Privacy Policy

Rightis collects, uses, and safeguards the personal information of rights holders and brands as described below.

1. Personal data we collect

The Company collects the following personal information to operate the Service. [Required] - Email, password (encrypted) - Name or display name [Required when mobile carrier verification is used] - Name - Date of birth - Gender - Resident or foreign national status - Mobile number - Mobile carrier - Duplicate-registration information (DI) - Time and result of the verification These are collected through the mobile carrier verification service of NICE Information Service Co., Ltd. We do not receive connecting information (CI). Connecting information is the same value across every service, so it is used to link a person between services; all of the same-person checks we carry out happen inside our own records, so we receive only duplicate-registration information, which is valid inside our service alone. [When identity or rights need to be confirmed] - Face image: collected to confirm that a registered likeness is your own. - Identity document copy: collected only where mobile carrier verification is unavailable, with separate consent. Neither is collected as a matter of course. They are collected only when you go through that step. [When you register and match a portrait (NO FAKES and similar)] - Registration photo: the face photo you take or choose when registering your portrait - Face template values: numbers computed from the registration photo. There are two: values the app computes on your device (128 numbers), and a face index Amazon Web Services creates from the registration photo. - Identity-check captures: several face photos taken as instructed during identity verification - Copies of images found: copies of web images that match your registered face at 85% similarity or higher, with their address and the date found - Photos you upload to compare or search: used only while that request is processed, and not stored. The same applies to the two-face comparison and web search you can use without signing in. The Company does not receive device biometric data such as Face ID or depth data. [Optional] - Profile image, contact information - Asset data: voice samples, style references, persona responses, demographic information - Agency affiliation (agency managers) - Brand information: company name, contact name, inquiry purpose, expected usage scope [Automatically Collected] - IP address, browser and device information - Service usage logs and access records - Cookies and session tokens [Users under 14] People under 14 may use the Service. The law requires a legal guardian's consent, so we also collect: - The guardian's name - The guardian's contact details (mobile number or email) - When and how consent was given Guardian details are used only to confirm consent and to evidence that it was given. They are not used for anything else and are not disclosed to third parties. A guardian may withdraw their consent at any time and may ask to see, correct, or delete the child's personal data.

01 / 11

2. Why we collect it

We use the personal data we collect for the following purposes. 1. Identifying members and mobile carrier identity verification 2. Using duplicate-registration information (DI) to identify the same person and prevent duplicate accounts 3. Using date of birth to identify users under 14 and guide them through guardian consent 4. Preventing fraudulent sign-ups, duplicate reward claims, and abuse of the Service 5. Registering and reviewing rights assets 6. Receiving licence requests, running the rights holder approval workflow, and concluding contracts 7. Processing payment and settlement 8. Usage tracking, dispute reports and handling, asset suspension and appeals 9. Service notices (mandatory) and marketing information (where separately consented) 10. Responding to security incidents and improving service quality 11. Meeting statutory obligations 12. Face data: confirming that a registered portrait is your own, computing the similarity between a photo you upload and your registered face, checking public web images for ones that resemble your registered face (when you ask, and once a day if you turn on Face Watch), and keeping records and building reports 13. Answering public registry queries: for a portrait on the public list, when someone queries with face template values, we answer only whether it matches and what the rights holder has made public about what they allow. We never return the name, photos or face template values. Face data is never used for advertising, marketing, profiling, data mining or AI training, and is never sold.

02 / 11

3. Retention and use periods

The Company retains and uses personal information for the following periods. - Account data: until account closure - If a usage contract is still running or a settlement is unfinished: until that contract and settlement end. We then tell you, within 10 days of your deletion request, that this is the case, why, and how it can be resolved. - Guardian name and contact details: until the child turns 14 or the account is closed - Mobile carrier verification data (name, date of birth, gender, resident or foreign national status, mobile number, mobile carrier, duplicate-registration information (DI)): until account closure - Records of verification processing and use: for the period required by law or by our abuse-prevention policy - Re-registration block (duplicate-registration information (DI) and the closure time): 1 month after closure. Used only to block re-registration for one month and to stop sign-up rewards being claimed twice, then destroyed without delay. - Registered face (registration photo and face template values) and voice, identity-check captures, copies of images found, persona trait scores: until account closure. We have no duty to keep them, so they are destroyed when you leave. If you delete a single portrait, its face index is removed at once and it is no longer used for matching or queries; its photos and template values are destroyed when you leave. - Photos you upload to compare or search: not stored. They are discarded as soon as the request is processed. [Records kept after you leave] The records below are kept for a fixed period after you leave. They are held apart from other data, visible only to staff with legal or finance access, and no longer shown anywhere in the service. - Contract, withdrawal, payment, settlement and payout records: 5 years (E-Commerce Consumer Protection Act, Framework Act on National Taxes). Contract records keep the party's name as it was when the contract was made, and the persona code. - Tax ID: 5 years after closure, only if we actually paid you. Otherwise destroyed when you leave. - Consumer complaint and dispute records, report evidence: 3 years (E-Commerce Consumer Protection Act). Report evidence includes photos you attach when reporting, and those photos may show your face. - Consent records (what was agreed, wording version, when it was given and withdrawn, IP address and device) and when and how a guardian consented: 5 years after closure - Audit records (the record of what the Company did): 5 years after closure - Electronic financial transaction records: 5 years (Electronic Financial Transactions Act) - Access logs: 3 months (Communications Privacy Act) Kept data is used only for the purpose it is kept for and is destroyed when the period ends.

