Privacy Policy

Article 1 (Purposes of Processing Personal Information)

The Company processes personal information for the following purposes and does not use it for any other purpose. Where the purpose of use changes, the Company obtains separate consent pursuant to Article 18 of PIPA.

(1) Member registration and management (identity verification and authentication, prevention of fraudulent use, notices and notifications); (2) provision of the AI API routing service (request routing, issuance and management of API keys, usage measurement); (3) payment and settlement (charging and deducting prepaid credits, KRW payments, refunds); (4) issuance of tax invoices and transaction records; (5) customer support and complaint handling; (6) service improvement and security (detection of fraudulent or abnormal use, bot blocking).

This Service uses generative AI. Pursuant to Article 31 of the Framework Act on Artificial Intelligence Development and Trust-Building (Korea), the Company permanently displays, on screens presenting AI-generated outputs such as chat, customer support, and the playground, a notice enabling users to recognize that the output was generated by AI. For the status of transfers of input information to external AI model providers and whether inputs are used for model training, see the cross-border transfer table in Article 5.

Article 2 (Items of Personal Information Collected and Methods of Collection)

Email and display name from an OAuth provider are only prefill suggestions. The account email is the address the user confirms with a six-digit code; the account display name is the value the user reviews or edits and submits.

Sensitive payment information such as full card numbers is processed through the payment gateway NICEPAY Co., Ltd. (NICEPAY) and is not stored directly by the Company. API request bodies (prompts and generated results) are transmitted for routing purposes, and the Company processes the metadata necessary for billing and statistics.

Email and account identifiers needed for sign-up are processed as necessary to perform the contract under Article 15(1)(4) of the Korean PIPA, without mandatory privacy consent. Acceptance of the Terms and confirmation of age 14 or older are sign-up conditions. Marketing email, improvement use of request/response bodies, leaderboard disclosure, and any independent provider training or overseas transfer require separate optional consent with the purpose, items, period, and effect of refusal shown. Refusal or withdrawal does not affect other functions. Without improvement consent, the Company does not store request/response bodies; it processes only usage and billing metadata.

Advertising emails are sent pursuant to Article 50 of the Network Act: the subject line carries an '(Advertisement)' prefix and the body includes an unsubscribe link. You may refuse receipt at any time via the unsubscribe link or under 'Settings > Consent Management'; non-advertising emails required for transactions, authentication, and notices continue to be delivered even after refusal.

Article 2-2 (Processing of Pseudonymized Information)

Pursuant to Article 28-2 of PIPA, the Company may process pseudonymized information without the consent of the data subject for purposes such as statistical compilation, scientific research (including industrial research such as research and development of model routing to improve service quality), and archiving in the public interest. Pseudonymized information means information processed so that a specific individual cannot be identified without additional information.

(1) Items processed: intent classification of API requests (code, translation, reasoning, creative writing, general, etc.), the number of input and output tokens, whether images are included, request parameters such as max tokens and temperature, the number of conversation turns, the request and response models, processing result signals (retry, evaluation, etc.), and irreversible hash values of prompts. The Company does not store the input or response bodies (original text).

(2) Method of pseudonymization: account identifiers (such as member IDs) are replaced with non-restorable pseudonymous keys, and direct identifying information is not included in the pseudonymized information.

(3) Ensuring safety and prohibition of re-identification: Pursuant to Article 28-4 of PIPA, the Company stores and manages pseudonymized information separately from additional information (such as information for generating or restoring pseudonymous keys), and pursuant to Article 28-5 of the same Act, does not process pseudonymized information for the purpose of identifying a specific individual. If, during processing, information identifying a specific individual is generated, the Company immediately ceases processing and recovers and destroys such information.

Article 3 (Period of Processing and Retention of Personal Information)

Consistent with Korean Ministry of Government Legislation interpretation 25-1025, withdrawal of consent does not by itself require us to retain every related item of personal information. We determine whether each record is subject to a separate statutory retention duty and keep only the minimum needed for that basis and purpose for its specified period.

Personal information for which the retention period has elapsed or the purpose of processing has been achieved is destroyed without delay in accordance with Article 7.

Article 4 (Outsourcing of Personal Information Processing)

For the smooth provision of the Service, the Company outsources personal information processing tasks as follows. Pursuant to Article 26 of PIPA, the Company specifies in writing, in the outsourcing contract, matters such as the prohibition of processing beyond the purpose, protective measures, restrictions on re-outsourcing, and management and supervision, and supervises the trustees.

