silk cave

Privacy Policy

Effective date: October 20, 2026

Notice of upcoming revision

Announced October 9, 2026. Changes concerning Resend's email processing and overseas transfers are scheduled to take effect October 17, 2026. Section 4 lists transferred data, retention and refusal methods. Before then, notifications are provided in the console, with no Resend notification emails sent.

Announced on October 13, 2026. The following amendments take effect on October 20, 2026. The previous policy took effect on October 7, 2026.

  • Brand settings: the data processed is reduced to logos and brand colors, and the injection and content-suitability validation of brand settings, along with the transfer to OpenAI for that validation, is discontinued. The brand color is included in the request when generating a try-on image. Previously stored visual directions, reference images, sharing images and dark-mode logos are no longer used and, instead of being replaced or removed in the console, are deleted when the site is deleted or operations cleans them up.
  • Overseas transfers (OpenAI): brand logos, visual directions, reference images and approved styles are removed from the transferred data, and the site's brand color is added.
  • Try-on memory: “Remember in this browser for 30 days” is removed, and memory is kept only in this tab. Records left after the tab is closed and previously enabled 30-day records are deleted when you open the try-on screen in that store again; until then, they remain in this device's browser.
  • Sharing results: the original product page address is passed instead of a share link.
  • Consultation requests: instead of being deleted when the Operator creates a site, they are deleted when the consultation ends, whether or not a site was created.
  • Order information: applies to paid plan orders instead of the Basic plan.
  • What installed tags keep: store-origin browser storage no longer holds whether the launcher was folded, and the try-on history of this tab adds the fixes chosen when trying again.
  • Language choice: pages can be shown in Korean, English, Japanese and Simplified Chinese, and your language choice is saved in this browser's local storage. In a store's try-on, the preference is separate for each site. It creates no cookies and sends no entered text or photos to a translation service.

Announced on October 12, 2026. The amendments concerning business account inquiries and customer support requests in the store try-on screen are scheduled to take effect on October 19, 2026. Section 1 describes the information processed and its purposes; section 2 covers retention; section 4 covers overseas transfers of reply emails; and section 7 covers browser storage. Neither channel will open before the effective date.

Silk Cave (the Service) adds virtual try-on to store product pages with one tag. Its operator (the Operator) complies with applicable laws, including Korea's Personal Information Protection Act, and explains personal information handling in this policy.

This policy applies to silkcave.com, its console and demo store, and Silk Cave tags installed in stores. For try-on on a store's product pages, the store is the data controller and the Operator processes try-on image generation on its behalf. The store's privacy policy also applies.

1. Personal information and purposes

Console login (Google account)

  • Data: email address, email verification status and Google account identifier provided by Google, plus last login time.
  • Purpose: verify business accounts and operators, maintain login and site membership.
  • An account is created at first login. Site roles and billing contact assignments are also retained.

Business account registration

  • Data: contact name, brand name, phone number (optional), and time of consent to the Terms and Privacy Policy.
  • Purpose: identify and address business accounts, and contact them when payment verification or installation guidance is blocked. Registration must be completed with the signed-in Google account before console use.
  • Notification emails: trial, installation verification, orders, payments, expiry and operations changes are sent to billing contacts' and administrators' login emails. Messages contain console links, with no photos, tokens or original requests. Console notification titles and bodies are retained. Separate send-queue records store notification/account identifiers, kind, times, attempts and failure classes. Recipient addresses are read from accounts at send time. Provider retention is in Section 4.
  • Order information (paid plan orders): payer name; company name and business registration number when a tax invoice is requested; dates and amounts of orders, payment reports, payment confirmations, cancellations and refunds. Purposes: verify bank transfers, apply plans, issue tax invoices and record refunds. We do not collect card or bank account details; you transfer directly to the account provided.
  • Console audit records: actor account identifier, action, target identifier, time and the operator's reason. Used only to identify who changed what; no email addresses or photos.

Inquiries (business accounts; effective October 19, 2026)

  • Information: inquiry category, subject and message; attached images such as screenshots; the page path where the inquiry was made, without its query; browser type; author account identifier; and timestamp.
  • Purpose: reviewing and answering inquiries and resolving installation, payment and service issues. Site inquiries are visible to that site's members; inquiries without a site are visible only to their author.
  • Images are re-encoded to remove metadata before storage. Replies trigger a console notification and an email to the author's login address; the email does not contain the inquiry text.

Request consultation

  • Data: brand name, store URL, platform and email address.
  • Purpose: confirm and reply to applications, and provide introduction consultations.

Virtual try-on

  • Data: uploaded customer photo or chosen avatar (a preset based on skin tone, face shape, glasses, hairstyle and one of three body shapes; no height or weight), product image, generated try-on image and customer instructions.
  • Purpose: generate and display try-on images.
  • Photos are re-encoded before storage to remove metadata such as shooting location. Instructions are used only for generation and not stored on the server.

