Trioly Privacy Policy
현재 버전 · 시행일 2026년 11월 10일
한국어 원문이 기준이에요. 번역본은 같은 내용이에요.
Trioly ("we") protects your personal data under Korea's Personal Information Protection Act (PIPA) and handles related concerns promptly.
1. Data we process
| Category | Data | Purpose | Retention |
|---|---|---|---|
| Account (all members) | Email, display language, country of residence, date of birth, role (buyer, seller, business), login records (IP, device) | Running your account, preventing abuse, applying age and country rules | Until you leave (login records 3 months) |
| Social login (if used) | Provider account ID, email, name (if the provider sends it) | Login and linking accounts with the same email | Until you unlink or leave |
| Identity check (sellers, some buyers) | Only a one-way (hashed) value of the identity link (we do not store your name or resident registration number) | Stopping one person using many accounts, confirming age | Until you leave |
| Seller payouts | Bank account (encrypted), payout-provider payee data, data needed for tax withholding (Korean resident registration number — required by the Income Tax Act), tax-treaty forms | Paying royalties, withholding and reporting tax | 5 years after the transaction (Framework Act on National Taxes) |
| Channel (public) | Channel name, bio, profile picture | Showing the seller page | Until you leave |
| Business | Company name, website, contact person name and details | Business account, billing, contact | 5 years after leaving (transaction records) |
| Payments | Order and payment records (card numbers and PayPal account details are handled by the payment provider and not stored by us; for PayPal payments we also store the payer's country and a one-way (hashed) value used to tell whether the same payment method was used) | Payments, refunds, disputes, preventing payment fraud | 5 years (E-Commerce Act) |
| Consent records | Terms version, time, IP, device | Proving consent to terms and pledges | 5 years after the content or contract ends |
| Rights complaints | Complainant name and contact, complaint | Handling copyright complaints (Copyright Act Art. 103) | 3 years after the case closes |
| Creation-method reports | Reporting member, report and evidence link | Checking and correcting how content was made (e.g. AI-generated) | 3 years after handling |
| Usage signals | Views, likes, searches (visitors who are not logged in are told apart by a random number in the tid cookie) | Recommendations | 90 days |
| Content | Faces, voices and capture metadata (may include location) in your uploads | Selling and reviewing content; location metadata is removed before publishing | Until the content is taken down (proof of licenses sold is kept) |
| My Vault (private storage, for those who choose it) | Uploaded files (videos, photos, illustrations) and the information in them (faces, voices, capture location, etc.), titles, tags and descriptions, project names and descriptions, original-proof values (hashes) | Keeping files for you, proving originals, providing them to AI apps you connect | Until you delete them or leave (original-proof values left in public records are hashes only and contain no personal data) |
| API & AI connection logs | Time, action type and item per token or connection; token hashes only | Security and support | 1 year |
| Requests and inquiries | Email, request | Handling requests | 3 years after handling |
Where the law requires longer retention we keep data separately for that period: contracts, withdrawals, payments and deliveries 5 years; consumer complaints and disputes 3 years (Korean E-Commerce Act); login records 3 months (Protection of Communications Secrets Act).
Registration proofs (hashes, public records) never contain personal data.
1-2. My Vault (private storage)
- Files you upload with "Keep it private" never appear in listings, search, channels, previews, the business API or data requests. We provide them only to you and to AI apps you connect. We do not use stored files, or provide them to others, for training AI models, except to AI apps you connect.
- AI apps: Only if you turn on "Read My Vault" for an AI app connection (or a personal token) and choose which projects it can access do we provide files in that scope to that AI app. This is a provision made at your choice, and after it the AI app's operator handles the files under its own privacy policy. You can turn it off or disconnect at any time in Settings.
- Automated checks: When you store a file, we automatically check its format and scan for malware, and match it against lists of known illegal content (such as child sexual abuse material). No person looks at the file during this process. If it matches, we do not store or provide it and handle it as required by law.
- Operator access: We do not normally open private files. Staff may open one only when there is a basis such as a rights complaint, a legal request or an automated-check alert, and every access is logged (who, when, on what basis, which file) and reported to an internal officer.
- Moving to sale: When you change a stored file to "for sale", we then review its quality, faces, licence plates, harmful content, traces of others' content (logos, watermarks), background music and similarity to existing works.
- Minors: Until guardian consent is complete, minors cannot store files or turn on "Read My Vault" for AI apps. If guardian consent is withdrawn, new storage stops, "Read My Vault" is switched off for all AI app connections, and we notify the member and the guardian. Files already stored are not deleted, and the member can delete them.
2. Processors
| Processor | Task |
|---|---|
| Korea PortOne Co., Ltd. | Payment integration (connecting the checkout, confirming payment results, passing on refund requests) |
| PayPal Pte. Ltd. (Singapore) | Processing overseas payments (PayPal) |
| Resend (USA) | Login links and notification email (mail.trioly.app) |
| Amazon Web Services, Inc. (USA) | Content delivery network that the site, API and videos pass through (CloudFront) |
| Cloudflare, Inc. (USA) | Content and backup storage (R2), domain (DNS) and forwarding of inquiry mail (privacy@, rights@) |
| Vultr Holdings, LLC (US company, servers located in Seoul, Korea) | Service servers (database and processing) |
We will announce domestic payment and payout providers in advance and add them to this table on the day we start using them.
