Privacy Policy

The Company processes personal information for the purposes below. Processed information is not used for any other purpose. Where a purpose changes, the Company takes the necessary measures, including obtaining separate consent under Article 18 of the Personal Information Protection Act.

• Member account management: providing membership-based services, identity verification, account creation and management, and the conclusion, maintenance, and termination of service agreements
• Service delivery: configuring and operating the AI counseling agent, messaging channel integration, knowledge document management, and providing conversation histories and reports
• Payment and subscription management: collecting service fees, changing or cancelling subscription plans, confirming payment records, and processing refunds
• Customer support and complaint handling: responding to inquiries, handling complaints, and delivering notices
• Service improvement and quality analysis: analyzing service usage, improving AI counseling quality, and developing new features
• Sales and onboarding inquiries: providing information and consultation to organizations interested in adopting the Service
• Legal compliance: retaining transaction records required by e-commerce legislation and resolving legal disputes

The Company processes the following categories of personal information in order to provide the Service.

1. Service administrators (customer account holders)

2. Information collected at payment

3. Messaging-channel users (end customers of the customer organization)

The items below are collected while an end customer converses with the AI counseling bot operated by the customer organization through its messaging channel. Whether and what is collected varies with that organization's bot configuration.

4. Adoption inquiries (preview and lead capture)

5. Automatically collected information

• IP address, operating system, visit timestamp, and service usage records
• Session authentication cookies (see Article 9 below)
• API usage logs (AI model call counts, input and output token counts — for billing and operations, not for identifying individuals)

The Company processes and retains personal information within the retention period required by law or the period consented to by the data subject. Information is destroyed without delay once the retention period expires or the processing purpose is achieved.

Where retention is required under applicable law, the information is stored separately for the required period and then destroyed.

As a rule, the Company does not provide personal information to third parties. The following are exceptions.

• Where the data subject has given prior consent
• Where required by law (a lawful request from an investigative authority, a court order, and the like)

The Company delegates personal information processing tasks as set out below in order to deliver the Service. Any change of processor will be announced through this policy.

For AI language model processing (OpenAI and others), see Article 10 (Cross-Border Transfer of Personal Information).

1. Procedure

Where the retention period has expired or the processing purpose has been achieved, the Company destroys the personal information without delay. Information that must be retained under law is separated into a distinct database (or storage location) and destroyed once the period expires.

2. Method

• Electronic files: deleted by technical means that make recovery impossible (permanent database deletion, overwriting, and the like)
• Paper documents: shredded or incinerated

A data subject (the user or their legal representative) may exercise the following rights against the Company at any time.

• The right to request access to personal information
• The right to request correction or deletion
• The right to request suspension of processing
• The right to request data portability (Personal Information Protection Act, Article 35-2, effective March 15, 2024)
• The right to refuse, or request an explanation of, an automated decision

How to exercise: submit a request in writing or by email to the privacy officer listed in Article 11 below, or through the customer inquiry channel. The Company will act within 10 days.

Where a data subject requests correction or deletion of an error in their personal information, the Company will not use or provide that information until processing is complete.

These rights may also be exercised through a legal representative or an authorized agent, in which case a power of attorney in the form prescribed by Annex 11 of the Enforcement Rules of the Personal Information Protection Act must be submitted.

In accordance with Article 29 of the Personal Information Protection Act and the Standards for Securing the Safety of Personal Information, the Company implements the following technical, administrative, and physical measures.

• Password encryption: user passwords are stored using one-way encryption with the bcrypt algorithm.
• Encryption in transit: HTTPS/TLS is applied when personal information is transmitted.
• Access control: access to personal information processing systems is granted at the minimum necessary for the work and reviewed periodically.
• Access log retention and tamper prevention: access logs for personal information processing systems are retained and their integrity is managed.
• Vulnerability management: security software is operated to prevent leakage of personal information through external attacks or malicious code.
• Internal management plan: an internal management plan for the safe handling of personal information is established and operated.
• Staff training: personnel who handle personal information receive regular training.

1. Use

The Service uses cookies to authenticate users and maintain sessions. A cookie is a small piece of information stored by the website server in the user's browser, used here solely to keep users signed in and for security.

2. Purposes

• Maintaining the signed-in state (NextAuth session cookie)
• Security tokens to defend against CSRF attacks

3. How to refuse

You may refuse cookie storage through your browser settings. If you do, services requiring sign-in will not be available.

• Chrome: Settings > Privacy and security > Cookies and other site data
• Safari: Preferences > Privacy
• Edge: Settings > Cookies and site permissions

To provide AI counseling functionality, the Service transfers personal information abroad as set out below. This disclosure is made under Article 28-8 of the Personal Information Protection Act.

Where the purpose, items, or recipients change, or a new cross-border transfer arises, the Company will announce it through this policy.

OpenAI data processing policy: platform.openai.com/docs/guides/safety-best-practices

The Company has designated the following privacy officer to oversee personal information processing and to handle complaints and remedy damages relating to data subjects' personal information.

A data subject may apply to the bodies below for dispute resolution or consultation regarding a personal information infringement. These bodies are separate from the Company; please contact them if you are not satisfied with the Company's own handling of a complaint or need further assistance.

This policy applies from its effective date. Where legislation or the policy changes result in additions, deletions, or corrections, the Company will give notice through in-service announcements from 7 days before the change takes effect. Where a change materially affects the rights or obligations of data subjects, notice will be given from 30 days before.