Privacy Policy
Effective: 2026-10-19
AZET LLC (the "Company"), the operator of Sponmi, protects users' personal information in accordance with the Korean Personal Information Protection Act, the Act on Promotion of Information and Communications Network Utilization and Information Protection and other applicable laws, and publishes this privacy policy so that related concerns can be handled quickly and smoothly. This policy applies to users worldwide; what is added for users in the EEA, the UK, Switzerland, Japan, the United States and other countries is set out in "Legal bases", "Rights of users outside Korea" and "Notice for US residents".
1. Controller
The controller of personal information processed on Sponmi is its operator, AZET LLC.
- Controller: AZET LLC / Address: 6545 Market Ave N Ste 100, Canton, OH 44721, USA / Email: help@sponmi.com
- The Company is located in the United States and has no address or place of business in Korea.
- Domestic representative in Korea: the Company does not meet the thresholds in the Korean Personal Information Protection Act art. 31-2(1) and Enforcement Decree art. 32-3(1) (total revenue of KRW 1 trillion or more in the previous year, a daily average of 1 million or more data subjects in Korea, and others), so it has not designated one. If it meets them, it will designate one and publish the name, address and contact details here.
- Personal information relating to MCN (creator agency) e-contracts is controlled by AZ Entertainment, not the Company (see "Processing by AZ Entertainment" below).
2. Information we collect and how
The Company collects the following personal information to provide the service.
- Required: name, email address, Google account identifier (ID), profile photo URL
- Optional: phone number, company or business name
- Creators and agencies acting as businesses (required): business name, representative's name, address, phone number, email, business registration number, collected to give counterparties the seller's identity details (Korean Act on Consumer Protection in Electronic Commerce art. 20(2); Enforcement Decree art. 25(1))
- With Google OAuth: Google account email, name, profile image
- With Kakao Login: Kakao account email (required), nickname and profile photo (if you agree), Kakao member number
- With the YouTube API: YouTube channel ID, channel name, subscriber count, per-video views, likes and comments, watch time, impressions, click-through rate (CTR), traffic sources, demographic data
- With the Instagram API: Instagram user ID, username, follower count, post count, profile image
- With the TikTok API: TikTok Open ID, display name, follower count, video count, like count
- Payments and payouts: payer name, payment and refund records, and the payout account or payout method of creators who receive payouts (card numbers and other payment-method details are handled by the payment provider and not stored by the Company)
- Billing details for US-dollar purchases (advertisers and licensees): billing country, company name and address, tax ID (optional — EU VAT numbers are checked against the European Commission's VIES service), and the payment reference and status returned by the payment provider. We never receive card numbers, bank passwords or crypto-wallet private keys
- Creator payouts and tax: payout method (bank account, Wise or PayPal address), country of tax residence, and the details needed to decide withholding
- US tax forms (W-9, W-8BEN, W-8BEN-E — required for creators paid in US dollars, because AZET LLC as payer has US withholding and reporting duties): legal name, country of citizenship or organisation, date of birth (W-8BEN), permanent and mailing address, US taxpayer identification number (SSN, ITIN or EIN) or foreign tax identifying number (FTIN — stored encrypted, with only the last 4 characters shown on screen), any tax treaty claim, signature (the name you type), the date and time of signing and the IP address
- Language: the language of the screen you signed up or logged in on, so notices and confirmation emails reach you in that language
- Rights ledger (for licence deals): member identifiers of the parties, the licence text as approved and its SHA-256 hash, and the consent record (times of viewing, verification, approval and revocation, browser information (User-Agent), and a hash of the IP address)
- Production agreement signature records (when a creator signs the agreement or an order sheet): the legal name typed on the signing screen, date of birth, country of residence, sign-up email, the signed text and its SHA-256 hash, and the signing record (times of viewing, code verification, signing, delivery of the signed copy and downloads, browser information (User-Agent), and a hash of the IP address)
- Prepaid balance (advertisers and licensees): top-up, reservation, deduction and refund history and the balance
- Derivative-upload tracking (licensees): post URLs the licensee registers, the posting channel, and snapshots of each post's public view count and status (checked through each platform's public API)
- Creators who are not members but whose videos are requested for a licence: channel name, channel URL, and a contact email they have published in the channel or video description, collected only to ask for permission
- Collected automatically: IP address, browser type, access times, cookies, service usage records
- How we collect: sign-up, Google/social OAuth, licence request and approval screens, lookups of public information on each platform, and automatic collection while you use the service
3. How we use it
We use the information we collect for the following purposes.
