Privacy Policy

Article 1 (General Provisions)

1. Purpose of This Policy

This Privacy Policy is established to protect the personal information of data subjects who use the D-mail service (hereinafter referred to as the "Service") provided by the Company, and to safeguard their rights and interests.

2. Definitions

• •"Personal Information" refers to information about a living individual that can be used to identify that individual, such as name, email address, etc.
• •"Data Subject" refers to a person who can be identified by the information being processed and who is the subject of that information.
• •"Processing" refers to the collection, generation, linking, integration, recording, storage, retention, processing, editing, retrieval, output, correction, recovery, use, provision, disclosure, destruction, and other similar acts performed on personal information.

3. Scope of Application

• •This policy applies to all services provided by the Company (website, Discord bot, API, etc.).
• •Third-party services (Google, Discord, etc.) are governed by their respective privacy policies.

Article 2 (Personal Information Collected & Methods of Collection)

1. Categories of Personal Information Collected

2. Methods of Collection

• •Collection through Discord bot invitation and command execution
• •Email account integration through Google OAuth authentication
• •Web dashboard login through Discord OAuth
• •Automatic collection upon website and dashboard access (server logs, session data)
• •Direct user input (contact groups, IMAP settings, user preferences, etc.)
• •Automated processing through AI services (temporary analysis of email content)
• •Collection through customer support inquiries

Article 3 (Purpose of Processing Personal Information)

The Company processes collected personal information for the following purposes. Personal information shall not be used for purposes other than those listed below, and if the purpose of use changes, the Company will obtain separate consent and take other necessary measures.

Article 4 (Retention & Usage Period of Personal Information)

1. Principle

The Company destroys personal information without delay once the purpose of collection and use has been fulfilled. However, in the following cases, the information is retained for the period specified.

2. Service-Related Retention

3. Retention Required by Law

Article 5 (Disclosure of Personal Information to Third Parties)

1. Principle

The Company processes the personal information of data subjects only within the scope of purposes specified in Article 3, and does not provide personal information to third parties without the separate consent of the data subject.

2. Exceptions

Personal information may be provided without consent in the following cases:

• •When there are special provisions in law or when it is unavoidable to comply with legal obligations
• •When a public institution requires it for the performance of duties prescribed by laws and regulations
• •When the data subject or their legal representative is unable to express their intent, or when prior consent cannot be obtained due to unknown address or similar reasons, and it is clearly necessary for the urgent benefit of the life, body, or property of the data subject or a third party
• •When there is a lawful request from an investigative authority

Article 6 (Outsourcing of Personal Information Processing)

1. Outsourcing Status

The Company outsources the processing of personal information as follows for the smooth provision of services.

2. Outsourcing Management

• •When entering into outsourcing contracts, the Company stipulates necessary provisions to ensure the safe management of personal information in accordance with the Personal Information Protection Act.
• •If the scope of outsourced tasks or the service provider changes, such changes will be disclosed through this policy.

Article 7 (International Transfer of Personal Information)

1. International Transfer Status

The Company may transfer personal information overseas as follows for the provision of services.

2. Protective Measures

• •Appropriate protective measures are taken in accordance with the Personal Information Protection Act when transferring personal information overseas.
• •The Company verifies that recipients comply with international standards for personal information protection.

Article 8 (AI-Based Data Processing)

1. Overview of AI Processing

The Company may utilize AI technologies, including the Google Gemini API, to process users' email content for the purpose of providing convenience features. AI processing is activated based on user settings, and users may disable AI processing at any time by changing their settings.

2. AI Processing Items and Purposes

3. AI Processing Principles

• •Email content transmitted for AI processing is destroyed immediately upon completion and is not separately stored on Company servers.
• •The data processing policies of the AI service provider (Google) may apply separately, and the Company shall not be held liable for such policies.
• •Whether data is used for training, model improvement, or other purposes by third-party AI service providers is subject to the respective provider's policies, and the Company does not control such use.

4. AI Processing Disclaimer

• •The Company does not guarantee the accuracy or completeness of AI processing results, and shall not be liable for any damages arising from reliance on AI processing results.
• •The Company shall not be liable for service interruptions caused by the AI service provider's service failures, policy changes, or API limitations.
• •By enabling AI processing features, users are deemed to have consented to the transmission of their email content to third-party AI services.

Article 9 (Destruction of Personal Information)

1. Destruction Procedures

• •When personal information becomes unnecessary due to expiration of the retention period, achievement of the processing purpose, or similar reasons, the Company destroys such information without delay.
• •If personal information must be retained pursuant to other laws despite the expiration of the consent-based retention period or achievement of the processing purpose, the information shall be moved to a separate database (DB) or stored in a different location.

