Mobi Privacy Policy
هذا المستند متاح باللغتين الإنجليزية والكورية فقط.
ORCARSTUDIO Inc. ("ORCARSTUDIO", "we", "us") operates Mobi, a messenger app that lets you talk with the businesses you use (the "Service"). This policy explains what personal information we process when you use Mobi, why, who receives it, how long we keep it and what you can do about it. It is written to meet the Personal Information Protection Act of the Republic of Korea and the requirements of the app stores.
1. Who is responsible
ORCARSTUDIO Inc. (오르카스튜디오 주식회사), Business Registration No. 576-87-02239, CEO Jaeho Jeong. Head office: Room 202, 28-1 Jeseong 1-gil, Jeju Special Self-Governing Province, Republic of Korea. Seoul office: 4F, 16-12 Yanghwa-ro 8-gil, Mapo-gu, Seoul, Republic of Korea. Contact: contact@orcar.kr.
For the information you share with a business through Mobi, that business decides how it uses it for its own services (for example, a car-rental company handling your booking). Their own privacy notices apply to that use.
2. What we collect
When you create an account and use it
- Email address (the one you sign in with, or a contact email you confirm with a code if you sign in with Apple and hide your address)
- Display name
- Phone number, only if you choose to add it (used to text you an urgent message that could not reach you otherwise)
- If you sign in with Apple or Google: the account identifier that Apple or Google gives us for Mobi, and the email address and name they share with us
- The terms and privacy versions you accepted, and when
When you talk with businesses
- The businesses you add, block or unblock, and when you added them
- Your messages, and the photos, videos and files you send (photos and videos are converted on your device, which removes their location data)
- Reports you make about messages, with the reported message and a few messages around it
- When you read messages, and whether a notification reached your device
About your device and the app
- A device identifier we create when you sign in, the platform (iOS or Android), app version, operating system version, device model and the app's language
- Your push notification token and whether notifications and urgent alerts are allowed
- The IP address of requests, used for security and to limit abuse
We do not collect your location, contacts, call logs or advertising identifiers, and we do not track you across other companies' apps or websites.
3. Why we use it
- To create and secure your account and sign you in (including sending sign-in codes by email)
- To deliver your messages to the businesses you add and theirs to you, in real time
- To send push notifications, and, for messages a business marks as urgent, to reach you by email or text message when a notification cannot reach you or stays unread
- To translate messages between you and a business into each other's language
- To let a business's AI assistant answer you on the business's behalf, when the business uses one
- To keep the Service safe: preventing abuse and spam, reviewing reports, enforcing our Terms of Use
- To fix problems and keep the Service working (diagnostics)
- To comply with legal obligations
We do not sell your personal information and do not use it for advertising.
4. What businesses receive
When you add a business, Mobi shows you what it will share and asks for your consent. The business then receives your display name, your email address, your phone number if you added one, and the messages, photos, videos and files you send in your conversations with it. A business receives nothing about your conversations with other businesses. You can block a business at any time; it then cannot send you messages.
5. Service providers we use
We use the following companies to run the Service. They process your information only on our instructions.
