HeimLog Privacy Policy
HEIMDEX Co., Ltd. (the “Company”) establishes and discloses the following Privacy Policy pursuant to Article 30 of the Personal Information Protection Act (“PIPA”) in order to protect the personal information of data subjects and to handle related grievances promptly and smoothly.
Date of publication: September 11, 2026 / Effective date: October 12, 2026
Article 1 (Purposes of Processing Personal Information)
The Company processes personal information for the purposes set out below. Personal information processed is not used for any purpose other than these purposes, and where the purpose of use changes, the Company will take necessary measures, including obtaining separate consent pursuant to Article 18 of PIPA.
| Category | Purpose of processing |
|---|---|
| Member management | Provision of membership-based services, identification and authentication, confirmation of intent to register, prevention of registration by children under 14, prevention of misuse, delivery of notices |
| Service provision | AI-based automated analysis, selection and editing of video, generation and delivery of Outputs, provision of storage, sharing of Outputs by the method designated by the Member |
| YouTube upload (optional) | Uploading Outputs requested by the Member to the Member’s own YouTube channel and applying the upload information selected by the Member (title, description, tags, category, visibility setting, scheduled publication time, license, thumbnail, captions and playlist); confirmation of the channel and playlists to be uploaded to; notification of upload results (limited to Members who use the feature) |
| Grievance handling | Receipt and handling of inquiries, reports and objections, verification of facts, notification of outcomes |
| Paid services | Payment and settlement of fees, management of the grant and deduction of Credits, processing of subscription withdrawals, refunds |
| Service improvement | Analysis of access frequency and usage statistics (limited to de-identified processing for statistical purposes) |
| Marketing (optional) | Notification of event information, transmission of advertising information (limited to Members who have given separate consent) |
Article 2 (Categories of Personal Information Processed)
(1) Membership registration and management
- Required: email address, password, nickname, year of birth (for the purpose of verifying that the user is at least 14 years old)
- Optional: profile image, gender
- Where social login is used, the items received from each provider:
| Provider | Items received |
|---|---|
| Account identifier, email address, name, profile image | |
| Kakao | Account identifier, email address, nickname, profile image |
(2) Content processed in the course of using the Service
- The Company processes video files uploaded by Members in order to use the Service. Video files may contain the following personal information:
| Item | Description |
|---|---|
| Facial images | Faces of the Member and of third parties who appear in the video |
| Voice | Voices and conversations of the Member and of third parties |
| Recording metadata | Date and time of recording, recording device information |
- A video file is itself a file that may contain personal information, and the Company treats it as personal information rather than as an ordinary posting. Location information contained in a video file (EXIF location metadata such as GPS coordinates) is removed on the server immediately upon upload, and the Company does not use or retain it for any purpose. The Company does not provide any feature that uses location information.
(3) Use of paid services
- Payment method information (processed through a payment gateway; the Company does not retain full card numbers), payment approval records, transaction history, records of the grant and deduction of Credits.
(4) Information collected automatically
- IP address, cookies, access date and time, service usage records, device information (OS, browser, device identifier), error logs.
(5) Use of the YouTube upload feature (optional)
- Where a Member links a YouTube account to use the upload feature, the Company processes the following information through YouTube API Services. The Company does not collect login information such as the password of the YouTube account.
| Category | Items |
|---|---|
| Authentication information | Access tokens and refresh tokens issued by Google; the scope of permissions granted by the Member |
| Channel information | Channel identifier, channel name, channel handle; list of playlists on the Member’s channel (playlist identifiers and names) |
| Upload information | Title, description, tags, category, visibility setting, scheduled publication time and license entered or selected by the Member; thumbnail image; caption files; playlist to which the video is to be added |
| Upload results | Identifier and URL of the uploaded video; upload status; date and time of upload; error history |
Article 3 (Special Notice Regarding the Personal Information of Third Parties Appearing in Video)
(1) The Company recognizes that video uploaded by a Member may contain the face or voice of a person other than the Member. In such case, that depicted individual is also a data subject under PIPA.
(2) The mere fact that a Member possesses a video file does not entitle the Member to exercise the rights relating to a depicted individual’s personal information on that individual’s behalf. A Member must upload only video for which the depicted individual’s consent has been obtained.
(3) The legal basis on which the Company processes the personal information of third parties appearing in video uploaded by a Member is Article 15(1)6 of PIPA (where processing is necessary to achieve the legitimate interests of the personal information controller and such interests manifestly override the rights of the data subject). The Company processes such information in a manner that does not unfairly infringe the rights of the data subject, as follows:
- 1. The purpose of processing is limited to the generation of an Output at the Member’s request and uploading to YouTube as requested by the Member, and processing is carried out only to the minimum extent necessary to achieve that purpose.