Customer support requests (store try-on screen; effective October 19, 2026)

  • Information: request category and message; attached photos; a try-on image the customer chooses to attach, excluding the original photo, and its product page path; device type; an optional reply email address and consent timestamp; and the hash of the device identifier.
  • Purpose: reviewing and answering try-on error, quality and privacy inquiries, and forwarding matters to the store without photos or email addresses. The Operator receives and answers requests directly. No reply is sent when the email field is empty.
  • Order, shipping, exchange and refund matters are referred to the store's customer service. Photos are re-encoded to remove metadata before storage.

Brand settings

  • Data: logos uploaded by site administrators and brand colors set by site members
  • Purpose: show the logo in the installed Tag's header and use the brand color for Tag buttons and the background tones of try-on images
  • The logo is public to visitors and is not sent for AI processing. If a brand color is set, it is included in the request when generating a try-on image.

Information generated during use

  • Device identifier: the tag creates a random browser value; only its hash is stored on the server. Used to count guest usage limits.
  • IP address: used only to count rate limits preventing abuse. The original address is not stored; only a hash made with a server secret is stored.
  • Usage records: tag events (site, page path without query, placement, stage and time). They contain no identifying personal information and show stores their usage. Raw records are deleted after 7 days.

2. Retention and deletion

Store preview, drafts and reviews process submitted public product URLs, titles, platforms, placement measurements, preview HTML/product images and review screenshots. Pages are opened without login or cookies to propose and inspect placements. Do not submit URLs containing login information or customer photos.

  • Customer photos, product images and try-on images: automatically deleted 24 hours after upload; customers can delete them earlier.
  • Guest sessions and device hashes: sessions 24 hours; device-limit calculations up to 32 days.
  • Console sessions: business console 8 hours, operations 2 hours.
  • Console audit records: 1 year.
  • Public preview HTML/product images and review screenshots: 24 hours. Processing records: 30 days. Rate-limit address hashes: 48 hours. Preview documents, images and screenshots are not backed up.
  • Console account (email, Google identifier, last login time) and registration data (contact, brand, phone, consent time): while the account exists. The Operator handles deletion requests; billing contacts must transfer responsibility to another administrator first.
  • Order data: while the site exists, deleted with the site. Operations separately retains tax invoice records for the period required by tax law.
  • Brand settings: logos and brand colors are kept until replaced, removed or the site is deleted. Brand colors copied into work are deleted when that work expires. Previously stored visual directions, reference images, sharing images and dark-mode logos are no longer used and are deleted when the site is deleted or operations cleans them up.
  • Consultation requests: deleted when the consultation ends. Deletion requests are honored without delay.
  • Customer support requests (effective October 19, 2026): photos and attached try-on images are deleted 30 days after receipt; email addresses 30 days after closure; and request text after one year, without photos or email addresses. Photos are not backed up.
  • Business account inquiry text and images (effective October 19, 2026): kept for one year after closure, or deleted along with the site or account. Images are not backed up.
  • Server logs: rotated and deleted within capacity limits. No photos, instructions, emails or tokens are logged.

Deletion removes storage files and database records. Deleted information may remain in server/database backups until their retention expires. Information legally required to be retained is stored separately for that period.

3. Third-party disclosure

The Operator does not disclose personal information to third parties, except where authorized by law or requested by investigative authorities through lawful procedures.

4. Processing providers and overseas transfers

The Operator outsources the following tasks to provide the Service.

  • Vultr: server hosting. Servers are in Seoul, Republic of Korea.
  • OpenAI: virtual try-on image generation
  • Resend (Plus Five Five, Inc.): business account transaction, installation and account notification emails (effective October 17, 2026), and reply emails to customers who requested a response through customer support (effective October 19, 2026).

Personal information is transferred overseas to generate try-on images as follows.

  • Recipient and contact: OpenAI, contact listed in the OpenAI Privacy Policy.
  • Destination country: United States.
  • Transferred data: customer photos or avatar images, product images, instructions and the site's brand color
  • When and how: sent over an encrypted connection when the customer selects Try on
  • Purpose: try-on image generation
  • Retention: under OpenAI's API data policy, data may be retained up to 30 days for abuse monitoring; it is not used to train models.
  • How to decline: no such transfer occurs unless you select Try on. In that case, virtual try-on is unavailable.

Overseas transfer for notification emails (scheduled for October 17, 2026)

The following is disclosed under Article 28-8(1)(3)(a) of Korea's Personal Information Protection Act for outsourced processing/storage needed to deliver notices for account and service contract formation/performance. This basis does not apply to advertising or marketing emails.

