Privacy Policy

1. Why we process personal data

To register and sign you in, to run the service and generate your results, to take payment and account for it, to answer your questions, and to analyse and improve how the product works. We do not use it for anything else, and if that ever changes we will tell you and ask first. With your optional consent, we also use your email address, language, plan and project activity to choose marketing emails and measure visits, project starts and completed images after them. Prompt text and images are not used for this selection.

2. What we hold

You can sign up with a Google or Kakao account, or with an email and password. With Google/Kakao we receive your name, email address, and profile image; with email signup we receive your email address and password. Passwords are stored only one-way hashed — never in plain text. To keep you signed in, we also keep the auth tokens Google/Kakao issued.

While you use the service we automatically collect your IP address, browser and device information, sign-in times, usage history, display language and the region used to decide which prices to show. We record marketing consent and withdrawal dates, source, wording version and the details you agreed to.

On a paid plan we keep your card issuer, the masked card number, and your payment history. The full card number and password go to our payment provider and never reach us.

We also store what you make in the product — projects, prompts, uploaded images, and the images and video generated from them.

3. Children under 14

GESTEL is for people aged 14 and over. We do not collect personal data from children under 14, and if we find that an account belongs to one we delete it and the data with it.

4. How long we keep it

As a rule we destroy your personal data as soon as you close your account. Korean law requires us to keep the following for a set time: Marketing use stops on withdrawal. Consent and withdrawal records remain until account deletion to manage preferences and document requests.

• Records of contracts and order withdrawals — 5 years
• Records of payment and of what was supplied — 5 years
• Records of consumer complaints and disputes — 3 years
• Records relating to advertising — 6 months
• Access logs — 1 year

We store those records separately from other personal data, keeping only the name and email address needed to identify who the transaction belonged to, and destroy them when the period ends. If you want to see your own transaction records after leaving, email hello@gestel.studio.

5. How we destroy it

Once the retention period passes or the purpose is met, we destroy the data without delay. Electronic files are erased so they cannot be recovered; anything printed is shredded or incinerated.

6. Sharing with third parties

When you authorize a connected AI app, GESTEL returns the results of that app's tool calls to it. Depending on the tools used, those results may include product names, photos and extracted details, your credit balance and quotes, request receipts, and links to finished media. The app handles results it receives under its own privacy policy. Disconnecting it in Settings → Account stops future access to GESTEL, but does not remove results already delivered to the app or invalidate media links already shared. We also disclose information when required by law or proper legal process. We never sell your personal data.

7. Processors we use

We entrust some work to the processors below, under contracts that require them to handle personal data safely and that we supervise.

• Toss Payments Inc. — domestic card and recurring payments
• Resend — account and service emails; marketing emails with optional consent

Processors that involve a transfer abroad are listed separately in the next section.

8. Transfers outside Korea

To run the service we transfer personal data abroad as set out below. These are transfers for processing and storage necessary to perform our contract with you, and publishing these details here takes the place of asking for separate consent. Overseas processing for optional marketing emails instead relies on separately requested consent. The consent details identify the recipient, country, data, purpose, transfer method and retention.

When and how: transmitted over the network at the moment you use the service.

Some overseas transfers are necessary to perform our service contract. If you refuse those transfers, we cannot provide the service. To refuse, stop using the service or close your account from Settings → Account. If you only want analytics switched off, email hello@gestel.studio and we will disable it for your account. Declining or withdrawing marketing-email transfer consent only stops marketing emails; it does not affect signup or service access. Change this in Settings → Account or through an unsubscribe link.

9. How we keep it safe

We limit access to personal data to the smallest number of people whose work requires it, and manage those permissions. All traffic between you and our servers is encrypted. We retain access logs for the systems that handle personal data and protect them against tampering. We keep a procedure for responding to incidents.

10. Cookies and automatic collection

We use only the cookies needed to keep you signed in; turning them off means you cannot stay signed in. We do not use advertising cookies or anything that follows you across other sites. You can refuse cookies in your browser settings.

11. Product analytics

We measure how the product is used: which features were used, when a generation started and whether it succeeded, and when a payment happened. That record is linked to your account and includes your name and email address.

The content of your prompts and generated output is never sent to our analytics. We do not follow you around other sites. We use product analytics to find what is slow or broken and decide what to build next. With separate marketing consent, account-level feature use and plan information help us select onboarding emails, and we measure the visits and creations that follow them. Analytics opt-out also stops that measurement.

If you would rather not be measured, email hello@gestel.studio and we will switch analytics off for your account. Nothing else about how the product works for you changes, though we still record that a payment occurred, because we need that to account for it.

12. Your rights and how to use them

You may at any time see, correct, delete or suspend the processing of your personal data, and withdraw consent. The legal representative of a child under 14 may exercise the same rights on their behalf.

You can close your account yourself from Settings → Account, in the same way and in as few steps as you signed up. Closing it removes your account, your projects, the files you uploaded or generated, and any remaining credits, and stops a subscription renewing.

For anything else, email hello@gestel.studio and we will act on it without delay and tell you the outcome. If we have to refuse a request to see or correct data, we will explain why and how to object.

13. Data protection officer

Data protection officer: Ahn Woonjang

Contact: hello@gestel.studio · +82 10-3029-1084

Questions, complaints and requests for redress about how we handle personal data go to that address, and we answer without delay.

14. Where else to complain

If you need advice or want to report a personal-data violation, these Korean bodies can help.

• Personal Information Dispute Mediation Committee — 1833-6972 (kopico.go.kr)
• Privacy Infringement Report Centre — 118 (privacy.kisa.or.kr)
• Supreme Prosecutors' Office, Cyber Investigation — 1301 (spo.go.kr)
• National Police Agency, Cyber Bureau — 182 (ecrm.police.go.kr)

15. Changes to this policy

We announce changes in the product at least seven days before they take effect, and at least 30 days before if the change disadvantages you.

16. Contact

Questions about this policy go to hello@gestel.studio.