AIBU INC.

Privacy Policy

Effective: October 25, 2026

This policy is written in Korean. This English version is a translation; if the two differ, the Korean version prevails.

AIBU Inc. (주식회사 아이부, “AIBU,” “we” or “us”) complies with the Personal Information Protection Act of the Republic of Korea (PIPA) and related laws to protect the rights of data subjects, and processes and safeguards personal information lawfully. Under Article 30 of PIPA, we publish this Privacy Policy to explain how we process and protect personal information and to handle related complaints promptly and smoothly.

Summary

What we process: the company name, email and message of people who send an inquiry; the email, role, agreement records and usage records of service users; and server access logs (section 3).
Agreement: each service user agrees to the Terms of Service and confirms having read this policy when signing up or accepting an invitation (one required checkbox). The legal basis for processing is performance of the service agreement (section 3).
Customer data: for personal information inside the order, review, advertising and video material a customer connects or uploads, the customer is the controller and AIBU processes it on the customer's behalf. We do not store buyers' or recipients' names, phone numbers, addresses or customs clearance codes from order data (section 10).
AI conversation memory (optional): only when a member turns it on, memory notes drawn from that member's own conversations are used in that member's answers. Other members and customer administrators cannot see them, and the member can delete them or turn memory off at any time (section 3).
Third parties: none. We do not sell personal information or use it for advertising, and we do not use customer data to train general-purpose AI models (section 7).
Processors and overseas transfers: our servers and databases are in the Amazon Web Services Seoul region. For AI features and support, we send only what is needed to providers that process it in the United States and China (section 8, section 9).
Contact: AIBU Privacy, aibesideyou@gmail.com (section 16).

1. Scope and AIBU's role

This policy applies to the AIBU website (ai-bu.net) and shared sign-in, AI Workspace for Commerce (an address for each customer, for example company-name.ai-bu.net), AIBU Studio (studio.ai-bu.net) and other related services AIBU provides (the “Services”). AI Workspace for Commerce and AIBU Studio share one account, and this policy covers both.

Where AIBU is the controller: personal information of website visitors, people who send an inquiry, people who email AIBU, and service account users (a customer's employees and the partner contacts a customer invites).
Where AIBU is a processor: personal information of a customer's consumers, review writers, staff and advertising models contained in the sales, order, review, advertising and video material the customer connects to or uploads into the Services. The customer is the controller of this information and the customer's privacy policy applies. AIBU processes it for the customer under the service agreement (Article 13 of the Terms of Service); details are in section 10.

2. Purposes of processing

We process personal information for the purposes below and for no other purpose. If a purpose changes, we take the steps PIPA Article 18 requires, such as obtaining separate consent.

Inquiries and consultation: reviewing and answering inquiries, consulting on adoption and preparing contracts.
Account management: inviting and activating accounts, confirming and recording agreement to the Terms of Service and this policy, sign-in and identity verification, managing roles and permissions, password resets, and preventing misuse.
Providing the Services: customer screens, AI answers and work records; generating analyses, proposals, images, video and audio; retrieving data from integrated services and applying approved actions; recording usage and calculating fees; managing each customer's monthly base allowance.
AI conversation memory (optional feature): remembering how a member who has agreed to memory works, their preferences and work in progress, and using them in that member's own later answers. Memory made for this purpose is not shown to anyone else and is not used to improve answer guidelines, for member usage overviews or to train AI models.
Support and quality: handling support requests, having staff answer help questions the AI could not, analyzing errors by having AIBU staff review usage records, improving answer guidelines from answer ratings (AI conversation memory is not used), and showing customer administrators each member's task usage cost.
Security and legal compliance: keeping sign-in records, access logs and audit logs; investigating and preventing security incidents; meeting legal obligations; and handling disputes.
Service notices: account invitations, password resets, sign-in lock notices, and notices about service operation and fees. AIBU does not send advertising messages.

3. Information we process and legal bases

Agreement to the Terms of Service and reading this policy

When signing up or accepting an invitation, each service account user ticks one required checkbox: ‘I agree to the Terms of Service and have read the Privacy Policy (required)’. No account is created unless it is ticked. Users whose accounts existed before this agreement was introduced see this screen once, the next time they sign in. When the same screen has an optional item (AI conversation memory), ‘Agree to all’ ticks the required and optional items at once. It starts unticked, and each item can still be unticked on its own. Agreement lasts until the user leaves (has the account deleted) or the service agreement ends, with no separate expiry; we ask again only when the Terms of Service change materially or when the law requires agreement to a change in this policy (section 19). One agreement covers both AI Workspace for Commerce and AIBU Studio.

