OX Factory Privacy Policy
VIBEMENT CO., LTD. (the "Company", "we", "us") operates "OX Factory" (https://oxfactory.app, the "Service"). We process users' personal information under the Personal Information Protection Act of Korea, and this policy explains how.
At a glance
- When you sign in, we receive only your member number and nickname from Kakao, or your unique ID and name from Google. We do not receive your email, phone number or date of birth. If you request 'Build it for real' and choose to enter how to reach you, we receive only that (optional).
- To make questions, pictures and plans, we send only the project content you enter to Google in the US (Gemini API). We do not send your account information.
- Trial records made without signing in are deleted 30 days after last use. If you delete your account, we delete your data right away.
- To improve the Service, we keep usage records (taps, scrolling, screen recordings — on-screen text and inputs are masked) on our own servers for 30 days. We do not sell them or use them for ads, and you can turn this off with 'Turn off usage records' in Section 10.
- For operations such as reviewing requests, we use our AI work tool (Anthropic Claude, USA). Since October 25, 2026, it is set not to use this data for model training.
- Please do not put personal information such as names, contact details or addresses into your project content.
1. Purposes of Processing
We process personal information only for the following purposes.
- Identifying members and keeping them signed in
- Providing the Service — making O/X questions, pictures and plans, and saving and resuming them in "My plans"
- Giving coins and keeping records of their use (including sign-up, attendance and friend invite bonuses)
- Preventing abuse — limiting daily use from the same access point and checking votes, friend invites and coin builds for fraud
- Handling inquiries and complaints
- Connecting paid coin payments and refunds (matching order numbers with the payment gateway)
- Handling 'Build it for real' requests — confirming the request, quoting and contacting you about the build
- Usage analytics to improve the Service — seeing where people stop or leave
2. Personal Information We Process
| Category | Items | Required or optional |
|---|---|---|
| Sign-in with Kakao | Kakao member number · nickname | Required |
| Sign-in with Google | Google unique identifier · name | Required |
| Sign-up check | Confirmation that you are 19 or older · time you agreed to the Terms | Required |
| Using the Service | What you first wrote · questions and answers · pictures made · plans · coin history (coins received · coins spent) · invite relationship (whose invite link you joined through) · "Would you use this?" vote records | Required |
| 'Build it for real' request | The plan you request · a one-line note · how to reach you (an email, phone number or KakaoTalk ID that you enter) | Plan required; note and contact optional |
| Collected automatically | Sign-in cookie (random number) · access IP (to check daily use) · access-point hash (your access IP turned into a value using that day's random key — to check votes and invites for fraud) · data saved in this device's browser (to resume) | Required |
| Usage analytics (collected automatically) | Usage records (taps · scrolling · screen recordings — on-screen text, inputs and pictures are masked) · pages viewed and time · device · browser type · screen size · referrer · random recording number | Automatic until you turn it off |
3. Processing and Retention Periods
| Item | Retention period |
|---|---|
| Member information · My plans · coin history | Until you delete your account (destroyed right away when you delete it) |
| Trial records without signing in | Destroyed 30 days after last use |
| Access IP usage records | Deleted after that day ends (up to 2 days) |
| Access-point hashes | The day's random key used for hashing is deleted after 8 days, after which the hash can no longer be matched to any access point |
| 'Build it for real' request information | Destroyed 1 year after the request is closed (not built, or build finished). Destroyed right away if you delete your account. If a paid build contract is made, contract records are kept 5 years under the E-Commerce Act |
| Usage records | Destroyed after 30 days |
When paid payments begin, we will add the transaction records we keep by law to this policy and tell you in advance.
4. Destruction Procedure and Method
When the retention period ends or the purpose is achieved, we destroy the information without delay. Electronic files are deleted in a way that cannot be recovered.
5. Provision to Third Parties
We do not provide personal information to third parties. Kakao and Google are sign-in methods you choose yourself. We receive from them only the information you agree to on their screen (Section 2).
6. Outsourcing of Processing
| Recipient | Task outsourced |
|---|---|
| Cloudflare, Inc. | Delivering access to the Service securely (network · security) |
| Amazon Web Services, Inc. | Servers · database · backup storage (Seoul region) |
| Anthropic, PBC | The Company's AI work tool (Claude) — reviewing requests, preparing quotes and operational analysis |
Our servers, database, backups and usage records are kept in the AWS Seoul region and operated by the Company.
