Privacy Policy

1. Purposes of Processing

We process personal information only for the purposes below. If a purpose changes, we take the steps required by Article 18 of PIPA, such as obtaining separate consent.

1. Membership: sign-up with a Google account, identification and authentication, account management, prevention of misuse, notices, withdrawal.
2. Service provision: AI generation and editing of video, images, voice and subtitles, rendering, automated shorts production, narration/celebrity/shopping shorts and other creation features, saving and loading projects, downloading results.
3. External accounts and publishing: when you request it, YouTube channel linking, uploads and scheduled publishing, channel statistics, and other services you connect.
4. Paid services and payments: purchase of plans and credits, payment confirmation, credit top-up/deduction/return, refunds, payment history, tax and settlement.
5. Dedicated Manager: answering usage questions, continuing previous conversations for more accurate answers (including on other devices), team verification of questions the Manager could not answer, receiving and analysing error reports and notifying results, delivering member notices, and reusing verified answers without personal information as help content.
6. Customer support: receiving inquiries and complaints, fact-checking, notifying results, keeping dispute records.
7. Security and quality: incident response through access/error logs, threat detection, blocking misuse and automated attacks.
8. Service improvement: usage statistics in a form that does not identify individuals, feature improvement and development.
9. Legal obligations: record keeping under e-commerce, tax and telecommunications laws and responding to lawful requests.

2. Personal Information Processed and How It Is Collected

We do not collect resident registration numbers or other sensitive or unique identifying information. If your uploads include other people's personal information, faces or voices, you must have the proper rights or consent.

3. Retention Periods

These general periods describe live-service data. Section 4 distinguishes current recovery-copy conditions; that distinction does not extend YouTube deletion requirements. Section 16 takes precedence for those requests.

• Account information: until withdrawal; deleted without delay upon withdrawal, except information that laws require us to keep (stored separately for the periods below).
• Creation data, results and projects: until withdrawal or your deletion request.
• Dedicated Manager conversations: until withdrawal; deleted without delay upon withdrawal; you may request deletion at any time (Section 17).
• YouTube API data: retained for the feature as needed. The current scheduled cleanup uses a 30-day threshold. Some comment records, past copies and complete deletion after revocation require separate checks; see Section 16.
• Customer support records: 3 years after completion (where they are consumer complaint or dispute records).

Retention required by law

• Records on contracts or withdrawal of offers — Act on Consumer Protection in Electronic Commerce — 5 years
• Records on payment and supply of goods — same Act — 5 years
• Records on consumer complaints or dispute handling — same Act — 3 years
• Records on labeling and advertising — same Act — 6 months
• Books and supporting documents for transactions under tax laws — Framework Act on National Taxes — 5 years
• Login records (access time, IP address and other communication confirmation data) — Protection of Communications Secrets Act — 3 months

4. Destruction Procedure and Method

Personal information is destroyed without delay when its retention period ends, its purpose is achieved, or you withdraw or request deletion, after approval by the privacy officer. Information that must be kept by law is stored separately and destroyed when its period ends. Electronic files are permanently deleted in a way that cannot be restored; paper documents are shredded or incinerated. Deletion from the live service does not immediately erase recovery backups or copies held by external processors. The current backup arrangements and remaining checks are described below. When an account is deleted, that member's Dedicated Manager conversations and summaries are automatically found and deleted.

When you delete your account (My Page > Settings > Delete account): we lock the account at once and sign you out on all devices. Your name, email, profile photo, linked YouTube/SNS permissions, projects, uploaded files and outputs, and Dedicated Manager conversations (including escalated questions and answers, error reports and result notices) are deleted without delay, and we ask the linked providers to revoke or delete those permissions. Records the law requires us to keep — payment, refund and credit records, consumer complaint and dispute records, and access logs — are kept separately with your name, email and other identifying details removed, linked only to a member number, and destroyed when the periods in Section 3 end. If you sign up again with the same Google account, you are treated as a new member and not linked to the previous information.

