Privacy Policy
Last updated: 2026-10-18
Notice of change: from 2026-10-18, coupons and stamp rallies are added. Only for visitors who get a coupon or join a stamp rally, we process a random participant number stored on their device and their participation records (when a coupon was received or used and at which store, and which spots were stamped and when), and delete them one year after the last record. The changes are in §2, §3, §4, §5 and §13 below.
From the same date, users can connect their own domain (for example, ar.brand.co.kr) to open AR experiences, so §1 now states that this policy also applies to the AR viewer opened at such an address. The information processed and the processors are the same as for the existing AR viewer.
When you sign up, we also record the country you connect from (looked up from your IP address — the IP address itself is not stored), your device information, the site and page you first arrived at, and campaign tags (UTM). Session records also keep the country you connect from at sign-in and session refresh. None of this applies to visitors. The changes are in §2, §3, §5 and §13.
LabGL Co., Ltd. (“we”, “us”) operates the Vi3w service (the “Service”) and handles personal data in accordance with the Personal Information Protection Act of the Republic of Korea and other applicable laws.
This policy explains what information we process, why, how long we keep it and who we share it with — written to match how the Service actually works.
The Service is used by “users”, who build AR experiences in a workspace, and by “visitors”, who open the links or QR codes those users publish. What we collect about visitors is very limited and is set out separately in §2.
1. Scope
This policy applies to the Vi3w website (www.vi3w.net), the AR viewer (ar.vi3w.net, including the viewer opened at a custom domain a user has connected) and the related APIs.
It does not apply once you follow an external link (such as a call-to-action) that a user placed inside their AR experience.
Where a user collects information from visitors for their own campaign, that user is the controller of that information and we act as their processor.
2. Information we collect
We collect only what the Service needs. We never collect national identification numbers.
| Context | Data | How it is collected | Required? |
|---|---|---|---|
| Sign-up (email) | Email address, password (stored as a one-way hash), display name | Entered on the sign-up form | Email and password required; name optional |
| Sign-up (Google) | Google account identifier, email address, name, email-verified status | Received from Google when you sign in with Google (scopes: openid, email, profile) | Required |
| At sign-up | Country you connect from (looked up from your IP address — the IP address itself is not stored), type and browser information of the device you sign up on (User-Agent, up to 400 characters), domain of the site you first came from, first page you viewed and campaign tags (UTM) | Generated automatically at sign-up (where you came from is a value kept temporarily in that browser tab — §13) | Required |
| Using the Service | Last sign-in time, language preference, browser information of the signed-in device (User-Agent, up to 400 characters), country you connect from at sign-in and session refresh (looked up from your IP address) | Generated automatically at sign-in and session refresh | Required |
| Workspace invitations | Email address of the invited person | Entered by the inviting user | Required |
| Paid plans | Subscription identifier, status and period | Received from our payment provider (Polar) | Required for paid use |
| Enquiries | Name, email address, company, phone number, message, consent timestamp | Entered on the enquiry form | Name and email required; others optional |
| Content you create | Uploaded 3D models and images, experience and hotspot text, and — for location-based AR — the coordinates you choose | Entered or uploaded by you | Optional |
| Visitors viewing an AR experience | Experience identifier, time of the view or click, event type (view or CTA click) | Generated when the experience runs | — |
| Visitors taking part in a coupon or stamp rally | A random participant number stored on the device; when a coupon was received or used and at which store; the coupon code received; which spots were stamped and when; when a rally was finished (if a lead form is sent, the same number is kept with that lead) | Generated when a coupon is received or a stamp is collected | — |
We do not store visitors' IP addresses, browser details or referrers. Only when a visitor gets a coupon or joins a stamp rally do we also record the random participant number stored on their device. That number is not linked to a name or contact details, so the records above cannot identify an individual. We do not use Google Analytics or any other third-party tracking or advertising analytics.
3. Why we process it
- Creating and managing accounts and workspaces, and keeping you signed in
- Providing the Service — building, storing, publishing and running AR experiences
- Managing paid subscriptions, usage limits and payment status
- Inviting and managing workspace members
- Responding to enquiries and error reports, and improving the Service
- Sending essential emails such as verification, password reset and invitations
- Preventing fraudulent sign-ups and automated abuse
- Compiling sign-up statistics by referral source and country (to improve the Service — used only within the company)
- Showing you view statistics for your own campaigns
- Running coupons and stamp rallies — giving each person one coupon, remembering stamped spots and completions, and showing you coupon and rally statistics
4. Camera, location and face detection
Because the Service provides augmented reality, it may request access to your device's camera, location and motion sensors. Access is always requested through your browser and you may decline. Given how sensitive this is, we set out the details here.