- 2. The Company does not extract or store feature points for the purpose of identifying a depicted individual’s face by linking it to a specific individual.
- 3. The Company does not use depicted individuals’ personal information to train artificial intelligence models.
- 4. The Company does not continuously monitor Members’ content; access is limited to matters received in accordance with the principles set out in Article 10 of this Policy.
- 5. A depicted individual may exercise the rights under paragraph (4) at any time even if they are not a Member, and the Company will verify the facts and act immediately upon receipt of a request and notify the requester of the outcome.
- 6. Where a Member uploads an Output to YouTube, the Company informs the Member before uploading that the consent of depicted individuals must be confirmed. Provision of a depicted individual’s personal information resulting from an upload requested by the Member takes place within the scope of the above purposes pursuant to Article 17(1)2 of PIPA.
(4) A person appearing in a video may, even if they are not a Member, request that the Company restrict access to, de-identify, delete or suspend the processing of content containing their face or voice, or discontinue its provision under the Dataset Program. Requests may be submitted to heimlog@heimdex.co, and the Company will verify the facts and act immediately upon receipt of a request and notify the requester of the outcome. The Company requests only the minimum information necessary to verify the facts and does not use it for any purpose other than handling that request; in the case of a minor, the legal representative may make the request. Where the content has already been uploaded to YouTube by a Member, the Company will inform the Member of the request and inform the requester of YouTube’s rights-infringement reporting procedure.
(5) As of the effective date of this Policy, the Company does not extract or store feature points for the purpose of identifying a face by linking it to a specific individual, and does not process voice for the purpose of identifying a speaker as a specific individual. Face detection, speech-segment detection and speech-to-text conversion performed by the Company in order to generate Outputs are not processing for the purpose of recognizing a specific individual and therefore do not constitute the processing of biometric identification information (sensitive information) under PIPA. Accordingly, the Company does not process sensitive information, and there is no sensitive information that data subjects may disclose.
(6) Should the Company in future introduce a feature that uses facial recognition or speaker identification, such as automatically gathering the scenes in which the same person appears, such processing would constitute processing of sensitive information (biometric identification information) under PIPA. In that case, the Company will comply with the following:
- 1. Before introducing the feature, the Company will disclose the purpose of processing, the items processed and the retention period, and will obtain separate consent distinguished from other consents.
- 2. A data subject who does not consent will face no restriction on use of the Service other than the feature concerned.
- 3. Feature-point data will be stored in encrypted form and destroyed without delay upon discontinuation of use of the feature or withdrawal of consent.
- 4. The procedure for exercising the rights under paragraph (4) applies equally with respect to the faces and voices of third parties appearing in video.
Article 4 (Processing and Retention Periods)
(1) The Company processes and retains personal information within the retention and use period prescribed by law or the retention and use period consented to by the data subject at the time of collection.
| Item | Retention period | Basis |
|---|---|---|
| Member information | Destroyed without delay upon withdrawal of membership | PIPA Article 21(1) |
| Original Content and Outputs | When the Member deletes them or withdraws, they are destroyed without delay from the Service and its operational databases, and any copies remaining in backup storage are destroyed by an irrecoverable method within 60 days in accordance with the backup rotation cycle. Even where the Member does not delete them, they are destroyed by the same method once the in-Service retention period (60 days) under Article 13 of the Terms of Service expires. | PIPA Article 21(1); Terms of Service |
| YouTube linking information (Article 9) | Destroyed without delay (within 5 days) upon unlinking, a deletion request or withdrawal of membership. Where access is revoked through the Google security settings page, destroyed without delay once the Company confirms the revocation, and in any event within 30 days of the revocation. Channel information, playlist lists and upload results other than authentication information is refreshed or destroyed at intervals of no more than 30 days even while the link is maintained. | PIPA Article 21(1); YouTube API Services Developer Policies |
| Inquiry and dispute handling records | 3 years after completion of handling | Act on the Consumer Protection in Electronic Commerce, Etc., Article 6 and Article 6 of its Enforcement Decree |
| Data access records (Article 10) | 2 years from the date of access | PIPA Article 29; Article 30 of its Enforcement Decree; Standards for Measures to Secure the Safety of Personal Information |
| Misuse records | 1 year; retained for the Company’s legitimate interest in preventing misuse | PIPA Article 15(1)6 |
(2) Retention required by law
| Governing law | Item | Period |
|---|---|---|
| Act on the Consumer Protection in Electronic Commerce, Etc. | Records on contracts or withdrawal of subscription | 5 years |
| Act on the Consumer Protection in Electronic Commerce, Etc. | Records on payment and supply of goods | 5 years |
| Act on the Consumer Protection in Electronic Commerce, Etc. | Records on consumer complaints or dispute handling | 3 years |
| Act on the Consumer Protection in Electronic Commerce, Etc. | Records on labeling and advertising | 6 months |
| Protection of Communications Secrets Act | Service usage records, access logs, access IP | 3 months |
| Framework Act on National Taxes | Books and supporting documents on transactions | 5 years |
Article 5 (Matters Concerning Artificial Intelligence Training)
(1) The Company does not use Members’ Original Content or Outputs for the training, fine-tuning or other training of artificial intelligence models.
