Privacy Policy

1. Purposes of processing

We process personal information only for the purposes below. If a purpose changes, we take the steps PIPA Article 18 requires, such as obtaining separate consent.

• Sign-up and tenant setup: verifying sign-up requests and the administrator, creating the company workspace (tenant), and contacting you about sign-up
• Providing the Service: sign-in and permissions, and the features you request — AI agent chat, workflow automation, e-approval, documents, mail and calendar
• Consultations: confirming consultation requests and contacting you
• Support and notices: answering inquiries and sending notices needed to run the Service (outages, security, changes to terms)
• Reliability and security: preventing misuse, keeping access logs, analysing incidents
• (Only if you opted in) product news and pilot program emails

2. Personal information we process

For member information and business data a customer puts into the Service, the customer is the controller (personal information controller). The Operator processes it on the customer's behalf, only on the customer's instructions and within the contract.

3. Retention periods

We keep personal information only for the period required by law or agreed with you, and destroy it without delay when that period ends.

• Sign-up requests: until sign-up is completed or the request is withdrawn
• Accounts: until you close your account or the customer's contract ends
• Consultation requests: one year after the consultation ends (destroyed immediately if you ask earlier)
• Customer data: for the term of the customer's contract; after it ends, destroyed after a period in which the customer can export it
• Connected-service tokens: until you disconnect the service or the account is deleted
• Access logs: 3 months (Protection of Communications Secrets Act)
• For paid use, contract and payment records: 5 years; consumer complaint and dispute records: 3 years (Act on Consumer Protection in Electronic Commerce)

4. Provision to third parties

We process personal information only within the purposes in Section 1 and do not provide it to third parties except with your consent or where the law specifically allows (PIPA Articles 17 and 18). We currently provide no personal information to third parties.

5. Processors (outsourcing)

We use the processors below to provide the Service. Our contracts with them prohibit processing beyond the stated purpose and require technical and organisational safeguards, restrict sub-processing, and set out supervision and liability. We supervise their handling of personal information.

If a customer registers its own AI model key (BYOK), those requests go to the provider the customer has contracted with, under the customer's account. We will update this policy without delay if processors or entrusted work change.

6. Services you connect

Only when you authorize a connection do we read or write data in your account through these services' APIs. You can disconnect at any time on the Service's Connections screen or in the provider's account settings.

7. Google API Services User Data Policy (Limited Use)

The Service's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.

• We use Gmail, Google Calendar and Google Drive data only to provide the features you see on screen or ask an AI agent for — reading, summarising, drafting replies to and sending mail; checking and adding events; opening and saving files.
• We do not use this data for advertising (including personalised, retargeted or interest-based ads), and we do not sell it.
• We do not use this data to develop, improve or train generalised AI or machine-learning models. When we pass it to an AI model provider to carry out a feature you requested, we limit it to that purpose and use only API terms under which the provider does not train models on the input.
• Humans do not read this data, except with your explicit consent for specific data, when necessary for security purposes (such as investigating abuse), to comply with applicable law, or when aggregated and anonymised for internal operations.
• We do not transfer this data to third parties except as necessary to provide or improve user-facing features, for security, or to comply with applicable law.

8. International transfers

Our servers and database are in Microsoft Azure's Korea Central region. Personal information is transferred abroad for the processing below (PIPA Article 28-8). Transfers happen each time you use the relevant feature, over encrypted connections (TLS).

If you do not want your information transferred abroad, ask your company administrator to turn off the relevant AI models, research or connections, or contact us. Those features will then be unavailable.

9. Destruction

When the retention period ends or the purpose is achieved, we destroy personal information without delay. Where another law requires us to keep it, we store it separately from other personal information.

• Electronic files: deleted so they cannot be recovered (database rows and storage objects deleted; backups overwritten when their retention cycle ends)
• Paper: shredded or incinerated

10. Your rights and how to exercise them

You may at any time ask us to give you access to, correct, delete or stop processing your personal information, or withdraw consent. Send a request in writing or by email ([Operator details not configured]) and we will act without delay (within 10 days). A representative must submit a power of attorney.

For member information entered by a customer, the customer is the controller; we will forward your request to the customer and help them handle it.

Information the law requires us to collect cannot be deleted, and access or suspension may be limited where it could harm another person's rights.

11. Security measures

• Organisational: an internal management plan, and a minimum number of trained staff handling personal information
• Technical: encryption in transit (TLS), one-way password hashing, encrypted storage of connected-service tokens and API keys (AES-256-GCM, with keys in a cloud key vault), per-tenant data separation, role-based access control
• Records: data changes, approvals and use of privileges are kept in tamper-evident audit logs
• Physical: access control at our cloud provider's (Microsoft Azure) data centres

12. Cookies

We use only the cookies needed to keep you signed in and remember screen settings. We do not use advertising or behavioural-analytics cookies or third-party analytics tools.

You can block cookies in your browser settings, but without the session cookie you cannot use features that require sign-in. Drafts you are writing are kept only in your browser's storage.

13. Privacy officer

We have designated a privacy officer who oversees personal information processing and handles complaints and remedies.

• Privacy officer: [Operator details not configured]
• Contact: [Operator details not configured]

14. Remedies

For remedies for infringement of personal information, you can apply for dispute resolution or advice to these Korean authorities.

• Personal Information Dispute Mediation Committee: 1833-6972, www.kopico.go.kr
• Privacy Infringement Report Center (KISA): 118, privacy.kisa.or.kr
• Supreme Prosecutors' Office: 1301, www.spo.go.kr
• Korean National Police Agency: 182, ecrm.police.go.kr

15. Changes to this policy

This policy applies from [Operator details not configured]. We will announce additions, deletions or changes on the Service at least 7 days before they take effect (30 days for changes that significantly affect your rights).

