Privacy Policy

Summary in one line

AIgorhythm Co., Ltd. (“we”) is the controller of the personal information described here. We keep the email, name and account number of your Google account needed for login, the video materials you make, and payment and credit records. We do not receive card numbers. We do not show ads or sell personal information.

1. What we store and why

The information above is received from Google when you sign up or log in, entered by you while you use the service, or generated automatically during use. We receive only the information needed to perform the service contract.

What we do not store

• Payment card details and billing address — collected and handled by Paddle; we do not receive them
• Phone number, address, date of birth, location information
• Identifiers for ad tracking

Why we are allowed to use it (legal basis)

• To provide the service you signed up for (performance of a contract) — account, making videos, credits and payments
• To meet legal obligations — keeping payment and tax records, answering lawful requests from authorities
• For our legitimate interests — keeping the service secure, preventing abuse and fraud, handling disputes. We weigh these against your rights
• With your consent — for anything optional, such as using a video you made in our promotion. You can withdraw consent at any time

2. Do we provide it to others

The Company does not provide personal information to third parties. Exceptions apply where the user has separately consented, where a law specifically so provides, or where an investigative agency requests it through a procedure under the law.

3. Where we entrust processing (outsourcing)

We require by contract that processors handle personal information safely, and if a processor or an entrusted task changes, we reflect it in this policy right away.

4. Information sent overseas

Making a video requires the help of outside AI services. We send only as much as that task needs, and we do not send your email or name to AI services.

• Where your data is stored — our servers and database are in the Republic of Korea. If you use Ddalkkak from another country, your information is transferred to Korea
• Safeguards — where personal information leaves the European Economic Area, the United Kingdom or Switzerland, we rely on the protections the law provides, such as the European Commission’s adequacy decision for the Republic of Korea, or standard contractual clauses with the recipient
• When and how it is sent — over encrypted communication (HTTPS) each time you run the relevant feature
• Retention period — for the period needed to process the request; after that it is deleted under each company’s retention policy
• How to refuse — if you do not want the overseas transfer, you may choose not to use the relevant feature or delete your account. In that case, however, you cannot make videos with that feature
• Basis — transfer necessary to perform the service contract with you

5. How long we keep it and how we delete it

• Account and video materials — when you delete your account, we delete without delay your account, login records, Google account link, projects and the generated script, voice, image and video files. When you delete a project, its files are deleted with it
• Payment and credit records of a deleted account — these fall under the 5-year records below, so they are changed to a separate number that does not reveal whose they are, kept for 5 years separately from other data, and then deleted
• Email of a deleted account — the email of a deleted account is kept for 5 years only as an irrecoverable hash value (for the purposes of preventing duplicate re-sign-up benefits and confirming disputes). The original email is not kept
• However, the records below are kept separately for the period set by law and then deleted
  • Records on contracts, withdrawal of purchase, payment and supply of goods — 5 years (Act on the Consumer Protection in Electronic Commerce)
  • Records on consumer complaints or dispute handling — 3 years (Act on the Consumer Protection in Electronic Commerce)
  • Access records — 3 months (Protection of Communications Secrets Act)
• Login cookie — disappears after one day or when you log out
• How we delete — when the retention period ends or the purpose is achieved, we delete without delay (within 5 days). Electronic files are deleted by a method that makes them irrecoverable, and records kept because of the law are stored separately from other data

6. What you can request

• Checking the information we hold about you (access)
• Correcting wrong information (rectification)
• Deletion of your account and data (erasure), and restriction of processing
• Receiving your data in a commonly used format (portability)
• Objecting to processing based on our legitimate interests, and withdrawing consent at any time
• Complaining to a data protection authority — for example, the authority in the country where you live in the EEA or the UK
• Deleting your account — do it yourself at Account settings > Login and security > Delete account, or ask customer support. For identity verification, you must have logged in within the last 10 minutes or re-enter the email you signed up with

If you send a request to customer support (official@aigorhythm.net), we verify your identity, process it without delay (within 10 days) and tell you the result. You may also make a request through a legal representative or an authorized person; in that case, please send the power of attorney with it. Where we cannot grant a request, such as for records that must be kept by law, we tell you the reason.

7. Children

Ddalkkak is not for people under 16. We do not collect dates of birth and accept sign-up only with a Google account; by signing up you confirm that you are 16 or older. If we learn that we hold information about a person under 16, we delete it without delay.

8. Cookies and browser storage

• Login cookie (frame_session) — keeps you logged in. It is made so that it cannot be read by JavaScript and expires after one day. The server stores not the cookie value itself but only an irreversible form of it
• Google login verification cookie — used only while you visit the Google login screen and return (up to 10 minutes)
• Browser storage — keeps values used only on this device, such as an inquiry you were writing or screen settings. They are not sent to the Company’s servers
• Paddle checkout — when you open the payment window, Paddle may set its own cookies needed for payment and fraud prevention, under the Paddle Privacy Notice
• We do not use cookies for advertising or visit analytics
• How to refuse — you can block or delete cookies in your browser settings. If you block the login cookie, you cannot use features that require login

9. How we keep it safe

• All communication is encrypted (HTTPS)
• Passwords and login tokens are stored only in an irreversible form
• Payment notifications from Paddle are verified with a secret signature, and the amount is checked against our server’s price list, not a value sent by the screen

10. Privacy officer and consultation

• Officer: Kim Myeong-hwan (CEO)
• Contact: official@aigorhythm.net

Requests for access, correction and deletion are also received at the contact above. You may also complain to the data protection authority where you live. In the Republic of Korea, you can report or consult with the bodies below.

• Personal Information Infringement Report Center — 118 without area code, in Korea (privacy.kisa.or.kr)
• Personal Information Dispute Mediation Committee — 1833-6972 (www.kopico.go.kr)
• Supreme Prosecutors’ Office — 1301 without area code, in Korea
• Korean National Police Agency — 182 without area code, in Korea (ecrm.police.go.kr)

11. Changes to this policy

If this policy changes, we state the new effective date on this page, and important changes are announced within the service.