(2) The Company uses artificial intelligence technology to analyze and edit video in order to provide the Service; however, this is limited to processing (inference) for the purpose of generating that Member’s Output and is not used for training that updates model weights.
(3) Where the Company uses an external artificial intelligence service, it enters into and applies a data processing agreement containing training opt-out terms and data-retention minimization terms so that data transmitted to the relevant service provider is not used to train that provider’s models. The services in use are set out in Articles 7 and 8.
(4) Should the Company wish in future to use content for training, it will disclose the purpose, scope and opt-out method in advance and obtain separate consent from the data subject; a data subject who does not consent will face no restriction on use of the Service.
(5) The Company does not use information received through YouTube API Services for the training, fine-tuning or other training of artificial intelligence models, and does not include it in the Dataset Program under Article 6(2).
Article 6 (Provision of Personal Information to Third Parties)
(1) The Company does not provide Members’ personal information or content to third parties. However, where a Member uses the YouTube upload feature to request the upload of an Output, the Company provides personal information as set out below with the Member’s consent. Provision is limited to the Output and upload information that the Member has requested to be uploaded, and the Member may refuse consent. A Member who refuses consent cannot use the YouTube upload feature but faces no restriction on use of the rest of the Service.
| Recipient | Purpose of provision | Items provided | Retention and use period |
|---|---|---|---|
| Google LLC (YouTube) | Uploading Outputs requested by the Member to the Member’s YouTube channel and applying the upload information selected by the Member | Output video (including the faces and voices of the Member and of depicted individuals contained in the video); title, description, tags, category, visibility setting, scheduled publication time and license entered or selected by the Member; thumbnail image; caption files; playlist to which the video is to be added (identifier) | In accordance with the terms and privacy policy of Google (YouTube), until the Member deletes the video on YouTube |
(2) The Company may in future operate a program under which content that Members elect to contribute is provided to third parties in the form of a dataset (the “Dataset Program”). In that case, the Company will comply with the following:
- 1. Consent will be obtained on a per-content basis; blanket consent covering all of a Member’s content will not be obtained.
- 2. At the time of consent, the Company will specifically disclose the recipient, the purpose of provision, the items provided and the retention period.
- 3. Consent may be refused, and refusal will not result in any disadvantage in the use of the Service.
- 4. Content that includes a depicted individual other than the Member will be provided only where the Company has obtained consent directly from that depicted individual and retains evidence thereof, or where the content has been processed so as to make re-identification impossible.
- 5. The Company will impose on recipients, by contract, obligations not to resell, not to use for other purposes, not to attempt re-identification, and to comply with destruction requests.
- 6. Where the Company comes to process pseudonymized information under the Dataset Program, it will state the purpose, items and retention period of such processing in this Policy and comply with the requirements of Article 28-2 et seq. of PIPA.
(3) Effect and limits of withdrawal of consent. A Member may withdraw consent at any time, and the Company will immediately cease further provision and request destruction by the recipient. However, physical recovery may not be guaranteed with respect to data already provided before withdrawal. The Company clearly discloses this on the consent screen.
(4) The Company may provide personal information where specifically required by law or where an investigative authority so requests in accordance with the procedures and methods prescribed by law, and will notify the data subject of that fact unless prohibited by law.
