Privacy terms for trusted cultural exchange.

Data we collect

Account identity, social-login references, verified phone status, school or work affiliation-verification metadata, profile details, interests, posts, comments, chat and call lifecycle metadata, structured peer references, profile-view analytics, buddy-discovery impression analytics, friendship-funnel milestone analytics, reports, blocks, device registrations, consent records, safety moderation/throttle metadata, identity-verification metadata, Korea residency verification outcomes, and subscription entitlement state.

Voice and video calls

Saii stores the participants, conversation, voice-or-video mode, lifecycle status and timestamps, and accepting device needed to ring and complete a call. WebRTC audio and video is encrypted in transit and travels directly between participants when possible or through a TURN relay; Saii does not record raw call audio or video.

Connection signaling, including SDP and ICE candidates that can contain network addresses, is transiently buffered by the Action Cable database and may remain recoverable longer through database backups or point-in-time recovery. Separately gated quality telemetry is disabled by default. If approved and enabled, it stores bounded connection metrics tied to call, conversation, and actor IDs, never raw media, SDP, device tokens, phone numbers, or private message or profile content.

School and work email verification

The full email address and one-time code are encrypted only while Brevo delivers the verification email, then redacted. We retain a masked address, keyed digest, domain, verification status, review history, and expiry so we can prevent duplicate claims and show an accurate organization email badge.

Face verification: collection and use

Saii may require face verification before an account can continue using the service as a safety measure. When it is not required for an account, it remains optional. Before each check, the Saii native app asks for biometric-processing consent, then uses the front-facing camera to capture and stream a short selfie video directly to Amazon Rekognition Face Liveness in the AWS Tokyo region (Japan). The face data processed for this check includes the video frames, a reference image selected from the video, a provider session identifier, and a liveness confidence result.

Saii uses this data only to check whether the capture appears to come from a live person, return the verification result, grant the Photo Verified badge when the check passes, enforce a required check where applicable, and prevent repeated or abusive attempts. Other members can see only the badge, not the capture, reference image, score, requirement status, or result details. Saii does not compare the capture with your profile photo, use it to determine your legal identity, add it to a face-recognition database, sell it, or use it for advertising, marketing, member profiling, or tracking.

Face data sharing and protection

Saii shares face data only with Amazon Web Services (AWS), acting as Saii's service provider and processor, so AWS can perform the Face Liveness check in Japan. Saii does not share face data with other third parties. The video is encrypted in transit, AWS encrypts session data at rest with Saii's customer-managed key, Saii requests zero audit images, and Saii does not configure an Amazon S3 output bucket for reference or audit images.

Saii requires AWS, and any provider subprocessors that handle the data, to provide the same or equal protection for face data as this Privacy Policy and Apple's privacy rules require. They may process the data only to provide, secure, and maintain the verification service, or as required by law, and may not use it for their own advertising or transfer it to another party for an unrelated purpose.

Face data retention

An AWS Face Liveness session expires three minutes after its session identifier is issued. At expiry, AWS makes all Face Liveness data associated with that session, including the video, reference image, and session results, unavailable. Saii does not save the video, reference image, faceprint, face vector, audit image, or numerical confidence score in its database, logs, or file storage.

Saii retains only non-image verification metadata: the provider and expired session identifier, pass/fail or technical status and reason, decision-policy version, timestamps, consent version, acceptance time, source and request IP address, processing region, registered device identifier, and a separate keyed IP-address digest used for rate limiting. We retain this metadata and the badge while your account remains active so we can show the badge, enforce retry limits, investigate abuse or errors, and demonstrate that the check followed the recorded consent and decision policy.

Revoking consent and deleting face data

You can cancel before completing a capture, and no further face data is collected unless you start another check. If face verification is required for your account, you cannot continue using Saii until a check passes; otherwise you can refuse without losing access. To revoke consent for future face verification, remove the badge, or delete Saii's retained face-verification consent and result metadata without deleting your account, email privacy@saii.kr from the address connected to your account. If the requirement still applies after deletion or revocation, the account returns to the verification step before normal use can continue.

The raw video, reference image, and provider result become unavailable automatically when the three-minute AWS session expires, so Saii has no retained copy of that face data to delete afterward. Revocation applies to future checks and cannot undo processing already completed during an expired session. You may also delete your entire account from Settings & Privacy; after the 30-day recovery window, Saii deletes the face-verification metadata, consent record, and badge with the account, subject only to records we must retain for security, fraud prevention, dispute handling, audit integrity, or legal obligations.