03 / 11

4. How personal data is destroyed

We destroy personal data without delay once its retention period ends or its purpose has been fulfilled. [Procedure] - Account closure or deletion request: submitted from the account deletion page in your rights wallet. You can cancel it yourself for 7 days. - When the grace period ends, unless a contract is still running or a settlement is unfinished, we go ahead without waiting for a member of staff, finish within 10 days of receiving the request, and tell you the result. If a contract or settlement means we cannot go ahead yet, we tell you within 10 days of the request that this is the case, why, how it can be resolved, and how to object. - Data with a fixed retention period: destroyed once that period ends. - Records the law requires us to keep: held separately for the periods listed in Article 3, visible only to staff with legal or finance access, used for no other purpose, and destroyed when the period ends. [Method] - Electronic files: deleted by a method from which they cannot be recovered. - Printed material: shredded or incinerated. [Records kept for a fixed time after you leave] Consent records and audit records prove what you agreed to and when, and what we did. They are kept for 5 years after you leave and then destroyed. They are not used for any other purpose. Write to support@rightis.org if you want to know where a destruction request stands.

04 / 11

5. Disclosure to third parties

The Company does not provide personal information to third parties without user consent. Exception cases: 1. Upon licensing transaction: with the rights holder's explicit approval, the minimum information required to fulfil the contract (rights holder's display name, asset identifiers, usage scope) is shared with the counterparty brand. 2. Where required by law, when investigative authorities or courts make a lawful request, disclosure proceeds under the prescribed procedure. 3. When urgent protection of life or safety is needed. Third-party disclosures are documented with the reason, items disclosed, and retention period. [What we give to services that share the Rightis account] Services you can sign in to with a Rightis account receive the following. 1. Account identifier 2. Social sign-in account details: email address, whether the email is verified, sign-in provider, nickname, profile image, account creation time, sign-up origin 3. Identity verification result: when it was completed, and the method used (mobile carrier verification or identity document) We do not give these services your name, mobile number, date of birth, gender, resident or foreign national status, mobile carrier, or duplicate-registration information (DI). We identify the same person and detect duplicate accounts ourselves, and pass on only the result. [What we receive from those services] Within the scope you agreed to on that service, we receive: 1. Account identifier, when you joined that service, profile completion status 2. Country and first-level region, interest categories, an activity score 3. Research panel answers: age band, gender, region, household, children, occupation, employment type, spending categories, channels, topics, frequency, preferred formats 4. Purpose consent records: which purpose, the wording version, the governing jurisdiction, and when it was given or withdrawn 5. Daily activity counts We do not receive raw survey answers, any amounts, settlement or bank account details, or precise location. [What those services collect themselves] Information a linked service collects from you directly to run its own service is governed by that service's privacy policy, for example a delivery address for a reward or a bank account for a payout. That information is not shared with us. A linked service may set its own eligibility rules according to what it does. The same Rightis account may therefore work on one service and not another; that service explains its own rule and the reason for it.

