Legal
Privacy Policy
This is an unofficial English translation provided for convenience. The Korean version is the legally binding original and prevails in case of any discrepancy. The operator of Thinket (the "Operator") operates the web service Thinket (the "Service") in compliance with applicable laws such as the Personal Information Protection Act, and processes users’ personal data as follows.
Article 1 (Categories, Purposes, and Retention Periods of the Personal Data Processed)
The Operator processes the following personal data.
| Category | Data collected | Collection method | Purpose of processing | Retention and use period |
|---|---|---|---|---|
| Account information | Email, name, Google account identifier (sub) | Provided by Google at Google account sign-in | Member identification, sign-in, per-account usage limit management, service-related notices | Until account deletion |
| Account information (optional) | Profile photo | Provided by Google at Google account sign-in (where the user has permitted it) | Displaying the profile within the Service | Until account deletion |
| Service use content | Conversation content (questions entered by the user, files attached to questions, answers generated by the AI, tree-structure data) | Entered and generated directly by the user while using the Service | Providing the Service such as storing and displaying conversations, and generating answers | Until account deletion |
| Automatically collected information | Access logs (access date and time, IP address, browser information, and other service logs) | Automatically generated in the course of using the Service | Ensuring service stability, preventing abuse such as circumventing limits, and responding to errors | Destroyed 3 months after the date of collection (or, where a statutory retention obligation applies, for that period) |
| Automatically collected information (anonymous statistics) | Anonymous service-usage statistics: feature-usage events, usage patterns, environment settings, response performance and error records, and the like. Does not include information that can identify an individual, such as account, email, IP address, question/answer text, or node titles | Automatically generated in the course of using the Service. The session identifier is stored only after conversion into a hash that cannot be reversed without a private value (a salt) held by the Operator (blocking re-identification of the individual or account by third parties) | Improving the Service and analyzing feature-usage trends (product usage statistics) | Kept as anonymous statistics not combined with any specific individual, and used for the period the Service is operated |
| Automatically collected information (service-usage records linked to the account) | Service-usage records linked to the user's account: feature-usage events, usage patterns (time spent on screens and nodes, revisits, and the like), model/language/theme selections, response latency, and whether errors or limits occurred. Question and answer text and node titles are not included | Automatically generated and collected in the course of using the Service while signed in (legal basis: Article 15(1)(iv) of the Personal Information Protection Act, processing necessary for the performance of a contract; see Article 2, paragraph 4) | Improving the Service and analyzing feature-usage trends, and diagnosing and responding to quality issues on the account (errors, latency, limits) | Destroyed or converted into anonymous statistics 1 year from the date of collection. Destroyed or anonymized without delay upon account deletion |
| User-submitted information (feedback and inquiries) | Feedback and inquiry content freely written and submitted by the user, opinions submitted at the end of demo use (anonymous), and a reply email optionally entered by the user | Entered and submitted directly by the user through the in-service feedback and inquiry channels | Improving the Service and responding to inquiries and opinions | Until the inquiry is handled and for the period the Service is operated (feedback linked to an account is deleted together upon account deletion) |
| Newsletter (optional) | Email (the same item as the email of the sign-in account) | Only where the user has ticked the "(Optional) I agree to receive the newsletter by email" item on the first-sign-in consent screen | Sending the newsletter | Until the user unsubscribes (withdraws consent). Destroyed together upon account deletion |
- The Operator does not collect personal data other than the items above. It does not collect phone numbers, unique identifiers such as resident registration numbers, or sensitive data.
- Because the Service is provided as a free beta, no payment information is collected.
- The "anonymous service-usage statistics" above are anonymized so that no specific individual can be identified and do not, in themselves, constitute personal data; the fact and purpose of their collection are nonetheless disclosed here for transparency. For statistics that are collected anonymously (use of the demo without signing in, collection from accounts that have requested suspension of processing, and the like), the Operator does not attempt to combine them with other personal data, such as account information, to identify an individual. The Operator also does not use either the anonymous statistics or the account-linked usage records for any purpose other than improving the Service (such as advertising or third-party tracking).
- The "service-usage records (linked to the account)" above are processed only within the contractual purpose of providing and improving the Service. The Operator does not use these records to train AI models (separately from the restriction on training by external AI under Article 4, paragraph 3, the Operator itself also does not use them for training purposes), does not use them for advertising purposes, and does not provide them to third parties (Articles 5 and 9). Users may request suspension of processing of this item at any time (Article 7); upon such a request, usage records for that account are collected only as anonymous statistics. The Operator plans to provide a setting within the Service to turn this off directly (opt-out) and will reflect it in this policy when provided.