- Sign-up and account management: identity check, member identification, account management (Korean Personal Information Protection Act art. 15(1)(4))
- Brokering deals: primary-ad orders, usage and derivative licence requests and approvals, and giving seller identity details (same paragraph, items 4 and 2)
- Rights ledger and consent records: proving that a licence was formed and what it says, confirming revocation, expiry and takedown, and handling disputes (same paragraph, item 4)
- Calculating derivative royalties and confirming takedowns: checking public view counts and status of registered posts, and deducting from prepaid balances (same paragraph, item 4)
- Asking non-member creators for permission: we use contact details they published themselves, within the scope related to why they published them (Korean Supreme Court, 17 August 2016, case 2014Da235080). Anyone we contact may ask us for the source of the information, the purpose of processing and their right to ask us to stop (Korean Personal Information Protection Act art. 20(1))
- YouTube and social-media analytics: analysing creators' channel performance and giving advertisers performance reports
- Payments and payouts: taking and refunding payments, paying creators' production fees and licence fees, topping up and refunding credit and prepaid balances
- Support: answering enquiries, mediating disputes, handling takedown requests, service notices
- Improving the service: usage statistics, quality improvements, new features
- Legal compliance: e-commerce, communications-privacy and other applicable laws
4. Legal bases (EEA, UK and Switzerland)
If you use the service from the European Economic Area, the United Kingdom or Switzerland, we process your personal data on these bases under Article 6(1) GDPR (and the UK GDPR and the Swiss FADP):
- Contract (Art. 6(1)(b)): sign-up and account management, orders and licences, payments and refunds, creator payouts, customer support
- Legal obligation (Art. 6(1)(c)): keeping accounting and tax records, issuing invoices and receipts, sanctions screening, responding to lawful requests from authorities
- Legitimate interests (Art. 6(1)(f)): security and fraud prevention (including automated sign-up checks), handling disputes and keeping the rights ledger, improving the service, and asking creators who are not members for permission through the contact details they made public — you can object to this processing at any time
- Consent (Art. 6(1)(a)): analytics cookies (Google Analytics) and marketing email — you can withdraw consent at any time; this does not affect processing before you withdrew
- We do not make decisions based solely on automated processing that produce legal or similarly significant effects on you (Art. 22 GDPR).
5. Google API Services User Data Policy
Sponmi's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.
- Google user data is used only for the purposes stated in this privacy policy.
- We do not sell Google user data to third parties.
- We do not use Google user data for advertising.
- We do not use Google user data to determine creditworthiness or for lending.
- Google user data may be transferred to third parties only with the user's explicit consent, for security or legal purposes, or as part of a merger or acquisition.
- Users can disconnect Google at any time in account settings and ask for their data to be deleted.
6. YouTube API Services
Sponmi uses YouTube API Services (https://developers.google.com/youtube/terms/api-services-terms-of-service). Data collected through YouTube API Services is subject to the Google Privacy Policy (https://policies.google.com/privacy).
- YouTube data we collect: channel statistics (subscribers, views), per-video performance (views, likes, comments, watch time), daily channel statistics, traffic sources, demographics
- Why we use YouTube data: to provide creators' performance dashboards, give advertisers campaign performance reports, and improve creator-advertiser matching
- We do not sell or share YouTube data with third parties without the user's explicit consent.
- Users can revoke this service's access to their YouTube data at any time in Google security settings (https://security.google.com/settings/security/permissions).
- When access is revoked, the Company deletes that user's YouTube-related data without delay.
7. How long we keep it
We destroy personal information without delay once its purpose has been achieved, except where the law requires us to keep it for a set period.