- Camera images — while an AR feature (marker, image, face or location tracking) runs, the camera feed is processed only inside your device's browser. We do not transmit or store camera images on our servers.
- Face detection — face AR estimates where a face is so a 3D element can be placed on screen. Face images and facial landmarks are never sent to or stored on our servers, and are not used to identify or authenticate anyone.
- When face AR starts, the program files it needs are downloaded from third-party content networks (Google Cloud Storage operated by Google LLC, and jsDelivr). Those providers may receive the visitor's IP address and browser information (see §8).
- Location (visitors) — when a location-based experience runs, or when a stamp is collected at a stamp rally spot that only works on site, your device's position is used on the device to calculate distance. Neither the position nor the result of the distance check is transmitted to or stored on our servers.
- Placement coordinates (users) — location-based experiences and stamp rally spots store only the placement coordinates you save. You can type them in, or fill the fields with “use current location” and review or edit them before saving; once saved, they become part of that experience and are visible to visitors who open it. “Use current location” measures your device's position once to fill in the fields — we do not separately send that position to our servers or keep it as your location.
- Photo capture — if a user enables it, visitors can save the screen as an image. The image stays on the visitor's device and is not uploaded to us.
5. How long we keep it
We delete personal data without delay once its purpose has been fulfilled, except where the law requires us to keep it.
- Under Korean e-commerce law — records of contracts and withdrawal of subscription: 5 years; records of payment and supply: 5 years; records of consumer complaints and dispute resolution: 3 years
- Under the Protection of Communications Secrets Act — service access logs: 3 months
- You can request account deletion yourself from the Account screen after signing in. We hold the account for 7 days so you can change your mind — you can cancel the request at any point during that period — and delete it automatically once the 7 days pass. If you cannot use that screen, contact privacy@vi3w.net and we will act within 10 days of the request.
| Data | Retention period |
|---|---|
| Account details (email, name, credentials) | Until you close your account |
| Sign-in device information (User-Agent), country and session records | 14 days from issue (until the session expires) |
| Sign-up record (country, device information and where you first came from at sign-up) | Until you close your account |
| Workspace invitations | Expire 7 days after they are sent; acceptance history is kept for the life of the workspace |
| Enquiry form submissions | 90 days from receipt |
| Content you create or upload | Until you delete it or close your account |
| Payment and subscription records | As required by law after the subscription ends (see below) |
| AR view and click statistics | For as long as needed to show you campaign statistics (kept in aggregate form) |
| Coupon and stamp rally records (including the random participant number) | One year from the last record (receiving or using a coupon, collecting a stamp or finishing a rally) — counts of coupons received and used remain in aggregate form |
6. Sharing with third parties
We do not sell or share your personal data with third parties, except:
- where you have given prior consent;
- where required by law, or where an investigative authority requests it under a procedure prescribed by law;
- within your workspace — when you invite someone or accept an invitation, your name, email address and role are visible to other members of that workspace, as the Service requires.
7. Processors we use
We engage the following processors to operate the Service. Our agreements require appropriate protection of personal data, and we will update this policy if the processors or the scope of processing change.
| Processor | Purpose | Data processed |
|---|---|---|
| Microsoft Corporation (Microsoft Azure) | Database and file storage, application hosting, transactional email | Data processed in the course of providing the Service |
| Vercel Inc. | Website hosting (www.vi3w.net) | Access logs, including IP addresses |
| Cloudflare, Inc. | Bot protection during sign-up; hosting of the AR viewer (ar.vi3w.net); storage and delivery of uploaded files (3D models, images) | IP address, browser information, files you upload |
| Google LLC | Google sign-in; delivery of program files required for AR | Google account identifier, email and name (at sign-in); IP address and browser information (when files are downloaded) |
| Polar Software Inc. | Payment processing and subscription management | Payment and billing details, collected directly by the provider |
| Anthropic, PBC | AI authoring assistant (only when a user runs it) | The prompt you type and the settings and text of that AR experience |
| jsDelivr (Volentio JSD Ltd.) | Delivery of program files required for AR | IP address, browser information |
The AI assistant runs only when you invoke it; if you do not use it, nothing is sent. We never store card numbers or other payment credentials.