Article 2 (Consent to the Collection and Use of Personal Data)
- Pursuant to Articles 15 and 22 of the Personal Information Protection Act, the Operator obtains consent to the collection and use of personal data at the time the user signs in to (registers for) the Service.
- When obtaining consent, the Operator clearly notifies the following four matters.
- The purpose of collecting and using personal data
- The categories of personal data collected
- The retention and use period of personal data
- The fact that the user has the right to refuse consent, and the content of the disadvantages resulting from such refusal
- If the user refuses consent to the items essential for sign-in and use of the Service (the account information, service use content, and automatically collected information (limited to access logs and anonymous statistics) under Article 1), the user cannot use the Service.
- The "automatically collected information (service-usage records linked to the account)" under Article 1 is personal data processed without the data subject's consent pursuant to Article 15(1)(iv) of the Personal Information Protection Act (where necessary for the performance of a contract), and, pursuant to Article 22(3) of the same Act, its categories and legal basis are disclosed in this policy separately from personal data processed with consent. Users may request suspension of this processing at any time (Article 7).
- Consent to receive the newsletter is an optional item. Refusing it places no restriction whatsoever on use of the Service, and users may at any time request to unsubscribe (withdraw consent) through the contact point in Article 11. Upon withdrawal, the email is no longer processed for the purpose of sending the newsletter. If the Service provides a way to change this setting directly within the Service, it will be reflected in this policy.
Article 3 (Age Restriction and Children's Personal Data)
Only persons aged 18 or older may register for the Service (a measure required by the age terms of the external AI provider (Google Gemini API)). The Operator does not collect the personal data of persons under 18, and any account confirmed to belong to a person under 18 is deleted without delay and the relevant personal data is destroyed. Under the Personal Information Protection Act, the personal data of children under 14 is never collected under any circumstances. Where a reply email is entered in the demo (trial use without signing in), only persons aged 18 or older should enter it; if it is confirmed that a person under 18 has entered such information, it is destroyed without delay.
Article 4 (Outsourcing of Processing and Overseas Transfer of Personal Data)
1. Current Outsourcing (List of Processors)
To provide the Service, the Operator outsources part of its personal data processing tasks as follows. (Article 26(2) of the Personal Information Protection Act)
| Processor | Outsourced tasks | Location (region) |
|---|---|---|
| Google LLC | Generating answers using generative AI (the Gemini API) | United States (overseas) |
| OpenAI, L.L.C. | Generating generative-AI answers to questions entered in the demo (trial use without signing in) | United States (overseas) |
| Render, Inc. | Hosting the service application (server operation) | United States (overseas) |
| Supabase, Inc. | Database storage and management of user account information and conversation content | Seoul region, Republic of Korea (domestic) |
| Cloudflare, Inc. | Relaying web traffic for content delivery (CDN) and security | United States (overseas) |
- The primary storage of user data (account information and the original conversation content) is domestic (the Seoul region, Supabase). The original conversation content is stored and kept domestically, and a signed-in user’s questions are transmitted to Google (United States), as described in paragraph 2 below, only at the point an AI answer is generated. Questions entered in the demo, which is used without signing in, are transmitted to OpenAI (United States) in the same manner; because the demo does not require sign-in, no account information is transmitted. The Service’s web traffic passes through relay servers of Cloudflare, Inc. (United States) in transit, for content delivery and security purposes. The relayed connection is encrypted, and Cloudflare is not a repository that stores the original conversation content.
- If a processor or the content of the outsourced tasks changes, this policy will be updated and notice given.
