Privacy Policy

Article 1 (Purposes of Processing)

The Company processes personal data for the following purposes.

• Membership and account management: confirming the intention to register, identifying and authenticating the member, maintaining and managing membership, and preventing misuse.
• Provision of the Services: viewing projects, contracts, billing and reports in the customer console, uploading materials, handling request tickets, and inviting members and approving their joining.
• Handling enquiries and consultation: receiving and answering enquiries submitted through the enquiry form, the AI consultation and chat consultation, and progressing quotations and consultations.
• Provision of free tools: producing diagnostic and keyword report results and sending them by email.
• Marketing and advertising (where separately consented): sending advertising messages such as announcements of new services and events.
• Service operation statistics: analysing access frequency and producing statistics to improve the Services.

Article 2 (Personal Data Collected)

• Email sign-up: email address and password (required).
• Social login sign-up: email address, profile name and profile picture (required) — provided by Google or Kakao.
• Onboarding (individual member): name and contact details (required).
• Onboarding (business member): name, contact details, company name, business registration number, name of the representative and job title (required).
• Enquiries and consultation: the name, contact details (such as an email address) and enquiry content entered by the user in the enquiry form or chat consultation.
• AI consultation transcripts: the enquiry content a user enters in the consultation window and any contact details (email address or phone number) the user volunteers during the conversation. When a conversation is stored as a record, email addresses and phone numbers are masked, and contact details found in the conversation are used only to pre-fill the enquiry form — nothing is submitted as an enquiry without the user sending it.
• Free tools (diagnostics): email address, company name, website address, industry and the memo entered by the user.
• Free tools (keyword report): email address, name, company name and the keywords the user asked us to look up.
• Whether the user has consented to receive marketing messages (optional).
• Automatically generated or collected data: IP address, cookies, access time, service usage records, and device and browser information.
• Materials uploaded by a user while using the customer console may contain personal data; the items and scope of such data are determined by the user.

Article 3 (Processing and Retention Periods)

• Member data: until withdrawal of membership. Once a withdrawal request is received, the account and personal data are destroyed without delay after review and approval by the Company's staff.
• Enquiry and consultation records: 3 years after the enquiry is resolved (records on consumer complaints and dispute resolution). Raw AI consultation messages are deleted automatically 180 days after the last exchange; only the consultation summary and enquiry record are kept for the period above.
• Free tool request records: until the purpose, such as delivering the result and any follow-up consultation, has been achieved.
• Data that must be preserved under applicable law is retained for the relevant period.
  • Records on contracts or withdrawal of subscription: 5 years (Act on Consumer Protection in Electronic Commerce).
  • Records on payment and the supply of goods and services: 5 years (same Act).
  • Records on consumer complaints or dispute resolution: 3 years (same Act).
  • Service access logs: 3 months (Protection of Communications Secrets Act).
• Audit logs: to verify the lawfulness of processing such as account deletion, the email address of the data subject concerned remains recorded in the processing history.

Article 4 (Provision to Third Parties)

The Company processes personal data only within the scope set out in Article 1 and does not process it beyond the original scope, or provide it to a third party, without the user's prior consent. Cases in which a law provides otherwise are an exception.

Where a user has consented to advertising cookies through the consent banner on the website, online identifiers such as cookie identifiers and usage records are provided to Google LLC and Meta Platforms, Inc. for advertising measurement and personalised advertising. The items and purposes of that provision, the retention periods and how to withdraw consent are set out in Article 10.

Article 5 (Entrustment of Processing)

In order to provide the Services, the Company entrusts the processing of personal data as set out below and stipulates in each contract the matters necessary to keep personal data secure.

Personal data is transferred overseas to those processors above that are located in the United States (Supabase Inc., Vercel Inc., Anthropic, PBC and Resend). The transfer is not made by handing over a separate storage medium; it takes place over the network in the course of providing the Services, and the recipient stores the data on that service provider's overseas servers. Data so transferred is retained until the purpose of the entrusted work has been achieved or the entrustment contract ends.

A user may refuse the overseas transfer of personal data. Because these transfers are essential to providing the Services, however, refusing may restrict use of the Services, including membership registration, the customer console and enquiry handling. Please send any refusal to cs@loopon.ai.kr.

AI consultation transcripts are sent through the Vercel AI Gateway to the AI model operated by Anthropic, PBC in order to generate an answer. The Company does not provide these conversations for the training of AI models.

Where a user signs in with a social login, the Company receives the email address, profile name and profile picture from Google LLC or Kakao Corp. and uses them to identify and authenticate the member.

Article 6 (Connecting Advertising Accounts)

• The Company accesses advertising accounts on Google Ads, Meta, Naver and Kakao only where a Client has connected them directly in the customer console. Without such a connection, the Company does not access them.
• The purpose of the connection is to retrieve advertising performance data from the account in order to produce reports in the console, and access does not exceed the scope of the authority granted by the user.
• Authentication tokens used for the connection are stored encrypted, and a user may disconnect at any time in the console.

Article 7 (Rights of Data Subjects and How to Exercise Them)

A user may at any time request access to, correction or deletion of, or suspension of the processing of, personal data.

• Member data such as the name and contact details can be viewed and corrected directly in My Page.
• Consent to receive marketing messages can be withdrawn at any time in My Page.
• Withdrawal of membership can be requested in My Page, and the account is deleted after review and approval by the Company's staff.
• Social login connections can be managed in My Page.
• Any other request may be sent to cs@loopon.ai.kr, and the Company will take the necessary measures without delay.