This agreement forms a service agreement under the Terms of Service between the user and AIBU. The legal basis for the personal information we process to provide the Services is the performance of that agreement (PIPA Article 15(1)(iv)); the basis for overseas transfers is set out in section 9. The basis for each item is shown below. The only processing based on consent (Article 15(1)(i)) is AI conversation memory, which users choose for themselves; users who do not agree still get an account and can use the rest of the Services as before.

Category	Items	How collected	Legal basis (PIPA)
Inquiries	Required: company name, work email, message, services of interest Optional: sales channels and advertising tools currently used Generated: page language, page the inquiry was sent from, receipt number, time received	Website inquiry form	Art. 15(1)(iv) (steps taken at the data subject's request in the course of entering into a contract). Keeping it after it is resolved: Art. 15(1)(vi) (legitimate interest: handling disputes)
Email and support requests	Sender's email address and name (if given), subject, body and attachments Support requests and help questions the AI could not answer: the requesting user's email, company and request	AIBU mailboxes (aibesideyou@gmail.com, support@ai-bu.net), support requests in the Services	Art. 15(1)(iv). Keeping it after it is resolved: Art. 15(1)(vi) (legitimate interest: handling disputes)
Service accounts	Email, password (stored as an irreversible hash), company, role and permissions, whether AIBU Studio is enabled, account status, invitation status, last sign-in time, agreement records (version of the Terms of Service agreed to and of this policy read, time ticked, and whether at sign-up or at sign-in) Partner contact accounts: also name	Invitation by a customer administrator, entry by the user, agreement screen	Art. 15(1)(iv) (performance of contract)
Sign-in	Session identifier and expiry time, sign-in cookie, sign-in records (user, time, a keyed hash of the IP address from which it cannot be recovered, session identifier), failed sign-in and lock records (time and reason), sign-in attempt counts (the IP address and account are recorded only as hashes from which the original cannot be recovered) Two-step sign-in: authenticator app key (stored encrypted), verification codes emailed when the authenticator app is unavailable (stored only as hashes, expiring after 10 minutes) and their use, recovery codes issued earlier (stored only as hashes, destroyed when the app is set up again), setup and use times, browsers for which “Don't ask for 30 days” was chosen (token hash, browser and operating system, last used)	Generated at sign-in	Art. 15(1)(iv) and (vi) (legitimate interest: protecting accounts)
AI Workspace for Commerce usage	Questions and requests users enter, work records (title, plan, steps, result, screen context), help conversations, answer ratings and feedback, feature usage, AI cost records, usage per member (recent use, number of tasks, active days)	Entered or generated during use	Art. 15(1)(iv) and (vi) (legitimate interest: quality improvement and task usage cost reporting to customer administrators)
AI conversation memory (optional)	Memory notes drawn from questions and requests entered after memory is turned on; notes the user edits; records of turning memory on and off (item and version, time, and whether at sign-up, first use or in settings)	Generated from the conversations of users who turned memory on, entry by the user, agreement screen and settings	Art. 15(1)(i) (consent of the data subject, optional). Keeping on/off records: Art. 15(1)(vi) (legitimate interest: disputes)
AIBU Studio usage	Production requests and instructions, review comments and choices, usage and cost records, ID and email of a connected Naver Works account	Entered or generated during use, Naver Works connection	Art. 15(1)(iv)
Audit logs	Who changed accounts, permissions or settings, what changed and when; sign-in records; agreement records; who approved Sellmate actions and when; service email delivery records (recipient, type, result)	Generated automatically	Art. 15(1)(vi) (legitimate interest: security and disputes), Art. 29 (security measures)
Integration access	Seller center login details provided by the customer (ID, password, and the Musinsa one-time password (OTP) generator setting), Sellmate and Meta connection tokens, Google and Naver Works connection details (connected account, granted scopes, access tokens)	Provided by a customer administrator, connection screens	Art. 15(1)(iv)
Server access logs	IP address, time, address requested (tokens and credentials are masked), browser information, referring page, preferred language	Generated by the web server	Art. 15(1)(vi) (legitimate interest: security and incident response)

We do not collect unique identifiers such as resident registration numbers or sensitive information, and we do not process pseudonymized information. For personal information inside material a customer connects or uploads, see section 10.