Recovery backups and deletion checks

• Automated database backups retain the most recent 36 copies; recovery logs retain 35 days. A count of 36 is not a maximum age of 36 days for all copies. Selected daily file backups are configured for cleanup after they are older than 36 days.
• Manual backups, initial/validation file backups and server snapshots/images do not have the same verified automatic expiry. Existing backups are retained on instance deletion, with a 35-day final backup setting. A deletion deadline covering all these copies has not yet been established.
• We distinguish live-service deletion, recovery-copy deletion and processor-held deletion when handling requests, and report unfinished steps. Expiry across all copies and procedures preventing deleted data from returning on restore are being improved and verified.

5. Provision to Third Parties

We do not provide personal information to third parties except with your separate consent, where laws specifically require it, or where investigative authorities request it under legal procedures. We currently do not provide personal information to any third party. Publishing to your own account at your request (such as YouTube uploads) is processing on your instruction, not third-party provision. Processors are listed in Sections 6 and 7.

6. Entrustment of Processing

Under Article 26 of PIPA, our contracts require processors to process data only for the entrusted work, apply technical and administrative safeguards, restrict sub-entrustment, accept supervision and bear liability. Changes will be disclosed in this Policy without delay.

• Google LLC (Google Cloud) — service servers, database and file storage (servers in Seoul, Korea), Google login — until withdrawal or end of contract
• Cafe24 Corp. — web traffic relay server — until end of contract (access logs per Section 3)
• Gumroad, Inc. — card checkout and payment processing, subscription management, payment confirmation, payment cancellation (refunds) — for the legally required period
• Neosapience, Inc. (Typecast) — AI voice generation — until the purpose is achieved
• Telegram FZ-LLC — notifying our operators of member error reports and questions — per the provider's message retention policy
• AI processing providers in Section 7 — AI generation of text, images, video and voice, speech recognition, search answers, Dedicated Manager replies — as stated in Section 7

7. Overseas Transfer

Under Article 28-8 of PIPA, we transfer (entrust and store) personal information overseas as below to provide the Service. Data is sent over encrypted (TLS) connections only when you use the related feature and only as needed for it. Request storage, model-improvement sharing and abuse-monitoring retention are separate controls. The verified Gemini and OpenAI conditions are distinguished below.

• Time and method: sent over the network with encryption each time you use the related feature.
• Refusal and consequences: you may refuse overseas transfer through Support; features that require these providers (AI generation, payments, etc.) then cannot be used.
• Inquiries about these providers can be sent to our privacy officer (Section 18), who will forward them.

8. Rights of Data Subjects and Legal Representatives

1. You may at any time request access, correction, deletion, suspension of processing and withdrawal of consent, and you may refuse or ask for an explanation of automated decisions (Section 13).
2. Requests can be made via My Page > Support or email (support@tubeai.org); we act without delay (within 10 days of receipt). YouTube-data deletion requests use the shorter seven-day requirement in Section 16. You can delete your account yourself at any time from My Page > Settings > Delete account.
3. Rights may also be exercised through a legal representative or an authorized agent with a power of attorney in the form prescribed by the relevant notice.
4. Access and suspension requests may be limited under Articles 35(4) and 37(2) of PIPA; deletion cannot be requested where other laws require the information to be collected.
5. We verify that the requester is you or your lawful representative.
6. You must keep your information accurate and must not use others' personal information or infringe others' rights through your uploads.

9. Children Under 14

We do not accept members under 14 and do not collect their personal information. If we learn that such information was collected, we destroy it without delay. Legal representatives may request access or deletion through Support.

10. Security Measures

• Administrative: internal management plan, minimal staff with access, security training, regular self-checks.
• Technical: access limited to designated people via internal network and authentication, firewalls, append-only records of server administration, TLS encryption in transit, no storage of member passwords (Google sign-in), secrets kept in separate access-restricted storage, automatic masking of emails/phone/card numbers in data sent by the support assistant to external AI, security updates, backups and incident response.
• Physical: servers and data are kept in cloud data centers with physical access controls (Google Cloud, Seoul, Korea).