Article 7 (Entrustment of Personal Information Processing)
(1) The Company entrusts personal information processing tasks as follows in order to provide the Service smoothly:
| Trustee | Scope of entrusted work | Retention and use period |
|---|---|---|
| Amazon Web Services, Inc. | Cloud infrastructure operation; storage of Original Content, Outputs and Member information; video rendering | Until termination of the entrustment agreement or until the Member’s deletion or withdrawal |
| Supabase, Inc. | Member authentication processing; storage and management of YouTube linking authentication information (tokens) | Until termination of the entrustment agreement or until the Member’s unlinking or withdrawal |
| Google LLC (Google Cloud) | GPU-based video analysis computation (processed serverlessly; data exists only during processing and is not stored) | Destroyed immediately upon completion of processing |
| Aieev | Operation of domestic GPU servers and video analysis computation | Until termination of the entrustment agreement |
| OpenAI, L.L.C. | AI-based video scene analysis and classification, and highlight detection | Destroyed immediately upon completion of processing (or, where the provider has a retention period for abuse-monitoring purposes, for that period, up to 30 days) |
| Verifone (2Checkout) | Overseas payment authorization and settlement | Until termination of the entrustment agreement or for the retention period under applicable law (5 years) |
| Kakao Pay Corp. | Domestic simple-payment processing | Until termination of the entrustment agreement or for the retention period under applicable law (5 years) |
(2) When entering into an entrustment agreement, the Company specifies in the contract or another document, pursuant to Article 26 of PIPA, matters concerning the prohibition of processing personal information for purposes other than performing the entrusted work, technical and administrative protective measures, restrictions on sub-entrustment, management and supervision of the trustee, and liability including damages, and supervises whether the trustee processes personal information safely.
(3) The Company contractually requires trustees to obtain the Company’s prior consent before sub-entrusting entrusted work to a third party, and discloses the status of sub-entrustment through this Policy.
(4) Where the contents of the entrusted work or the trustee changes, the Company will disclose the change through this Policy without delay.
Article 8 (Transfer of Personal Information Abroad)
(1) Pursuant to Article 28-8(1)3(a) of PIPA, the Company transfers personal information abroad as set out below for the purposes of entrusted processing and storage necessary to enter into and perform a contract with the data subject, and makes such transfers without separate consent by disclosing in this Policy the matters listed in Article 28-8(2) of PIPA.
| Recipient (contact) | Country | Date/time and method of transfer | Items transferred | Purpose of transfer | Retention and use period |
|---|---|---|---|---|---|
| Amazon Web Services, Inc. (aws-korea-privacy@amazon.com) | United States | Transmitted over an information and communications network at the time of service use | Member information, Original Content and Outputs, access records | Cloud infrastructure operation and data storage | Until termination of the entrustment agreement or until the Member’s deletion or withdrawal (destroyed within 30 days, including backups) |
| Supabase, Inc. (privacy@supabase.com) | United States | Transmitted over an information and communications network at the time of member authentication and YouTube linking | Member identifier, email address, YouTube linking authentication information (tokens) | Member authentication processing and storage of linking authentication information | Until termination of the entrustment agreement or until the Member’s unlinking or withdrawal |
| Google LLC (googlekr-privacy@google.com) | Singapore | Transmitted over an information and communications network at the time of a video analysis request | Video frame and audio data from Original Content | GPU-based video analysis computation (scene segmentation, speech recognition, etc.) | Destroyed immediately upon completion of processing (exists in memory only during computation; not stored) |
| OpenAI, L.L.C. (privacy@openai.com) | United States | Transmitted via API call at the time of a video analysis request | Video frame and audio data from Original Content and processing request information | AI-based video scene analysis and classification, and highlight detection | Destroyed immediately upon completion of processing (or, where the provider has a retention period for abuse-monitoring purposes, for that period, up to 30 days) |
| Verifone (2Checkout) (privacy@verifone.com) | United States and others | Transmitted at the time of an overseas payment request | Payment method information, transaction history, email address | Overseas payment authorization and settlement | Retention period under applicable law (5 years) |
(2) A data subject may request suspension of the transfer of personal information abroad (PIPA Article 37). However, because the above transfers abroad are essential to the provision of the Service, suspending them would make use of the Service impossible; in that case the data subject may cease processing by withdrawing their membership. Request method: heimlog@heimdex.co
(3) Pursuant to Article 28-8(4) of PIPA, the Company implements necessary protective measures, including encryption of the transfer channel and of stored data, contractual prohibitions on use for other purposes and on onward provision, the imposition of safety obligations on recipients, and the operation of a grievance-handling procedure concerning transfers abroad.
