Privacy Policy
Effective Date: July 14, 2025
Last Updated: October 15, 2026
ORCAR Studio Inc. (hereinafter referred to as "Company") values users personal information and processes it lawfully and manages it safely in accordance with relevant laws such as the Personal Information Protection Act and the Act on Promotion of Information and Communications Network Utilization and Information Protection. This Privacy Policy provides guidance on the processing standards for personal information collected and processed through the Orcar Reservation Platform operated by the Company.
※ Actual vehicle ownership and rental, insurance processing, accident response, etc. are handled by our partner rental car business, Jeju Plus, Rainbow Car Rental, Family Car Rental, and the Company provides personal information for these purposes within the necessary scope.
1. Personal Information Items Collected and Collection Methods
| Category | Items Collected | Collection Method |
|---|---|---|
| Social Login | Name, email, phone number | Apple / Google Login |
| Driver Verification | Driver's license number, date of birth | User input |
| Foreign Verification | Passport number, International Driving Permit (IDP) | Image upload |
| Remote Verification | Selfie photo | Persona API submission |
| Payment Processing | Partial card information, payment history | Toss Payments, Stripe |
| Notification | Name, phone number | KakaoTalk notification (Popbill) |
| Consultation Log | Conversation records | AI consultation system log |
| Automatic Collection | IP, browser, device information, etc. | Automatic collection when accessing website |
| File Storage | Driver's license and passport images | Stored in S3 private bucket |
2. Personal Information Collection and Use Purposes
- • Account-based social login provision
- • Driver verification and reservation management
- • Remote identity verification (including selfie comparison)
- • Vehicle reservation and payment processing
- • Notification messages via KakaoTalk
- • Essential information verification for accident and insurance response
- • Customer consultation and record management through AI chatbot
- • Storage and response according to laws
3. Third-Party Provision of Personal Information
The Company does not provide personal information to external parties without user consent in principle. However, exceptions are made in the following cases:
| Recipient | Purpose | Items Provided |
|---|---|---|
| Jeju Plus | Vehicle handover, insurance registration, accident response | Name, phone number, date of birth, driver's license number, passport number (incl. IDP) |
| Insurance Company | Accident handling, insurance claims | Name, license information, contract information |
| Persona | Remote identity verification | Selfie, license image, date of birth |
| Payment Processors (Toss, Stripe) | Payment processing | Name, email, payment history |
| Popbill (KakaoTalk) | Notification message delivery | Name, phone number, message content |
4. Personal Information Processing Consignment
| Consignee | Commissioned Tasks | Retention Period |
|---|---|---|
| Persona | Remote identity verification | Until verification is completed |
| Amazon AWS | Servers and file storage | Until withdrawal or retention period expires |
| Popbill | KakaoTalk message delivery | Until the purpose is achieved |
| AI chatbot engine | Customer support automation | Retained for 1 year, then deleted |
5. Personal Information Retention and Use Period
| Item | Retention Period |
|---|---|
| Reservation and payment history | 5 years (under the Act on Consumer Protection in Electronic Commerce) |
| Driver's license and verification information | 3 months after the end of rental |
| Passport / IDP images | Deleted within 30 days after verification completion |
| AI consultation records | 1 year |
| Web logs (IP, etc.) | 3 months |
6. Information Subject Rights and Exercise Methods
- • Request for access, correction, deletion, and processing suspension of personal information
- • Direct application through My Page or customer center
- • Withdrawal of consent or inquiry: contact@orcar.kr
- How to delete your account and data: see Account and Data Deletion
7. Personal Information Destruction Procedures and Methods
- • Electronic files: Permanent deletion in unrecoverable manner
- • Printed materials: Shredding or incineration
- • Passport and license images: Deleted immediately after retention period or verification completion
8. Personal Information Protection Officer
| Role | Name | Contact |
|---|---|---|
| Personal Information Protection Officer | Park Jeong-gi | contact@orcar.kr |
9. Notification and Changes
The Privacy Policy may be changed, and changes will be notified in advance through the website.
This policy applies from July 15, 2025.
10. Use of Instagram and Meta Platforms
The Company uses the Instagram Graph API, the Instagram Messaging API and the Marketing API provided by Meta Platforms, Inc. to operate Orcar's official Instagram business account (@orcar.ai) and to run advertising on Meta's services. The account is operated by the Company's AI agent (Orcar Brain) and staff.
- Purpose: Publishing marketing content created by the Company; managing and replying to comments on the Company's posts; sending people who comment on a post a direct message with what they asked for, such as a discount code; answering direct messages, including customer inquiries about reservations and partnership inquiries; reviewing how posts perform; and creating and managing the Company's advertising campaigns.
- Information processed: Content created by the Company (images, captions, hashtags); aggregated post and advertising metrics provided by Meta, such as reach, views, spend, clicks and the number of likes, comments, saves and shares, which do not identify individual users; the Instagram username and comment of people who comment on the Company's posts; and the Instagram username, account ID and conversation content of people who send direct messages, including any reservation details or contact information they share.
- Processing by service providers: To read and answer comments and messages, the AI agent may send their content to AI service providers (Anthropic, OpenAI, Google), and conversation summaries may be shared with staff through Slack. These providers are located in the United States.
- What we do not do: We do not offer sign-in with Instagram or Facebook, and we do not access Instagram users' own accounts, posts or other conversations. We do not sell information obtained from Instagram.
- Retention: Posts remain on Instagram until the Company deletes them. Comments and messages are stored by Instagram and are subject to Meta's Privacy Policy. The Company does not separately store commenters' information. When the Company keeps a record of a direct message conversation, it keeps it for the same period as consultation records (1 year) and then deletes it.
- Your choices: You can delete your own comments on Instagram at any time, and you can stop messaging us at any time. To ask the Company to remove your comment from its post or delete its records of your messages, or to ask about this processing, contact contact@orcar.kr.
For details, see Account and Data Deletion.