Privacy Policy
Effective Date: [November 13, 2026]
Gaon Prime Inc. ("Company," "we," "us," or "our") operates Nordy.ai (the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you use our Service.
By using Nordy.ai, you agree to the collection and use of information in accordance with this policy.
Language. The Korean-language version of this Privacy Policy is the official and governing version. This English version is provided as a courtesy translation for your convenience. In the event of any discrepancy or inconsistency between the Korean and English versions, the Korean version shall prevail. The Korean version is available at nordy.ai/ko/terms/privacy.
1. Information We Collect
1.1 Information You Provide
| Category | Data Collected |
|---|---|
| Account Information | Email address, profile information (name, profile image via Google/Discord login) |
| Onboarding Information | Task you want to solve, job role, how you heard about Nordy |
| Payment Information | Payment method, transaction date, amount ※ Sensitive payment details (card numbers) are processed directly by payment processors |
| Communication | Inquiries and support requests via Channel Talk |
1.2 Information Collected Automatically
When you use our Service, we automatically collect:
- IP address, browser type, operating system
- Device information (device identifiers, screen resolution)
- Cookies and similar tracking technologies
- Usage data, access logs, service interaction records
- Content you generate, post, or make public (AI Output such as images, videos, audio, and 3D models, and input data) and related safety/legal review records
1.3 Optional Information
- Marketing communication preferences (with separate consent)
- Age verification information (Korea: date of birth, identity verification result / International: confirmation of being 18 or older) - when accessing adult content
1.4 Creator Program Application Information
If you apply to the Nordy Creator Program, we collect the following additional information:
| Category | Data Collected |
|---|---|
| Required | Nordy account ID, name or handle, email address, country, social media and channel URLs and follower counts, area of activity, statement of interest |
| Optional | Portfolio and other supporting materials |
Portfolios and other materials submitted with your application are used solely to review that application and are not used to train AI models.
1.5 API Usage Information
If you use the Nordy API, the following information is generated and collected:
| Category | Data Collected |
|---|---|
| API Key Identification Information | Key name, key prefix, key hash, issuance date, last used date (the original API key value is not stored) |
| API Request and Processing Records | Request date and time, IP address, request ID, job status, error codes |
| Data You Submit | Workflows and metadata included in your requests, and input files retrieved by us from URLs you specify |
Please do not include personal information in the metadata of your API requests. If you transmit personal information of the end users of your own service through the API, Section 5.3 applies.
2. How We Use Your Information
We use collected information for the following purposes:
| Purpose | Description |
|---|---|
| Service Provision | To provide and maintain Nordy.ai, authenticate users, and deliver features |
| Service Improvement | To analyze usage patterns and improve our Service |
| Payment Processing | To process transactions for paid services, and to handle payment disputes and fraudulent payments |
| Age Verification | To verify age for access to adult content |
| Customer Support | To respond to inquiries and resolve issues |
| Marketing | To send promotional content (only with your consent) |
| Content Safety & Legal Compliance | To detect and block illegal/harmful content (such as child sexual abuse material and non-consensual sexual content), report to and cooperate with authorities under applicable laws, and preserve evidence |
| Creator Program Operation | To receive and review Creator Program applications, notify applicants of results, manage creator status, issue reward credits, and provide program-related communications |
| API Service Provision | To issue and authenticate API keys, process API requests and deliver results, manage usage limits, and prevent API abuse |
| Legal Compliance | To comply with applicable laws and regulations |
3. Legal Basis for Processing (GDPR)
For users in the European Economic Area (EEA), United Kingdom, and Switzerland, we process personal data based on the following legal grounds:
| Legal Basis | Purpose |
|---|---|
| Contract Performance | Account creation, service provision, payment processing, Creator Program application review and participation, API service provision |
| Legitimate Interests | Service improvement, security, fraud prevention, content safety |
| Consent | Marketing communications, cookies for analytics and advertising/targeting (e.g., Meta Pixel) |
| Legal Obligation | Compliance with applicable laws, including detection, reporting, and evidence preservation of illegal content |
4. Data Retention
We retain your personal information for as long as necessary to fulfill the purposes outlined in this policy, unless a longer retention period is required or permitted by law.