AI conversation memory (optional consent)

Work requests and help conversations (the Service Assistant) in AI Workspace for Commerce remember a user's conversations only if that user turns memory on. The feature applies only once it is offered and only when the user turns it on; conversations from before it is turned on are not used. We ask when users sign up or accept an invitation, as an optional item kept apart from the required ones and left unticked; users whose accounts existed before then are asked once, the first time they use the work request screen.

Purpose: remembering how the user works, their preferences and work in progress, and using them in that user's own later answers.
Items: short memory notes drawn from the questions and requests the user types after turning memory on (AI answers are not used), and notes the user edits. Conversations are not copied into memory word for word, and other people's contact details, addresses and orderer names, unique identifiers such as resident registration numbers, sensitive information, account and card numbers, and passwords and credentials are filtered out and not kept. No memory is made from conversations before memory was turned on or from another user's conversation that was copied.
Retention: until the user deletes memory or turns it off, the account is deactivated or deleted, or the service agreement ends, whichever comes first. Memory is then destroyed within 5 days, and backup copies are deleted automatically within 7 days at most.
Who can see it: only the user. Other users of the same customer, customer administrators and other customers cannot. A customer administrator can only turn the feature off for the whole company; they cannot require users to turn it on, see who turned it on, or read any memory. When it is turned off for the whole company, that company's users' memory is destroyed within 5 days. AIBU staff look at it only as far as needed when the user asks for support, to investigate a security incident, or where a law specifically provides for it, and record that they did so in the audit log.
Not used for: improving the answer guidelines shared by all customers, member usage overviews, forwarding support requests, or training general-purpose AI models.
Overseas transfer: to make memory notes, the user's request text and that user's most recent memory notes (up to 50) are sent to OpenAI; to answer, only the memory notes that answer needs are sent to OpenAI or Google (section 9), which do not use them for model training under the terms in section 9.
Right to refuse: users who do not agree can sign up and use every other feature as before. After agreeing, users can view, edit, delete one by one or all at once, or turn off memory at any time under ‘AI conversation memory’ in the account menu (section 14).

4. Children under 14

The Services are business services, and AIBU does not process personal information of children under 14. If we learn that such information is being processed, we destroy it without delay.

5. Retention periods

We keep personal information only as long as needed for its purpose and destroy it without delay when the period ends.

Category	Retention
Inquiries	3 years after the inquiry is resolved. No law sets this period: AIBU chose it to handle disputes about inquiries and our answers.
Email and support requests	3 years after the request is resolved (open requests until they are resolved). This applies to support mail and original message files stored in our database, to mail in AIBU's business mailbox, and to support requests made in the Services; after a service agreement ends, these records are kept separately for this period only to handle disputes. No law sets this period: AIBU chose it to handle disputes.
Service accounts	Until the service agreement ends. Accounts no longer in use are deactivated and kept, to show who created records, until the agreement ends, then destroyed within 30 days after it ends. If a user asks for deletion, we delete without delay unless the law requires us to keep the information.
Sign-in sessions	While signed in (8 hours by default, up to 30 days with “Keep me signed in”). Records of expired, signed-out or revoked sessions are destroyed 30 days later. Sign-in records are kept as audit logs.
Two-step sign-in details	While two-step sign-in is in use; destroyed when it is reset or the account is destroyed. A browser remembered with “Don't ask for 30 days” stops working after 30 days or when the password is reset.
Invitation and password-reset links	Invitation links work for 7 days and reset links for 60 minutes. Issue records are kept until the service agreement ends.
Other usage records	Until the service agreement ends (destroyed within 30 days after it ends). This includes original work requests and revision notes in AI Workspace for Commerce. If a user asks for deletion, we delete without delay unless the law requires us to keep the information.
AI conversation memory (optional)	Until the user deletes memory or turns it off (withdrawing consent), the account is deactivated or deleted, or the service agreement ends, whichever comes first; then destroyed within 5 days. Memory keeps only notes, not the conversations themselves, so turning it on does not lengthen how long conversations and work records are kept (‘Other usage records’), and turning it off or deleting it leaves those records to that period. When the service agreement ends, memory is destroyed and not included in the data the customer can download. On/off records are kept as audit logs.
Audit logs (including sign-in and agreement records)	3 years from the date recorded (for records of granting, changing and removing access rights, the minimum period under Article 5 of the Standards for Measures to Ensure the Security of Personal Information). After the service agreement ends, they are kept only to investigate security incidents and handle disputes, and used for nothing else.
Integration access	Destroyed without delay when disconnected or when the service agreement ends
Server access logs	3 months (90 days, the period under Article 41 of the Enforcement Decree of the Protection of Communications Secrets Act). Logs are split into a new file each day, and files older than 90 days are deleted.
Contract and billing records	5 years (Article 85-3 of the Framework Act on National Taxes)
Backups	Automatic database backups are kept for at most 7 days and then deleted automatically; daily backup files kept on our server are deleted automatically within 4 days. Earlier versions of files deleted from file storage (Amazon S3) are deleted automatically after 30 days.