11. Cookies

We use cookies and browser storage to keep you logged in, save settings, keep screen state and for security. We do not use third-party advertising or analytics cookies. You can refuse or delete cookies in your browser settings (Chrome: Settings > Privacy and security; Edge: Settings > Cookies and site permissions; Safari: Settings > Privacy > Manage Website Data), but features that require login will not work.

12. Behavioral Information

We do not collect or use behavioral information for online targeted advertising, nor allow third parties to collect it. Usage records are used only for the purposes in Section 1.

13. AI Processing and Automated Decisions

1. The Service generates requested content and Dedicated Manager replies with AI. AI output may be wrong or inaccurate; please review before use.
2. Questions the Manager cannot answer with confidence are verified by our team and answered through a Manager notice for Master members, or through our KakaoTalk channel consultation for other members; answers involving money such as prices or refunds are sent only after approval by the responsible operator.
3. We do not make decisions that significantly affect your rights or obligations solely by fully automated systems; decisions such as payments, refunds and account restrictions are reviewed by a person.
4. Under Article 37-2 of PIPA you may refuse or request an explanation of automated decisions through Support, and we will explain the criteria and process.

14. Pseudonymized Information

We currently do not process pseudonymized information. If we start doing so, we will disclose it in this Policy as required by Article 28-2 of PIPA.

15. Credit Payments and Refunds

• Card payments: card payments for plans (Master membership, subscriptions) and credits are processed in the checkout of our external payment provider, Gumroad, Inc. (USA). When the checkout opens, your member number and email are passed to the provider to match the payment; you enter card details directly in the checkout and the provider collects and processes them. We receive and keep only the payment result (transaction ID, email used, product, amount, time, subscription/cancellation/refund status).
• Bank transfer: for transfers to our account, we confirm the deposit using the depositor name you give when requesting it and the amount and time of the deposit, then apply your access.
• Credit top-up/deduction/return history is kept for the periods in Section 3. Automatic credit returns for failed or cancelled AI jobs are also recorded in your credit history.
• Refunds follow our refund policy and applicable laws. For card payments we ask the payment provider to cancel the payment and pass it the necessary transaction details. Bank-transfer refunds are sent to an account in your own name; the refund account details are used only for the refund and kept with the refund record. Refund records are kept for 5 years under the e-commerce consumer protection law.

16. YouTube and Other Google API Services Data

• The Service uses YouTube API Services to link your channel and upload videos. By using the Service, you agree to be bound by the YouTube Terms of Service.
• Please see the Google Privacy Policy for how Google processes data.
• The Service's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
• Data obtained via YouTube API Services is used only to provide features to you, is not shared with third parties other than the essential providers in Sections 6 and 7, and is not used for advertising or sold.
• The current scheduled YouTube-data cleanup uses a 30-day threshold. Some records and recovery copies require separate deletion checks; a scheduled cleanup is not confirmation that all copies were erased.
• You can delete a linked channel on My Page and revoke the Service's access at any time via the Google Security Settings page to stop further access. Automatic detection of external revocation and complete removal of existing records/copies require separate checks; also submit a deletion request if you want that data removed.
• Data and features: Depending on the functions you use, TubeAI processes channel identifiers, video and playlist information, metadata, statistics, comments and Google-issued authorization credentials. These support channel information, video and thumbnail publishing, metadata, playlist and channel management, and comment replies that you request or enable.
• Connection permissions: New YouTube connections request https://www.googleapis.com/auth/youtube.force-ssl for these functions. A scope change does not revoke previously issued authorizations. You can manage or revoke existing access using the controls linked above.
• AI-assisted features: If you request an AI-assisted channel report or enable AI-assisted comment replies, the relevant channel/video context or comment text may be sent to the AI processor configured for that feature. Processing providers and overseas transfers are described in Sections 6 and 7. Review feature settings and the actual retention conditions in Section 7 before using these optional functions.
• Deletion requests: Use YouTube data controls or Support. The explicit request in data controls covers all YouTube connections for your TubeAI account, so distinguish it from unlinking one channel. Requests are handled without delay under YouTube's seven-day deletion requirement. Timely deletion across every copy is not yet fully verified; we report the completed scope and remaining steps separately. Request deletion of data held by TubeAI through My Page > Support or support@tubeai.org. Identify your TubeAI account and the connected channel; do not send passwords or authorization tokens. Disconnecting TubeAI or deleting its stored data does not delete videos or comments already published on YouTube. Manage that published content on YouTube.