Article 5 (Provision to Third Parties and Cross-Border Transfer of Personal Information)

The Company discloses personal information to third parties only with consent or another lawful basis. AI request bodies will be sent to a provider only after its recipient, processing country, training use, retention, and transfer basis have been verified. Article 28-8(1)(3) of Korea's PIPA applies only to outsourcing or storage necessary to perform the contract. Independent provider training requires a separate lawful basis and optional consent. Due to the nature of the AI API routing service, the request body (prompt) entered by a Member is transmitted to the AI model provider selected by the Member for processing, and some of this is transferred overseas. Because such cross-border transfer constitutes outsourcing necessary for the performance of the contract (provision of the Service), the Company, pursuant to Article 28-8(1)(iii) of PIPA, discloses the following matters through this Policy in lieu of separate consent to cross-border transfer.

(1) Timing and method of transfer: data is transmitted in real time over HTTPS (TLS) encrypted communication at the moment the Member calls the API.

(2) Recipient's purpose of use: limited to the generation of responses (inference) for the model selected by the Member. The Company uses, to the extent possible, enterprise API routes in which input is not used for training (opt-out / Zero-Data-Retention, etc.); however, some model providers use input for model improvement and training, or it is unclear whether they do so. Whether each provider uses input for training is indicated in the 'Use of Input for Model Training' column of the table above, and Members can review this and select models accordingly (if you do not want your input used for training, select only models for which that column reads 'Not used').

(3) Method, procedure, and effect of refusing transfer: A Member may (a) enable the 'PII Masking' option per API key so that sensitive information is masked before transmission, or (b) all currently supported inference models are processed on overseas or global cloud infrastructure, so avoiding transfers by choosing a domestic-only model is not available; to minimize cross-border transfers, members may enable the 'PII Masking' option per API key or cease invoking relevant models (even if offered by a Korean entity, models with overseas inference infrastructure — for example, Upstage Solar on US infrastructure — are listed as cross-border transfer recipients above). However, overseas storage on the service operating infrastructure under (5) below is unavoidable for the provision of the Service (performance of the contract) and is not subject to avoidance. If transfer is refused, the relevant overseas models cannot be used, but there is no restriction on other use of the Service.

(4) The Company stores request and response bodies only where the Member has separately consented to using input content for service improvement. It does not store bodies without consent for enterprise or regulated profiles until an independent retention basis is verified. Usage and billing metadata are processed separately for contract performance and required recordkeeping.

(5) Domestic processing of primary service infrastructure and cross-border transfers: The Company's primary cloud infrastructure (servers and database) operates in the Seoul region (Republic of Korea, icn1 / ap-northeast-2) via Vercel, Supabase, and Alibaba Cloud, and website traffic analytics (self-hosted web event and performance telemetry) is also processed securely on domestic infrastructure. Accordingly, the primary storage location for account information, usage records, consent history, and request/response bodies stored under (4) above is domestic (processors are listed in the Article 4 table above). In addition, email delivery (Resend, Inc. · USA), global edge network, DDoS mitigation, and bot blocking (Cloudflare, Inc. · global edge), website usage analytics (Google LLC · Google Analytics, USA), and service error tracking (Functional Software, Inc. · Sentry, USA) are processed overseas and are disclosed as follows — Recipients: Resend, Inc. (US entity) / Cloudflare, Inc. (global edge) / Google LLC (Google Analytics) / Functional Software, Inc. (Sentry) / Countries: USA (Resend, Google, Sentry) · global edge (Cloudflare) / Items: the minimum recipient email address and other information needed for delivery (Resend) · connecting IP address, request headers/metadata, device/browser information, and security-check data (Cloudflare) · page URL, event information, browser, and device information (Google Analytics) · built-in exception type, occurrence time, severity, and line/column numbers for server and Edge errors (Sentry — nothing is sent from browsers; error messages, file names, function names, URL/request, user-identifying data, and API request body / prompts are removed before transmission) / Timing and method: sent in real time over HTTPS (TLS) when emails are sent, pages are accessed, or errors occur / Purposes: transactional, authentication, and notice emails (Resend) · traffic acceleration, DDoS mitigation, WAF, and bot prevention (Cloudflare) · usage analytics (Google Analytics) · error tracking for service quality improvement (Sentry) / Retention: destroyed upon membership withdrawal or expiry of the retention period (Articles 3 and 7) · Google Analytics and Sentry follow each company's data retention policy / Refusal and effects: email delivery, edge proxy and security, and error tracking are inevitable for providing the service (notices, security, and quality management); refusal is processed as membership withdrawal. Usage analytics can be refused by blocking cookies in your browser (Google Analytics), and refusal does not restrict use of the Service.