2. Current Overseas Transfers of Personal Data
Among the processors above, the details of the personal data transferred to those located overseas (the United States) are as follows. (Article 28-8 of the Personal Information Protection Act)
| Item | Google LLC | OpenAI, L.L.C. | Render, Inc. | Cloudflare, Inc. |
|---|---|---|---|---|
| Country of transfer | United States | United States | United States | United States |
| Categories of personal data transferred | Questions entered by the user, the content of files attached to those questions, and the conversation context needed to generate answers | Questions entered in a demo session and the conversation context needed to generate answers (no account information, as the demo does not require sign-in) | Account information and conversation content passing through the hosting server in the course of using the Service | Connection information (such as IP addresses), account information, and conversation content passing through the relay servers in the course of using the Service |
| Date and method of transfer | Transmitted over encrypted communication (HTTPS/TLS) each time the user enters a question | Transmitted over encrypted communication (HTTPS/TLS) each time a question is entered in the demo | Transmitted and processed over encrypted communication during use of the Service | Transmitted and relayed over encrypted communication (HTTPS/TLS) during use of the Service |
| Purpose of transfer (outsourced task) | Generating answers using generative AI (the Gemini API) | Generating generative-AI answers in the demo | Hosting the service application | Relaying web traffic for content delivery (CDN) and security |
| Retention and use period | The period under Google’s API data processing policy (see paragraph 3 below) | After the answer-generation processing, retained for up to 30 days for abuse-monitoring purposes under OpenAI’s API data policy and then deleted (except where a statutory retention obligation applies) | The service provision period (until account deletion) | Processed only at the moment of relay and not separately stored; security and operational logs are retained briefly under Cloudflare’s policies and then deleted |
| Processor contact | Google LLC (privacy.google.com) | OpenAI, L.L.C. (openai.com/policies) | Render, Inc. (render.com) | Cloudflare, Inc. (cloudflare.com/privacypolicy) |
- This overseas transfer constitutes outsourced processing and storage necessary for the performance of the contract (providing AI answers to questions), and pursuant to Article 28-8(1)(iii) of the Personal Information Protection Act and its Enforcement Decree, it is notified by disclosure in this Privacy Policy without a separate consent procedure.
- If a user does not want the overseas transfer, the user may stop using the Service (entering questions) or delete the account. However, without the overseas transfer required to enter questions, the AI answer generation feature cannot be used.
3. Restriction on Use for Training by External AI
The Operator uses the paid tier of the Google Gemini API. Under Google’s paid-tier API policy, the content entered by users is not used to train Google’s AI models or to improve its products. (Unlike the free tier, Google has a policy of not using submitted content to improve its products on the paid tier, and the statement above is based on this Google policy.) For the OpenAI API used for the demo (trial use without signing in) as well, under OpenAI’s API data policy, inputs and outputs sent through the API are not used to train OpenAI’s models.
Article 5 (Provision of Personal Data to Third Parties)
The Operator does not sell or provide users’ personal data to third parties. The following cases are exceptions, however.
- Where the user has given prior consent
- Where an investigative agency or the like requests it through lawful procedures under applicable law
Article 6 (Procedure and Method for Destroying Personal Data)
| Category | Details |
|---|---|
| Grounds for destruction | Account deletion, expiry of the retention period, achievement of the processing purpose, a request to suspend processing or withdrawal of consent, confirmation of being under 18, and the like |
| Destruction procedure | Personal data for which grounds for destruction have arisen is identified and destroyed without delay (at the latest within 5 days from the date the grounds arose). Upon account deletion, the account information and conversation content are deleted together |
| Method of destruction | Information in electronic file form is permanently deleted by a method from which it cannot be recovered. Where included in backup data, it is deleted together when the backup cycle passes (up to 30 days) |
| Exception | Information that must be retained under other laws is stored separately for the period set by the relevant law and then destroyed |
Article 7 (Rights of the Data Subject and How to Exercise Them)
- Users may exercise the following rights at any time.
| Right | Details | How to exercise |
|---|---|---|
| Access | Checking how one’s own personal data is processed | In-service feature or the contact in Article 11 |
| Correction | Correcting inaccurate information | Editing Google account information or the contact point |
| Deletion | Deleting personal data and conversation content (account deletion) | Delete it yourself using “Delete account” in the account menu within the Service, or send a request to the contact point (email) in Article 11 and it will be handled without delay |
| Suspension of processing | Requesting that the processing of personal data stop, in particular the suspension of processing of the "service-usage records (linked to the account)" under Article 1 | The contact point in Article 11 |
- Where a user requests suspension of processing of the "service-usage records (linked to the account)", the Operator stops account-linked collection for that account without delay (usage records are thereafter collected only as anonymous statistics) and destroys or anonymizes the account-linked usage records already collected so that no individual can be identified. Requesting suspension of processing places no restriction whatsoever on use of the Service (Article 37 of the Personal Information Protection Act).
