Neosapience, Inc. (the “Company”) establishes and discloses this Privacy Policy in accordance with the Personal Information Protection Act of the Republic of Korea, the EU General Data Protection Regulation (GDPR), the UK GDPR, the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA), the Children’s Online Privacy Protection Act (COPPA), and other applicable laws. This Policy also applies to users who access the services from outside the Republic of Korea, including the European Economic Area (EEA), the United Kingdom, and the United States.
1. Purposes of Processing Personal Information
The Company processes personal information for the following purposes and does not use it for any purpose other than those stated below.
Category | Purpose | Data Collected | Type | Legal Basis (GDPR) |
General Member | Handling user inquiries (identity verification, verifying the details of inquiries, contacting and notifying for fact-finding, and notifying of results) | Email, telephone number, mobile phone number | Required | Performance of a contract (Art. 6(1)(b)) |
General Member | Identifying and verifying users for the use of products and services | Name, mobile phone number, email, date of birth, gender | Required | Performance of a contract (Art. 6(1)(b)) |
General Member | Providing the TTS service and managing usage records | Voice generation records, payment history | Required (when using the TTS service) | Performance of a contract (Art. 6(1)(b)) |
General Member | [Newsletter] Announcing new features, event/promotion information, and service updates | Email address | Optional | Consent (Art. 6(1)(a)) |
General Member | [SMS/MMS] Sending event/promotion announcements and benefit information | Mobile phone number | Optional | Consent (Art. 6(1)(a)) |
General Member | [KakaoTalk] Sending service announcements and event/promotion information | Mobile phone number | Optional | Consent (Art. 6(1)(a)) |
Social Login Member | Providing the social login service | Social account identifier (ID), email address | Required (when choosing social login) | Performance of a contract (Art. 6(1)(b)) |
All Members | Preventing fraudulent use of the service, responding to security threats, and ensuring system stability | Access logs, device information, IP address | Required | Legitimate interests (Art. 6(1)(f)) |
2. Processing and Retention Period of Personal Information
1. The Company processes and retains personal information within the retention
and use period consented to at the time of collection, or within the retention and
use period prescribed by applicable laws.
2. The specific processing and retention periods are as follows:
Purpose | Data Collected | Retention Period |
Handling user inquiries | Email, telephone number, mobile phone number | Until membership withdrawal |
Identifying and verifying users | Name, mobile phone number, email, date of birth, gender | Until membership withdrawal |
Providing the TTS service and managing usage records | Voice generation records | Until membership withdrawal |
[Newsletter] announcements | Email address | Until consent is withdrawn |
[SMS/MMS] announcements | Mobile phone number | Until consent is withdrawn |
[KakaoTalk] announcements | Mobile phone number | Until consent is withdrawn |
Providing the social login service | Social account identifier (ID), email address | Until membership withdrawal |
3. Notwithstanding the foregoing, information retained on the basis of the following
laws is stored for the retention period prescribed by such laws for the relevant
purpose:
Records on evidence of transactions: 5 years (Article 85-3 of the Framework Act on National Taxes)
Records on contracts or withdrawal of subscription: 5 years (Article 6 of the Act on the Consumer Protection in Electronic Commerce, etc. and Article 6 of its Enforcement Decree)
Records on payment and the supply of goods, etc.: 5 years (Article 6 of the Act on the Consumer Protection in Electronic Commerce, etc. and Article 6 of its Enforcement Decree)
Records on consumer complaints or dispute resolution: 3 years (Article 6 of the Act on the Consumer Protection in Electronic Commerce, etc. and Article 6 of its Enforcement Decree)
Records on labeling and advertising: 6 months (Article 6 of the Act on the Consumer Protection in Electronic Commerce, etc. and Article 6 of its Enforcement Decree)
Log records and access location-tracking data: 3 months (Article 15-2 of the Protection of Communications Secrets Act and Article 41 of its Enforcement Decree)
3. Rights and Obligations of Data Subjects and Legal Representatives, and How to Exercise Them
Data subjects and their legal representatives may exercise the following personal-information rights against the Company at any time:
The right to request access to personal information
The right to request correction in the event of errors
The right to request deletion
The right to request suspension of processing
In addition, users residing in the EEA, the United Kingdom (under the GDPR), and the United States are granted the following rights:
Right to data portability: the right to receive the personal information you provided in a structured, commonly used, and machine-readable format, or to have it transferred to another controller.