| Data Category | Retention Period |
|---|---|
| Account Information | Until account deletion |
| Transaction Records | 5 years (as required by Korean Commercial Act and Consumer Protection Act) |
| Consumer Complaints | 3 years (as required by Consumer Protection Act) |
| Service Access Logs | 3 months (as required by Korean Communications Privacy Act) |
| Illegal Content Detection / Reporting / Evidence | Period necessary for reporting, investigation, and preservation under applicable laws (e.g., the Act on the Protection of Children and Youth against Sex Offenses) |
| Marketing Preferences | Until consent withdrawal |
| Creator Program Application (not selected) | Deleted within 30 days after the review period ends; thereafter only an encrypted email value is retained to manage duplicate applications |
| Creator Program Application (selected) | 6 months after creator status ends |
| Portfolio and Supporting Materials | Deleted within 30 days after the review period or creator status ends |
| Creator Program Eligibility Restriction Records | 1 year, matching the re-application restriction period (to prevent abuse in connection with re-application) |
| API Key Identification Information | Deleted without delay upon deletion of the API key or account deletion |
| Output Generated via the API | 7 days from generation |
| Input Files Retrieved from URLs You Specify | Deleted when the output provision period for the relevant job ends |
| API Request and Processing Records | Until account deletion (service access logs follow the 3-month period above) |
5. Data Sharing and Disclosure
5.1 Service Providers
We share your information with third-party service providers who assist in operating our Service:
| Provider | Purpose | Location |
|---|---|---|
| Google LLC | Social login, analytics (Google Analytics) | United States |
| Discord Inc. | Social login (Discord account integration) | United States |
| Stripe, Inc. | International payment processing | United States |
| Toss Payments Co., Ltd. | Domestic (Korea) payment processing | South Korea |
| NHN KCP Corp. | Identity verification (age verification) | South Korea |
| Mixpanel, Inc. | Analytics and usage statistics | United States |
| Channel Corporation (Channel Talk) | Customer support | South Korea |
| Comfy Organization Inc. | AI model API integration (including image, video, and audio/voice generation) | United States |
| Features and Labels, Inc. (fal.ai) | AI model API integration (including image, video, and audio/voice generation) | United States |
| Amazon Web Services, Inc. | Service infrastructure (cloud servers) | South Korea |
| MongoDB, Inc. | Database operation (MongoDB Atlas) | South Korea |
| Meta Platforms, Inc. | Advertising measurement and targeting (Meta Pixel for Facebook/Instagram ads) | United States |
5.2 Other Disclosures
We may disclose your information:
- When required by law or legal process
- To protect our rights, privacy, safety, or property
- To report to and cooperate with authorities regarding illegal content (such as child sexual abuse material) under applicable laws
- In connection with a merger, acquisition, or sale of assets (with prior notice)
5.3 Personal Information of API End Users
- If you use the API to operate your own service and transmit personal information of your service's end users to us, you are responsible for securing a lawful basis for that processing, such as providing notice and obtaining consent.
- We process such personal information only to the extent necessary to process your API requests and deliver the results, and do not use it for any other purpose.
- Requests from end users to access, correct, delete, or suspend processing of their personal information should be directed to you as the operator of your service, and we will reasonably cooperate upon your request.
6. International Data Transfers
Your information may be transferred to and processed in countries other than your country of residence, including the United States and South Korea.
6.1 Overseas Transfers under the Korean Personal Information Protection Act
| Recipient | Country | Items Transferred | Timing and Method | Purpose | Retention Period |
|---|---|---|---|---|---|
| Stripe, Inc. | United States | Payment information | Network transmission at the time of international payment | International payment processing | Until termination of the service agreement |
| Google LLC | United States | Usage records, device information, account authentication information | Network transmission during Service use and Google account login | Analytics, social login | Until termination of the service agreement |
| Mixpanel, Inc. | United States | Usage records, device information | Network transmission during Service use | Analytics | Until termination of the service agreement |
| Comfy Organization Inc. | United States | AI generation request data | Network transmission at the time of an AI generation request | API integration | Until termination of the service agreement |
| Features and Labels, Inc. (fal.ai) | United States | AI generation request data (prompts, input images, videos, audio, etc.) | Network transmission at the time of an AI generation request | API integration | Until termination of the service agreement |
| Discord Inc. | United States | Account authentication information | Network transmission at the time of Discord account login | Social login | Until termination of the service agreement |
| Meta Platforms, Inc. | United States | Cookie/advertising identifiers, site visit and event records, device information | Network transmission when users who consented to advertising cookies visit the Service | Advertising measurement and targeting | Until termination of the service agreement |
You may refuse the overseas transfer of your personal information as follows:
- Analytics (Google Analytics, Mixpanel) and advertising (Meta Pixel): You may refuse through your browser cookie settings or by withdrawing consent to advertising cookies. Refusal does not restrict your use of the Service.