05 / 11

6. Processors and transfers abroad

The Company engages the following processors to run the Service. Each is bound by a processing agreement. [Vercel Inc.] - Scope: hosting, server-side execution, access logs - Processing location: Republic of Korea (Seoul) - Retention: until account closure [Supabase Inc.] - Scope: authentication, database, file storage - Processing location: Republic of Korea (Seoul) - Retention: until account closure [Amazon Web Services] - Scope: face image analysis and matching, image and file storage - Processing location: Republic of Korea (Seoul) - Retention: until account closure or completion of analysis [Google LLC] - Scope: public web image search (Google Cloud Vision). We send the photo you upload for a web search, or the registration photo used for web search and Face Watch. No name or contact details are sent. - Processing location: the United States and other countries where Google operates data centres. See the cross-border transfer notice below - Retention: only while the request is processed. Not stored afterwards [NICE Information Service Co., Ltd.] - Scope: mobile carrier identity verification and returning the result - Data processed: name, date of birth, gender, resident or foreign national status, mobile number, mobile carrier, duplicate-registration information (DI) - Processing location: Republic of Korea - Retention: until verification is complete, or for the statutory period that applies to the processor - This engagement applies from the date we actually offer mobile carrier verification. [Resend, Inc.] - Scope: transactional and notification email - Processing location: Japan (Tokyo). See the cross-border transfer notice below - Retention: 90 days after sending We announce changes to this list in advance and reflect them here. [Transfer of personal data abroad] - Recipient: Resend, Inc. (support@resend.com) - Data transferred: recipient email address and name, and the content of the message - Destination country: Japan - When and how: transmitted over the network at the moment a notification is sent - Purpose: sending transactional and notification email - Retention: 90 days after sending - How to refuse: you can turn off optional notifications in your rights wallet settings. Messages required to run the Service, such as contract and settlement notices, cannot be refused without limiting your use of the Service. - Recipient: Google LLC (Google Cloud data protection contact https://support.google.com/cloud/contact/dpo) - Data transferred: photos showing a face (the photo you upload for a web search, and the registration photo used for web search and Face Watch) - Destination country: the United States and other countries where Google operates data centres - When and how: transmitted over the network when you request a web search and when Face Watch runs its daily check - Purpose: finding public web images that resemble your registered face - Retention: only while the request is processed. Not stored afterwards - How to refuse: if you do not use web search and turn off Face Watch, nothing is transferred. Web search and Face Watch are then unavailable. Apart from Resend and Google, processing takes place inside the Republic of Korea.

06 / 11

7. Your rights

Users may exercise the following rights at any time. 1. Access: review the personal information on file 2. Correction: fix inaccurate information 3. Deletion and processing suspension: request deletion or pause processing 4. Withdrawal of consent: withdraw consent for optional items such as marketing 5. Data portability: download the user's data in a structured format How to exercise: - "My Account" menu inside the rights-holder or brand console - Email: support@rightis.org The Company processes requests within 10 days of receipt. Delays are communicated with the reason and expected handling date. If licensing transactions are in progress, deletion requests are processed after those transactions complete. [Decisions made automatically] The following are decided without a person involved. - Automatic licence approval: a request that fits the scope and minimum price the rights holder set in advance is approved automatically. The rights holder sets those limits and can change them at any time. - Misuse matching: registered likenesses and assets are compared against reported images to produce a similarity score. No penalty follows from that score alone; an operator reviews the evidence before any action such as suspending an asset. - Survey answer scoring: answers are scored on form and diligence to decide acceptance. The substance of an answer is not judged. If you believe one of these went against you, write to support@rightis.org to ask for an explanation or a review by a person. We will explain the basis and look again.

07 / 11

8. Security measures

The Company applies the following technical and managerial safeguards to protect user data. [Technical] - AES-256 encryption for passwords and rights data at rest - TLS 1.2 or higher on every transport - IP allow-listing and certificate-based access controls on database connections - Periodic vulnerability scans and patches [Managerial] - Role-based access control for operators - audit_log capture of every operator action (5-year retention) - Regular training for personnel who handle personal information - Internal security policy and incident-response procedure [Incident response] - In the event of a personal data breach the Company notifies data subjects and the relevant authorities within 24 hours.

08 / 11

9. Cookies

The Company uses cookies for the following purposes. - Maintaining sign-in sessions - Storing language preferences and user environment - Service usage statistics (e.g. which pages are visited) The Company does not use advertising or third-party analytics cookies. Users may disable cookies in browser settings (e.g. Chrome, Settings, Privacy). Some features (session retention, language preference) may be limited as a result.

09 / 11

10. Data protection officer and how to seek redress

The Company designates a data protection officer who oversees personal-data processing and handles inquiries, complaints, and remediation. - Name: Jace BAE - Department: The Backers Inc., Operations - Email: support@rightis.org Please direct privacy-related inquiries, complaints, or reports to the contact above. Reports may also be submitted to the Korea Internet & Security Agency (KISA) Privacy Complaints Center at privacy.kisa.or.kr or 118 (domestic call). If you are not satisfied with how we handled your request, or you want further help, you can contact: - Privacy Infringement Report Centre: privacy.kisa.or.kr / 118 - Personal Information Dispute Mediation Committee: kopico.go.kr / 1833-6972 - Supreme Prosecutors' Office Cybercrime Division: spo.go.kr / 1301 - National Police Agency Cyber Bureau: ecrm.police.go.kr / 182

10 / 11

11. Changes to this policy

Material changes to this policy are communicated as follows. - General changes: announced through the Service and by registered email at least 7 days before the effective date - Changes unfavourable to users (additional data collection, longer retention, broader third-party disclosure): announced at least 30 days in advance Before the Service formally launches, however, a change may take effect on the day it is announced; the fact and content of the change are still announced the same way. The Company makes the change history available inside the Service. Users who disagree with a change may close their account.

11 / 11

Last updated: 18 October 2026