Right to object: the right to object to processing based on legitimate interests and, in particular, the right to object at any time to processing for direct-marketing purposes.
Right to withdraw consent: the right to withdraw at any time consent to processing that is based on consent (withdrawal takes effect prospectively only).
Right to object to automated individual decision-making: the right to object to, and to request human intervention in, a decision based solely on automated processing that produces legal effects or similarly significant effects.
Users may view or modify their personal information at any time via [Company Website > Member Information], and may exercise the above rights by contacting the Chief Privacy Officer in writing, by telephone, or by email.
The Company will notify the user of the result of a request within: 10 days of receipt for users residing in the Republic of Korea (Articles 35 and 36 of the Personal Information Protection Act); one month for users residing in the EEA and the UK (Article 12(3) of the GDPR, extendable by up to a further two months taking into account the complexity of the request); and 45 days for users residing in the United States, including California (CCPA/CPRA, extendable up to 90 days). Where an extension is necessary, the Company will inform the user in advance of the reason and the extension period.
4. Methods of Collecting Personal Information
The Company collects personal information through the following methods:
When a user consents to the collection of personal information and directly enters the information during membership registration and use of the service;
When information is collected through web pages, email, fax, telephone, and the like during consultation via customer support;
When information is collected in writing at offline events, seminars, and the like;
When information is provided by partner companies or organizations;
When generated information, such as device information, is automatically created and collected in the course of using the PC web or mobile web/app.
5. Cross-Border Transfer of Personal Information
For the provision of its services, the Company transfers personal information overseas as described below, and provides the following notice in accordance with Article 28-8 of the Personal Information Protection Act and Articles 44 through 49 of the GDPR:
Recipient | Country | Items Transferred | Date & Method of Transfer | Recipient’s Retention/Use Period | Basis |
Mailchimp (The Rocket Science Group LLC) | United States | Email address | Transmitted over the network at the time a newsletter is sent | Until consent is withdrawn or the outsourcing contract ends | Service operation |
Mixpanel, Inc. | United States | Service usage behavior (access records, feature-usage history) | Transmitted in real time when the service is used | Until the outsourcing contract ends | Service operation |
Google LLC (Google Analytics · Google Ads) | United States | Website visit history, advertising identifiers, behavioral information | Transmitted in real time when the website/app is used | In accordance with Google’s own retention policy | Service operation |
Meta (Facebook) | United States | Behavioral information (website visit history, web/app search history, app usage history, advertising identifiers) | Transmitted in real time when the website/app is used | Until consent is withdrawn or the outsourcing contract ends | Service operation |
Users have the right not to consent to the cross-border transfer. If you refuse consent, you may restrict the use of the relevant features (e.g., newsletter subscription, personalized advertising) through the [Account Settings > Privacy] menu or by contacting privacy@neosapience.com. However, if you refuse a transfer that is essential to the provision of the service, your use of the service may be restricted.
6. Domestic Entrustment of Personal Information Processing
To process personal information more smoothly, the Company entrusts certain tasks to the domestic companies listed below. In accordance with Article 26 of the Personal Information Protection Act, each company is provided with only the minimum information necessary for its assigned task.
Entrusted Company | Entrusted Task | Remarks |
Kakao Business | AlimTalk (notification message) delivery service | Located in Korea |
NHN Cloud | SMS/MMS delivery service | Located in Korea |
7. Destruction of Personal Information
As a rule, the Company destroys the relevant personal information without delay once the purpose of processing has been achieved.
Destruction procedure: Once the purpose has been achieved, the information is moved to a separate database (or a separate document box in the case of paper), stored for a certain period in accordance with internal policies and applicable laws, and then destroyed; it is not used for any other purpose except as required by law.
