Privacy Policy

1. Purposes of Processing Personal Information

Mozzamile Inc. (the “Company”) processes personal information for the following purposes. Personal information will not be used beyond these purposes, and if the purpose of use changes, the Company will take necessary measures, such as obtaining separate consent.

• Account registration and management: maintenance of membership, identity verification, and prevention of fraudulent use.
• Service provision: emotion logging, AI-based emotion analysis and translation, family connection, parent-child messaging, weekly emotion summaries, and other core features.
• AI-based analysis and translation: emotion classification, summarization, translation, suggestion prompts, and generation of weekly reports.
• Payment and subscription management: processing of paid service fees and management of subscription status.
• Notifications: sending push notifications for new records, responses, weekly summaries, and similar events.
• Service improvement and analytics: ensuring app stability and improving service quality through usage pattern analysis.
• Handling of complaints and inquiries.
• Service safety: detection of abusive or fraudulent use, response to legal disputes, and fulfillment of legal obligations.

2. Categories of Personal Information Processed

The Company processes the following categories of personal information.

3. Processing of Children Under 14

• Legal guardian consent: Personal information of children under 14 is collected with the consent of the legal guardian (parent). A child's account may only be created via an invitation code issued by the parent, and this flow itself incorporates guardian consent.
• Minimized collection: Information collected from children is limited to the minimum necessary for service provision (nickname, avatar, emotion records). Contact information such as email address or phone number is not collected from children.
• Child data protection: Children's emotion records are stored in encrypted form and are not disclosed to any third party outside the family. Children's data is never used for advertising.
• Guardian rights: The legal guardian may request access, correction, deletion, or suspension of processing of the child's personal information. Child accounts are custodial accounts; a child cannot delete the account directly — deletion must be requested through the guardian's account.
• Privacy-preserving design: Children can choose whether to share or keep each emotion record private; private records are not disclosed to anyone, including parents.
• No use for AI training: Children's personal information, including emotion records, is under no circumstances provided to external AI providers for model training or retraining. It is used only for AI inference required to deliver the service.
• Guardian supervision duty: Guardians are responsible for ensuring that children do not include identifiable information about third parties (such as friends or teachers) in their records.

4. Retention Period

The Company processes and retains personal information within the retention and use period prescribed by applicable laws or agreed upon at the time of collection.

• Until account deletion (except where applicable laws require longer retention).
• Records on contracts and withdrawal of subscription: 5 years.
• Records on payment and supply of goods: 5 years.
• Records on consumer complaints or dispute handling: 3 years.
• Records on display/advertisement: 6 months.

5. Provision to Third Parties

The Company processes personal information only within the purposes set out in Section 1 and provides it to third parties only with consent of the data subject, where special provisions of law apply, or as otherwise permitted under the Korean Personal Information Protection Act.

The Company currently does not provide personal information to third parties. In particular, children's emotion data is never sold to or shared with external parties for advertising purposes under any circumstance.

6. Outsourcing of Personal Information Processing

The Company entrusts certain personal information processing tasks to the following processors for smooth service operation.

In entrustment contracts, the Company clearly specifies compliance with personal information protection laws, confidentiality, prohibition of third-party provision, responsibility for incidents, the term of entrustment, and return or destruction of personal information after processing is complete, and supervises processors to ensure that personal information is handled safely.

In particular, for AI analysis and translation processors (OpenAI, Google, etc.), the Company either contractually ensures that user data is not used to train or retrain the processor's own models, or maintains opt-out settings provided by those services for such training.

7. Cross-Border Transfer

The Company transfers personal information abroad as follows in order to provide the service. If the user does not consent to cross-border transfer, the related features (AI analysis and translation, push notifications, app analytics, etc.) may be restricted.

8. Automated Decision-Making and AI Processing

The Company performs automated processing using AI (artificial intelligence) to deliver core service features. AI results are provided for reference only and are not used for decisions that have a legal or similarly significant effect on users.

• Emotion classification and summarization: The AI analyzes the user's text records to automatically generate key emotion tags and one-sentence summaries.
• Emotion translation: The AI rewrites a child's record in language a parent can more easily understand, and a parent's message in a tone the child can more comfortably receive. Users may choose to send either the translated or the original version.
• Weekly emotion summary: The AI analyzes a week's emotion records to automatically generate a weekly report containing emotional distribution, key keywords, and insights.
• Communication suggestions: Based on the child's emotion records, the AI suggests empathetic response drafts to the parent. Whether or not to use these suggestions is entirely at the parent's discretion.

Users may object to AI processing results by contacting the Company at the address listed in Section 13.

9. Rights and Obligations of Data Subjects

Data subjects may exercise the following rights against the Company at any time.

• Request for access to personal information.
• Request for correction in case of errors.
• Request for deletion.
• Request for suspension of processing.

These rights may be exercised by contacting devteam@mozzamile.com, and requests will be processed without delay (within 10 days).

10. Destruction of Personal Information

The Company destroys personal information without delay when the retention period has expired or the purpose of processing has been achieved and the information is no longer necessary.

• Destruction procedure: Upon account deletion, all data including emotion records, messages, family memberships, and notification settings are destroyed immediately. Information that must be retained under applicable laws is stored separately for the required period and then destroyed.
• Destruction method: Information in electronic file form is deleted using technical methods that render the records unrecoverable.
• Destruction of child data: When a legal guardian withdraws consent to the collection and use of a child's personal information, the child's personal information is destroyed without delay.

11. App Analytics and Automatic Collection

The Company uses Firebase Analytics to improve app performance and user experience.

The data collected does not directly identify individuals and does not include sensitive information such as emotion record text or message content. Data collected through Firebase Analytics is handled in accordance with Google's privacy policy. Please refer to the Google Privacy Policy.

12. Security Measures

The Company takes the following measures to ensure the security of personal information.

• Administrative: establishment and implementation of an internal management plan; periodic employee training.
• Technical: access control for the personal information processing system, installation of access control systems, TLS encryption in transit, encrypted storage of emotion records, logging of account access, periodic vulnerability assessments and security updates.
• Physical: access control for server rooms and data storage areas.

13. Data Protection Officer and Remedies

The Company designates the following data protection officer to oversee the processing of personal information and to handle complaints and remedies related to personal information.

14. Changes to This Policy

This Privacy Policy takes effect on the effective date below. In case of additions, deletions, or amendments due to laws or Company policy, the changes will be announced in-app at least 7 days prior to the effective date.

For material changes that significantly affect users' rights, such as changes to the categories of personal information collected or the purposes of use, the Company will provide notice at least 30 days in advance.

15. Service Misuse and Crisis Response

The Company maintains the following principles to ensure the sound operation of the service and the safety of users.

• No continuous monitoring: The Company does not continuously monitor or automatically scan users' emotion records, messages, or other content for the purpose of providing such content to third parties. This service is not a surveillance tool.
• Compliance with legal obligations: Where required by applicable laws or by a lawful request from an investigative agency or court, the Company provides personal information only within the scope and procedures prescribed by law, and makes reasonable efforts to notify the affected user afterward where permitted.
• User-safety exception: If the Company becomes aware of a situation involving imminent risk to life or physical safety — such as self-harm, suicide, child abuse, or specific threats to others — the Company may, to the extent permitted by law, provide minimum necessary information to relevant authorities or the legal guardian. This response applies only when such a situation has been brought to the Company's attention; it does not imply any obligation of the Company to proactively detect user content.
• Fraud prevention: The Company may analyze logs and access records within the scope necessary to prevent and respond to account compromise, payment circumvention, impersonation, and other abusive use.