6. How we destroy information

Procedure: we destroy personal information without delay when its retention period ends or its purpose has been achieved, and a scheduled job deletes records past their retention period every night. Personal information that other laws require us to keep is stored separately from other information and only for the required period. The only such information today is contract and billing records (contract terms, invoices and payments, contact email), kept under Article 85-3 of the Framework Act on National Taxes.
When a service agreement ends: we offer the customer a way to export its data, then destroy the customer's data and its users' account details within 30 days after the agreement ends. Audit logs, inquiry and support records, and contract and billing records are kept separately only for the periods in section 5. AI conversation memory is not included in the download and is destroyed within 5 days after the agreement ends (section 5).
Method: electronic files and database records are deleted so that they cannot be restored, and copies in backups and earlier file versions in file storage expire with the backup retention periods in section 5. Paper documents are shredded or incinerated.

7. Provision to third parties

We process personal information only within the purposes in section 2 and provide it to third parties only where PIPA Articles 17 and 18 allow, such as with the data subject's consent or where a law specifically provides for it. We currently provide no personal information to third parties. A customer administrator viewing their own company members' task usage cost is part of the service we provide to that customer. AI conversation memory is shown to no one but the user, not even customer administrators (section 3).

8. Processors

To provide the Services, we entrust the processing of personal information to the processors below. They are also sub-processors for personal information customers entrust to us (section 10).
We entrust work to each processor under its terms of service and data processing terms, and we check that they process personal information safely.
Before adding or changing a processor, we update this policy and inform customer administrators by email (Article 13 of the Terms of Service).

Processor	Work entrusted
Amazon Web Services, Inc.	Servers, databases and file storage; sending service email (Amazon SES) and receiving support mail (Seoul region, Republic of Korea)
Google LLC	AI answers and analysis, search indexing, image, video and audio generation (Gemini API), AIBU business email (Gmail)
OpenAI OpCo, LLC	Interpreting questions, answering and analyzing advertising questions, judging links between ads and products, review analysis, input assistance, improving answer guidelines, making AI conversation memory notes, image and audio generation in AIBU Studio
Alibaba Cloud (Singapore) Private Limited	Video generation (Wan) and ranking material search results in AIBU Studio
Meta Platforms, Inc.	Looking up the customer's Meta advertising data to answer advertising questions (Meta's ads tools)

Processors keep information until our agreement with them ends; the retention periods of processors abroad are shown in the table in section 9.

9. Overseas transfers

To provide the Services (perform the service agreement), we entrust the processing of personal information abroad as shown below. The legal basis is PIPA Article 28-8(1)(iii): entrusting processing or storage abroad where it is necessary to conclude or perform a contract with the data subject, and the matters listed in Article 28-8(2) are disclosed in this policy. We therefore do not ask for separate consent for each recipient, and there is nothing further to agree to for overseas transfers. If a user has turned on AI conversation memory (section 3), the text needed to make memory notes or reflect them in answers is sent in the same way. All transfers use encrypted connections (HTTPS), and only what the feature in use needs is sent.