(4) Where a Member uses the YouTube upload feature to request the upload of an Output, the Company, for the purpose of the provision under Article 6(1), obtains the Member’s separate consent to transfer abroad pursuant to Article 28-8(1)1 of PIPA and transfers personal information abroad as set out below. A Member may refuse the transfer abroad by not using the upload feature or by unlinking on the settings screen within the Service; a Member who refuses cannot use the YouTube upload feature but faces no restriction on use of the rest of the Service.
| Recipient (contact) | Country | Date/time and method of transfer | Items transferred | Purpose of transfer | Retention and use period |
|---|---|---|---|---|---|
| Google LLC (YouTube) (googlekr-privacy@google.com) | United States | Transmitted over an information and communications network via the YouTube API when the Member requests an upload | Output video (including the faces and voices of the Member and of depicted individuals); title, description, tags, category, visibility setting, scheduled publication time and license entered or selected by the Member; thumbnail image; caption files; playlist to which the video is to be added (identifier) | Uploading Outputs requested by the Member to YouTube and applying the upload information | In accordance with the terms and privacy policy of Google (YouTube), until the Member deletes the video on YouTube |
Article 9 (Matters Concerning the Use of YouTube API Services)
(1) The Company uses YouTube API Services so that Members can upload Outputs to their own YouTube channels. The YouTube Terms of Service (https://www.youtube.com/t/terms) apply to Members who use the YouTube upload feature, and the Google Privacy Policy (https://www.google.com/policies/privacy) applies to personal information processed by Google.
(2) The information that the Company accesses, collects, stores and uses through YouTube API Services is as set out in Article 2(5), and the Company uses it only for the following purposes:
- 1. Displaying the channel name and handle of the linked channel, the Member’s playlists and the categories available for upload so that the Member can select the channel to be uploaded to and the upload information;
- 2. Uploading Outputs requested by the Member to the Member’s YouTube channel and applying the upload information selected by the Member, such as the visibility setting, scheduled publication time, license, thumbnail, captions and playlist;
- 3. Notifying the Member of upload results and errors.
(3) The Company does not use information received through YouTube API Services for any purpose other than those set out in paragraph (2); it does not use such information for purposes not disclosed to Members, such as advertising, artificial intelligence model training or the Dataset Program, and does not sell or provide it to third parties (excluding entrustment of processing under Article 7). The Company’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
(4) The Company carries out only the uploads that the Member has confirmed and requested within the Service and the application of the related upload information and, apart from uploading, does not manage, modify or delete the Member’s YouTube channel, videos or playlists. The Company does not change the upload information finalized by the Member, such as the title and description, or append any text to it without the Member’s consent.
(5) A Member may revoke the Company’s access to YouTube by either of the following methods:
- 1. Unlinking on the settings screen within the Service: the Company immediately requests Google to revoke the token and destroys the YouTube-related information it holds without delay (within 5 days).
- 2. Removing access on the Google security settings page (https://security.google.com/settings/security/permissions): the Company periodically checks the validity of authentication information and, upon confirming the revocation, destroys the related information without delay, and in any event within 30 days of the revocation.
(6) A Member may request deletion of the YouTube-related information held by the Company through the settings menu within the Service or by writing to heimlog@heimdex.co, and the Company will delete it without delay (within 5 days) and unlink the account. The same applies where the Member withdraws membership. Deleting the information held by the Company or unlinking does not delete videos already uploaded to YouTube or information stored by YouTube; to delete such videos or information, the Member must delete them directly on YouTube.
(7) The Company refreshes or destroys channel information, playlist lists and upload results received from YouTube at intervals of no more than 30 days, and retains authentication information only while the Member maintains the link. The Company’s operation of automatic collection devices such as cookies is governed by Article 15.
(8) Inquiries and complaints concerning the processing of personal information in connection with YouTube linking may be directed to the Chief Privacy Officer under Article 17 (heimlog@heimdex.co).
Article 10 (Access to Content for Handling Inquiries and Disputes)
(1) The Company may access a Member’s video content to the minimum extent necessary to handle the Member’s inquiries, error reports, reports of rights infringement or disputes.
(2) Access is subject to the following principles:
- 1. Limited to matters received: The Company does not conduct continuous monitoring; access is limited to the files necessary to handle a matter for which a request or report has been received.
- 2. Minimum personnel: Only personnel designated in advance and bound by confidentiality obligations have access rights.
- 3. Records: The date and time of access, the person accessing, the subject and the reason are recorded automatically and retained for two (2) years.
- 4. Revocation of rights: Access rights are revoked upon completion of handling.
