Privacy Policy

Effective date: 3 November 2026 · Operator: Making Soul Studio. If this English version differs from the Korean version, the Korean version prevails, except where the law of your country requires otherwise.

Making Soul Studio (the “Company”) operates MyPetToon (mypettoon.com) and processes personal information as described below, in line with the Korean Personal Information Protection Act. Section 11 adds information for users in the European Economic Area (EEA) and the United Kingdom.

1. What We Process and Why

• How we collect it: we receive your email and account ID through Google sign-in; everything else is what you type or upload in the Service, or what the Service makes for you.
• Payment details such as payer name, payment method and billing country are collected and processed directly by our online reseller, Dodo Payments, as the seller. The Company does not receive card details. When you open the checkout, we send your account ID and sign-in email (pre-filled in the checkout) to the reseller; this is a provision abroad under section 4, and we ask for your separate consent before the checkout opens.
• We do not record IP addresses in generation records. Cloudflare, which serves the website, may process connection data for security and operations.
• Pet photos are kept in private storage on our server and are never served at any address. When we draw your pet’s character, those photos are sent to OpenAI to generate the picture. Cover and panel pictures for comics made with pet profiles use only the character drawing and scene instructions, without your photos (a redraw also sends the previous picture). Older comics made by uploading photos directly, before pet profiles existed, also send one of those photos with the character drawing when a cover or panel is drawn.
• If a person appears in a photo, the Service instructs the model to draw people only as simple cartoon figures whose real face cannot be recognised. The Service does not extract features from photos to identify or authenticate anyone, so photos are not processed as sensitive (biometric) information. Please add photos of other people only with their consent, and photos of children under 14 only with a parent’s or guardian’s consent.
• Your story and the names and kinds of the pets you choose are sent to Anthropic to write the script. Photos are never sent to Anthropic.
• By default OpenAI and Anthropic do not use data received through their APIs to train their models. OpenAI keeps abuse-monitoring logs for up to 30 days, and Anthropic keeps inputs and outputs for up to 30 days (longer where needed for policy-violation review or required by law).
• Pictures you make are served at addresses with names that cannot be guessed (/generated/…); anyone who has the address can view the picture without signing in. Downloaded pictures with text and watermark are put together inside your browser.

2. Retention

• Account data and saved content (pet profiles and photos, comics and scripts, generated pictures, generation records) are kept until you ask us to delete your account, and are then destroyed without delay under section 3.
• When you delete a pet profile, the profile and its original photos are deleted right away. If that profile’s character drawing was already used in a comic, the drawing stays with that comic.
• Records required by law are kept separately for the legal period: contract and withdrawal records and payment and supply records for 5 years, consumer complaint and dispute records for 3 years (Enforcement Decree of the Korean Act on Consumer Protection in Electronic Commerce, Article 6).

3. How We Destroy Data

• Procedure: when a retention period ends or we receive a deletion request, we destroy the data without delay. For an account deletion we
  1. confirm you are the account owner through your sign-in email,
  2. if a subscription has not been cancelled (active, overdue or paused), explain how to cancel it first and delete the account once it is cancelled or has expired,
  3. if the account has payment or credit transactions, set aside a copy of only those records that the law requires us to keep (no copy is made if there are none),
  4. delete the account and all other data (steps 3 and 4 happen in a single operation, so no new generation or upload can slip in between), and
  5. have an hourly clean-up job delete the picture and photo files from storage. Because the name of a generated picture or photo is recorded on the account before the file is stored, pictures from generations that finish during deletion are deleted too. The clean-up job deletes the files once more a day later, so no copy made late during the deletion remains.
• Once a day we look for files in storage that no longer match any account record; after an administrator checks them, those older than a day are deleted.
• Method: electronic files and database records are deleted so they cannot be recovered. We do not keep personal information on paper.
• Separate retention: the set-aside copy of payment and credit records is kept in separate, access-restricted storage and destroyed automatically when the 5-year period ends. Payment notification records are unlinked from the account and destroyed automatically after 5 years. The copy holds only the sign-in email, account ID, payment provider customer ID, subscription, credit grant, payment and refund records, and the payment-related credit ledger and payment notification list; stories, scripts, pictures, photos, pet names and generation records are never part of it.
• Backups: where our database provider keeps backup copies, they are removed when its backup cycle ends (at most 7 days).