Social login provider — Google LLC (USA): when you log in with Google, it sends us the "Social login" data in table 1. We do not hand personal data to this provider or have it process data for us.
3. Sharing
We do not share personal data without consent or a legal basis, except where the service requires it:
- Overseas seller payouts: name, email and payout amount to Payoneer Inc. (USA) — USD payouts
- Content selected in a business data mission: the original file to that business (never the seller's contact details)
We never give a seller's name or contact details to businesses or buyers, and never put them in certificates or public records.
4. International transfers
To perform our contract with you we store and process personal data outside Korea as below (PIPA Art. 28-8(1)(3)).
| Recipient (contact) | Country | Data | When & how | Purpose | Retention |
|---|---|---|---|---|---|
| Amazon Web Services, Inc. (aws.amazon.com/privacy) | USA and other AWS edge locations (incl. Seoul — the one nearest to you) | IP address and request data | When you connect; network transfer | Site, API and video delivery | 3 months |
| Cloudflare, Inc. (privacy@cloudflare.com) | USA and other Cloudflare data-centre countries | Content files, backups (encrypted), inquiry mail | On upload, daily backups, when mail arrives; network transfer | Storage and mail forwarding | As in table 1 |
| Resend (resend.com) | USA | Email address, message | When sending email; network transfer | Email delivery | 3 months |
| PayPal Pte. Ltd. (paypal.com/privacy) | Singapore and other countries where PayPal processes data | Order number, amount and currency, item name (credit top-up) | When you pay with PayPal; network transfer | Processing overseas payments and refunds | Under PayPal's policy (payment records we receive: as in table 1, Payments) |
| Payoneer Inc. | USA | Overseas sellers' name, email and payout data | At payout | USD payouts | Payoneer's policy |
Our service servers (Vultr) and database are in Seoul, Korea.
You can refuse these transfers at privacy@trioly.app, but the related features (accessing the site and API, uploading content, overseas payouts, email login) will not work without them. You can refuse by not paying with PayPal. Overseas payments are currently available only through PayPal, so if you refuse, you will not be able to top up credits from outside Korea.
Where a country requires local storage, we keep its users' data in that country (none at present).
4-2. Children and minors
- Children under 14 cannot sign up and we do not knowingly collect their data; if we learn we have, we delete it without delay.
- For EU/UK residents under 16, and for minors who pay or sell, we obtain a guardian's consent and process the guardian's name, date of birth, relationship, email, identity-check value (hash) and consent record (time, IP, device) (kept until the member comes of age or leaves; contract records 5 years).
5. Deletion
Data is deleted without delay when the retention period ends; electronic files are erased so they cannot be recovered and paper is shredded. Data kept by law is stored separately.
6. Your rights
You (and the guardian of a minor who joined with guardian consent) may ask at any time for access, correction, deletion, suspension of processing, withdrawal of consent, and an explanation of automated decisions — via "My info" or privacy@trioly.app; we respond within 10 days. Data we must keep by law cannot be deleted.
7. Security
Encryption (bank accounts and secrets with envelope encryption, encryption in transit), least-privilege access with logs, isolated encrypted backups, isolated media processing, regular checks.
8. Cookies
We use cookies to keep you logged in (session cookie, 30 days), to remember your display language (trioly_lang cookie, 1 year) and, for visitors who are not logged in, a random number for recommendations (tid cookie, 1 year), and browser storage for your theme and an invite code (30 days). No advertising or tracking cookies. You can block cookies in your browser, but login may stop working.
9. Recommendations
We recommend your home feed from what you watch, like and search (for visitors who are not logged in, by the tid cookie). These records are deleted after 90 days.
10. Contact
Privacy officer: 김윤근 (CEO) · phone 010-9472-1204 · privacy@trioly.app. Rights (copyright) infringement complaints: rights@trioly.app. Reports and advice in Korea: Personal Information Infringement Report Center (118), Personal Information Dispute Mediation Committee (1833-6972), Supreme Prosecutors’ Office (1301), Korean National Police Agency (182).
11. Country notes
- EU/UK: our legal bases are contract, legal obligation, legitimate interest and consent; you may complain to your supervisory authority; transfers outside the EU rely on Standard Contractual Clauses. We will appoint an EU representative before accepting EU sellers.
- USA (incl. California): we do not sell or share personal data for advertising. We do not track you, so we do not respond differently to browser Do Not Track signals.
- Japan: for transfers to third parties abroad we disclose the recipient country and its data-protection regime.
- Taiwan: purposes, data, period, region, recipients and methods are in sections 1–4; your rights are in section 6.
12. Changes
Changes are announced 7 days ahead (30 days, also by email, for material changes). Earlier versions stay available on this page.
부칙
Effective November 10, 2026.
What changed from the earlier version (November 8, 2026 version): with overseas payments (PayPal) opening, we added Korea PortOne Co., Ltd. and PayPal Pte. Ltd. to the processors table and PayPal Pte. Ltd. to the international transfers table, and described the payer country and payment-method comparison value kept for PayPal payments. Domestic payment and payout providers will be added, with advance notice, when we start using them. We also added PayPal payments to how to refuse international transfers and what happens if you do.
If language versions differ, the Korean text prevails unless that would disadvantage you.