Article 8 (Destruction of Personal Data)

Where personal data is no longer needed because the retention period has expired or the purpose of processing has been achieved, the Company destroys it without delay. Data held in electronic files is permanently deleted by a method that prevents recovery, and personal data recorded on paper is shredded or incinerated. Data that must be preserved under applicable law is stored separately from other personal data.

Article 9 (Security Measures)

• Encryption: passwords are stored in a form that cannot be decrypted, and sensitive data such as advertising integration tokens is stored encrypted.
• Access control: row level security (RLS) in the database and permission management keep access to personal data to a minimum.
• Retention of access logs: access logs of the personal data processing system are retained and protected against forgery or alteration.
• Encryption in transit: data in transit is encrypted with SSL/TLS.
• Minimising and training handlers: the number of staff who handle personal data is kept to a minimum and they receive management training.

Article 10 (Cookies and Other Automatic Collection Tools)

The Company uses cookies and similar technologies (including local storage) to provide the Services, to analyse how they are used and to measure advertising performance. Cookies are managed in the three categories below; categories other than the required one are used only where the user has consented through the consent banner on the website. No such script is downloaded before consent is given.

The user's choice is stored in the browser as a cookie (loopon_consent) for one year, together with the time of consent and the version of the Privacy Policy consented to. Where this Policy is amended, the previous consent ceases to have effect and the Company asks again.

• Required (cannot be refused) — items that are essential to providing the Services.
  • Login session cookie: keeps the user signed in.
  • Language cookie (loopon.locale): stores the language selected for the console and the website.
  • AI consultation visitor cookie (loopon_ai_visitor): confirms that a consultation session belongs to the user. It is an httpOnly cookie that browser scripts cannot read and it is kept for 30 days from issue.
  • Visitor cookie (loopon_vid): a random value used to connect visits and enquiries made from the same browser so that the referral path can be understood. It is not a device fingerprint, it is an httpOnly cookie that browser scripts cannot read, and it is kept for 180 days from issue. It is not used for advertising and is not provided to third parties.
  • Consent cookie (loopon_consent): stores the choices made under this Article. It is kept for one year.
  • First-party visit records: the page path, referral source (including UTM parameters) and interface language are recorded in a database operated by the Company itself. These are first-party records used to operate and improve the Services; they are not used for advertising and are not provided to third parties.
  • Vercel Analytics and Speed Insights: collect visit, traffic and performance statistics that do not identify individuals.
  • Channel Talk: maintains the consultation session.
• Analytics (optional) — usage measurement for improving the site.
  • Google Analytics 4: measures page views, referral sources and device or browser information.
• Advertising (optional) — advertising measurement and personalised advertising.
  • Google Ads: links visits from advertising to conversions (such as submitting an enquiry or requesting materials) in order to measure advertising performance.
  • Meta Pixel: measures advertising performance and shows advertising relevant to the user's interests.
• Retention periods differ by tool. Analytics cookies (Google Analytics) may be kept for up to two years and advertising cookies (Meta Pixel) for up to 90 days, according to each tool's default settings. Where consent is withdrawn, new collection stops immediately.
• A user may also refuse the storage of cookies through browser settings, but some Services such as signing in may then be restricted.

All of the transfers above are overseas transfers to the United States. They do not involve handing over a separate storage medium; the user's browser transmits the data directly to the servers of the relevant provider.

A user may refuse the use of analytics and advertising cookies and the resulting overseas transfers, and such refusal does not restrict use of the Services. Consent may be changed or withdrawn at any time from "Cookie settings" at the bottom of the page.

The analytics and advertising tools operate only where the Company has actually adopted and configured them. Before adoption, the relevant scripts are not downloaded even if the user has consented, and no data is transferred.

Article 11 (Personal Data of Children Under 14)

The Company does not accept membership registration from children under 14 years of age and does not collect their personal data. Where collected data is found to belong to a child under 14, it is destroyed without delay.

Article 12 (Data Protection Officer and Contact)

The Company designates the following data protection officer to take overall responsibility for personal data processing and to handle users' enquiries and remedies.

• Data protection officer: 배란임 (position: Representative)
• Business name: 루프온 (trading as loopon)
• Representative: 배란임
• Address: 4F 403-L128, 84 Hipark 3-ro, Ilsanseo-gu, Goyang-si, Gyeonggi-do, Republic of Korea
• Business registration number: 635-22-01092
• Phone: 070-7666-9886
• Customer enquiries: cs@loopon.ai.kr
• Sales enquiries: sales@loopon.ai.kr

To report or seek advice on an infringement of personal data, you may contact the Personal Information Infringement Report Centre (privacy.kr, 118), the Personal Information Dispute Mediation Committee (kopico.go.kr, 1833-6972), the Cybercrime Investigation Division of the Supreme Prosecutors' Office (1301) or the National Police Agency Cyber Bureau (182).

Article 13 (Changes to this Policy)

This Privacy Policy takes effect on 26 August 2026 and supersedes the previous policy that applied from 1 August 2026. This revision adds the purposes of each category of cookies and similar technologies, the analytics and advertising tools used, the resulting overseas transfers, and how to withdraw consent (Article 10). Where content is added, deleted or amended, the Company will announce the change on the website at least 7 days before it takes effect.