OnNori-provided display examples are separate from user uploads. Deleting an account deletes that user's usage records, not the provided material itself. Derivatives and results combined with a user's photos remain personal data subject to the periods above. This does not mean a Library for selecting or purchasing shared sources is currently available.
The B and E image stores controlled by OnNori do not retain deleted objects for recovery or keep previous object versions. Once deletion is executed, the object is permanently deleted immediately. This does not mean every deletion request instantly removes all data; deletion follows the periods and procedures above. Copies held by fal and Resend follow their separate provider terms. Files already downloaded to your device are outside deletion from OnNori's servers.
Account, consent, transaction, ledger, security, and legal records are retained for their operational or legally required periods. When a period ends, information is deleted, de-identified, or isolated as appropriate.
An authenticated user may request account deletion or deactivation. We verify identity and authority, delete or deactivate information within the actual service scope, revoke supported sessions or access, and retain only narrowly limited records required for transactions, security, disputes, or law.
After account deletion is completed, we may temporarily keep the email address registered to the account, solely to send one deletion-completion notice, and, for accounts that used Sign in with Apple, the Apple token needed to revoke the Sign in with Apple connection. We delete the email address as soon as our email provider accepts the notice for delivery or a bounce is confirmed, and the Apple token as soon as revocation succeeds; even if these steps fail, we do not keep either for more than seven days after account-data deletion is completed. A processing-result record that shows only whether the deletion was completed and cannot identify you is kept for 30 days after completion and then deleted. The notice does not include your name or payment details and does not use open or click tracking. Retention by our email provider is described in Section 4.
Subject to applicable state law and verification, a resident may request access, confirmation, correction, deletion, or a portable copy and may appeal a denial where required. Because OnNori does not currently sell personal information, share it for cross-context behavioral advertising, or conduct targeted advertising, the corresponding opt-outs do not change the current processing. We do not discriminate for exercising applicable privacy rights. An authorized agent must provide authority and may be subject to verification requirements.
State privacy statutes have different applicability thresholds. Applicability is assessed from actual revenue, resident volume, data uses, and other statutory facts; this Policy does not claim that every state statute applies regardless of threshold.
OnNori is a general-audience service, is not directed to children under 13, and does not market to them. A general-audience operator is subject to COPPA when it has actual knowledge that it is collecting personal information from a child under 13. If we obtain such knowledge, we stop collection, restrict the account, and delete the information or use a legally sufficient parental-consent process if one is expressly supported. An adult's upload of an image depicting a child does not by itself establish that the account user is under 13, but the uploader must have all necessary rights and permissions.
We use server-side authentication and authorization, least-privilege private storage, user-level data isolation, environment separation, input validation, and atomic and idempotent ledger controls. No security method is absolute. Privacy, deletion, and appeal requests may be sent to cs@onnori.com; we may request information reasonably necessary to verify identity and authority.
De-identification used instead of deletion must irreversibly prevent reconnection to a person. Reversible pseudonymization is not treated as erasure or used to avoid retention limits.