Regional availability

New registrations in the EEA and UK are temporarily restricted because appointment of local representatives has not yet been completed. Registration will reopen after we announce the representatives and regional launch; these Terms as then published and applicable mandatory laws will govern use in those regions. Existing-account sign-in is not restricted. Regardless of registration availability, this Privacy Policy and applicable statutory rights continue to apply to personal data already processed.

1. Controller

Operator: 별내림(Byeolnaerim) / Representative: 김주형 / Address: 경기도 안성시 서인동 13-21 코워크시티 안성서인1호점 2층 S10호, Republic of Korea / Email: [email protected] / Phone: 010-9273-7837. Privacy Officer: 김주형 / [email protected] / 010-9273-7837. 별내림(Byeolnaerim) is the controller, or equivalent responsible entity under applicable law, for the Dollippo processing described here.

2. Personal data we process

• Account and profile data, including account name, securely hashed password, nickname, email, country, profile image, and optional profile information.
• Social sign-in identifiers and permitted profile or email information from Google, Naver, Kakao, or another provider you choose.
• Game and service activity such as selected or collected 3D prizes, game progress, settings, views, reactions, reports, community posts and comments.
• AI data such as text prompts, reference images, generation requests and output, thumbnails, and limited metadata used for classification, search and moderation.
• Public-source provenance data from services such as Meshy Community, including creator UID, nickname, avatar URL, original content identifiers, license and source metadata used for attribution and rights management.
• Payment data: products, quantities, order and transaction identifiers, status, amount, currency, store product IDs, delivery/use/refund ledgers and purchase-term acknowledgement. Purchase tokens verify store payments; we do not directly store full card numbers.
• Private support data: category, subject, Editor message, replies, processing times and account linkage, visible only to the owner and authorized staff.
• Technical and security data such as IP address, user agent, login and security events, request identifiers, access and error logs, and records of policy acknowledgement.
• Advertising-related data processed by advertising partners when ads are enabled, such as cookies or similar identifiers, ad impressions and clicks, IP address, user agent, approximate location, and information used for delivery, measurement, fraud prevention, and consented personalization.

3. Purposes

• Create, authenticate, secure and manage accounts and respond to support requests.
• Provide game progress, 3D content discovery, storage, display and requested service features.
• Provide AI-powered 3D generation, content classification, search assistance, translation and moderation.
• Operate community features, process reports and rights complaints, and prevent spam or abuse.
• Protect security, diagnose failures, generate statistics and improve service quality.
• Provide and measure advertising and, where required, personalize ads with consent.
• Comply with law and establish, exercise or defend legal claims.

4. Retention and deletion

We delete or de-identify personal data when the purpose is complete or the applicable retention period expires. Data required by law may be kept separately for the legally required period.

• Payment records are restricted to applicable legal periods. Korean contract/withdrawal and payment/supply records are retained for five years, with necessary extensions for disputes or legal holds.
• Private inquiries and complaint records are retained for three years from submission or the latest reply, then deleted. Direct account linkage may be removed on account deletion.
• Core account data: while the account remains active, then ordinarily deleted on account closure.
• Login records: 180 days from creation.
• Account security events: 365 days from occurrence.
• Personal-data access audit records: 730 days from occurrence.
• Minimal deleted-account snapshot: 30 days after closure for integrity checks and recovery, then deleted.
• Terms and privacy acknowledgement records: while the account is active and up to 1,095 days after account closure for dispute and compliance evidence.
• Public community or public 3D content: may remain until deleted by the user or removed for operational or legal reasons; direct account linkage may be removed after account closure.
• Temporary AI job data and processing logs are kept only as long as reasonably necessary to provide the feature, secure it, and troubleshoot failures. Generated content intentionally saved or published may remain until the user deletes it.

5. AI providers and automated processing

When AI 3D generation is available, text prompts, reference images and generation settings may be sent to the Meshy API. Meshy's own terms, privacy notice, and the conditions of the operator's Meshy account or plan may apply to Meshy's processing.

We may use the OpenAI API to classify 3D thumbnails and text metadata, generate search keywords, translate content, or assist moderation. OpenAI states that API business data is not used to train its models by default and that abuse-monitoring data may be retained for up to 30 days under standard API settings.

Only private-inquiry titles may be sent to the OpenAI API for Korean translation for the operator list; originals are retained. Inquiry bodies and administrator replies are not sent for automatic translation.

AI is used as an assistive processing tool. The current Services are not designed to make high-impact automated decisions that directly determine a person's legal rights or similarly significant interests.

6. Service providers and international processing

Because the Services are global, personal data or data containing personal information may be processed outside the Republic of Korea. We update this Policy when the providers or material processing arrangements change.

• MongoDB Atlas for account, community, game and service data storage.
• Cloudflare R2/CDN for 3D models, images and static-object storage and delivery.
• Meshy for user-requested AI 3D generation and related processing.
• OpenAI for classification, search assistance, translation, moderation or other AI-assisted processing.
• Web payment providers enabled at checkout, such as Stripe, PayPal, Xsolla, Tebex or Paddle, and Google Play or Valve (Steam), for payment, verification, disputes and refunds. Their independent processing is also covered by their privacy notices.
• Google, Naver and Kakao for social sign-in selected by the user.
• Google Gmail SMTP or similar mail infrastructure for verification and service email delivery.
• Google AdSense or other advertising partners, when enabled, for ad delivery, measurement, fraud prevention and consented personalization.

7. Cookies and similar technologies

We may use cookies, localStorage and similar technologies for sessions, security, language and theme preferences, advertising delivery and measurement. Non-essential technologies that require consent under applicable law are used only through the applicable consent process. See the Cookie Policy for details.

8. Security

We use reasonable technical and organizational measures such as access controls, authentication and authorization checks, transport protection, one-way password hashing, audit and security logs, data minimization, and retention controls. No system can guarantee absolute security.

9. Your rights

Depending on applicable law, you may have rights to access, correct, delete, restrict or object to processing, withdraw consent, obtain data portability, or complain to a supervisory authority. Contact the Privacy Officer for requests not available directly through account controls. Reasonable identity verification may be required.

10. Children

Account features are generally intended for users aged 14 or older, and the Services are not designed to intentionally collect personal data from children below that age without legally valid parental authorization. Higher local age thresholds or additional consent requirements apply where required.

11. Contact and changes

Privacy requests: 김주형 / [email protected] / 010-9273-7837. Material changes to this Policy will be announced through reasonable means before they take effect, and the current version and effective date are shown here.

Rights claim information and account deletion

Rights reports collect name, contact email, rights holder information, original and disputed URLs and descriptions, electronic signature and declarations. These are used for intake, authority checks, contact, appeals and disputes, and are deleted 3 years after submission, subject to separate legally required retention. A hash of the submitting IP address is processed for up to one hour to prevent abusive submissions.

Request account deletion via the Delete account button in Edit profile or at /account-deletion. If you cannot sign in, contact [email protected]; ownership is verified before processing. Service data is deleted, anonymized or removed from public display, while legally retained, transactional, security and dispute records follow the periods in this policy.