(6) Cross-border transfer of behavioral information for advertising performance measurement and personalized advertising: Where the Company operates Meta Pixel pursuant to Article 9, behavioral information is transmitted directly from the user's browser to Meta and processed overseas. The matters under each subparagraph of Article 28-8(2) of PIPA are disclosed as follows — Recipient: Meta Platforms, Inc. (USA · facebook.com/privacy/policy) / Country of transfer: USA / Items transferred: visited page addresses (URLs), in-service event information (the occurrence of conversion events such as sign-up and credit top-up), browser and device information, and online identifiers such as cookies (the behavioral information under Article 9 — API request bodies (prompts) are not included) / Timing and method of transfer: transmitted in real time over HTTPS (TLS) from the user's browser upon website visits and event occurrences / Recipient's purpose of use: measurement of advertising performance (conversion tracking) and provision of personalized advertising / Retention and use period: in accordance with Meta's privacy policy and data policy / Method, procedure, and effect of refusal: you may refuse by the methods under Article 9(3) (blocking cookies in the browser; Meta ad settings), and refusal does not restrict your use of the Service.

(7) Disclosure of a nickname for the token-usage leaderboard (provision to third parties): Where a Member has consented to 'disclosure of a nickname on the token-usage leaderboard' (Terms of Service Article 14(7)), the Company, pursuant to Articles 17 (provision to a third party) and 22 of PIPA, displays the Member's configured nickname (or a masked display derived from the email where none is set) and the token-usage rank and statistics on the leaderboard of a public web page. Recipient: an unspecified number of persons (visitors to the leaderboard page) / Items provided: nickname (or masked email display), rank, and token-usage statistics (no other identifying information such as email, account ID, or contact details is provided) / Purpose of use: displaying token-usage rankings among Members / Retention and use period: until consent is withdrawn or the Member withdraws membership (the Member's nickname and rank are removed from the leaderboard immediately upon withdrawal) / Method and effect of refusal: you may withdraw at any time under 'Settings > Consent Management'; refusing (non-consent or withdrawal) only means the Member's rank is not displayed on the leaderboard and does not restrict use of the Service. This disclosure takes place on domestic infrastructure and does not constitute a cross-border transfer.

(8) Optional referral-link tracking (Tapfiliate): Referral tracking starts only when a Member affirmatively chooses the referral CTA and proceeds to the external provider site. At this stage, Pleum adds only a server-generated random pseudonymous referral Sub-ID to the referral URL; the exact parameter is operator-configured after provider confirmation. Pleum adds no email, name, account ID, or API request body. The browser then transmits the URL externally over HTTPS (TLS), and the advertiser-side Tapfiliate integration may process the click technical data listed in the table above. The purposes are attribution of the referral click and first paid conversion, verification of any referral bonus, and prevention of duplicate or fraudulent conversions. A Member may refuse the tracking and cross-border transfer by not choosing the referral CTA. Refusal means that referral attribution and the resulting Pleum referral bonus are unavailable, but does not restrict access to BYOK plan information or any other use of the Service. Blocking cookies may disrupt later conversion attribution but does not block the initial click transfer for a referral link already chosen. The recipient, countries, and retention period are stated in the Tapfiliate row above.

Article 6 (Rights and Obligations of Data Subjects and Legal Representatives and How to Exercise Them)

(1) A data subject may at any time request access to, correction, deletion, or suspension of processing of personal information, and withdraw consent (Articles 35, 36, and 37 of PIPA). Where you withdraw consent to leaderboard nickname disclosure or withdraw membership, your nickname and rank are removed from the leaderboard immediately.

(2) Rights may be exercised through the in-service settings or by contacting the Privacy Officer below, and the Company takes action without delay (within 10 days). When exercised through a representative, a power of attorney must be submitted.

(3) For a child under 14 years of age, a legal representative exercises the rights.

Article 7 (Procedure and Method of Destroying Personal Information)

(1) When personal information becomes unnecessary, such as upon expiry of the retention period or achievement of the purpose of processing, the Company destroys it without delay. Information retained pursuant to other statutes is stored and managed separately.

(2) Electronic files are permanently deleted by technical means that prevent recovery, and paper documents are shredded or incinerated.