16. Additional information for EU and UK users (GDPR)

This section gives additional information required by the General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) and the UK GDPR when we process personal data of people in the European Union (EU), the European Economic Area (EEA) or the United Kingdom (GDPR Art. 3, 13 and 14). It applies together with sections 1–15; where they differ, the more protective provision for the data subject applies.

16-1. Controller and processor

If you are a member of a company, the fastest way to exercise your rights is through your company. Requests sent from "Account settings · My data" go to your company's administrator, and the operator supports the company technically.

16-2. Purposes and legal bases (GDPR Art. 6)

You have the right to object to processing based on legitimate interests (Art. 21).

16-3. Retention periods

Retention periods are as in section 3. Your company sets the retention of company data; company administrators can set retention for AI memories, request records and export files under "Privacy management". Records still under a statutory retention period are stored separately from other data and destroyed when the period ends.

16-4. Recipients and sub-processors

We send AI model providers only what the task you requested needs (your question and the relevant parts of the documents, e-mails or business records used for it). Resident registration numbers, card numbers and similar data are masked before files are uploaded or added to the knowledge index. Under the providers' API terms, input data is not used to train models. If your company registers its own key (BYOK), requests go to the provider account your company contracted.

Services you connect yourself, such as Google, Microsoft or Box, are described in section 6. We announce new or changed sub-processors in advance through this policy and the DPA, and your company may object.

16-5. International transfers

• EU/EEA → Republic of Korea: on 17 December 2021 the European Commission decided that the Republic of Korea ensures an adequate level of protection (Commission Implementing Decision (EU) 2022/254, GDPR Art. 45). Transfers to the service's primary storage (Azure Korea Central) rely on this adequacy decision.
• UK → Republic of Korea: transfers rely on The Data Protection (Adequacy) (Republic of Korea) Regulations 2022.
• Republic of Korea → United States and other sub-processor locations: where the provider is certified under the EU-U.S. Data Privacy Framework (adequacy decision of 10 July 2023) we rely on that decision; otherwise on the Commission's Standard Contractual Clauses (SCC, Commission Implementing Decision (EU) 2021/914, Art. 46(2)(c)) with supplementary measures (encryption in transit, data minimisation). We also meet the cross-border transfer requirements of Korea's Personal Information Protection Act (Art. 28-8).
• You can request a copy of the transfer safeguards using the contact details in section 16-8.

16-6. Your rights (GDPR Art. 15–22)

• Access (Art. 15) — the personal data we process and a copy
• Rectification (Art. 16) — correct inaccurate or incomplete data
• Erasure (Art. 17) — when there is no longer a ground to process
• Restriction (Art. 18) — storage only until a dispute is resolved
• Portability (Art. 20) — receive your data in a machine-readable format (JSON)
• Objection (Art. 21) — to processing based on legitimate interests
• Not to be subject to solely automated decisions (Art. 22)
• Withdraw consent (Art. 7(3)) — this does not affect the lawfulness of processing before withdrawal

How to exercise them: in the service, open "Account settings · My data" (the globe menu at the top after signing in) to download your data or send a request, or e-mail [Operator details not configured]. After verifying your identity we respond within one month of receipt; for complex or numerous requests we may extend this by up to two further months and will tell you why (Art. 12(3)). Requests are free of charge (Art. 12(5)).

Even after an erasure request, records we must keep by law (accounting and tax books and vouchers, employment records such as the register of workers) are kept separately, with the reason and period explained, and destroyed when the period ends (Art. 17(3)(b)).

16-7. Automated decision-making and AI

The service's AI Agents produce drafts, summaries, analyses and simulations. Decisions with legal or similarly significant effects — such as performance evaluations, hiring or approvals — are always made by a person; AI alone never makes them (GDPR Art. 22, PIPA Art. 37-2). Performance evaluations use only aggregate metrics disclosed in advance, and you can contest the result and ask for human review.

16-8. Contacts and representatives

Privacy questions and requests: [Operator details not configured]

For member data, the fastest route is your company's (the controller's) privacy contact.

16-9. Right to lodge a complaint (GDPR Art. 77)

• EU/EEA: the supervisory authority of the member state where you live, work or where the infringement took place — list at https://edpb.europa.eu/about-edpb/about-edpb/members_en
• United Kingdom: Information Commissioner's Office (ICO) https://ico.org.uk
• Republic of Korea: Personal Information Protection Commission https://www.pipc.go.kr and the bodies listed in section 14

16-10. Cookies and browser storage (full inventory)

This is the complete list of cookies and browser storage the service uses as of 10 November 2026. Each is strictly necessary to provide the service or serves a feature you requested, so no prior consent is requested (exemption under Art. 5(3) of the ePrivacy Directive). We use no advertising or behavioural analytics cookies, third-party analytics tools or tracking pixels.

If we ever introduce non-essential cookies or analytics tools, we will switch to asking for consent first and update this table.

16-11. Security and breach notification

In addition to the measures in section 11, e-mail addresses, phone numbers and similar values are masked before they are written to audit records (GDPR Art. 5(1)(c) and 25). If we become aware of a personal data breach we inform the company (controller) without undue delay; for processing where the operator is the controller we notify the supervisory authority within 72 hours (Art. 33) and inform data subjects without undue delay where there is a high risk (Art. 34). We also notify and report under Korea's Personal Information Protection Act (Art. 34, 72 hours).