- When you leave: destroyed within 30 days (kept for 30 days to handle disputes, then destroyed)
- Records of e-commerce contracts and withdrawals: 5 years (Korean e-commerce law)
- Records of payments and supply: 5 years (Korean e-commerce law)
- Payment and tax records of US-dollar transactions: 7 years after the end of the year of the transaction (US tax record-keeping)
- US tax forms (W-9, W-8BEN, W-8BEN-E): kept, even after they are replaced or expire, for 4 years after the end of the last year in which we paid you on that form (US rules on keeping withholding documents). If we never paid you on a form, it is deleted when you close your account
- Records of consumer complaints and disputes: 3 years (Korean e-commerce law)
- Access logs: 3 months (Korean Protection of Communications Secrets Act)
- YouTube and social-media analytics data: destroyed within 30 days of disconnection or leaving
- Rights ledger (licence text, hash and consent record): 5 years from the day the licence ends (expiry or revocation), the same as contract records
- Signed copies and signing records of the production agreement and order sheets: at least 3 years from the day the agreement ends (for an order sheet, the day that order ends), as Korean law requires such contracts to be kept — they are not deleted during this period even if you close your account
- Prepaid-balance history and derivative view-count snapshots: 5 years, the same as payment records
- Contact details of non-member creators: once the request is closed (declined, or no reply for 1 year), destroyed except for the channel identifier and the decision, kept so we do not contact them again
8. Sharing with third parties
As a rule, the Company does not give personal information to third parties without the user's consent, except in the following cases.
- Where the user has consented in advance
- Counterparties: with consent obtained on the order or licence request/approval screen, we give the other member the information needed to perform the deal (the creator's channel information; the advertiser's or licensee's business name and posting channel URL) (Korean Personal Information Protection Act art. 17(1)(1))
- Identity details of members selling as businesses are given to counterparties as the law requires (same Act art. 17(1)(2); Korean Act on Consumer Protection in Electronic Commerce art. 20(2))
- When running a campaign, giving advertisers a creator's public channel statistics (subscribers, views and similar) (with the creator's prior consent)
- Where required by law or requested by investigative authorities
- Tax ID checks: if you enter an EU VAT number, we send that number and its country to the European Commission's VIES service (validity check only)
- Where needed to provide the service (payment providers and similar) under a processing agreement
9. Processing by AZ Entertainment
Personal information relating to the MCN (creator agency) membership e-contract is processed by AZ Entertainment to conclude and perform its own contract, and AZ Entertainment, not the Company, is its controller. The Company processes it on AZ Entertainment's behalf only to the extent that it provides the signing and storage system AZ Entertainment uses.
- Controller: AZ Entertainment (AZ MCN) (Jiseon Lee, Representative, Korean business registration no. 629-45-01136, A-3635, 301 Incheon tower-daero, Yeonsu-gu, Incheon, 22007, Republic of Korea, content@azentertainment.kr)
- Data: name, email, date of birth, country of residence, channel information, signature image, signing record (time, browser, hashed IP), for minors the legal representative's name, email and relationship, term sheets, acceptances and objections for agency-sourced deals and settlement records, and identity-check results and "AZET Verified" badge decisions
- Badge decision records are deleted one year after the badge is removed or the agreement ends.
- Legal basis and retention: concluding and performing the contract (Korean Personal Information Protection Act art. 15(1)(4)); kept for 10 years after the contract ends. See the personal-data clause of that e-contract for details
- The signature image is not analysed for anything other than confirming the signature.
- Outsourced processing (Korean Personal Information Protection Act art. 26): processor AZET LLC; task: running the e-contract signing and storage system and sending contract emails / sub-processor: Cloudflare, Inc. (storage, email delivery, contract PDF generation)
- Overseas transfer (same Act art. 28-8(1)(3)(a)): recipients AZET LLC (United States, help@sponmi.com) and Cloudflare, Inc. (United States and countries where Cloudflare operates data centres, privacy@cloudflare.com) / items: the data listed above / when and how: sent over the network when the contract is prepared and signed / purpose: e-contract signing and storage / retention: 10 years after the contract ends / how to refuse and the effect: do not sign, or write to content@azentertainment.kr; the e-contract then cannot be concluded or maintained
- Requests to access, correct or delete this information may be sent to AZ Entertainment (content@azentertainment.kr); requests sent to the Company are forwarded without delay.
10. Processors
The Company entrusts the processing of personal information as follows to provide the service smoothly.
- Cloud infrastructure (web hosting, database, file storage, email sending, contract PDF generation): Cloudflare, Inc.
- Automated-abuse checks on sign-up, log-in and contact forms (Cloudflare Turnstile — it checks connection and browser signals and is not used for advertising; the Cloudflare Turnstile Privacy Addendum applies): Cloudflare, Inc.
