Hottest Lab Inc. (hereinafter referred to as "Company") values the personal information of users and complies with relevant laws such as the "Personal Information Protection Act" and the "Act on Promotion of Information and Communications Network Utilization and Information Protection." Through this privacy policy, the Company informs users about the purposes and methods for which personal information provided by users is being used, and what measures are being taken to protect personal information.
The Company collects the following information to provide AI Girlfriend services:
The Company utilizes collected personal information for the following purposes:
However, when necessary to preserve according to relevant laws, the Company retains personal information for the period specified by relevant laws:
In principle, the Company does not provide users' personal information to third parties. However, exceptions are made in the following cases:
The Company outsources personal information processing as follows to improve services:
| Contractor | Outsourced Work Content | Retention and Usage Period |
|---|---|---|
| Google Cloud Platform | AI conversation processing, image generation, and server hosting | Service provision period |
| Supabase | User authentication, database management, and file storage | Service provision period |
| Firebase | Push notifications and analytics | Service provision period |
| Cloudflare R2 | Image and media file storage | Service provision period |
| OpenRouter | AI model routing and API gateway for conversation and image generation services | Not retained; processed in real-time per DPA |
| xAI (Grok) | AI conversation generation (Grok models) | Not retained; processed in real-time; not used for model training under API terms |
| Google AI (Gemini) | Content moderation and AI image generation (Gemini models) | Not retained beyond processing; subject to Google Cloud DPA |
| fal.ai | AI image generation from user-uploaded images | Deleted immediately after generation; not used for training |
When concluding outsourcing contracts, the Company specifies matters concerning prohibition of personal information processing beyond the purpose of performing outsourced work, technical and administrative protective measures, restrictions on re-outsourcing, management and supervision of contractors, and responsibilities including damage compensation in documents such as contracts in accordance with Article 26 of the Personal Information Protection Act, and supervises whether contractors safely process personal information.
Users may exercise the following rights at any time:
Rights may be exercised in writing, by email, etc., according to the format specified in Annex No. 8 of the Enforcement Rules of the Personal Information Protection Act, and the Company will take action without delay.
Information entered by users for service use is moved to a separate database after the purpose is achieved and stored for a certain period according to internal policies and information protection reasons under other relevant laws before being destroyed.
The Company uses ‘cookies‘ that store usage information and retrieve it from time to time to provide individualized customized services to users.
Users have the right to choose regarding cookie installation:
The Company designates a personal information protection officer as follows to take overall responsibility for personal information processing matters and to handle user complaints and remedy damages related to personal information processing:
▶ Personal Information Protection Officer
Users may contact the personal information protection officer and relevant department regarding all personal information protection-related inquiries, complaint handling, damage remedies, etc. that occur while using the Company's services. The Company will respond to and process users' inquiries without delay.
This privacy policy applies from the effective date, and when there are additions, deletions, and corrections of changes according to laws and policies, it will be announced through announcements from 7 days before the implementation of changes. However, in case of important changes to user rights such as collection and utilization of personal information, provision to third parties, etc., it will be announced at least 30 days in advance.
Due to the characteristics of AI Girlfriend services, the following matters are additionally provided:
If you believe your personal information rights have been violated or you need assistance with privacy-related concerns, you may seek remedy through the following channels:
Please contact our Personal Information Protection Officer first:
Email: help@hottestlab.com
We will respond to your inquiry within 7 business days
You have the right to lodge a complaint with your local data protection authority. Depending on your location:
If you are not satisfied with our response, you may also seek resolution through independent dispute resolution services or legal proceedings available in your jurisdiction.
This Privacy Policy complies with the EU General Data Protection Regulation (GDPR). If you are located in the European Economic Area (EEA), you have the following additional rights:
Our legal basis for processing personal data includes: performance of a contract (service provision), legitimate interests (service improvement, security), consent (optional features, marketing), and legal obligations.
This Privacy Policy complies with the California Consumer Privacy Act (CCPA). If you are a California resident, you have the following rights:
To exercise your GDPR or CCPA rights, please contact us at help@hottestlab.com. We will respond within 30 days (GDPR) or 45 days (CCPA) of receipt of your request.
This privacy policy takes effect from February 1, 2026.
If you have any questions regarding personal information protection, please contact the above personal information protection officer.