  • Recipient/contact: Plus Five Five, Inc. (Resend), support@resend.com.
  • Destination country: United States.
  • Transferred information: recipient email address, notification subject and body, console link, sending identifier, timestamp and delivery status. Customer support reply emails (effective October 19, 2026) contain the address provided by the customer and the Operator's reply text. Email bodies do not contain Google account identifiers, customer photos, original AI generation requests, deposit accounts or API keys.
  • Timing and method: sent or retried after notifications about trials, orders, payments, periods, invitations, installation, inspections or inquiry replies, and when the Operator answers a customer support request, over a TLS-encrypted SMTP connection.
  • Purpose: delivering business notifications and requested replies, checking delivery status, and preventing sending errors and abuse.
  • Retention: on Resend's standard plans, emails/logs for 30 days and backups for 7 days. Remaining customer data is deleted within 90 days after account termination.
  • Subprocessors and safeguards: Resend uses AWS and other subprocessors. See Subprocessor list and Security and retention policy for the current list and safeguards. Storage is in the United States regardless of sending region.
  • Refusal and effect: before or after the effective date, contact rlaaudgjs5638@gmail.com to request suspension of overseas processing or account deletion. The Operator stops sending and explains the process. Email notifications will stop; console notifications remain available while the account exists. Already transferred information follows deletion requests and the retention periods above. Leaving the email field empty in a customer support request means no reply email or overseas transfer of that email.

5. Google user data

The console requests only openid and email scopes during Google login. It receives only email address, verification status and Google account identifier for identity verification and account maintenance. The email is also the recipient address for account, transaction and installation notices disclosed in Section 4.

  • This information is not sold. Outsourced processing needed for the Service is limited to Section 4's disclosed scope.
  • Not used for advertising or AI model training.
  • Stored in the Operator's database, with retention/deletion as specified for console accounts in Section 2.

Silk Cave's use and transfer to other apps of Google API information complies with the Google API Services User Data Policy, including its Limited Use requirements. You can revoke Silk Cave access anytime through your Google account's Third-party connections.

6. Your rights and how to exercise them

You may request access, correction, deletion or suspension of processing of your personal information at any time by contacting rlaaudgjs5638@gmail.com. After verifying your identity, we respond and report the result within 10 days. Requests may also be made through a legal representative or authorized agent.

Try-on photos can be deleted in the sheet and are deleted after 24 hours regardless. Contact the store or Operator regarding try-on used at a store. Children under 14 must not upload photos or request consultations without a legal representative's consent.

7. Cookies and browser storage

  • The console uses one login cookie per area: silkcave_console expires after 8 hours and silkcave_ops after 2 hours. Page scripts cannot read them; they are sent only on requests to their area.
  • Installed tags use no cookies. Store-origin browser storage holds a device identifier. Tab-scoped storage holds guest session, tab marker and try-on history (job IDs, product names, image/page URLs, category, the fixes chosen when trying again and progress; no photos, instructions or result images). Other storage values used by the store are neither read nor deleted.
  • Try-on memory: your selected photo or avatar, and each product's clothing category and instructions, are stored in the store origin's browser storage (IndexedDB) for this tab only. They remain when you visit other product pages in the same tab and are deleted when you open the try-on screen in that store again after closing the tab; until then, they remain in this device's browser. Records previously saved with Remember for 30 days are also deleted at that time. Reset fitting settings to delete them immediately, or clear the store's site data in your browser settings.
  • Sharing results: Share in the sheet passes the result image file and the original product page address to your device's sharing feature, which sends them directly to the app you choose, such as KakaoTalk or Instagram. The address contains no customer result photo. The operator does not create or store public sharing copies of customer results. Shared or saved images remain with recipients and their apps; their retention is independent of the operator's 24-hour deletion.
  • Customer support requests (effective October 19, 2026): only the most recent request number is kept in this tab's sessionStorage and shown when reopened. It is deleted when the tab closes.
  • Pre-registration placement preview URLs and adjustments are stored in this tab's sessionStorage to continue applying after login. They are deleted when the tab closes, are not restored after 24 hours, and the draft is removed after successful application.
  • Your language choice is saved in this browser's local storage. In a store's try-on, the preference is separate for each site. It creates no cookies and sends no entered text or photos to a translation service.
  • No advertising or behavioral analytics cookies or tracking tools are used.
  • You can clear or block cookies and storage in browser settings. Blocking cookies prevents console login.

8. Security measures

  • All communications require encrypted connections.
  • Only hashes of login session tokens and device identifiers are stored, not originals.
  • Server access requires key authentication. Server secrets are kept in separate access-restricted files.
  • Access to personal information is limited to operators.

9. Privacy contact

Contact below for personal information questions, complaints or remedies.

You may also report privacy violations or seek advice from these agencies.

  • Personal Information Dispute Mediation Committee: 1833-6972, www.kopico.go.kr
  • Privacy Infringement Report Center: 118, privacy.kisa.or.kr
  • Supreme Prosecutors' Office: 1301, www.spo.go.kr
  • Korean National Police Agency: 182, ecrm.police.go.kr

10. Policy changes

Policy changes and their effective date will be announced here at least 7 days in advance.