- Backup email sending (when Cloudflare sending fails): Resend, Inc.
- Error collection: Functional Software, Inc. (Sentry)
- Bank-deposit confirmation: PayAction
- Card payments (US-dollar purchases): Stripe, Inc.
- PayPal payments and PayPal payouts to creators: PayPal, Inc.
- PayPal checkout through a Korean payment gateway (opening the PayPal window and confirming the payment, US-dollar purchases): Toss Payments Co., Ltd. (Republic of Korea) — receives only the order number and amount; PayPal account details are entered in PayPal's own window
- Card and local payment methods (US-dollar purchases): Tazapay Pte. Ltd.
- Wise payouts to creators: Wise
- Processors receive only the minimum information needed for the entrusted purpose and are bound by data-protection obligations in the processing agreement.
11. International transfers
The Company processes and stores personal information outside Korea as follows to provide the service (Korean Personal Information Protection Act art. 28-8(1)(3)(a)). You can refuse the transfer by leaving the service, but you then cannot use it.
- Cloudflare, Inc. (United States and countries where Cloudflare data centres are located, privacy@cloudflare.com) — data: member information, usage records, channel information, payment and payout records, e-contract documents / purpose: web hosting, database, file storage, email sending / when and how: sent over the network when you use the service / retention: until you leave or the statutory retention period ends
- Resend, Inc. (United States) — data: email address, message body / purpose: backup sending of verification emails / when and how: sent over the network when Cloudflare sending fails / retention: destroyed after sending according to the processor's retention rules
- Functional Software, Inc. (Sentry, United States) — data: IP address, browser information and error records when an error occurs / purpose: error analysis / when and how: sent over the network when an error occurs / retention: 90 days
- Google LLC (United States) — data: cookie identifiers, connection data (device and browser type, referring page), page-use records / purpose: usage statistics (Google Analytics; where consent is required, only with your consent) / when and how: sent over the network when you view a page / kept: up to 14 months (Google Analytics retention setting). Creator video thumbnails load directly from YouTube (Google) servers, so your IP address reaches Google when they load.
- Stripe, Inc. (United States) — data: name, email, billing country and address, amount and order number (card details are typed into Stripe's payment page and never pass through the Company) / purpose: card payments, refunds and fraud prevention / when and how: sent over the network when you pay / retention: Stripe's statutory retention rules
- PayPal, Inc. (United States) — data: email, amount and order number; for payouts, the recipient's PayPal address and the amount / purpose: PayPal payments and refunds, creator payouts / when and how: sent over the network when you pay or are paid / retention: PayPal's statutory retention rules
- Tazapay Pte. Ltd. (Singapore) — data: name, email, billing country, amount and order number (payment-method details are typed into Tazapay's payment page) / purpose: card and local-payment-method payments and refunds / when and how: sent over the network when you pay / retention: Tazapay's statutory retention rules
- Wise — data: recipient name, account details and amount / purpose: payouts when the creator chooses Wise / when: at payout / retention: Wise's statutory retention rules
- When we transfer personal data from the EEA, the UK or Switzerland to countries without an adequacy decision (such as the United States), we rely on our processors' data processing terms that include the European Commission's Standard Contractual Clauses (with the UK Addendum, and clauses recognised by the Swiss FDPIC), or on the processor's certification under the EU-U.S. Data Privacy Framework. You can ask for a copy of these safeguards at privacy@sponmi.com.
- Rights-ledger text and consent records, prepaid-balance history and derivative-upload tracking data are also stored in the Cloudflare, Inc. database and file storage (R2) above.
12. Your rights
You may exercise the following rights over your personal information at any time.
- Access: you can see the personal information the Company holds about you.
- Correction or deletion: you can ask for inaccurate information to be corrected or unnecessary information to be deleted.
- Suspension: you can ask the Company to stop processing your personal information.
- Revoking Google/YouTube access: you can revoke access yourself in Google security settings (https://security.google.com/settings/security/permissions).
- Disconnecting social media: you can disconnect Instagram, TikTok and others in the service settings.
- Leaving: you can leave in the service settings; your personal information is then destroyed, except what the law requires us to keep and rights-ledger records.
- Consent records in the rights ledger prove that a licence was formed, so they are not edited; errors are corrected by adding a correction record.
- Copy of your data (export): email privacy@sponmi.com from your account address and we will send you the information we hold about you (account, channels, orders, licences and payouts) in a machine-readable format (JSON or CSV).