17. Dedicated Manager Conversations

• What we keep: your messages, the Manager's replies, the screen and time, summaries made when you start a new conversation, questions forwarded for verification and their answers, error reports and result notices.
• Why: to continue previous conversations and answer more accurately (including on other devices), to let our team verify questions and errors, and to reuse verified answers without personal information as help content. The Manager screen states “Conversations are saved to give better answers.”
• How long: until withdrawal; automatically deleted without delay upon withdrawal.
• Deletion on request: at any time via My Page > Support or email.
• Reused help sentences: help sentences derived from verified answers, with nothing that identifies you, may continue to be used to guide other members.
• External processing: conversation text may be sent to the AI providers in Section 7 to generate replies and summaries and for the support assistant's analysis; emails, phone numbers etc. are masked before sending to the support assistant.

18. Privacy Officer and Responsible Department

19. Department Handling Access Requests

Access requests under Article 35 of PIPA can be made to the department above via My Page > Support or support@tubeai.org.

20. Remedies for Infringement

• Personal Information Infringement Report Center (KISA): 118, privacy.kisa.or.kr
• Personal Information Dispute Mediation Committee: 1833-6972, www.kopico.go.kr
• Supreme Prosecutors' Office Cyber Investigation: 1301, www.spo.go.kr
• Korean National Police Agency Cyber Bureau: 182, ecrm.police.go.kr
• Administrative appeals regarding public institutions: Central Administrative Appeals Commission, 110, www.simpan.go.kr

21. Changes and Revision History

This Policy first applied from October 17, 2026; this version is effective from November 5, 2026. Changes due to laws, policies or the Service will be announced on the Service and apply from the announced effective date.

• November 5, 2026: added self-service account deletion from My Page and what happens on deletion (what is deleted at once, how legally retained records are kept, revoking linked-account permissions) to Sections 4 and 8.
• October 30, 2026: added Sume, Inc. (USA), ATLAS CLOUD AI INC. (USA), Segmind Inc. (USA), SerpApi, LLC (USA), Dumpling Software UG (Supadata, Germany) and Vast.ai Inc. (USA, GPU server rental) to the overseas transfer table.
• October 22, 2026: distinguished actual backup count and exceptional copies, provider request storage and separate retention, deletion-check scope and current feature limits.
• October 22, 2026: clarified Google/YouTube data categories, feature uses, new-connection scope, optional AI processing and the support route for deletion requests; added a direct Google/YouTube data link.
• October 17, 2026: Official Korean version newly written and this translation aligned (purposes, items, retention including legal retention, destruction, third-party provision, entrustment, overseas transfer, rights, security, cookies, behavioral information, AI processing and automated decisions, pseudonymized information, payments and refunds, Google API data, Dedicated Manager conversations, privacy officer, remedies).
• October 17, 2026 (same-day correction): the card payment provider corrected to Gumroad, Inc. (USA), the checkout actually used (including the entrustment and overseas transfer tables), and bank-transfer deposit and refund handling added.
• Previous policy: version as of September 30, 2026

Governing Language

If there is any conflict between the Korean and English versions, the Korean version prevails.