Privacy Policy

The Company processes personal information for the following purposes.

1. 1.
   Membership registration and management

   Identifying and authenticating Members, maintaining and managing membership, preventing misuse, and providing notices

2. 2.
   Service provision

   Providing reference collection and storage, performance analysis, AI script writing, and project and script management

3. 3.
   Service improvement and product analytics

   Improving service stability, optimizing performance, analyzing product activation, and improving quality using AI usage, error records, and feature usage events

The Company may collect the following information through email login, service use, customer inquiries, and automated log processing.

For paid transactions, Payple Co., Ltd. directly processes full card numbers, expiration dates, dates of birth, card passwords, and payment authentication information. The Company does not directly collect or store these details. It may receive payment member numbers, encrypted billing keys, card issuers and last four digits, payment/order/subscription identifiers, products, amounts and currencies, payment/subscription status, service periods, and payment/cancellation timestamps.

Passwords used for email login are processed by the authentication provider. The Company does not directly store plaintext passwords in its service database.

Collection methods

• Information entered directly during signup, login, payment, and customer inquiries
• Information entered with consent when requesting referral reward payouts
• Automatic collection of usage records, cookies, access logs, and error records generated during service use
• Receipt of processing results through authentication or payment provider APIs or payment callbacks
• Collection of public profile and content information through external platforms and public content collection providers

Information That May Be Processed Without Consent

The Company may process the following information without separate consent where there is a legal basis or where necessary to enter into or perform a contract with the user.

For its legitimate business purpose of providing content planning and performance analysis, the Company lawfully collects and uses information that data subjects make available to the general public on social networks such as Instagram, TikTok, and YouTube Shorts.

The Toplr Chrome extension uses the same account as the web service and stores a server-revocable, extension-specific session token in the browser to maintain login. Passwords and web Supabase session tokens are not stored in the extension. Only when paid access is verified does the extension process public media and engagement metrics from the Instagram screen the user is viewing, within the browser, to provide summaries and sorting.

1. Collection principles and scope

   Collection is limited to information set as public under each platform’s policies and accessible to everyone. Private accounts and access-restricted information are not intentionally collected.

   • Profile information: name, username, profile image, biography, and similar details
   • Post information: post/video URLs, captions, publication dates, and similar details
   • Public contact information
   • Public metrics: follower counts, views, likes, and similar statistics
2. External platform APIs and public web content search and collection

   The Company may use official platform APIs and public web content search and collection methods to provide the Service, in compliance with applicable terms and policies. Users are not required to log in to external platform accounts.

3. Collection purposes

   The Company collects and processes public information for the following purposes.

   • Collecting, searching, and categorizing public content references
   • Analyzing content performance metrics and providing analysis reports
   • AI analysis of hooks, structure, and calls to action, and script-writing assistance
   • Improving service quality through statistics
4. Processing methods

   The Company processes collected public information statistically and analytically for Service users. Analysis results are used for content planning and performance comparison. Public information may be stored as necessary to provide the Service.

5. Requests for deletion or exclusion from analysis

   Data subjects or rights holders may contact the privacy officer by email to request deletion of their data, exclusion from analysis or search results, or suspension of processing. After verifying the requester’s identity or rights, the Company acts without delay under applicable laws. If content is deleted or made private on its original platform and prompt reflection is needed, a request may also be sent to that contact.

The Company may use Google APIs, including Google LLC’s Gemini API, to provide reference video analysis.

• Information processed: public content metadata and captions saved or submitted for analysis by users, and analysis request details
• Purpose: reference summarization, hook/structure/call-to-action analysis, and content performance analysis
• Method: information is transmitted and processed as needed for API requests. Analysis results may be stored as service data to provide the requested features.

Processing through Google APIs is limited to service provision and complies with applicable terms and policies, including the Google API Services User Data Policy.

The Company may use the Claude API provided by Anthropic, PBC to generate and refine AI scripts.

• Information processed: script-writing inputs, user-selected script structures, reference analysis summaries, existing scripts, and AI-generated results
• Purpose: generating AI script drafts and refining them at the user’s request
• Method: the minimum information needed to provide the feature is transmitted through the API. Script results and AI usage records may be stored as service data.

The Company does not provide inputs and outputs sent to the Anthropic API for training its own models and complies with Anthropic’s commercial API data processing policies and applicable agreements.

The Company destroys personal information without delay when its collection and use purposes are fulfilled or a Member closes their account. Information required by law to be retained is kept for the statutory period.