- You can also ask through an authorised agent; we will confirm your authorisation. We verify requests through your account email address.
- You can exercise these rights in the service settings or by email (privacy@sponmi.com or help@sponmi.com); requests are handled within 10 days of receipt.
13. Rights of users outside Korea
Where the law where you live gives you stronger protection, you have those rights too. Send any of the requests below the same way as above (privacy@sponmi.com).
- EEA, UK and Switzerland: you have the right of access, rectification, erasure, restriction, data portability (a machine-readable copy), to object to processing based on legitimate interests and to direct marketing, and to withdraw consent. You can complain to the data protection authority where you live (EU authorities: edpb.europa.eu, UK ICO: ico.org.uk, Swiss FDPIC: edoeb.admin.ch).
- We have not yet appointed an EU or UK representative under Article 27 of the GDPR or the UK GDPR. When we do, we will publish the name and contact details here; until then, contact us directly at privacy@sponmi.com.
- Japan: the Company is a business located outside Japan (in the United States). For the personal-data protection systems of the countries listed under "International transfers", see the Personal Information Protection Commission's survey of foreign systems (ppc.go.jp). Requests to notify the purpose of use, disclose, correct or stop using retained personal data can be sent to privacy@sponmi.com.
- Brazil (LGPD) and other countries: you can exercise the rights your local law gives you through the same contact.
- Children: the service is not directed to children. Children under 14 (in the EEA and the UK, under the age set by their country, up to 16) cannot sign up without a parent's or guardian's consent; if we learn we collected such data without consent, we delete it without delay.
14. Notice for US residents (California CCPA/CPRA and other states)
This section applies to users covered by California and other US state privacy laws.
- Categories of personal information collected in the last 12 months: identifiers (name, email, account ID, IP address), commercial information (orders, payments, refunds), internet activity (usage records, cookies), approximate location (country inferred from the IP address), and professional or business information (company name, channel information, tax ID). Sources, purposes and retention are as described in "Information we collect and how", "How we use it" and "How long we keep it".
- We do not sell personal information and do not share it for cross-context behavioural advertising, including that of consumers under 16. That is why there is no separate "Do Not Sell or Share My Personal Information" link.
- We treat a Global Privacy Control (GPC) signal from your browser as an opt-out request: analytics cookies are not loaded unless you choose "Accept all" yourself.
- Sensitive personal information (such as tax IDs and financial accounts) is used only as needed for payouts and tax, never to infer characteristics about you.
- You have the right to know (including a copy), delete, correct, opt out of sale or sharing, and limit the use of sensitive personal information, and we will not discriminate against you for using these rights. Email privacy@sponmi.com; we verify you through your account email and respond within 45 days. If an authorised agent asks for you, we confirm your written authorisation.
- We disclose personal information only to service providers and contractors under contract for the service (see "Processors").
15. Security measures
The Company takes the following technical, administrative and physical measures to keep personal information safe.
- Technical: encrypted transmission (TLS), encryption of stored data, row-level access control, and only hashes of login session tokens are stored
- IP addresses in consent records are stored only as hashes, never in plain form, and the rights ledger is append-only.
- Administrative: as few staff as possible handle personal information, with regular security training
- Social-media tokens: OAuth tokens are stored encrypted, and only the minimum scopes are requested.
17. Privacy officer
The privacy officer responsible for personal-information processing is as follows.
- Service: Sponmi (operated by AZET LLC)
- Email: help@sponmi.com
- Privacy requests (access, copy, deletion and more): privacy@sponmi.com
- Website: https://sponmi.com
- You can contact the officer with any privacy question, complaint or request for redress arising from your use of the service.
18. Changes to this policy
This privacy policy may change with laws, policies or the service, and we will announce changes in advance through service notices or email. This policy is provided in Korean, English and Japanese; if the versions differ, the Korean version prevails.
- Effective: 2026-10-19
- Previous version effective: 2026-10-12 — changed: what we collect on US tax forms and how long we keep them; Toss Payments added as a processor (PayPal checkout)
Privacy enquiries
AZET LLC · help@sponmi.com
Website: https://sponmi.com
For other reports or advice about privacy violations in Korea, contact the KISA Privacy Infringement Report Center (privacy.kisa.or.kr, 118).