Article 8 (Measures to Ensure the Safety of Personal Information)

The Company takes measures including: (1) establishing and implementing an internal management plan and minimizing the number of staff handling data; (2) one-way encryption of passwords (bcrypt), encryption of transmission channels (SSL/TLS), and hashed storage of API keys; (3) differentiated granting of access rights and access control; (4) intrusion blocking and detection, global edge WAF/DDoS mitigation, and bot mitigation (Cloudflare · Turnstile); and (5) retention of access logs and prevention of forgery or alteration.

Article 9 (Devices for Automatic Collection of Personal Information — Cookies)

(1) The Company uses cookies and other devices that automatically collect personal information to maintain login sessions, perform security verification, analyze usage statistics, and provide personalized advertising (collection of behavioral information). A data subject may refuse or delete the storage of cookies in their web browser settings, but in that case there may be restrictions on the use of some services that require login.

(2) Collection and use of behavioral information for online personalized advertising: To measure advertising performance and provide personalized advertising, the Company installs and operates on its website Meta Pixel, an advertising tool of Meta Platforms, Inc., thereby allowing Meta to collect and process users' behavioral information. — Items of behavioral information collected: visited page addresses (URLs) and visit/usage records, in-service event information (the occurrence of conversion events such as sign-up and credit top-up), browser and device information, and online identifiers such as cookies / Method of collection: collected and transmitted automatically via the Meta Pixel script when a user visits the website / Purpose of collection: measurement of advertising performance (conversion tracking) and provision of personalized advertising based on user interests / Retention and use period: the Company does not itself store behavioral information; Meta retains and uses it in accordance with its own privacy policy and data policy. The Company does not collect API request bodies (prompts) or other contents of Service use as behavioral information, nor use them for advertising purposes.

(3) How to refuse the collection of behavioral information (exercise of control): (a) block or delete cookies in your web browser settings (including blocking third-party cookies); (b) restrict the display of personalized ads and data connections in your Meta account's ad settings (facebook.com/adpreferences). Refusal does not restrict your use of the Service, although non-personalized general ads may still be displayed. For harm or inquiries related to behavioral information, you may contact the Privacy Officer under Article 10.

④ To improve the service, the Company operates its own visit statistics, which use no cookies or browser storage. Collected items: visited page path (query strings and identifiers removed), page view time, referrer domain, advertising parameters (utm_source, utm_campaign), device type (desktop, mobile, tablet), page performance metrics (LCP, INP, CLS, FCP, TTFB), progress through the signup screens, and a session identifier kept per browser tab. Visitors are distinguished only by a hash combining a daily salt generated by the server with IP and browser information; raw IP addresses and raw browser information are not stored. Raw collection records are deleted after 14 days, and only aggregated statistics are kept. Visits judged to be automated are not collected. The purpose is to improve screen performance and analyze the signup flow; the data is not provided to third parties or transferred overseas.

Article 10 (Privacy Officer)

The Company designates a Privacy Officer to oversee tasks related to personal information processing and to handle complaints and remedy damage of data subjects. (Pursuant to Article 31 of PIPA, Won-young Lee, Representative Director of PLEUM. AI Co., Ltd., serves as the Privacy Officer.)

Article 11 (Methods of Remedy for Infringement of Rights)

A data subject may apply to the following organizations for dispute resolution or consultation to remedy infringement of personal information: Personal Information Dispute Mediation Committee (1833-6972, kopico.go.kr), Personal Information Infringement Report Center (118, privacy.kisa.or.kr), Supreme Prosecutors' Office Cyber Investigation Division (1301), and National Police Agency Cyber Investigation Bureau (182, ecrm.police.go.kr).

Article 12 (Changes to the Privacy Policy)

This Privacy Policy was established on June 15, 2026. This revision was announced on October 6, 2026 and takes effect on November 5, 2026. Subsequent changes will be announced through service notices at least 7 days (or 30 days for significant changes) before they take effect.

Revision history: Announced October 6, 2026; effective November 5, 2026 — separate retention of transaction evidence after account erasure, with record-specific retention periods, access, and destruction procedures; Vercel (Web Analytics, Speed Insights) added to the Article 4 processing tasks and to the Article 5(5) cross-border transfers. / Amended and effective October 27, 2026: the optional post-signup survey answers were added to the Article 2 collected items and the Article 3 retention periods. / Amended and effective November 5, 2026: clarified Cloudflare global edge network, reverse proxy, and DDoS security roles; added DuckDuckGo as web search processor; aligned domestic inference model status; refined Sentry error frame collection disclosures; reflected self-hosted web analytics.