Privacy terms for trusted cultural exchange.

Data we collect

Account identity, social-login references, verified phone status, school or work affiliation-verification metadata, profile details, interests, posts, comments, chat and call lifecycle metadata, structured peer references, profile-view analytics, buddy-discovery impression analytics, friendship-funnel milestone analytics, reports, blocks, device registrations, consent records, safety moderation/throttle metadata, identity-verification metadata, and subscription entitlement state.

Voice and video calls

Saii stores the participants, conversation, voice-or-video mode, lifecycle status and timestamps, and accepting device needed to ring and complete a call. WebRTC audio and video is encrypted in transit and travels directly between participants when possible or through a TURN relay; Saii does not record raw call audio or video.

Connection signaling, including SDP and ICE candidates that can contain network addresses, is transiently buffered by the Action Cable database and may remain recoverable longer through database backups or point-in-time recovery. Separately gated quality telemetry is disabled by default. If approved and enabled, it stores bounded connection metrics tied to call, conversation, and actor IDs, never raw media, SDP, device tokens, phone numbers, or private message or profile content.

School and work email verification

The full email address and one-time code are encrypted only while Brevo delivers the verification email, then redacted. We retain a masked address, keyed digest, domain, verification status, review history, and expiry so we can prevent duplicate claims and show an accurate organization email badge.

Face verification: collection and use

Face verification is optional. If you choose it, the Saii native app uses the front-facing camera to capture and stream a short selfie video directly to Amazon Rekognition Face Liveness in the AWS Tokyo region (Japan). The face data processed for this check includes the video frames, a reference image selected from the video, a provider session identifier, and a liveness confidence result.

Saii uses this data only to check whether the capture appears to come from a live person, return the verification result, grant the optional Photo Verified badge when the check passes, and prevent repeated or abusive attempts. Other members can see only the badge, not the capture, reference image, score, or result details. Saii does not compare the capture with your profile photo, use it to determine your legal identity, add it to a face-recognition database, sell it, or use it for advertising, marketing, member profiling, or tracking.

Face data sharing and protection

Saii shares face data only with Amazon Web Services (AWS), acting as Saii's service provider and processor, so AWS can perform the Face Liveness check in Japan. Saii does not share face data with other third parties. The video is encrypted in transit, AWS encrypts session data at rest with Saii's customer-managed key, Saii requests zero audit images, and Saii does not configure an Amazon S3 output bucket for reference or audit images.

Saii requires AWS, and any provider subprocessors that handle the data, to provide the same or equal protection for face data as this Privacy Policy and Apple's privacy rules require. They may process the data only to provide, secure, and maintain the verification service, or as required by law, and may not use it for their own advertising or transfer it to another party for an unrelated purpose.

Face data retention

An AWS Face Liveness session expires three minutes after its session identifier is issued. At expiry, AWS makes all Face Liveness data associated with that session, including the video, reference image, and session results, unavailable. Saii does not save the video, reference image, faceprint, face vector, audit image, or numerical confidence score in its database, logs, or file storage.

Saii retains only non-image verification metadata: the provider and expired session identifier, pass/fail or technical status and reason, decision-policy version, timestamps, consent version, acceptance time, source and request IP address, processing region, registered device identifier, and a separate keyed IP-address digest used for rate limiting. We retain this metadata and the badge while your account remains active so we can show the badge, enforce retry limits, investigate abuse or errors, and demonstrate that the check followed the recorded consent and decision policy.

Revoking consent and deleting face data

You can refuse face verification without losing access to Saii; only the optional Photo Verified badge will be unavailable. You can cancel before completing a capture, and no further face data is collected unless you choose to start another check. To revoke consent for future face verification, remove the badge, or delete Saii's retained face-verification consent and result metadata without deleting your account, email privacy@saii.kr from the address connected to your account.

The raw video, reference image, and provider result become unavailable automatically when the three-minute AWS session expires, so Saii has no retained copy of that face data to delete afterward. Revocation applies to future checks and cannot undo processing already completed during an expired session. You may also delete your entire account from Settings & Privacy; after the 30-day recovery window, Saii deletes the face-verification metadata, consent record, and badge with the account, subject only to records we must retain for security, fraud prevention, dispute handling, audit integrity, or legal obligations.

Profile-view analytics

Public profile opens are stored as one aggregate row per viewer and viewed profile, including view count and last-viewed time. These include profile views you made and profile views received.

Buddy-discovery analytics

When Saii shows signed-in members a buddy directory, it stores the viewer and shown account identifiers, an opaque request identifier, one-based position, algorithm version, experiment group, bounded reason codes, an optional bounded score, and the time shown. This is used to balance exposure and measure whether recommendations lead to safe, reciprocal conversations.

These rows do not copy names, contact details, profile text, interests, language lists, photos, messages, birthdates, gender, nationality, device identifiers, or location. They are deleted after 30 days and removed immediately when either member requests account deletion.

Friendship-funnel analytics

Allowlisted milestones such as completed onboarding, useful profile discovery, reciprocal chat, event or meetup participation, and confirmed attendance are stored with coarse role, service-language, catalog-city, and affiliation-type snapshots. Names, contact details, message bodies, profile text, organization names, and raw event or conversation identifiers are not stored in analytics context. These records are removed when you request account deletion.

Optional onboarding insights

If you turn on Share onboarding insights, Saii sends the onboarding step name and client platform to Google Analytics. Saii does not send your name, account ID, contact details, profile answers, messages, precise location, or provider identity in these events. This is optional, off by default, and can be turned off in Settings & Privacy.

Verified peer references

After a trusted two-way chat or confirmed attendance together, a member may choose one to three predefined positive traits about another member. We retain the author, recipient, selected traits, and the verified chat, event, or meetup used as provenance. Public profiles show only combined trait counts and broad provenance; the recipient can privately see the author, hide or report a reference, and the author can update or withdraw it. Free-text references and public negative ratings are not collected.

Sensitive-data processing

Identity verification is vendor-SDK based. Rails stores verification metadata only, rejects direct document uploads, and keeps production KYC provider work behind the post-review webhook boundary. The optional Face Verification sections above describe the separate AWS Face Liveness data flow in full.

Provider and billing posture

Premium access, calling, push delivery, and identity checks use provider boundaries so sensitive data and account controls stay separated.

Map tiles and location controls

City and Nearby maps use CARTO-hosted tiles based on OpenStreetMap data. Tile requests may send CARTO your IP address, browser and request data, and the requested map area. If you tap Show my location, your browser or app uses the device coordinate to center the map. Saii does not receive or store that raw coordinate through this control, but the tile area requested from CARTO can reflect the area around you.

On the Nearby tab, your browser or app rounds the device coordinate to a fixed grid of roughly one kilometre before anything is sent, so Saii never receives your exact position. Saii stores that rounded point only while Show me on the Nearby map is on, and buddies near you see the same rounded point and a distance in whole kilometres. Turning the control off erases the stored point, and a point that has not been refreshed for two weeks stops appearing. Read CARTO's privacy notice. Read the OpenStreetMap Foundation privacy policy.