Recipient (contact)	Country	Items transferred	When and how	Purpose	Retention
OpenAI OpCo, LLCdsar@openai.com	United States	Users' questions and requests and screen context, answers, ratings and feedback, business data such as advertising and reviews (including parts of review text and customer staff names in ad account activity), ad images (which may show people) and product images, images and documents users upload, image-generation instructions and reference images in AIBU Studio (which may show people) and narration scripts, memory notes of users who turned on AI conversation memory (that user's most recent notes, up to 50, when making notes; the parts an answer needs when answering)	Via API when a feature is used and when answer guidelines are updated each week	Interpreting questions, answers and analysis, judging links between ads and products, improving answer guidelines, image and audio generation, making AI conversation memory notes	Results are returned right away and we do not use response storage. OpenAI keeps data for up to 30 days to monitor abuse and then deletes it (unless the law requires longer).
Google LLCsupport.google.com/policies	United States and other countries where Google has processing facilities	Users' questions and recent conversation, ad copy and ad images (which may show people), product names and images, production requests, instructions and narration scripts in AIBU Studio, photos, video and audio users upload (which may contain people's faces and voices) and generated scenes, parts of customer documents, and AIBU business email (sender email, message content), memory notes an answer needs, for users who turned on AI conversation memory	Via API when a feature is used and when search indexes are built; email when sent or received	AI answers and analysis, search indexing, image, video and audio generation and quality review, keeping AIBU business email	Under the paid-service terms, the Gemini API keeps data for 55 days solely to detect policy violations; files uploaded for analysis are deleted after analysis. Generation records we ask to be stored so that a video can be continued are kept for the period Google's policies set. Business email is kept for the email retention period in section 5 (3 years after the request is resolved).
Alibaba Cloud (Singapore) Private LimitedDPO_Intl@alibabacloud.com	China (processed in Alibaba Cloud's Beijing region)	AIBU Studio video-generation instructions; product and reference images and video for scenes in which no person appears; material search terms and candidate images (up to 40) and videos (up to 4). Search candidates may include material showing people.	During video generation and material search; the provider fetches files from temporary addresses that stay open for 2 hours	Video generation, ranking material search results	Kept until the job is finished and the result delivered; otherwise according to the provider's policies.
Meta Platforms, Inc.facebook.com/privacy/policy	United States	Users' advertising questions (up to 1,000 characters), identifiers of the ad accounts and ads to look up	Sent to Meta's ads tools when answering an advertising question	Looking up the customer's Meta advertising data	According to Meta's policies.

Use for AI training: AIBU does not use customer data to train general-purpose AI models. OpenAI does not use data received through its API to train its models by default. AIBU uses the Gemini API on the paid tier: under the Gemini API terms for paid services, Google does not use the prompts we send (including instructions and image, video or document files) or the responses to improve its products, so it does not use them to train its models. Other providers follow their own policies.
How to refuse a transfer, and what happens: if you do not want your information transferred abroad, tell us at aibesideyou@gmail.com. Where possible we turn off the feature concerned or work out another way with you. Features that rely on providers abroad (AI questions and answers, analysis, image, video and audio generation, forwarding support requests) may then be unavailable.
Servers, databases and file storage are in the Amazon Web Services Seoul region (Republic of Korea) and are not moved abroad for storage.

10. Information we process for customers

We process the material a customer connects to or uploads into the Services on the customer's behalf. The customer is the controller of any personal information in that material, so data subjects can exercise their rights with the customer. If you contact us, we pass the request on to the customer and help with it.