- 5. Purpose limitation: Information accessed is not used for any purpose other than handling the relevant matter and is not used for artificial intelligence training.
(3) A data subject may request confirmation of the access records relating to their own content by writing to heimlog@heimdex.co.
Article 11 (Matters Concerning Automated Decision-Making)
(1) The Company automatically selects and arranges the segments of a Member’s uploaded video to be included in an Output. This is done on the basis of criteria such as image quality, camera shake, scene transitions, the presence of speech, and the arrangement method selected by the Member (chronological or thematic).
(2) The automated processing under paragraph (1) is carried out in order to generate an Output at the Member’s request and does not have a material effect on the Member’s rights or obligations; accordingly, it is not subject to the right of refusal under Article 37-2(1) of PIPA.
(3) However, a Member may at any time request an explanation of an automated decision pursuant to Article 37-2(2) of PIPA, and the Company will, absent justifiable grounds to the contrary, take necessary measures such as reprocessing with human intervention or providing an explanation. A Member may also manually modify the composition of an Output or request regeneration.
Article 12 (Destruction of Personal Information)
(1) Where personal information becomes unnecessary because the retention period has elapsed or the purpose of processing has been achieved, the Company destroys it without delay.
(2) Method of destruction
- - Electronic files: permanently deleted by a technical method that makes restoration impossible
- - Paper documents: shredded or incinerated
(3) Personal information that must be retained under applicable law is stored separately in a distinct database and is not used for any purpose other than retention.
Article 13 (Rights and Obligations of Data Subjects and Legal Representatives, and How to Exercise Them)
(1) A data subject may exercise the following rights against the Company at any time:
- - Request to access personal information
- - Request to correct errors
- - Request to delete
- - Request to suspend processing
- - Withdrawal of consent
- - Request to delete YouTube linking information and to unlink
- - Request for an explanation of an automated decision
(2) Rights may be exercised through the settings menu within the Service or by writing to heimlog@heimdex.co, and the Company will act without delay (within ten (10) days from the date of receipt of the request in the case of access, correction and deletion).
(3) Where a data subject requests correction of an error in personal information, the Company will not use or provide that personal information until the correction is complete.
(4) Rights may be exercised through a legal representative or an authorized agent, in which case a power of attorney in the form of Attached Form No. 11 of the Enforcement Rules of PIPA must be submitted.
(5) A third party appearing in video may also exercise rights pursuant to Article 3(4).
Article 14 (Children Under the Age of 14)
(1) The Company does not accept membership registration by children under the age of 14. The Company verifies age by requiring entry of the year of birth at registration and, in the case of social login, also checks the age information provided by the relevant provider. An account subsequently confirmed to belong to a person under the age of 14 is immediately suspended and the related data is destroyed without delay.
(2) Where a child under the age of 14 appears in video uploaded by a Member, the rights relating to that child’s personal information may be exercised by their legal representative.
(3) Where a Member seeks to enroll in the Dataset Program content in which a minor appears, the Company will separately verify the consent of the legal representative.
Article 15 (Installation, Operation and Refusal of Automatic Personal Information Collection Devices)
(1) The Company uses cookies to provide users with individually tailored services. Cookies are used to maintain login status, analyze usage statistics and improve the Service.
(2) A user may refuse the storage of cookies through their web browser settings. However, refusing cookies may cause difficulties in using certain parts of the Service, such as maintaining login status.
- - Chrome: Settings > Privacy and security > Third-party cookies
- - Safari: Preferences > Privacy
- - Edge: Settings > Cookies and site permissions
Article 16 (Measures to Secure the Safety of Personal Information)
Pursuant to Article 29 of PIPA, the Company takes the following measures to secure the safety of personal information:
- - Administrative measures: establishment and implementation of an internal management plan (approved by the CEO), minimization of personnel handling personal information and periodic training, periodic self-inspection
- - Technical measures: management of the grant, modification and revocation of access rights to the personal information processing system; installation of an access control system; encryption of unique identifying information and passwords; encryption of stored data and of the transmission channel (TLS); installation and updating of security software
- - Retention of access logs: access logs of the personal information processing system are retained and managed for two (2) years or more, with measures applied to prevent forgery, alteration, theft and loss
- - Physical measures: access control for the server room, document storage room and similar areas
Article 17 (Chief Privacy Officer and Department Handling Access Requests)
(1) The Company has designated a Chief Privacy Officer to oversee personal information processing and to handle data subjects’ grievances, as follows:
| Category | Details |
|---|---|
| Chief Privacy Officer | Name: Heejo Kang / Title: CSO / Contact: heimlog@heimdex.co |
| Department receiving and handling access requests | Department: Business Strategy Team / Contact: heimlog@heimdex.co |
(2) A data subject may direct all inquiries, grievances and requests for remedy relating to personal information protection to the Chief Privacy Officer or the responsible department, and the Company will respond and act without delay.