Destruction deadline: Personal information is destroyed without delay from the date it becomes unnecessary due to the expiry of the retention period, achievement of the processing purpose, discontinuation of the service, closure of business, and the like; where there is a legal obligation to retain it, it is stored securely for the relevant period.
8. Installation and Operation of Automatic Data-Collection Devices, and Refusal Thereof
The Company uses “cookies” that store and retrieve usage information from time to time in order to provide individually customized services.
Purpose of using cookies: To provide optimized information by identifying users’ visits to and usage patterns of the services/websites they visit, popular search terms, whether a secure connection is used, and the like.
Installation/operation of, and refusal of, cookies: You can refuse the storage of cookies via Tools > Internet Options > Privacy at the top of your web browser. However, if you refuse cookies, you may experience difficulties in using customized services.
For users located in the EEA and the UK, the Company obtains prior, category-by-category opt-in consent through a cookie-consent banner upon access to the website for functional, analytics, and advertising cookies, excluding strictly necessary cookies required to provide the service. Users may withdraw their consent at any time via the [Cookie Settings] menu.
The Company provides behavioral information — such as users’ website visit history, web/app search history, app usage history, and advertising identifiers — so that Facebook and Google may use it for data analysis and the operation of personalized advertising.
Recipient of Behavioral Information | Purpose of Use | Remarks |
Inquiries/consultation, promotion | See Section 5 (Cross-Border Transfer) | |
Inquiries/consultation, promotion | See Section 5 (Cross-Border Transfer) |
9. Protection of Children’s Personal Information
Where the Company collects the personal information of a child under the age of 14, it obtains the consent of the child’s legal representative in accordance with Article 22-2 of the Personal Information Protection Act, collecting only the minimum information, such as the legal representative’s name and contact details.
For children under the age of 13 among users in the United States, the Company obtains verifiable parental consent before collecting personal information in accordance with the Children’s Online Privacy Protection Act (COPPA); without such consent, account creation and use of the service are restricted.
A legal representative or parent may request access to, correction of, or deletion of the child’s personal information, and may withdraw consent.
If the Company becomes aware that it has collected the personal information of a child under the age of 14 (or under the age of 13 in the case of the United States) without the consent of a legal representative or parent, it destroys such information without delay. For related inquiries, please contact privacy@neosapience.com.
10. Notice Regarding Facial Images and Biometric Information
The Company provides a feature that generates AI-based avatar content using images uploaded by users (e.g., photos containing faces), and accordingly provides the following clear notice:
The Company does not collect or analyze facial-recognition information or biometric information (“facial data”).
Images uploaded by users are handled as ordinary image files and are not used for any purpose other than providing the service, such as content generation, quality improvement, and error handling.
The Company does not identify individuals through such images or perform functions such as facial recognition or tracking.
Facial images or the resulting content are not provided to any third party and are not used for any external analysis purpose.
Information related to facial images is not stored indefinitely and is retained only for the minimum period necessary to provide the service.
11. Notice Regarding Automated Processing (AI Content Generation)
① The Company automatically processes text, images, and other data entered by users (“Input”) through AI models to generate audio and video content (“Output”). Input may contain personal information, and such information may be reflected in the Output.
② Such automated processing does not constitute automated decision-making that produces legal effects concerning the user or similarly significantly affects the user.
③ Nevertheless, users may object to the results of automated processing or request human review, and may contact privacy@neosapience.com.
12. Chief Privacy Officer and Related Matters
The Company designates a Chief Privacy Officer, as set out below, to take overall responsibility for personal-information processing and to handle user complaints and provide damage relief:
Chief Privacy Officer: Taesu Kim (CEO) / Contact: contact@neosapience.com
Personal Information Protection Department: Operations Team (Contact person: Juncheol Cho) / Contact: privacy@neosapience.com
Data Protection Officer (DPO): Operations Team (Contact person: Juncheol Cho) / Contact: privacy@neosapience.com
Users may direct all inquiries, complaints, and requests for damage relief regarding personal-information protection arising from their use of the Company’s services to the Chief Privacy Officer and the responsible department.