Order data: from order data received from Sellmate and sales channels, buyers' and recipients' names, phone numbers, addresses, emails, personal customs clearance codes and delivery notes are discarded on receipt and never stored. Numbers that identify an order, such as a channel's order number, are stored; matched against information the customer holds, they can identify a buyer. Sellmate's change-of-address function is not part of the current connection permissions and is not used; if it is used in future, change requests will be kept encrypted for 30 days only.
Reviews: we store the review text, rating, time written and the writer's gender, and replace the writer's nickname or member ID with a value from which the original cannot be recovered (a keyed hash). Anything writers put in the review text itself may remain. We do not store height and weight, purchase options or review photos.
Settlement and advertising data: buyer and member columns in settlement files are emptied before storage. Advertising data may include names of customer staff recorded in the ad account's activity history and ad images that show people.
AIBU Studio material: photos, video and audio users upload or import from Google Drive or Naver Works may contain people's faces and voices, such as advertising models. When generating a scene that shows a person, the still frames of that person are sent only to Google's video-generation models; only material for scenes without people is sent for video generation by the provider that processes in China (Alibaba Cloud). Candidates sent to rank material search results may, however, include material showing people. Files are stored on AIBU servers in the Seoul region; files uploaded as production references but not used are deleted after 24 hours. Temporary addresses opened for providers to fetch files close after 2 hours, and the copies served through them are deleted within 4 hours. Copies of files imported from Google Drive or Naver Works are kept only as long as indexing and delivery need them and then deleted, and at the latest they are destroyed when the service agreement ends.
Sub-processing and overseas transfer: this material is stored in the Amazon Web Services Seoul region, and only the parts needed when a user uses an AI feature are sent to the processors in sections 8 and 9. Under Article 13 of the Terms of Service, the customer consents to this sub-processing, and can disclose these sub-processors and overseas transfers in its own privacy policy by linking to sections 8 and 9 of this policy.
Retention and destruction: kept until the service agreement ends. When it ends, we offer the customer a way to export the material and destroy it within 30 days after the agreement ends (Article 21 of the Terms of Service). Copies left in backups and earlier file versions in file storage remain after that only for the backup retention periods in section 5 (database backups at most 7 days, earlier file versions 30 days) and are then deleted automatically. During the agreement, copies of raw Meta advertising data are deleted automatically after 365 days.

11. Security measures

Under PIPA Article 29, we take the following measures.

Access rights: each customer's data is kept separate so that other customers cannot see it, and the functions available depend on the customer administrator or member role. Deactivating an account or changing its password ends all of that account's sign-in sessions. AIBU's operator account is limited to one, and account and permission changes are recorded in the audit log. AI conversation memory is shown only to the user it belongs to, checked by both customer and user, and neither customer administrator screens nor AIBU operator screens have any way to view it.
Fewest people with access: only the small number of AIBU staff who operate the Services handle personal information.
Access control: databases cannot be reached directly from the internet, only from our service servers. Server administration is possible only through AWS management tools and key-authenticated remote access (SSH) from one pre-approved address; passwords cannot be used to sign in to the servers.
Sign-in protection: sign-in attempts from one address or for one account are rate-limited, and an account with 10 wrong passwords within 15 minutes is locked for 15 minutes and its owner notified by email. Locks and unlocks are recorded in the audit log. AIBU's operator and customer administrator accounts must complete two-step sign-in with an authenticator app (customer administrators may postpone setting it up for 7 days from the first prompt), and members can turn it on if they wish. When the app is unavailable, a user can sign in with a verification code sent to the registered email address; the account owner is notified by email, and operator and customer administrator accounts must set the app up again right away.
Encryption: all Services are reachable only over HTTPS (TLS). User passwords are stored with one-way hashing that cannot be reversed; invitation and password-reset tokens are stored only as hashes and delivered in a way that keeps them out of servers and access logs. Databases, file storage (Amazon S3) and the service server's disk are encrypted at rest, and Meta, Sellmate, Google and Naver Works connection tokens are stored encrypted in the database. Seller center login details are stored encrypted with AWS Key Management Service and decrypted only in server memory when data is retrieved.
Records: account and permission changes, sign-ins and failed sign-ins, agreements and Sellmate approvals are recorded in the audit log. Web server access logs are split by day and kept for 90 days, with tokens and credentials in addresses and request headers masked.
Mail security: mail to our support address is scanned for spam and malware.
Physical security: servers and data are in Amazon Web Services data centers.

12. Cookies and browser storage

A cookie is a small piece of information a website stores in your browser; browser storage keeps similar information on your device. We use only the cookies and browser storage below, which the Services need to work. We use no advertising, analytics or tracking cookies and no third-party analytics tools.