(3) The Company’s proprietor or representative, as the person ultimately responsible for the safe processing of personal information and the protection of data subjects’ rights, effectively carries out overall management measures, including the provision of necessary personnel and budget.
Article 18 (Remedies for Infringement of Rights)
(1) A data subject who needs to report or seek counselling regarding an infringement of personal information may contact the following bodies:
- - Personal Information Dispute Mediation Committee: 1833-6972 / www.kopico.go.kr
- - Personal Information Infringement Report Centre: 118 / privacy.kisa.or.kr
(2) A person whose rights or interests are infringed by a disposition or omission of the head of a public institution in response to a request under Article 35 (Access to Personal Information), Article 36 (Correction or Deletion of Personal Information) or Article 37 (Suspension of Processing of Personal Information, Etc.) of PIPA may file an administrative appeal in accordance with the Administrative Appeals Act.
Article 19 (Changes to this Privacy Policy)
(1) This Privacy Policy applies from its effective date.
(2) Where this Policy is amended, the Company will give notice on the initial screen of the Service and in its notice board from seven (7) days before the amendment takes effect; where the amendment has a material effect on data subjects’ rights (such as provision to third parties, transfer abroad or the addition of purposes of use), notice will be given from thirty (30) days before, and separate consent will be obtained where necessary.
(3) Previous versions of this Policy are available within the Service.
(4) Revision history: enacted and effective August 31, 2026 / published September 11, 2026 and effective October 12, 2026 (addition of the items processed, provision to third parties, transfer abroad and matters concerning the use of YouTube API Services in connection with the addition of the YouTube upload feature, and establishment of additional disclosures for residents outside the Republic of Korea).
Article 20 (Additional Disclosures for Residents Outside the Republic of Korea)
(1) The Company publishes additional disclosures and methods for exercising rights under the laws of countries or regions outside the Republic of Korea, such as the United States, as an Annex to the English version of this Policy.
(2) The Annex applies together with this Policy to residents of the relevant country or region, and where the Annex conflicts with this Policy, the provision more protective of the data subject applies.
Annex. Additional Disclosures for Residents of the United States
Section 1 (Scope)
(1) This Annex supplements this Privacy Policy for individuals who reside in the United States (“U.S. residents”). Where this Annex conflicts with the other provisions of this Policy, the provision more protective of the U.S. resident applies.
(2) Certain U.S. state privacy laws, including the California Consumer Privacy Act as amended by the California Privacy Rights Act (the “CCPA”), apply only to businesses that meet specified thresholds. Regardless of whether such a law applies to the Company, the Company extends the rights described in Section 4 to all U.S. residents, subject to verification and to the exceptions permitted by applicable law.
(3) The Service is operated by HEIMDEX Co., Ltd. from the Republic of Korea, and personal information is processed in the Republic of Korea, the United States, Singapore and other countries as described in Article 8.
Section 2 (Categories of Personal Information)
(1) In the preceding twelve (12) months, the Company has collected the following categories of personal information, which are described in more detail in Article 2. The Company retains each category for the periods described in Article 4.
| Category | Examples | Sources | Business purposes | Categories of recipients |
|---|---|---|---|---|
| Identifiers | Email address, nickname, account identifier, IP address, social login account identifier, YouTube channel identifier | You; social login providers; Google (YouTube) | Account management; provision of the Service; YouTube upload at your request; security | Cloud and authentication service providers; Google (YouTube) when you request an upload |
| Customer records | Name (where provided through social login), email address, payment records | You; social login providers; payment processors | Account management; payment processing | Payment processors; cloud service providers |
| Characteristics of protected classifications | Year of birth; gender (optional) | You | Age verification; optional profile information | Cloud service providers |
| Commercial information | Purchase history; subscription and Credit records | You; payment processors | Paid services; refunds | Payment processors; cloud service providers |
| Internet or other electronic network activity information | Service usage records, access logs, cookies, device and browser information, error logs | Automatically from your device | Operation, security and improvement of the Service | Cloud service providers |
| Audio, electronic and visual information | Videos you upload (including the faces and voices of persons appearing in them), Outputs, thumbnail images, caption files | You | Provision of the Service; YouTube upload at your request | Cloud and AI processing service providers (Article 7); Google (YouTube) when you request an upload |
| Sensitive personal information | Account log-in credentials (email address and password) | You | Authentication only | Cloud and authentication service providers |
(2) The Company does not collect precise geolocation information (location metadata is removed upon upload), government identification numbers or biometric identifiers (see Section 5), and does not retain full payment card numbers, which are processed by payment processors.