Remedies for infringement of rights: Data subjects may apply for dispute resolution or consultation to the following bodies to obtain relief for personal-information infringement (Republic of Korea):
Personal Information Dispute Mediation Committee: 1833-6972 (www.kopico.go.kr)
Personal Information Infringement Report Center: 118 (privacy.kisa.or.kr)
National Police Agency: 182 (ecrm.police.go.kr)
Supreme Prosecutors’ Office Cybercrime Investigation Division: 1301 (www.spo.go.kr)
13. Measures to Ensure the Security of Personal Information, and Breach Notification
In accordance with the Network Act and the Personal Information Protection Act, the Company takes the following technical, administrative, and physical measures necessary to ensure security:
Administrative measures: establishing and implementing an internal management plan, providing regular employee training, and the like;
Technical measures: managing access rights to the personal-information processing system, installing an access-control system, encrypting unique identifying information, and installing security programs;
Physical measures: access control to the computer room, data storage room, and the like.
If the Company becomes aware of a personal-information breach, it notifies the data subjects, the Personal Information Protection Commission, and the relevant authorities (including the competent supervisory authority for EEA residents), without delay — in principle, within 72 hours of becoming aware — of the circumstances of the breach, the items affected, the measures taken, and how to minimize harm, in accordance with Article 34 of the Personal Information Protection Act and, where applicable, Articles 33 and 34 of the GDPR.
14. Special Provisions for Residents of the European Economic Area (EEA) and the United Kingdom
Controller information: The Company information stated at the beginning of this Policy constitutes the Data Controller under the GDPR.
EU Representative: The Company designates a representative within the EU in accordance with Article 27 of the GDPR, whose details are as set out in Section 12.
Legal basis for processing: The Company processes personal information based on the legal basis for each purpose specified in Section 1 (consent, performance of a contract, compliance with legal obligations, and legitimate interests).
Rights of data subjects: Users residing in the EEA and the UK may exercise all rights specified in Section 3 (access, correction, deletion, suspension of processing, portability, objection, withdrawal of consent, and objection to automated decisions).
Cross-border transfers: Where the Company transfers your personal information to a country outside the EEA, it implements safeguards under Articles 44 through 49 of the GDPR — such as entering into Standard Contractual Clauses (SCCs) or relying on adequacy decisions — as specified in Section 5.
Lodging a complaint with a supervisory authority: Users residing in the EEA have the right to lodge a complaint with the competent data-protection supervisory authority in their country of residence, and users residing in the UK with the Information Commissioner’s Office (ICO, https://ico.org.uk).
15. Special Provisions for Residents of the United States (California)
Under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA), California residents have the following rights:
Right to Know: the right to request disclosure of the categories of personal information collected, the sources of collection, the purposes of processing, and the categories of third parties to whom it was disclosed.
Right to Access: the right to request access to the specific pieces of personal information held by the Company.
Right to Delete: the right to request deletion of collected personal information, subject to statutory exceptions.
Right to Correct: the right to request correction of inaccurate personal information held by the Company.
Right to Opt Out of Sale/Sharing: the right to opt out of the “sale” or “sharing” of personal information (including for cross-context behavioral advertising).
Right to Limit Use of Sensitive Personal Information: the right to request that the use of sensitive information, such as payment information, be limited to what is necessary to provide the service.
Right to Non-Discrimination: the right not to receive discriminatory treatment for exercising the above rights.
Sale/sharing status over the past 12 months: The Company does not “sell” personal information for monetary consideration. However, the provision of behavioral information — such as website visit history and advertising identifiers through Google Analytics (Google Ads) and Facebook — may constitute “sharing” under the CCPA/CPRA (see Sections 5 and 8).
16. Duty to Give Notice Prior to Amendment
If there is any addition to, deletion from, or modification of this Privacy Policy, the Company will provide advance notice through the “Notices” section at least 7 days before the amendment takes effect.
However, where a material change to users’ rights occurs — such as a change to the items of personal information collected or to the purpose of use — the Company will provide notice at least 30 days in advance and may, if necessary, obtain users’ consent again.
This Privacy Policy is effective as of [August 1, 2026].