How HISO processes and protects personal information.
Weitblic Inc. ("Company") processes and protects the personal information of HISO users under the Korean Personal Information Protection Act and related laws. This policy explains what we process, why, for how long, and your rights. If the Korean and English versions differ, the Korean version prevails.
| Category | Items | How collected |
|---|---|---|
| Sign-up (required) | Email, password (stored encrypted), username | Sign-up screen |
| Social login (optional) | Account identifier, email, name and profile image provided by Google, Apple, Naver or Kakao | Social login |
| Profile (optional) | Nickname, bio, profile image, date of birth, gender | Profile screen |
| Adult verification (optional) | Name, mobile number, date of birth, gender, nationality type, connecting information (CI), duplicate-check information (DI) | Identity verification service (when turning on Deep Mode) |
| Service use | Chat messages, chat profiles and notes, memories the AI summarizes from chats, uploaded or generated images, reports | While using the Service |
| Payments | Product, amount, order and transaction numbers, payment status, store transaction identifiers for app purchases (card details are handled by the payment gateway; the Company does not store them) | During payment |
| Two-factor authentication (optional) | Authenticator secret, backup codes (stored encrypted) | Security settings |
| Marketing consent (optional) | Consent status and time, IP address and device information at consent | Notification settings |
| Collected automatically | IP address, browser and device information (OS, device model, app version, language, time zone, screen size), access logs, cookies, push notification tokens, usage records | Generated automatically when you access and use the Service |
We delete personal information without delay once its purpose is fulfilled, except for the following.
| Information | Retention | Basis |
|---|---|---|
| Member and usage information | Until 30 days after account closure (restoration period) | Restoration at the user's request |
| Chats a member deleted | 30 days after deletion | Restoring chats deleted by mistake |
| Device and browser diagnostics | 30 days after collection | Error analysis |
| Records of contracts and purchase withdrawals | 5 years | Act on Consumer Protection in Electronic Commerce |
| Records of payments and supply of goods | 5 years | Act on Consumer Protection in Electronic Commerce |
| Records of consumer complaints and disputes | 3 years | Act on Consumer Protection in Electronic Commerce |
| Records of labeling and advertising | 6 months | Act on Consumer Protection in Electronic Commerce |
| Access logs (sign-in records) | 3 months | Protection of Communications Secrets Act |
Information whose retention period has ended or whose purpose is fulfilled is destroyed without delay. Electronic files are deleted so they cannot be recovered, and paper records are shredded or incinerated. Information kept under law is stored separately and used only for that purpose.
We do not provide your personal information to third parties unless you consent or the law specifically requires it.
We entrust the following processing to provide the Service. Our contracts require safe processing, restrict further entrustment and set liability for incidents, and we supervise these processors.
| Processor | Entrusted work |
|---|---|
| Amazon Web Services, Inc. | Server and database operation, AI response generation (Amazon Bedrock), email delivery |
| Vercel Inc. | Website hosting |
| Cloudflare, Inc. | Image and video storage and delivery, security |
| OpenAI, L.L.C. / Anthropic, PBC | AI response generation |
| Google LLC | AI response and image generation and chat-memory search processing (Gemini), usage analytics (Google Analytics), app notification delivery (Firebase) |
| Langfuse GmbH | AI response quality and cost monitoring |
| LangChain, Inc. | AI processing traces and error analysis (LangSmith) |
| Functional Software, Inc. | Error collection and analysis (Sentry) |
| Raintank, Inc. (Grafana Labs) | Service performance and outage monitoring |
| 650 Industries, Inc. (Expo) | App notification delivery |
| RevenueCat, Inc. | App purchase verification |
| Better Auth, Inc. | Member account management tool |
| Toss Payments Co., Ltd. | Web payment processing and fraud prevention |
| Dreamsecurity Co., Ltd. | Identity verification (MOBILEOK) |
To perform our service contract with you, we entrust processing outside Korea as follows (Article 28-8(1)(3) of the Personal Information Protection Act). Transfers occur over encrypted networks whenever you use the Service. You can stop the transfers by closing your account, but you will then be unable to use the Service.
| Recipient (website) | Country | Items | Purpose | Retention |
|---|---|---|---|---|
| Amazon Web Services, Inc. (aws.amazon.com) | Japan, United States | Chat messages, chat profiles and memories | AI response generation (Amazon Bedrock) | Service data retention period |
| OpenAI, L.L.C. (openai.com) Anthropic, PBC (anthropic.com) | United States | Chat messages, chat profiles and memories | AI response generation | Each company's API data retention period |
| Google LLC (policies.google.com) | United States | Chat messages, image generation requests, usage records and device information, notification tokens | AI response and image generation, usage analytics, app notifications | Each service's retention period |
| Vercel Inc. (vercel.com) | United States and worldwide | Access logs, IP address, cookies | Website hosting | Until the entrustment ends |
| Cloudflare, Inc. (cloudflare.com) | United States and worldwide | Uploaded or generated images and videos, access logs | Media storage and delivery, security | Until account closure or deletion |
| Langfuse GmbH (langfuse.com) | Japan | Chat inputs and outputs used to generate AI responses | AI response quality and cost monitoring | Service retention period |
| LangChain, Inc. (langchain.com) | United States | Inputs and outputs of AI processing steps | AI processing traces and error analysis | Service retention period |
| Functional Software, Inc. (sentry.io) | United States | Error and device information (personal identifiers are masked before sending) | Error analysis | Service retention period |
| Raintank, Inc. (grafana.com) | Japan | Server logs and performance metrics (no chat content) | Service performance and outage monitoring | 14 days |
| 650 Industries, Inc. (expo.dev) | United States | Push notification tokens, notification content | App notification delivery | Service retention period after delivery |
| RevenueCat, Inc. (revenuecat.com) | United States | Member alias, app purchase product and transaction identifiers | App purchase verification | Until the entrustment ends |
| Better Auth, Inc. (better-auth.com) | United States | Member email, name, sign-in records | Member account management tool | Until the entrustment ends |
You may ask at any time to access, correct, delete or suspend processing of your personal information, or withdraw consent. You can edit your profile or close your account yourself, or email the privacy officer below. We act within 10 days of receiving a request and tell you the result. A legal guardian or an authorized agent may also make requests with a power of attorney.
Information we must keep by law may be retained for the required period even if you ask us to delete it.
Only people aged 14 or older can join the Service, and we do not collect personal information from children under 14.
AI responses are generated automatically from your input, but we do not make fully automated decisions that significantly affect your rights or obligations. If you disagree with a measure such as a content restriction, contact customer support.
For advice or dispute resolution about personal information infringement, you can contact:
We announce changes in the Service at least 7 days before they take effect. This policy takes effect on October 13, 2026.
Effective date: October 13, 2026