Name	Purpose	Duration
Sign-in cookie `access_token`	Keeps you signed in (shared across ai-bu.net and its subdomains)	Shared sign-in page: until the browser closes, or up to 30 days with “Keep me signed in”. AI Workspace for Commerce sign-in page: 8 hours
Two-step sign-in cookie `aibu_mfa`	Keeps the sign-in step open while you enter a code after your password is checked	Up to 20 minutes
Remembered browser cookie `aibu_trusted_device`	Skips the code on a browser where you chose “Don't ask for 30 days”	30 days (ends on a password reset or when you forget the browser)
Language cookie `aibu_locale`	AI Workspace for Commerce screen language	1 year
Partner screen cookies	Sign-in and language on partner screens	Sign-in 8 hours, language 1 year
Language setting (browser storage) `aibu-locale`, `aibu-studio-locale`	Language chosen on the website and in AIBU Studio	Until you clear it
Saved email (browser storage)	Sign-in email, if you choose “Remember email”	Until you turn it off or clear it
Screen settings (browser storage)	Collapsed menus, display currency, view settings and forms in progress, to make the screens easier to use	Forms in progress are deleted when the tab closes or after 8 hours; the rest until you clear them

You can refuse cookies or delete stored cookies and site data in your browser settings; in Chrome, for example, under Settings › Privacy and security › Third-party cookies, or Delete browsing data. If you refuse the sign-in cookie, you cannot use the Services that require sign-in.

13. Behavioral information

We do not collect, use or provide to third parties behavioral information for targeted advertising, and we do not let other companies collect behavioral information on our website or Services.

14. Your rights and how to use them

You may at any time ask AIBU to let you access (PIPA Article 35), correct or delete (Article 36), or stop processing (Article 37) your personal information, and you may refuse or ask for an explanation of automated decisions (Article 37-2).
You can exercise these rights by email to aibesideyou@gmail.com or in writing. We act without delay and tell you the result; access is provided within 10 days of your request. You can also ask your customer administrator to deactivate your service account.
To withdraw your agreement to the Terms of Service, ask us to delete your account. Because service account information is processed to perform the service agreement, you can no longer use the Services with that account once you withdraw.
You can view, edit, delete one by one or all at once, or turn off AI conversation memory yourself under ‘AI conversation memory’ in the account menu, or ask us by email. Turning memory off counts as withdrawing consent: we destroy the memory within 5 days, and you can keep using the rest of the Services.
You may also act through a legal representative or someone you authorize, who must submit a power of attorney in the form set by the Notice on Methods of Processing Personal Information (Annex Form 11).
We check that the person making a request is you or your rightful representative. Where a law specifically provides for it, or where a request could unfairly harm another person's life, body, property or other interests, we may limit or refuse it as PIPA allows; we then tell you why and how to object.
You cannot ask us to delete personal information that another law requires us to keep.
Rights over material for which a customer is the controller (section 10) are exercised with that customer, and we act on the customer's instructions.
Users must keep their account information accurate and must not infringe others' personal information.

15. Automated decisions

AIBU does not make decisions that significantly affect a data subject's rights or obligations by fully automated means. There is therefore no processing that counts as an automated decision under PIPA Article 37-2.
The AI in the Services proposes ad budget changes, price forecasts, links between products and ads, and to-dos. Ad budget proposals and Sellmate order actions take effect only after a person reviews and approves them, and prices are never applied to sales channels automatically. Links between products and ads are used in reports automatically when confidence is high, and users can change them. These proposals concern products and ads, not decisions about individuals.
A sign-in lock is a temporary 15-minute measure to protect the account and ends at once when the password is reset or when you ask us.
If you want an explanation of how an AI result was reached or wish to object, write to aibesideyou@gmail.com.

16. Privacy officer and complaints

AIBU has designated the following privacy officer, who oversees personal information processing and handles complaints and remedies. Requests for access are received and handled by the same team.

Privacy officer: the Representative Director of AIBU Inc.
Complaints and access requests: AIBU Inc. Privacy
Contact: aibesideyou@gmail.com

Send questions, complaints or requests for remedies about personal information to the contact above, and we will reply and act without delay.

17. Remedies

To seek a remedy for an infringement of your personal information, you can apply for dispute resolution or advice to the bodies below (in Korea). For other reports or advice about privacy infringements, contact them as well.