2. Methods of Destruction

• •Electronic files: Permanently deleted using methods that make recovery impossible.
• •Paper documents: Shredded or incinerated.

Article 10 (Rights & Obligations of Data Subjects and How to Exercise Them)

1. Rights of Data Subjects

Data subjects may exercise the following personal information protection rights against the Company at any time:

• •Right to request access to personal information processing status
• •Right to request correction in case of errors
• •Right to request deletion
• •Right to request suspension of processing

2. How to Exercise Rights

• •Request via email ([email protected])
• •Request through the Discord customer support channel

3. Processing Timeline

• •The Company will take action within 10 days from the date of receiving the data subject's request and notify the data subject of the results.

4. Restrictions on Exercising Rights

• •When there are special provisions in law or when it is unavoidable to comply with legal obligations
• •When there is a risk of harm to the life or body of another person, or of unjustly infringing on the property or interests of another person
• •When performance of the contract would be difficult, such as being unable to provide the agreed-upon service, if personal information is not processed

Article 11 (Personal Information of Children Under 14)

• •The Company does not collect personal information from children under the age of 14, and the Service is not intended for children under 14.
• •If the Company becomes aware that personal information of a child under 14 has been collected, it will destroy such information without delay.
• •Legal representatives may request access to, correction, deletion, or suspension of processing of a child's personal information.

Article 12 (Installation, Operation, and Rejection of Automatic Data Collection Devices)

1. Use of Cookies

The Company uses session cookies for the web dashboard service. These are essential cookies for maintaining user login status and are automatically set when using the dashboard. Users may refuse cookies through browser settings; however, dashboard service usage may be restricted in such cases.

2. Server Logs

• •Access IP addresses, access timestamps, and requested URLs may be automatically recorded in server logs for service operation purposes.
• •Such information is used solely for service security and quality improvement purposes and is retained in accordance with applicable laws.

Article 13 (Collection & Use of Behavioral Information)

• •The Company does not collect or use behavioral information for the purpose of providing personalized advertising.
• •Usage pattern analysis for service improvement is based on anonymized statistical data.

Article 14 (Security Measures for Personal Information)

The Company takes the following measures to ensure the security of personal information:

1. Administrative Measures

• •Establishment and implementation of an internal management plan for personal information protection
• •Minimizing and training personnel who handle personal information

2. Technical Measures

• •Encrypted storage and transmission of personal information (TLS/SSL, Fernet encryption)
• •Technical countermeasures against hacking and other threats (security software, access controls)
• •Retention and tamper-prevention of personal information access logs

3. Physical Measures

• •Verification of security certifications of cloud service providers

Article 15 (Privacy Protection Officer)

The Company has designated a Privacy Protection Officer as follows to oversee personal information processing, handle complaints from data subjects, and provide remedies for damages related to personal information processing.

Article 16 (Remedies for Rights Infringement)

Data subjects may apply for dispute resolution or consultation with the following organizations to seek remedies for personal information infringement.

Article 17 (Disclaimer)

1. Limitation of Liability

• •The Company takes commercially reasonable measures to protect personal information, but does not guarantee that its security is infallible.
• •The Company is not liable for personal information leaks caused by the negligence or carelessness of the data subject.
• •The Company is not liable for personal information leaks resulting from security incidents at third-party services (Google, Discord, etc.).

2. Grounds for Exemption

• •Damages caused by events beyond the Company's control, such as natural disasters, war, or hacking
• •Damages resulting from personal information voluntarily disclosed by the data subject
• •Personal information leaks caused by issues with the data subject's device environment or network
• •Damages arising from data processing by AI service providers (Google Gemini, etc.)
• •Damages caused by errors in user-provided IMAP settings, contact information, etc.
• •Exposure of personal information in public channels configured by the user through mail forwarding
• •Personal information leaks due to negligent session management on the web dashboard (e.g., failure to log out on shared devices)

Article 18 (Changes to This Privacy Policy)

• •When additions, deletions, or modifications are made to this Privacy Policy due to changes in laws, policies, or security technologies, the Company will provide notice at least 7 days before the effective date of the changes through announcements on the website or within the Service.
• •For changes that are disadvantageous to data subjects, notice will be provided at least 30 days in advance.
• •Continued use of the Service after the effective date of the revised policy shall be deemed as consent to the revised policy.