Privacy Policy

1. Purposes of processing

We process personal information only for the purposes below. If a purpose changes, we take the steps PIPA Article 18 requires, such as obtaining separate consent.

• Sign-up and tenant setup: verifying sign-up requests and the administrator, creating the company workspace (tenant), and contacting you about sign-up
• Providing the Service: sign-in and permissions, and the features you request — AI agent chat, workflow automation, e-approval, documents, mail and calendar
• Consultations: confirming consultation requests and contacting you
• Support and notices: answering inquiries and sending notices needed to run the Service (outages, security, changes to terms)
• Reliability and security: preventing misuse, keeping access logs, analysing incidents
• (Only if you opted in) product news and pilot program emails

2. Personal information we process

For member information and business data a customer puts into the Service, the customer is the controller (personal information controller). The Operator processes it on the customer's behalf, only on the customer's instructions and within the contract.

3. Retention periods

We keep personal information only for the period required by law or agreed with you, and destroy it without delay when that period ends.

• Sign-up requests: until sign-up is completed or the request is withdrawn
• Accounts: until you close your account or the customer's contract ends
• Consultation requests: one year after the consultation ends (destroyed immediately if you ask earlier)
• Customer data: for the term of the customer's contract; after it ends, destroyed after a period in which the customer can export it
• Connected-service tokens: until you disconnect the service or the account is deleted
• Access logs: 3 months (Protection of Communications Secrets Act)
• For paid use, contract and payment records: 5 years; consumer complaint and dispute records: 3 years (Act on Consumer Protection in Electronic Commerce)

4. Provision to third parties

We process personal information only within the purposes in Section 1 and do not provide it to third parties except with your consent or where the law specifically allows (PIPA Articles 17 and 18). We currently provide no personal information to third parties.

5. Processors (outsourcing)

We use the processors below to provide the Service. Our contracts with them prohibit processing beyond the stated purpose and require technical and organisational safeguards, restrict sub-processing, and set out supervision and liability. We supervise their handling of personal information.

If a customer registers its own AI model key (BYOK), those requests go to the provider the customer has contracted with, under the customer's account. We will update this policy without delay if processors or entrusted work change.

6. Services you connect

Only when you authorize a connection do we read or write data in your account through these services' APIs. You can disconnect at any time on the Service's Connections screen or in the provider's account settings.

7. Google API Services User Data Policy (Limited Use)

The Service's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.

• We use Gmail, Google Calendar and Google Drive data only to provide the features you see on screen or ask an AI agent for — reading, summarising, drafting replies to and sending mail; checking and adding events; opening and saving files.
• We do not use this data for advertising (including personalised, retargeted or interest-based ads), and we do not sell it.
• We do not use this data to develop, improve or train generalised AI or machine-learning models. When we pass it to an AI model provider to carry out a feature you requested, we limit it to that purpose and use only API terms under which the provider does not train models on the input.
• Humans do not read this data, except with your explicit consent for specific data, when necessary for security purposes (such as investigating abuse), to comply with applicable law, or when aggregated and anonymised for internal operations.
• We do not transfer this data to third parties except as necessary to provide or improve user-facing features, for security, or to comply with applicable law.

8. International transfers

Our servers and database are in Microsoft Azure's Korea Central region. Personal information is transferred abroad for the processing below (PIPA Article 28-8). Transfers happen each time you use the relevant feature, over encrypted connections (TLS).

If you do not want your information transferred abroad, ask your company administrator to turn off the relevant AI models, research or connections, or contact us. Those features will then be unavailable.

9. Destruction

When the retention period ends or the purpose is achieved, we destroy personal information without delay. Where another law requires us to keep it, we store it separately from other personal information.

• Electronic files: deleted so they cannot be recovered (database rows and storage objects deleted; backups overwritten when their retention cycle ends)
• Paper: shredded or incinerated

10. Your rights and how to exercise them

You may at any time ask us to give you access to, correct, delete or stop processing your personal information, or withdraw consent. Send a request in writing or by email ([Operator details not configured]) and we will act without delay (within 10 days). A representative must submit a power of attorney.

For member information entered by a customer, the customer is the controller; we will forward your request to the customer and help them handle it.

Information the law requires us to collect cannot be deleted, and access or suspension may be limited where it could harm another person's rights.

11. Security measures

• Organisational: an internal management plan, and a minimum number of trained staff handling personal information
• Technical: encryption in transit (TLS), one-way password hashing, encrypted storage of connected-service tokens and API keys (AES-256-GCM, with keys in a cloud key vault), per-tenant data separation, role-based access control
• Records: data changes, approvals and use of privileges are kept in tamper-evident audit logs
• Physical: access control at our cloud provider's (Microsoft Azure) data centres

12. Cookies

We use only the cookies needed to keep you signed in and remember screen settings. We do not use advertising or behavioural-analytics cookies or third-party analytics tools.

You can block cookies in your browser settings, but without the session cookie you cannot use features that require sign-in. Drafts you are writing are kept only in your browser's storage.

13. Privacy officer

We have designated a privacy officer who oversees personal information processing and handles complaints and remedies.

• Privacy officer: [Operator details not configured]
• Contact: [Operator details not configured]

14. Remedies

For remedies for infringement of personal information, you can apply for dispute resolution or advice to these Korean authorities.

• Personal Information Dispute Mediation Committee: 1833-6972, www.kopico.go.kr
• Privacy Infringement Report Center (KISA): 118, privacy.kisa.or.kr
• Supreme Prosecutors' Office: 1301, www.spo.go.kr
• Korean National Police Agency: 182, ecrm.police.go.kr

15. Changes to this policy

This policy applies from [Operator details not configured]. We will announce additions, deletions or changes on the Service at least 7 days before they take effect (30 days for changes that significantly affect your rights).