Personal Information Dispute Mediation Committee: 1833-6972, www.kopico.go.kr
Personal Information Infringement Report Center (KISA): 118, privacy.kisa.or.kr
Korean National Police Agency: 182, ecrm.police.go.kr

18. Google API data

AIBU sends service email, such as account invitations, password-reset links and operational or billing alerts, through Amazon SES. AIBU does not require Gmail access to send transactional email. Google Drive access is requested separately when a customer administrator or user connects the customer's storage to an AIBU service.

AI Workspace for Commerce imports Google Sheets data the customer connects, read-only (drive.readonly). AIBU Studio reads files the user selects (drive.readonly) and saves finished outputs to the customer's Drive (drive.file).
When Google Drive is connected, AIBU stores the connected account, the granted scopes, an encrypted refresh token, the IDs of selected folders and files, and the minimum metadata needed for synchronization.
Data received through Google APIs is used only for the service and customer that authorized it. It is not sold, not used for advertising, and not used to train or improve generalized or foundation AI models.
Only the systems and staff needed to operate, secure and support the feature can access this data.
The Google Account owner can revoke access at any time from the Google Account permissions page, and on request AIBU deletes the stored token.

AIBU's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

19. Changes to this policy

This policy is effective from October 25, 2026.
When we add, delete or change anything, the changed policy is published on the website when it takes effect and recorded in the revision history below. Before transferring to a new overseas recipient, we update this policy first.
Only where the law requires the data subject's agreement to a change are users asked to agree to it again, the first time they sign in on or after the effective date. Changes made under a basis that needs no agreement, such as performing the service agreement (section 3), are announced instead.
When we add a feature that applies only to users who choose to agree to it, we ask for that optional agreement when the feature is first offered. Users who do not agree can keep using the rest of the Services as before.
Before adding or changing a processor, we update this policy and inform customer administrators by email.
Earlier versions are available in the revision history below.

Revision history

October 31, 2026 update: usage per member is seen only by AIBU staff, and customer administrators see each member's task usage cost (sections 2, 3, 7 and 15). This describes narrower processing, so the effective date stays the same.
October 25, 2026 update: we no longer entrust personal information to development and operations support, so Anthropic was removed from sections 8 (processors) and 9 (overseas transfers). Records sent to that support service earlier are deleted under Anthropic's policies within 30 days.
October 25, 2026 update: the required items at sign-up, invitation acceptance and sign-in were merged into one, ‘I agree to the Terms of Service and have read the Privacy Policy’, and ‘Agree to all’ is described (summary, sections 3 and 14). Because processing is based on performing the service agreement, this policy is now read rather than agreed to. Sign-in records are now correctly described as keeping a hash of the IP address that cannot be reversed (section 3), and the ad and product images sent to OpenAI, judging links between ads and products (sections 8 and 9), and what is sent to make AI conversation memory notes (sections 3, 8 and 9) now state the actual practice. Memory notes are made only from text the user types, and Google is not used for this, so those words were removed from the items in section 3 and from Google's purposes in section 9.
October 25, 2026 update: how work is entrusted to processors (section 8) and Anthropic's entrusted work and retention period (sections 8 and 9) now state the actual terms, and OpenAI's development and operations support, which has ended, was removed (sections 8 and 9).
October 24, 2026 update (before taking effect): the procedure for changes was set out (section 19). Changes apply when they are published and are recorded in the revision history; agreement is asked again only where the law requires it; processors and overseas transfers are updated here before the processing starts.
October 24, 2026 update (before taking effect): added how the optional AI conversation memory feature, which users choose for themselves, processes information (sections 2, 3, 5, 6, 7, 9, 11 and 14). The feature applies only once it is offered and only when a user turns it on; nothing changes for users who do not turn memory on.
October 24, 2026 update: AIBU no longer uses Discord. Support requests and operation alerts are forwarded by email only (removed from sections 5, 8 and 9). Earlier messages left in Discord hold no personal information of customer members (server alerts, setup tests and AIBU staff's test requests only). It reduces processing, so it applied at once.
October 24, 2026 update: an added security measure described (section 11, server disk encryption).
Effective October 25, 2026 (current): Korean Privacy Policy adopted. The services were renamed AI Workspace for Commerce and AIBU Studio; the policy now describes each user's agreement and the legal basis per item, retention periods, processors and overseas transfers, security measures and cookies, and separates where AIBU is the controller from where it is a processor. This English version was revised to match.
October 13 to October 24, 2026: previous Privacy Policy