• Contract or withdrawal records: 5 years
• Payment and goods/service supply records: 5 years
• Consumer complaint or dispute records: 3 years
• Advertising records: 6 months
• Service usage records, access logs, and access IP information: 3 months
• Subscription cancellation reasons and detailed feedback: 90 days after collection
• Access records of personnel handling personal information: 2 years
• Referral payout information: until the statutory retention period ends after payout and tax processing are completed

The Company destroys personal information without delay when it is no longer needed, including when the retention period expires or the processing purpose is fulfilled. Electronic files are deleted using methods that prevent recovery. Paper documents are shredded or incinerated.

The Company processes personal information only within the purposes above and provides it to third parties only with the data subject’s consent or where specifically permitted by law. The Company does not currently sell personal information.

Without separate consent, the Company does not use Member data or AI inputs and outputs received for service operation to train its own AI models.

The Company outsources personal information processing as follows to provide the Service.

Under Article 26 of the Korean Personal Information Protection Act, processing agreements specify restrictions on processing outside the entrusted purpose, technical and organizational safeguards, restrictions on subcontracting, supervision of processors, and liability including damages. The Company supervises processors to ensure safe handling of personal information.

The Company may use overseas infrastructure for authentication, databases, cloud hosting, AI analysis, public content collection, file storage, and product analytics. The following personal information may currently be transferred overseas. Transfers occur through network transmission during service use or storage in overseas infrastructure.

If the Company adds new international transfer activities or materially changes the information, purposes, or retention periods, it will provide notice through this Policy or a separate notice.

Users may decline international transfers. Declining transfers essential to authentication or hosting prevents use of membership features; declining transfers for AI analysis prevents use of the relevant AI features. Declining optional features does not restrict other features.

Data subjects may request access, correction, deletion, suspension of processing, or withdrawal of consent at any time. Requests may be sent to the privacy contact email or in writing. The Company acts without delay under applicable laws.

The Company may use cookies and similar technologies to maintain login sessions, provide security, and save preferences such as sidebar settings. Users may refuse cookies in browser settings, but some features requiring login may then be unavailable.

During signup and repeated failed logins, Cloudflare Turnstile may process browser and network signals to identify bots and malicious activity. Details are available in the Cloudflare Turnstile Privacy Addendum.

Through product analytics tools, the Company may collect one-way pseudonymized profile identifiers and feature usage events including landing viewed, app session started, user signed up, onboarding completed, creator searched, creator added, reel imported, reel opened, reel analysis requested, reel analysis completed, script generated, project created, subscription activated, and extension events for saving to projects, requesting Reel analysis, downloading media, and exporting CSV. When campaign attribution is present on a landing visit, only permitted fields (utm_source, utm_medium, utm_campaign, utm_content) are collected. This information is used to measure activation, distinguish campaign performance, diagnose errors, and improve features.

Landing visit events are collected explicitly. Automatic pageview, click, and scroll tracking is not currently used. However, screen structure, clicks, scrolling, and navigation may be collected through session replay from the landing page through onboarding and Free plan selection until the first dashboard appears. Signup, login, authentication, and payment screens are not recorded; inputs are masked; and console logs and network request/response bodies are not collected. Logging out resets the link between the account and analytics identifier, but anonymous public landing events may be collected again. While signed in, a session start event may be collected on initial app entry and the first interaction after a date change or at least 30 minutes of inactivity. Users may contact the privacy team to ask about or object to processing for product analytics.

The Company does not provide the Service to children under 14 or accept their registrations. If such an account is identified, the account and personal information are deleted without delay.

The Company implements reasonable technical and organizational safeguards, including access control, encryption, storage and review of access records, security software, and training for personnel handling personal information.

If a personal information breach or similar incident occurs, the Company promptly determines whether statutory reporting is required. If so, it reports to the relevant authorities and notifies data subjects within 72 hours of becoming aware of the incident.

The Company appoints a privacy officer to oversee personal information processing and handle data subjects’ complaints and remedies.

Privacy Officer

조준희

Address

충청남도 천안시 동남구 성황로 40

Phone

010-4050-3135

Email

support@toplr.ai

Data subjects may seek consultation or dispute resolution from the Personal Information Dispute Mediation Committee, the Personal Information Infringement Report Center, the Supreme Prosecutors’ Office, or the police.

• Personal Information Dispute Mediation Committee: 1833-6972, www.kopico.go.kr
• Personal Information Infringement Report Center: 118, privacy.kisa.or.kr
• Supreme Prosecutors’ Office: 1301, www.spo.go.kr
• Police: 182, ecrm.police.go.kr

This Privacy Policy takes effect on September 9, 2026. If laws, services, outsourced activities, or personal information processing change, the Company provides notice in the Service or on this page at least 7 days before the effective date. Material changes to user rights are clearly announced at least 30 days in advance.