Section 3 (Sale, Sharing and Targeted Advertising)
(1) The Company does not sell personal information, does not share personal information for cross-context behavioral advertising, and does not process personal information for targeted advertising or for profiling in furtherance of decisions that produce legal or similarly significant effects. The Company has no actual knowledge of selling or sharing the personal information of consumers under sixteen (16) years of age.
(2) When you request an upload to YouTube, the Company discloses your Output and upload information to Google at your direction; this is not a sale or sharing of personal information.
(3) The Company uses sensitive personal information only for purposes permitted under applicable law, such as providing the Service you request, and does not use it to infer characteristics about you.
(4) The Company treats a Global Privacy Control signal sent by your browser as a valid request to opt out of the sale and sharing of personal information for that browser. Because there is no uniform standard for other “Do Not Track” signals, the Service does not otherwise respond to them.
(5) The Company does not disclose personal information to third parties for their own direct marketing purposes (California Civil Code Section 1798.83).
Section 4 (Your Rights)
(1) Subject to verification and to applicable exceptions, you have the right to:
- - Know and access the categories and specific pieces of personal information the Company has collected about you, the categories of sources, the purposes of collection and the categories of recipients;
- - Delete personal information the Company has collected from you;
- - Correct inaccurate personal information;
- - Obtain your personal information in a portable and, to the extent technically feasible, readily usable format;
- - Opt out of the sale or sharing of personal information, targeted advertising and certain profiling (although the Company does not engage in these activities);
- - Not receive discriminatory treatment for exercising these rights.
(2) You may submit a request through the settings menu within the Service or by email to heimlog@heimdex.co. The Company verifies your identity by confirming your control of the email address registered to your account and may request additional information where necessary. You may designate an authorized agent to submit a request on your behalf; the Company may require written permission signed by you and may ask you to verify your identity directly.
(3) The Company will respond within forty-five (45) days after receiving a verifiable request and may extend this period by an additional forty-five (45) days where reasonably necessary, in which case it will notify you.
(4) If the Company declines to take action on your request, you may appeal by replying to the Company’s decision or by emailing heimlog@heimdex.co with the subject “Privacy Request Appeal”. The Company will respond to your appeal in writing within the period required by applicable law, generally within sixty (60) days. If your appeal is denied, you may contact the Attorney General of your state of residence.
(5) Persons who appear in videos uploaded by a Member may exercise the rights described in Article 3(4) even if they are not Members.
Section 5 (Biometric Information)
(1) The Company does not collect, capture, store or use biometric identifiers or biometric information, including scans of face geometry or voiceprints. Face detection performed to generate Outputs, such as locating faces in video frames for blurring, does not create or retain a template of any person’s face and is not used to identify any person. Speech-to-text conversion transcribes spoken content and does not create voiceprints.
(2) If the Company introduces a feature that uses facial recognition or speaker identification, it will, before collecting any biometric identifiers, provide notice and obtain written consent as required by applicable state laws, including those of Illinois, Texas and Washington, and will publish a retention schedule and guidelines for the permanent destruction of such information.
Section 6 (Children)
The Service is not directed to children under the age of thirteen (13), and registration is not permitted for anyone under the age of fourteen (14). The Company does not knowingly collect personal information from children under thirteen (13). If the Company learns that it has collected such information, it will delete it without delay. A parent or guardian who believes that a child has provided personal information may contact heimlog@heimdex.co.
Section 7 (Marketing Communications)
The Company sends marketing emails only to Members who have consented to receive them. You may unsubscribe at any time using the link in each marketing email or by contacting heimlog@heimdex.co. The Company will continue to send transactional and service-related messages.
Section 8 (Security and Contact)
(1) The Company maintains reasonable security measures as described in Article 16 and will notify affected individuals of a security breach as required by applicable law.
(2) Questions about this Annex and requests under it may be sent to HEIMDEX Co., Ltd., Room 4011, 4F, 75 Ansan-ro, Buk-gu, Gwangju, Republic of Korea, or heimlog@heimdex.co.
Date of publication: September 11, 2026 / Effective date: October 12, 2026