한국어

OwlAI Privacy Policy

Version: 2026-10-23-draft · Effective date: 2026-10-23

TmaxTibero Co., Ltd. (the "Company") sets out this Privacy Policy to protect the personal information of users of the OwlAI cloud service (the "Service") in accordance with the Personal Information Protection Act of Korea and other applicable laws, and to handle related complaints promptly.

Type Purpose Items Retention
Required Sign-up and identity verification, account management, provision of the Service, notices and support Email address, name, password, records of adult confirmation (legal adult in the country of residence) and consent to the terms Until withdrawal or account deletion (or longer where the law requires retention)
Optional Information about new features, events and offers Email address, record of marketing consent Until consent is withdrawn or the user withdraws

You may refuse consent. Without the required consents you cannot sign up; refusing the optional consent does not limit your use of the Service.

1. Purposes of Processing

The Company processes personal information only for the following purposes. If a purpose changes, the Company takes the steps required by law, such as obtaining prior consent.

  1. Membership: confirming the intent to sign up, verifying identity and adulthood (legal adult in the country of residence), protecting accounts (sign-in security, two-step verification), preventing misuse, and sending notices
  2. Providing the Service: question answering using generative AI, document storage and search, database connections, meeting transcription and minutes, workflow automation, external service connections, and managing organizations and members
  3. Paid Services: verifying subscriptions, metering and billing usage, and preventing repeated free-trial claims
  4. Operating and improving the Service: incident response, security auditing, answer quality improvement, usage statistics
  5. Handling complaints: reviewing and answering inquiries and handling disputes
  6. Marketing (only with optional consent): information about new features, events and offers

2. Personal Information Processed and How It Is Collected

Category Items
Sign-up and account Email address, name, password (stored with irreversible hashing), time zone and display language, time of adult confirmation, consent records (version, items, time), two-step verification data, organization memberships and roles
Information you enter or upload while using the Service Questions and conversations, attachments and uploaded documents, meeting audio and its transcripts and minutes, voice input, saved memories, workflow automation settings and run results, ratings of answers, external service and database connection details (connection details and credentials are stored encrypted)
Information generated or collected automatically IP address, browser and device information (User-Agent), access times, sign-in success and failure records, usage and error records, AI usage, browser notification subscriptions (if you turn notifications on)
Paid Services AWS account identifier, subscription and contract details, number of seats and usage, free-trial claim records (an irreversibly transformed value of the email address and the email domain). Card numbers and other payment details are processed by Amazon Web Services; the Company does not receive them.
Organization invitations Email address of the invitee (entered by an organization administrator)

The Company collects personal information through the sign-up screen, the Service screens and support email, and collects information generated automatically while you use the Service. Please take care not to enter other people's personal information or sensitive information into the Service.

3. Retention Periods

The Company destroys personal information without delay once the purpose of processing is achieved. Retention periods are:

Information Retention
Account information Until withdrawal or account deletion. The account remains even if you no longer belong to any organization, so you can accept invitations from other organizations.
Conversations (questions, answers, list of attachments) 1 year from the last activity. If you delete a conversation, it is destroyed 30 days after deletion. Attachments uploaded to a conversation are destroyed as soon as it is deleted.
Files created in conversations (documents, spreadsheets, presentations, etc.) 7 days from creation
Ratings of answers and the conversations sent with them 90 days from the rating
Meeting audio Destroyed as soon as recording of the meeting ends. A meeting left paused for 7 days is ended automatically and its audio destroyed.
Meeting records (transcripts, minutes), uploaded documents, memories Until you delete them or your organization is closed
Workflow automation run records The most recent 100 runs per automation. Destroyed together with the automation.
Service operation records (AI call records, processing step records, job history, application logs) Up to 90 days
Access and administration records (sign-ins, permission changes, access by administrators and operators) 3 years
Sign-up verification and password reset records (email, requesting IP) 7 days after use or expiry
Organization invitations (invitee email) 30 days after the invitation is accepted, revoked or expires
AI usage records Until your organization is closed. After closure, items that identify you are removed and only statistics remain.
AWS Marketplace sign-up linking records (IP, AWS account identifier) 7 days after linking completes
Free-trial claim records [to be confirmed]. Used only to prevent the same person from claiming a free trial again.
  1. When an organization is closed, the Company keeps its data for 30 days from closure and then destroys it. Access and administration records, billing and subscription records, and free-trial claim records are kept separately for the periods above and in paragraph 3.
  2. Deleted information remains briefly in backups for disaster recovery. Previous versions in file storage are removed automatically after up to 30 days, and database backups after up to 7 days. The Company uses backups only for recovery.
  3. Information that laws require to be kept is stored separately for the required period. [to be confirmed: applicable laws and items]
    • Records of contracts or withdrawal of offers: 5 years (Act on the Consumer Protection in Electronic Commerce)
    • Records of payment and supply of goods: 5 years (same Act)
    • Records of consumer complaints or dispute handling: 3 years (same Act)
    • Service access records (sign-in records, access location): 3 months (Protection of Communications Secrets Act)

4. Destruction Procedure and Method

  1. Information whose retention period has passed or whose purpose has been achieved is destroyed automatically every day. Information to be kept under law is moved and stored separately.
  2. Electronic information is deleted in a way that cannot be recovered. The Company does not keep personal information on paper.

5. Provision to Third Parties

The Company does not provide your personal information to third parties, except where you have separately consented, or where the law specifically provides for it or it is unavoidable to comply with a legal obligation.

6. Entrustment of Processing

The Company entrusts the following processing to provide the Service.

