Onki Privacy Policy

This policy explains how Cluver Inc. ("we", "us"), a company incorporated in the Republic of Korea, processes personal data when you use the Onki service. We wrote it to be readable; the design principle behind the Service is to process as little personal data as possible, for as short a time as possible.

1. Who is responsible

  • Data controller: Cluver Inc., Republic of Korea
  • Contact: jaekoo.choi@cluver.biz · https://iframe.kr

2. What we process, and why

  • Household name and phone number — registering the frame; letting family connect by number. Legal basis: contract (Art. 6(1)(b) GDPR).
  • WhatsApp ID and profile name of senders — delivering photos, showing who sent them, replying in the chat. Legal basis: contract.
  • Photos, videos, captions — delivery to the frame; reading captions aloud. Legal basis: contract.
  • Device information (model, app version, network type, language, time zone) — operating and troubleshooting the frame. Legal basis: legitimate interest (Art. 6(1)(f)).
  • One-time approximate location (only if you grant permission) — showing local weather on the frame. Legal basis: consent (Art. 6(1)(a)), revocable at any time.

We do not sell personal data and do not use it for advertising.

3. What we deliberately do not collect

  • No microphone. The store version of the app does not request or use microphone access at all.
  • No continuous location tracking. Location, if granted, is read once to set up local weather; the frame does not track movement.
  • Face detection never leaves the device. The frame detects faces locally on the tablet only to position photos nicely on screen. No biometric data is created, stored or transmitted to our servers.
  • No message content beyond what you send to the frame. We receive only the messages your family sends to the Onki WhatsApp number.

4. How long we keep data

  • Photos and videos: our servers are a relay, not an archive. A copy is kept only to deliver the Content to the frame, and is deleted from our servers within approximately 30 days after the frame has confirmed receipt. After that, the Content exists only on the frame device in your family's home and on the sender's own device.
  • Names, phone numbers, addresses and messaging IDs are stored encrypted (searchable only via keyed blind indexes) and are deleted when the household account is closed.
  • Operational logs are kept for up to 12 months for security and troubleshooting, then deleted.

5. Where data is processed

Our servers are located in the Republic of Korea. The European Commission has recognised the Republic of Korea as providing an adequate level of data protection (adequacy decision under Art. 45 GDPR, adopted 17 December 2021 and confirmed on periodic review). Transfers to our servers therefore do not require additional safeguards.

6. Service providers (processors)

We use the following categories of providers to operate the Service:

  • Messaging platforms chosen by your family to send photos (e.g. Meta Platforms for WhatsApp) — governed by their own terms and privacy policies for your use of their apps;
  • App stores for subscription billing (Apple, Google) — we never see your payment card details;
  • Push notification delivery (Google Firebase Cloud Messaging);
  • Server hosting in the Republic of Korea.

7. Children

Photos sent by family members may show children. The family member who sends a photo is responsible for being entitled to share it. Children's photos are treated exactly like all other Content — relay delivery, prompt server-side deletion, display only on the family's own frame.

8. Security

Personal identifiers are encrypted at rest; traffic is encrypted in transit (TLS); photo access requires per-device credentials; access to production systems is restricted. If a breach is likely to result in a risk to you, we will notify the competent supervisory authority within 72 hours and inform affected users without undue delay.

9. Your rights

Under the GDPR you may at any time request access to, rectification or erasure of your personal data, restriction of processing, data portability, and you may object to processing based on legitimate interests. Where processing is based on consent, you may withdraw consent at any time.

To exercise these rights, contact jaekoo.choi@cluver.biz. You also have the right to lodge a complaint with your local data protection supervisory authority.

10. Changes

If we change this policy in a way that affects you materially, we will inform you through the app or the store listing before the change takes effect.

Cluver Inc. · jaekoo.choi@cluver.biz · https://iframe.kr