- Rights may be exercised by the user in person or by a legal representative or a duly authorized agent, and the Operator takes action without delay (within the statutory deadline) from the date the request is received and notifies the result.
- Where a request such as for access falls under a ground for restriction under the law, the Operator notifies the reason.
Article 8 (Measures to Ensure Security and the Operator’s Access Policy)
- The Operator takes the following measures to protect personal data.
- Encryption of the transmission channel (HTTPS/TLS)
- Minimizing database access rights to the Operator and securely managing the means of access (passwords and keys)
- Using the security features of the cloud infrastructure providers (access control, encryption of stored data, and so on)
- Even during the beta, promptly taking action if a serious security issue is identified and, where necessary, notifying users
- The Operator’s access policy: The Operator holds the technical authority to access the database for service operation and fault response (the Service cannot be operated without such access), and users’ conversation content is stored in the database. As a matter of policy, however, the Operator does not read users’ individual conversation content. Access may nonetheless be made to the minimum extent necessary in the following cases.
- Where the user requests it or consents to it
- Where required by applicable law
- Where unavoidable in order to investigate and respond to a serious error, security incident, or abuse
- Separately from the access policy above, the questions entered by users are transmitted to and processed by Google (United States) in order to generate answers, as described in Article 4. That is, even if the Operator does not look into conversations at will, conversations are stored to provide the Service and are transmitted to the external AI when answers are generated.
Article 9 (Cookies and Other Automatic Collection Devices)
The Service uses (i) cookies (or equivalent storage means) that are essential to maintaining the signed-in state, and (ii) local storage (localStorage) and transmission means (such as sendBeacon) to save usage preferences such as language and theme and to collect usage statistics for improving its own service. As disclosed in Article 1, these usage statistics are collected anonymously, without identifying individuals, and while signed in they are also collected as account-linked service-usage records (Article 1 and Article 2, paragraph 4). In either case this collection is carried out by the Operator directly, for the purpose of improving the quality and features of its own service; it is not provided to third-party analytics or advertising businesses, nor does it rely on third-party tracking technologies. The Service does not use cookies or tracking technologies for third-party advertising, cross-site behavioral tracking, or user profiling for advertising purposes. Users may refuse cookies in their browser settings, but in that case they cannot use features that require sign-in.
Article 10 (Notice on the Use of Generative AI)
- The answers provided by the Service are outputs generated by generative artificial intelligence (AI). Pursuant to Article 31 of the Framework Act on the Development of Artificial Intelligence and the Establishment of a Basis for Trust, the Operator (i) gives advance notice that the Service is based on generative AI, and (ii) gives a standing notice on the service screen so that users can clearly recognize that the answers are outputs generated by generative AI, and, where a feature to take answers outside the Service is provided, indicates that fact on those outputs as well.
- Questions entered by users are transmitted to an external AI only in order to generate answers. Signed-in use relies on the Google Gemini API, and the demo used without signing in relies on the OpenAI API. Under Google’s paid-tier API policy, the entered content is not used to train Google’s AI models or to improve its products, and the Operator uses that paid-tier API. Inputs and outputs sent to the OpenAI API are likewise not used to train OpenAI’s models (see Article 4, paragraph 3).
- Users are advised not to enter personal data (their own or others’ names, contact details, health information, and the like) into questions.
Article 11 (Personal Data Protection Officer and Contact)
| Category | Details |
|---|---|
| Personal Data Protection Officer (CPO) | Lee Yuntae (the individual Operator in person; the protection officer under Article 31 of the Personal Information Protection Act) |
| ytLee@thinket.ai |
Users may direct inquiries, complaints, and requests for remedy regarding personal data to the contact above. Users may also apply for dispute mediation or counseling to the following bodies.
- Personal Information Dispute Mediation Committee: 1833-6972 (www.kopico.go.kr)
- Personal Information Infringement Report Center: 118 (privacy.kisa.or.kr)
- Supreme Prosecutors’ Office: 1301 / National Police Agency: 182
Article 12 (Changes to the Privacy Policy)
If the content of this policy is added to, deleted, or amended, notice will be given within the Service from 7 days before it takes effect (or from 30 days before for material changes such as to the categories collected, the purposes, or the retention periods).
Addendum
This policy takes effect on 2026-09-11. (Revised 2026-09-11: "files attached to questions" specified in the processed items and the overseas-transfer items. The previous edition took effect on 2026-08-09.)