Privacy Policy

Effective date: November 4, 2026

Paven (“we”, “us”) operates the Selling service (the “Service”). This policy explains what personal information we process and why.

1. Information we process

Whose	What	How we get it
Creators who use the Service	App-scoped Facebook user ID; Instagram professional account ID, username, name, profile picture URL, follower count and media count; business portfolio ID; Meta access tokens (stored encrypted); Coupang Partners API keys and Sub ID (optional, stored encrypted)	Granted by the creator through Facebook (Meta) Login
Instagram users who comment on a creator’s posts	Instagram-scoped user ID, username, comment text and time, ID of the post commented on, messages exchanged with the creator’s account and delivery results	Meta webhooks and APIs, only for accounts the creator connected
Visitors of a creator’s link page	Time of visits and clicks, referral source (in-app browser type, previous site), device type (mobile/desktop), and a daily-rotating hash of the IP address (the IP address itself is not stored)	Generated automatically when the link page is opened or a button is tapped
People who report a link page or a sold-out product	Report reason and details or product number, time, and a daily-rotating hash of the IP address (the IP itself is not stored; used to prevent repeated reports)	Entered on the report or sold-out form
Creators who buy credits or subscribe	Order number, product, amount, payment/refund time and status, credit history, subscription status, card issuer and last 4 digits, and the automatic-payment key issued by Toss Payments (stored encrypted). We never receive or store full card numbers, expiry dates, or passwords (handled by Toss Payments)	Through the Toss Payments payment window
Creators who turn on notifications	The push subscription the browser creates, a device label (e.g. “iPhone Safari”), and per-type notification settings	When the creator taps “Get notifications on this device”
Creators who use AI features	Link page content sent with an AI request (page name, bio, notice, group names, recent product titles, badges and captions, text blocks, link button names), the request the creator types, and the product title and price to tidy	When the creator taps an “AI” button
Everyone	IP address, browser information, access time	Generated automatically in server logs

2. How we use it

• To connect the creator’s Instagram account and show its profile information
• To show creators visit and click statistics for their link page (excluding bots and repeated clicks)
• To send a private reply (DM) and a public reply to comments that match the posts and keywords the creator chose
• To show delivery history and failure reasons, retry messages, and respect sending limits
• To prevent abuse and keep the Service secure (handling reports, blocking harmful links)
• To process credit purchases, subscriptions, automatic renewals, refunds, and payment inquiries
• To generate the AI template suggestions and product title edits the creator asks for

We use data received from the Meta platform only for these purposes. We do not sell it, use it for advertising, or share it with third parties.

3. Retention and deletion

• Creator account information and access tokens: deleted without delay when the creator disconnects, closes the account, or requests deletion
• Comment and message events and delivery history: deleted 90 days after receipt (immediately on disconnection or a deletion request)
• Link page visit and click records: deleted after 13 months (immediately when the page is deleted)
• Server access logs: kept for 3 months as required by Korean law, then deleted
• Payment and refund records: kept for 5 years as required by Korean e-commerce law. On account deletion we unlink them from the account and keep only order number, amount, time, and status. Credit history is deleted with the account
• Automatic-payment key: deleted immediately when the subscription is cancelled, ends, or is refunded
• Push subscription: deleted immediately when notifications are turned off or the browser revokes it
• AI request content: not stored on our servers. See section 4 for the AI provider

4. Sharing and processors

We do not provide personal information to third parties. We use the following processors to run the Service:

• Toss Payments Co., Ltd. (Korea): payment processing, automatic payments, and refunds
• Anthropic, PBC (United States, [email protected]): processing AI features. Data listed above for AI features is sent over HTTPS each time the creator taps an “AI” button, is not used to train models under Anthropic’s commercial API terms, and is deleted under Anthropic’s API data retention policy. If you do not use AI features, nothing is sent; all other features still work.
• Google LLC (United States) — Web Risk: checking whether link URLs added by creators are phishing or malware sites (only the URL is sent)
• Browser push services (Google, Apple, Mozilla): delivering notifications the creator turned on; only the encrypted title and text are sent
• Cloud server and database hosting: hosting provider (we will name the provider and country here once selected)

Receiving Instagram comments and sending messages is done through the official APIs of Meta Platforms, Inc., at the creator’s request. Coupang link conversion sends the product URL to the official Coupang Partners API using the key the creator registered.

5. Your rights

You can ask to access, correct, delete, or stop the processing of your personal information at any time. See Data Deletion instructions. Instagram users who commented on a creator’s post can also contact us at the email below.

6. Security

• Access tokens and other secrets are encrypted at rest and never written to logs.
• All traffic is encrypted with HTTPS.
• Access to personal information is limited to the minimum number of people.

7. Cookies

We only use cookies needed to secure the login process (protection against forged requests), and a cookie that counts visits and clicks that arrive through a creator’s video link (/s/…) toward that link (sl_t — contains only the link ID, expires after 30 minutes, not readable by other sites). We do not use advertising or tracking cookies.

8. Contact

9. Changes

If we change this policy, we will post a notice on this page at least 7 days before the change takes effect.