8. Transfers outside Korea
We transfer personal data outside the Republic of Korea as set out below. You may object to these transfers, although this may prevent us from providing the Service — contact privacy@vi3w.net.
| Recipient | Country | Data | When and how | Purpose | Retention |
|---|---|---|---|---|---|
| Microsoft Corporation | United States and other Azure regions | Data processed in the course of providing the Service | Transmitted over the network as you use the Service | Cloud infrastructure | Until the processing agreement ends |
| Vercel Inc. | United States | Access logs including IP addresses | Automatically when you visit the site | Website hosting | Until the processing agreement ends |
| Cloudflare, Inc. | United States and other Cloudflare locations | IP address, browser information, files you upload (3D models, images) | When you sign up, upload files or open an AR experience, over the network | Bot protection; AR viewer hosting; file storage and delivery | Until the processing agreement ends |
| Google LLC | United States | Google account identifier, email, name; IP address and browser information | When you sign in with Google, or when an AR feature loads | Social sign-in; AR program files | Until the processing agreement ends |
| Polar Software Inc. | United States | Payment and billing details, subscription identifiers | When you pay | Payment and subscription management | Until the processing agreement ends |
| Anthropic, PBC | United States | Your prompt and the experience's settings and text | When you use the AI assistant | AI authoring assistant | Until the processing agreement ends |
| Volentio JSD Ltd. (jsDelivr) | United Kingdom and others | IP address, browser information | When an AR feature loads | AR program files | Until the processing agreement ends |
9. Children under 14
We do not accept sign-ups from children under the age of 14. If we learn that an account belongs to a child under 14, we delete it and the related data without delay.
Published AR experiences can be viewed by anyone. Even then, we do not collect personal data from visitors (see §2).
10. Your rights
You may exercise the following rights in relation to your personal data at any time.
- Request access to your personal data
- Request correction of inaccurate data
- Request deletion (except where we are legally required to retain it)
- Request that we stop processing your data
- Withdraw consent by closing your account
11. How to exercise your rights, and how we delete data
You can act on most of these from the Account screen after signing in, or contact privacy@vi3w.net. We respond within 10 days of receiving a request. A legal representative or authorised agent may act for you on presentation of written authorisation.
When a retention period ends or the purpose is fulfilled, we delete the data without delay. Electronic records are erased so they cannot be recovered; printed records are shredded or incinerated. Backup copies kept for recovery from failures are deleted automatically within 7 days after the original is deleted.
When you request account deletion, your account details and the content you uploaded are deleted once the 7-day grace period passes, and the share links and QR codes you published stop working. You can cancel the request from the Account screen during that period. Where content remains in a workspace shared with other members, it stays with that workspace and ownership passes to another member.
12. How we protect your data
- Passwords are stored using a one-way hash and cannot be recovered.
- Access to databases and storage containing personal data is limited to the minimum number of people.
- All traffic between you and our servers uses an encrypted connection (HTTPS).
- Sessions expire automatically, and changing your password revokes all existing sessions.
- We apply rate limiting to block automated sign-up and sign-in attempts.
- Staff who handle personal data are instructed on our security rules.
14. Content you publish is public
When you publish an AR experience we generate a unique link and QR code. Anyone with the link can open it without signing in, and can therefore see the text, 3D models and settings it contains — including the coordinates of a location-based experience.
Uploaded 3D models and images are also served from publicly reachable addresses. Please do not upload files containing personal or confidential information.
Unpublishing an experience stops the link from working.
15. Data protection officer and contact
We have designated the following person to take overall responsibility for personal data processing and to handle complaints and remedies.
- Data protection officer: Chan Hyoung Lee, CTO
- Privacy requests and access enquiries: privacy@vi3w.net
- General enquiries: support@vi3w.net
16. Dispute resolution
You may contact the following Korean authorities for mediation or advice about a privacy complaint.
- Personal Information Dispute Mediation Committee — +82-1833-6972 (www.kopico.go.kr)
- Privacy Infringement Report Centre, Korea Internet & Security Agency — 118 (privacy.kisa.or.kr)
- Supreme Prosecutors' Office, Cyber Investigation Division — 1301 (www.spo.go.kr)
- National Police Agency, Cyber Bureau — 182 (ecrm.police.go.kr)
17. Changes to this policy
If we add to, remove from or amend this policy, we will announce it in the Service at least 7 days before it takes effect — or at least 30 days beforehand where the change materially affects your rights.
This policy applies from 2026-10-18.