| Provider | What they do for Mobi | Information |
|---|---|---|
| Google LLC (Google Cloud, Seoul region) | Hosting of the servers, database and files | All information described in section 2 |
| Google LLC (Google Workspace) | Sending emails (sign-in codes, urgent-message emails) | Email address, email content |
| Google LLC (Firebase Cloud Messaging) | Delivering push notifications to Android devices | Push token, notification content |
| Apple Inc. (Apple Push Notification service) | Delivering push notifications to iOS devices | Push token, notification content |
| OpenAI, L.L.C. | Translating messages; generating replies of a business's AI assistant; reading photos and documents sent to an AI assistant | Message content, attachments, display name as it appears in a conversation |
| Twilio Inc. | Sending text messages for urgent messages | Phone number, text content |
6. Transfers outside Korea
Some of the providers above process information outside the Republic of Korea. Under the Personal Information Protection Act, we tell you the following:
| Recipient | Country | Information | Purpose | When and how | Retention by the recipient |
|---|---|---|---|---|---|
| Google LLC (Workspace, Firebase; https://support.google.com/cloud/contact/dpo) | United States | Email address, push token, email and notification content | Email and Android push delivery | Over an encrypted network each time an email or notification is sent | As needed to deliver, under Google's terms |
| Apple Inc. (https://www.apple.com/legal/privacy/contact/) | United States | Push token, notification content | iOS push delivery | Over an encrypted network each time a notification is sent | As needed to deliver, under Apple's terms |
| OpenAI, L.L.C. (privacy@openai.com) | United States | Message content, attachments, display name | Translation and AI replies | Over an encrypted network each time a message is translated or an AI reply is prepared | Not used to train models; may be kept up to 30 days for abuse monitoring, then deleted |
| Twilio Inc. (privacy@twilio.com) | United States | Phone number, text content | Urgent text messages | Over an encrypted network each time a text is sent | As needed to deliver, under Twilio's terms |
If you do not want your information transferred abroad, you can decline by not using the Service or by deleting your account; translation, AI replies, push notifications and urgent emails and texts cannot work without these transfers.
7. How long we keep it
- Your account: as long as your account exists. When you delete your account (in the app, or on our account deletion page), you are signed out at once and your account is erased 30 days later. Until then you can restore it by signing in again.
- What erasure removes: your email addresses, sign-in identities (Apple, Google), phone number, devices and push tokens, pending sign-in codes and the files you sent; your display name is replaced with "Deleted user".
- What remains after erasure: the text of the messages you sent stays in the businesses' conversations under "Deleted user", because it is part of those businesses' records of their conversations, and is kept while those conversations exist. It no longer identifies you.
- Security and delivery records: request records used to limit abuse (including IP addresses) are deleted after 2 hours; records of notifications and urgent-message emails and texts after 30 days; ended sign-in sessions 30 days after they end; used sign-in codes within a day of expiring.
- Reports: kept as long as needed to review them and act on them.
- Backups: database backups are kept for 7 days, so deleted information disappears from them within 7 days.
- Server logs: kept for up to 30 days.
We keep information longer only when a law requires it, and then only for the period the law sets.
8. How we destroy information
Electronic information is deleted so that it cannot be recovered. We do not keep personal information on paper.
9. Your rights
You can, at any time:
- see and correct your profile (name, phone number, contact email) in the app;
- delete your account in the app (Settings → Delete account) or on our account deletion page at joinmobi.link/delete-account;
- turn notifications off, and block any business;
- ask us to access, correct, delete or stop processing your personal information, or withdraw your consent, by writing to contact@orcar.kr. We answer without delay, and within 10 days.
A legal representative can make these requests on your behalf with proof of authority.
10. Children
Mobi is not for children under 14. We do not knowingly collect information from children under 14; if we learn that we have, we delete it.
11. Security
We protect your information with encryption in transit (HTTPS/TLS) and at rest, access controls limited to the people who need them, separation of production systems, and records of access. Stored credentials of businesses are encrypted with separate keys. No method is perfectly secure, but we work to protect your information and will tell you and the authorities about a breach as the law requires.
12. Cookies
The Mobi apps do not use cookies. Our web pages (such as the account deletion page) use a short-lived cookie only to protect forms you submit.
13. Privacy officer and help
Privacy Officer: Park Jeong-gi, contact@orcar.kr.
You can also contact:
- Personal Information Infringement Report Center (KISA): privacy.kisa.or.kr, call 118
- Personal Information Dispute Mediation Committee: kopico.go.kr, call 1833-6972
- Supreme Prosecutors' Office Cybercrime Investigation: spo.go.kr, call 1301
- Korean National Police Agency Cyber Bureau: ecrm.police.go.kr, call 182
14. Changes
If we change this policy, we announce it in the app or on this page at least 7 days before it takes effect (30 days for changes that reduce your rights). The Korean version of this policy prevails if the two versions differ.