Processor Entrusted work Location
Amazon Web Services, Inc. Service infrastructure (servers, databases, file storage, log storage), embedding processing for document search (Amazon Bedrock), email delivery (Amazon SES) Republic of Korea (Asia Pacific (Seoul) Region)

The Company's entrustment contracts require compliance with personal information laws, prohibit processing for other purposes, and set out technical and administrative safeguards, limits on sub-entrustment and liability for damages. The Company supervises processors to ensure they handle personal information securely. Changes to processors or entrusted work are announced through this Policy.

7. Transfer of Personal Information Abroad

To perform its service contract with you, the Company transfers personal information abroad for processing as follows (Article 28-8(1)(3) of the Personal Information Protection Act). All transfers use encrypted connections (TLS).

Recipient (contact) Country Items transferred Purpose Time and method Retention by recipient
OpenAI, L.L.C.
([to be confirmed: privacy contact])		 United States Questions and conversations, content extracted from attachments and documents, voice input Generating AI answers, transcribing voice input Sent over the network each time you ask a question or use voice input The Company asks that responses not be stored. The provider may keep data for up to 30 days for abuse monitoring and then delete it. The provider does not use this data to train its models.
AssemblyAI, Inc.
([to be confirmed: privacy contact])		 [to be confirmed: EU region country] Meeting audio Meeting transcription Sent over the network in segments while a meeting is being recorded The Company requests deletion of the audio and transcript as soon as the transcript is received. If that request fails, the data is deleted within [to be confirmed: account retention time] under the provider's retention setting. Model training is opted out.
Cohere Inc.
([to be confirmed: privacy contact])		 [to be confirmed: Canada or United States] Search queries, excerpts of candidate documents Ranking document search results Sent over the network each time documents are searched Kept by the provider for up to 30 days and then deleted. [to be confirmed: training opt-out]
Tavily
([to be confirmed: legal entity name, privacy contact])		 United States Web search queries (generated from the conversation), web addresses to read Web search Sent over the network each time a web search is made Query data is set not to be used for service improvement. [to be confirmed: provider retention period]
Amazon Web Services, Inc. (AWS Marketplace) United States AWS account identifier, subscription details, number of seats and usage Verifying subscriptions, metering and billing Sent over the network when a subscription is linked and when usage is reported According to the provider's billing and accounting policies
Supabase, Inc.
([to be confirmed: privacy contact])		 United States Connection credentials, queries you run Querying a Supabase database your organization chose to connect Sent over the network when your organization connects or queries Supabase According to the agreement between you and Supabase
  1. You may refuse the transfer abroad by emailing the Privacy Officer below. However, AI answers, meeting transcription, search ranking and web search cannot be provided without the transfer, so refusing may mean you cannot use those features or must terminate the service agreement. No data goes to Supabase unless your organization connects it.
  2. Information sent to external services your organization connects (MCP servers, external databases, etc.) and to browser notification services when you turn notifications on is transferred at your choice, and is processed under those providers' policies.
  3. Changes to recipients or items transferred abroad are announced through this Policy.

8. Access by Organization Administrators and the Company

  1. When you rate an answer or a run result, the administrators of your organization can see the full conversation (or run result or meeting minutes). The screen tells you this before you rate.
  2. The Company's service operators may view the ratings in paragraph 1 and the full conversations to improve answer quality. Such access is recorded in the organization's access records, which organization administrators can review.
  3. If the Company needs direct database access to investigate a failure or handle an inquiry, it notifies the organization in advance. Operators access the database only through individual accounts, and these access records are kept for 3 years.

9. Your Rights and How to Exercise Them

  1. You may at any time request access to, correction or deletion of, or suspension of processing of your personal information, and withdraw consent. You can edit or delete account information, conversations, documents and memories directly in the Service; for other requests and account withdrawal, email the Privacy Officer below.
  2. The Company acts on a request within 10 days of receipt and informs you of the result. If the Company refuses or delays a request as permitted by law, it tells you why.
  3. Organization data (documents placed in the organization, organization settings, etc.) is managed by organization administrators. The Company may handle requests about such data together with them.
  4. You may exercise your rights through a legal representative or an authorized agent, who must submit a power of attorney.
  5. The Company does not make decisions that have legal or similarly significant effects on you solely by automated processing.

10. Personal Information of Children and Minors

The Company does not collect personal information of children under 14. Only legal adults in their country of residence may sign up for the Service, and the Company does not knowingly collect personal information from minors. On learning that a minor has signed up, the Company destroys that account and its personal information without delay.

11. Security Measures

  1. Administrative: an internal management plan, minimizing personnel who handle personal information, and regular training
  2. Technical: irreversible hashing of passwords, encryption of credentials using a key management service (AWS KMS), encryption of stored data, encryption in transit (TLS), role-based access control, two-step verification, limits on failed sign-ins, and retention and tamper protection of access records
  3. Physical: storing personal information in access-controlled cloud data centers (Amazon Web Services)

12. Automatic Collection Tools

  1. The Company does not use cookies or tracking tools for advertising or behavioral analytics. The Service keeps authentication data in browser storage to keep you signed in, and briefly uses a security cookie when connecting external services.
  2. You can clear or block cookies and storage in your browser settings. If you block them, you cannot sign in or connect external services.

13. Privacy Officer and Complaints

For reports or advice about privacy infringement, you may also contact the following Korean authorities.

14. Changes to This Policy

The Company announces changes to this Policy within the Service at least 7 days before they take effect. Changes that are important to your rights, such as items collected, purposes of use or transfers abroad, are announced at least 30 days in advance, and consent is obtained again where required.

Company Information