Profile-view analytics

Public profile opens are stored as one aggregate row per viewer and viewed profile, including view count and last-viewed time. These include profile views you made and profile views received.

Buddy-discovery analytics

When Saii shows signed-in members a buddy directory, it stores the viewer and shown account identifiers, an opaque request identifier, one-based position, algorithm version, experiment group, bounded reason codes, an optional bounded score, and the time shown. This is used to balance exposure and measure whether recommendations lead to safe, reciprocal conversations.

These rows do not copy names, contact details, profile text, interests, language lists, photos, messages, birthdates, gender, nationality, device identifiers, or location. They are deleted after 30 days and removed immediately when either member requests account deletion.

Friendship-funnel analytics

Allowlisted milestones such as completed onboarding, useful profile discovery, reciprocal chat, event or meetup participation, and confirmed attendance are stored with coarse role, service-language, catalog-city, and affiliation-type snapshots. Names, contact details, message bodies, profile text, organization names, and raw event or conversation identifiers are not stored in analytics context. These records are removed when you request account deletion.

Optional onboarding insights

If you turn on Share onboarding insights, Saii sends the onboarding step name and client platform to Google Analytics. Saii does not send your name, account ID, contact details, profile answers, messages, precise location, or provider identity in these events. This is optional, off by default, and can be turned off in Settings & Privacy.

Advertising measurement (Meta)

Saii's iOS and Android apps include the Meta (Facebook) Core SDK so Saii can measure whether Facebook and Instagram ads led to app installs and registrations. The SDK sends to Meta Platforms, Inc. (outside Korea) app-install and app-launch events, a registration-completed event, device model, operating system and app version, language, time zone, and the IP address of the connection.

Saii does not collect or send the device advertising identifier, does not show the iOS tracking prompt, and never sends names, email addresses, phone numbers, account IDs, profile answers, messages, or location in these events. On Android, Saii also reads the Google Play install referrer once after installation to record which campaign led to the install.

Saii keeps the install campaign fields it decrypts, linked to your account once you register, for up to 13 months so it can report which campaigns bring members; it never shares those records back with Meta.

You can opt out through iOS Settings → Privacy & Security → Tracking or Android Settings → Google → Ads → Delete advertising ID. Read Meta's privacy policy.

Verified peer references

After a trusted two-way chat or confirmed attendance together, a member may choose one to three predefined positive traits about another member. We retain the author, recipient, selected traits, and the verified chat, event, or meetup used as provenance. Public profiles show only combined trait counts and broad provenance; the recipient can privately see the author, hide or report a reference, and the author can update or withdraw it. Free-text references and public negative ratings are not collected.

Sensitive-data processing

Identity verification is vendor-SDK based. Rails stores verification metadata only, rejects direct document uploads, and keeps production KYC provider work behind the post-review webhook boundary. The Face Verification sections above describe the separate AWS Face Liveness data flow in full.

Provider and billing posture

Premium access, calling, push delivery, and identity checks use provider boundaries so sensitive data and account controls stay separated.

Map tiles and location controls

City and Nearby maps use CARTO-hosted tiles based on OpenStreetMap data. Tile requests may send CARTO your IP address, browser and request data, and the requested map area. If you tap Show my location, your browser or app uses the device coordinate to center the map. Saii does not receive or store that raw coordinate through this control, but the tile area requested from CARTO can reflect the area around you.

On the Nearby tab, your browser or app rounds the device coordinate to a fixed grid of roughly one kilometre before anything is sent, so Saii never receives your exact position. Saii stores that rounded point only while Show me on the Nearby map is on, and buddies near you see the same rounded point and a distance in whole kilometres. Turning the control off erases the stored point, and a point that has not been refreshed for two weeks stops appearing. Read CARTO's privacy notice. Read the OpenStreetMap Foundation privacy policy.

Korea residency verification

Korea residency verification is optional. If you tap Verify my location, your device reads its position once, rounds it to a neighbourhood-sized area, and sends that area to Saii so we can check whether it falls inside Korea. Saii stores only the outcome (verified or not), the reported accuracy in metres, the client platform, and the time; it never stores the coordinate or the area, and other members see only the Verified in Korea badge.

The badge expires 30 days after each check and can be renewed at any time. Saii keeps the outcome records while your account is active to show the badge, enforce retry limits, and investigate abuse; they are deleted with your account.