- Social login (Google, Discord): You may refuse by not using that login method, in which case you may use the Service with an email account.
- Payment (Stripe): You may refuse by not using international payment methods, in which case payment for paid services through that payment method is restricted.
- AI generation (Comfy Organization, fal.ai): These transfers are essential to providing the Service. You may refuse by deleting your account, in which case use of the Service is restricted.
Inquiries and refusal requests regarding overseas transfers may be sent to support@nordy.ai or to the Privacy Officer listed in Section 12.
6.2 Transfers from the EEA, UK, or Switzerland
For transfers from the EEA, UK, or Switzerland, we implement appropriate safeguards including:
- Standard Contractual Clauses (SCCs) approved by the European Commission
- Data Processing Agreements with service providers
- Additional technical and organizational measures
7. Your Rights
7.1 All Users
You have the right to:
- Access your personal information
- Correct inaccurate information
- Delete your account and associated data
- Withdraw consent for marketing communications
- Request data portability
Please note that information subject to a preservation obligation under applicable laws (such as evidence related to the reporting of, or cooperation with investigations into, illegal content), as well as the minimum information necessary to prevent abuse of the Service (such as Creator Program eligibility restriction records), may be excluded from requests for deletion or suspension of processing until that obligation or purpose ends.
7.2 Additional Rights for EEA/UK/Swiss Users (GDPR)
Under GDPR, you additionally have the right to:
- Object to processing based on legitimate interests
- Restrict processing in certain circumstances
- Lodge a complaint with a supervisory authority
- Not be subject to automated decision-making
To exercise your rights, contact us at support@nordy.ai or use the settings within the Service. For matters concerning the Privacy Officer, you may also contact admin@gaonprime.com.
8. Children's Privacy
Nordy.ai is not intended for users under the age of 14. We do not knowingly collect personal information from children under 14. If we become aware that we have collected personal data from a child under 14, we will take steps to delete that information.
9. Cookies and Tracking Technologies
9.1 Types of Cookies We Use
| Cookie Type | Purpose |
|---|---|
| Essential | Required for Service functionality |
| Analytics | Google Analytics, Mixpanel for usage analysis |
| Advertising | Meta Pixel (Facebook/Instagram) for ad measurement and targeting. Advertising/targeting cookies are used only with the user's consent, which may be declined or withdrawn at any time. |
9.2 Managing Cookies
You can control cookies through your browser settings:
- Chrome: Settings > Privacy and Security > Cookies
- Safari: Preferences > Privacy
- Firefox: Settings > Privacy & Security > Cookies
Note: Disabling cookies may affect Service functionality.
10. Data Security
We implement appropriate technical and organizational measures to protect your personal information, including:
- Encryption of data in transit and at rest
- Access controls and authentication
- Regular security assessments
- Employee training on data protection
11. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the "Effective Date" at the top.
For significant changes, we will provide notice through the Service or via email at least 7 days before the changes take effect.
12. Contact Us
If you have questions about this Privacy Policy or our data practices, please contact us:
| Data Controller | Gaon Prime Inc. |
| Privacy Officer | Hosan Jeong |
| Email (general / rights requests) | support@nordy.ai |
| Email (Privacy Officer) | admin@gaonprime.com |
| Address | A-703, Halla One&One Tower, 101 Gasan Digital 2-ro, Geumcheon-gu, Seoul, South Korea |
For EEA/UK Users
If you are located in the EEA or UK and have concerns about our data practices, you have the right to lodge a complaint with your local data protection authority.
Published: [October 14, 2026], Effective: [November 13, 2026]
The Korean-language version of this Privacy Policy is the official and governing version. This English version is a courtesy translation provided for reference only; in the event of any discrepancy, the Korean version shall prevail.
Gaon Prime Inc. Co-CEOs: Kihun Kim, Hosan Jeong