Biometric (Facial) Data Processing Consent

Last Revised: October 18, 2026

Table of Contents

• Purpose of Collection
• Scope of Biometric Data Collected
• Processing Method — Photos and Diagnostic Codes Are Handled Differently
• Retention and Use Period
• Third-Party Provision and Outsourced Processing
• User Rights
• Right to Refuse Consent and Consequences
• Legal Basis
• Contact

Purpose of Collection

K DanJang (the "Company") processes biometric data solely for the purpose of analyzing a user's uploaded facial photo to derive 32 diagnostic items (skin tone, face shape, eye shape, lips, etc.), and providing a daily personalized K-makeup guide (text and voice) based on this data.

The Service's core functionality cannot be provided without processing biometric data.

Scope of Biometric Data Collected

The Company does not collect other identifying information such as national ID numbers or fingerprints, and facial photos are not used for identity verification purposes.

• One facial photo directly uploaded by the user (a front-facing photo is required; side-profile and photos with glasses are optional)
• 32 diagnostic codes automatically extracted from the above photo by AI (MediaPipe, 478-point facial landmark recognition) (e.g., morphological feature values for skin tone, face shape, eye shape, nose, lips, etc.)

Processing Method — Photos and Diagnostic Codes Are Handled Differently

The Company processes the original photo and the diagnostic codes extracted from it in different ways.

In other words, the initially uploaded photo becomes the sole source data for all subsequent personalized recommendations. Rather than re-analyzing the photo each time, the Service generates content by combining the already-stored diagnostic codes with each day's situation (weather, activity, mood, etc.).

Retention and Use Period

Upon account withdrawal, biometric data including diagnostic codes is destroyed without delay.

Third-Party Provision and Outsourced Processing

The Company does not sell biometric data to third parties or provide it for marketing purposes.

The Company outsources processing to the following infrastructure providers to deliver the Service, and each provider processes data in accordance with its own privacy policy.

Servers of providers to whom the Company outsources processing (Supabase, Anthropic, Google, HeyGen) may be located outside the Republic of Korea, in which case biometric data (in the form of diagnostic codes) may be transferred abroad for processing. The Company verifies that each provider maintains an adequate level of data protection as required by applicable law. For the items transferred and the countries involved, see Section 5 of the Privacy Policy.

The Company does not use a user's biometric data (photos and diagnostic codes) for AI model training or improvement purposes without the user's separate consent. However, if a user separately consents to AI training use in the settings screen, their uploaded photos are securely stored separately and used only to improve the AI; if that consent is withdrawn, the stored photos are deleted immediately.

• Supabase Pte. Ltd. (Sydney region) — computes diagnostic codes from facial coordinates and stores the diagnostic codes (photos are neither transmitted nor stored)
• Anthropic, PBC (United States) — generates guide text. It receives diagnostic features, consultation answer features and today's context (place, weather, etc.); it does not receive your name, email, member ID or photos
• Google LLC (Google Cloud Text-to-Speech, United States) / HeyGen, Inc. (backup, United States) — generates the audio guide. They receive only the guide text that reflects diagnostic features; no photos or identifiers

User Rights

Users may exercise the following rights at any time.

Deletion requests are processed without delay upon receipt, and within any deadline separately required by applicable law.

• If photos are stored under AI training consent, immediate deletion by withdrawing that consent in the settings screen
• Request for deletion of stored diagnostic codes (biometric data) — available through the menu in the settings screen
• Withdrawal of this consent — provided that withdrawing consent will restrict use of the AI facial diagnosis service

Right to Refuse Consent and Consequences

Users have the right to refuse this consent. However, because this consent is essential for providing K DanJang's core AI facial diagnosis service, refusing consent may restrict sign-up and use of the Service.

Legal Basis

The Company processes biometric data based on the following legal grounds.

• The user's explicit consent to the processing of sensitive information (biometric data) under the Personal Information Protection Act of the Republic of Korea
• The data subject's explicit consent under Article 9(2) of the EU General Data Protection Regulation (GDPR)
• Biometric data laws of the relevant jurisdiction, including the Illinois Biometric Information Privacy Act (BIPA) in the United States

Contact

If you have any questions regarding the processing of biometric data, please contact us below.

Email: kdanjang@kdanjang.com

This document applies together with K DanJang's Privacy Policy and Terms of Service.

Processing Flow

• The user uploads a photo.
• On the user's own device (browser/app), AI recognizes 478 facial landmarks, and only the coordinate values (not the photo) are sent to our servers to compute the 32 diagnostic codes.
• The original photo is never stored on our servers and is analyzed only on your device (browser). It is only securely stored separately if you give separate (optional) consent to AI training use, and stored photos are deleted immediately if you withdraw that consent.
• The extracted 32 diagnostic codes are stored for as long as the account exists, and are subsequently used as the basis for generating daily personalized guides.