For services that members build through "Build it for real", the member is the controller of their users' information and the Company processes it on the member's behalf (Terms of Service Article 6-4). That information follows the built service's own privacy policy.
7. Transfer of Personal Information Abroad
We transfer personal information abroad as shown below because it is needed to provide the Service (performance of a contract) (Personal Information Protection Act, Article 28-8(1)(iii)). If you do not want this transfer, you can choose not to use the Service or delete your account. In that case, you cannot use the Service.
| Recipient (country) | Items transferred | Purpose | When and how | Retention period | Contact |
|---|---|---|---|---|---|
| Google LLC (USA) | What you first wrote · questions and answers · picture descriptions | Making questions, pictures and plans (Gemini API) | Each time you use the Service, over encrypted communication | The period set by the Google API terms | https://support.google.com/policies |
| Cloudflare, Inc. (USA) | Access IP · content sent and received (encrypted communication) | Delivering access · security | Each time you connect | Right after delivery (security logs follow Cloudflare's policy) | https://www.cloudflare.com/privacypolicy/ |
| Anthropic, PBC (USA) | 'Build it for real' request information · the requested plan's content · usage records needed for operational analysis | Reviewing requests, preparing quotes, operational analysis (AI work tool) | When our staff do that work, over encrypted communication | 30 days (set not to be used for model training since October 25, 2026; conversations flagged for policy review may be kept longer under Anthropic's policy) | https://www.anthropic.com/legal/privacy |
Only when you buy coins — outsourcing of payment processing (Korea): Paid coin payments are processed by KG Inicis (KG이니시스, 주식회사 케이지이니시스), an electronic payment gateway, and we use the service of Korea PortOne ((주)코리아포트원) to connect payments. When you press Top up coins, we pass the order number · the coin pack you chose · the payment amount · your internal member number (a random string) to them. You enter your name, mobile number, email and card details directly in the payment window. We do not receive card details. We keep payment records for 5 years under the Electronic Commerce Act of Korea.
8. Processing in the Generative AI Service
- The project content you enter is sent to AI (Google Gemini) to make questions, pictures and plans.
- Results made by AI are for reference only and may not match the facts.
- Please do not put your own or anyone else's personal information into your project content.
9. Measures to Keep Personal Information Safe
- We encrypt all communication (HTTPS).
- Sign-in cookies are signed so they cannot be forged, and JavaScript cannot read them (HttpOnly).
- We keep server access rights to a minimum and store secret keys separately from the code.
10. Tools That Collect Information Automatically (Cookies)
- We use a cookie holding a random number to keep you signed in.
- For usage analytics, we keep a random recording number in your browser. It is not linked to your member information. Records stay on our servers, are not used for ads, and we do not look at your activity on other sites. We do not record visitors from the European Economic Area, the UK or Switzerland.
- To block them: Turn off usage records (this browser will not be recorded again), or clear cookies and site data in your browser. If you block the sign-in cookie, you cannot stay signed in.
11. Behavioral Information
We do not run targeted advertising and do not collect behavioral information for it. To improve the Service, we analyze only usage records on our own site (Sections 2 and 10).
12. Your Rights and How to Use Them
- You can ask at any time to access, correct or delete your personal information, or to stop processing it.
- You can delete your account yourself in "My plans" (destroyed right away). You can also ask the privacy officer below by email or phone.
13. Children Under 14
Only people aged 19 or older can join the Service. We do not collect personal information from children under 14.
14. Privacy Officer
- Privacy officer: Sungjun Park (박성준), CEO
- Contact: 070-8656-6190 · [email protected]
15. Remedies for Infringement of Rights
- Personal Information Dispute Mediation Committee: 1833-6972 (www.kopico.go.kr)
- Personal Information Infringement Report Center: 118 (privacy.kisa.or.kr)
- Supreme Prosecutors' Office: 1301 (www.spo.go.kr)
- Korean National Police Agency: 182 (ecrm.police.go.kr)
16. Changes to This Policy
This policy applies from October 25, 2026. If it changes in the future, we will announce it in the Service 7 days before the change takes effect (30 days before if the change is unfavorable to users).
- Revised October 25, 2026: added 'Build it for real' request information, usage-record analytics, our AI work tool (Anthropic), servers (AWS Seoul), vote records and access-point hashes
- Previous version (effective October 24, 2026)
This English version is a translation. If it differs from the Korean 개인정보처리방침, the Korean version prevails.