4. Processors and International Transfers

We entrust the processing needed to provide the Service (to perform our contract with you) to the processors below (Supabase, Cloudflare, OpenAI, Anthropic), so personal information is transferred abroad or processed by providers abroad (Korean Personal Information Protection Act, Article 28-8(1)(iii)). Our online reseller, the seller, is not our processor and handles payments for its own purposes, so sending data to it is a provision abroad; before the checkout opens, the consent box tells you the recipient’s name, contact and country, the data sent, the purpose and the retention period, and asks for your separate consent (Article 28-8(1)(i)). If the reseller changes, we will update the table below and announce it under section 10. Data is transferred over an encrypted connection (HTTPS) each time you use the related feature (for the reseller, when you open the checkout).

• How to refuse and what happens: you may decline by not signing in, not using the related generation features, or not paying. Those features will then be unavailable. You can refuse the provision to the reseller in the consent box before the checkout opens; you then cannot pay, and nothing else changes. You can ask us to delete data already sent under section 5 (ask the reseller about the payment records it keeps as the seller).
• With Google sign-in you sign in to Google (Google LLC, USA) directly, and we receive your email and account ID from Google. We do not send personal information to Google.

5. Your Rights

• You may ask to access, correct, delete or stop processing your personal information, withdraw consent, or delete your account at contact@makingsoulstudio.com. We confirm your identity through your sign-in email and reply within 10 days.
• A legal representative or a person you authorise may also make a request; we will ask for proof of authority such as a power of attorney.
• Children under 14 may not sign up. If we learn we hold information about a child under 14, we destroy it without delay.

6. Security

• All traffic is encrypted (HTTPS).
• The database is reachable only from our server; browsers can read only their own account information. The set-aside payment record copies are readable only by our server.
• Admin accounts use two-factor authentication, and only the representative has admin access.

7. Browser Storage and Cookies

We keep your sign-in state in browser storage, and briefly keep the plan you picked on the pricing page in session storage while you sign in. We do not use advertising or tracking cookies. You can clear or block browser storage in your browser settings; you will then not stay signed in. The checkout is shown by our online reseller, which may use cookies under its own policy.

8. Privacy Officer

Sanghen Oh (Representative) · contact@makingsoulstudio.com · +82-50-6532-2453

9. Remedies in Korea

You may contact the Korea Internet & Security Agency privacy center (privacy.kisa.or.kr, +82-118) or the Personal Information Dispute Mediation Committee (kopico.go.kr).

10. Changes

We will announce changes on the Service at least 7 days before they take effect, and at least 30 days before changes that matter to your rights, such as new kinds of data, purposes or international transfers.

11. Users in the EEA and the UK

• Controller: Making Soul Studio, 202-S23, 12 Jungang-ro 214beon-gil, Nam-gu, Ulsan 44690, Republic of Korea · contact@makingsoulstudio.com.
• Legal bases (GDPR and UK GDPR Article 6(1)): performance of our contract with you (b) — your account, generation, storage and payments, including sending your account ID and email to our online reseller when you check out; our legitimate interests (f) — security, preventing abuse and troubleshooting, and keeping the transaction records that Korean law requires and that we need to handle disputes; your consent (a), where we ask for it. You can withdraw consent at any time without affecting earlier processing.
• Your rights: access, rectification, erasure, restriction of processing, data portability, objection, and withdrawal of consent. Contact us as in section 5. You also have the right to complain to the data protection authority where you live or work. In the UK, that is the Information Commissioner’s Office (ico.org.uk).
• International transfers: your data is processed in the USA and Cloudflare’s Asia-Pacific locations, as set out in section 4. Transfers to our providers rely on their data processing terms, including standard contractual clauses or other safeguards recognised by law.
• We do not make decisions based solely on automated processing that have legal or similarly significant effects on you.