Privacy Policy

Treeru (the “Company”) establishes and publishes the following personal information processing guidelines under Article 30 of the Personal Information Protection Act to protect data subjects and promptly and smoothly handle related complaints.

Article 1 (Purposes of Processing Personal Information)

We process personal information for the following purposes. We do not use the information for other purposes. If a purpose changes, we will take the necessary measures, including obtaining separate consent, under Article 18 of the Personal Information Protection Act.

1. Website membership registration and management

We process personal information to confirm the intention to join, identify and authenticate users for membership services, maintain and manage membership, verify identity under the limited identity verification system, prevent misuse, verify legal representative consent when processing personal information of children under 14, deliver notices, and handle complaints.

2. Service provision

We process personal information to provide services, send contracts and invoices, provide content and personalized services, verify identity, and process and settle payments.

3. Marketing and information

We process personal information for marketing and promotional purposes, including newsletters about AI, IT, and development, new service announcements, event and promotion information, and personalized advertising. We obtain prior consent before sending promotional information and stop sending it immediately upon opt-out.

4. Complaint handling

We process personal information to identify complainants, confirm complaints, contact and notify people for fact-finding, and communicate results.

5. TreeTalk platform account management

We process account information needed to identify and authenticate business staff, manage permissions, maintain login sessions, and manage access records for the conclusion and performance of TreeTalk service agreements and account security.

Our administrators manage platform permissions and access for each business. Business staff view their own business’s consultation materials and visit and engagement analytics according to their assigned permissions. Administrator accounts are managed separately from business staff accounts.

Article 2 (Processing and Retention Periods)

① We process and retain personal information within the retention and use periods prescribed by law or agreed to by the data subject when the information was collected.
② The processing and retention periods for each category are as follows.

Website membership registration and management

Retention period: until withdrawal from the business or organization’s website

However, where any of the following applies, information is retained until the relevant circumstances end.

Until an ongoing investigation or inquiry into a violation of applicable law ends
Until any outstanding claims and debts arising from website use are settled

TreeTalk platform account information

We retain business account access records for 1 year and then automatically delete them. Account information for a business that terminates its service is pseudonymized 90 days after termination. Requests for deletion following account termination or the end of access permissions can be sent to info@treeru.com. Information subject to a legal retention obligation is stored separately for the required period.

Customer information processed on behalf of businesses

We process customer personal information for the period specified in the business’s privacy policy and contract. When the processing arrangement ends, we return or destroy it according to the business’s request and the contract. Each business’s policy is available through the privacy policy link in its chat window. The retention period for visit records follows “Visit Records” in Article 3-2.

Article 3 (Provision of Personal Information to Third Parties)

We process personal information only within the scope specified in Article 1 (Purposes of Processing Personal Information). We provide it to third parties only in circumstances covered by Articles 17 and 18 of the Personal Information Protection Act, such as data subject consent or specific statutory provisions, and do not otherwise provide it to third parties.

Article 3-2 (Scope of TreeTalk Processing on Behalf of Businesses)

Businesses entrust us with operating the TreeTalk consultation system. Each business determines the purposes and retention periods for its customers’ personal information. The processing arrangement is established under the service agreement with the business. The personal information processing provisions in the TreeTalk Terms of Service specify the scope of work, safeguards, subprocessors, supervision, and return or destruction of information.

Scope of processing

Storage and management of customer conversations and consultation submissions, provision of consultation materials for each business, visit and engagement analytics, and operation of the consultation system. The actual information processed and its purposes depend on each business’s services and policy.

Customer identification and consultation submissions

Customers can use the chat without logging in. We store a random visitor identifier in browser storage and do not use customer cookies or social login. Name and phone number entry is optional, but both are required when submitting them to request a reply. Each business explains any additional inquiry form fields before collecting them.

Visit Records

Items On websites where TreeTalk is installed, we process the following visit records even if the chat window is not opened: IP address, approximate location derived from the IP address (province/metropolitan city level), device and browser information (including the raw browser user-agent string), screen size, browser language setting, time zone, date and time of visit, address and title of the pages visited, referral path (referring address and utm advertising parameters — no other query values in the address are stored), visit identifier, page views, time on page, time the screen was visible, scroll depth, button and link clicks (type, displayed name and destination path of the element clicked), when the chat window was opened and closed and whether typing was started, automated-access (bot) assessment, exit reason, and use of the chat window, conversations, contact form and inquiry form. Depending on the website, only the leading part (network range) of the IP address may be stored. Typed text and keystrokes are not recorded, and names, contact details and chat contents are not included in these records. We do not create identifiers that combine several pieces of information to recognise a device or person (device fingerprints).

Purpose Visit statistics, service improvement, and prevention of fraudulent use (security). We do not use these records for any other purpose (targeted advertising, tracking of individuals, provision to third parties, or identifying individuals by combining with other information). Before changing the purpose we will first amend this policy and obtain consent where required.

Retention Records are destroyed one year after they are recorded (after 90 days they are encrypted and kept separately, and they are deleted at one year). Aggregate statistics that cannot identify individuals may be kept without a time limit. Raw IP addresses can be viewed only by operators designated by the company, and every view is logged; business customers see only location and device level information. Location is estimated only with data held on the company's own servers (DB-IP Lite, CC BY 4.0) and IP addresses are not sent outside.

How to refuse The visit identifier is stored in browser storage (localStorage), not in a cookie. You can delete or block this site's cookies and site data in your browser settings to remove the identifier or prevent it from being stored (resuming a previous chat may then be limited). If you turn on your browser's "Do Not Track" or GPC (Global Privacy Control) setting, no visit records are kept. A marker cookie (tt_self, one year) is stored on a site only when company or business staff choose to exclude their own device from visit statistics.

Exercising rights and contacting the responsible business

Customers may request access, correction, deletion, or suspension of processing through the contact listed in the relevant business’s privacy policy. We assist with the necessary processing at the business’s request (info@treeru.com). Rights concerning account information that we process directly can be exercised through the contacts in Articles 9 and 10.

Safeguards for processing on behalf of businesses

We separate consultation materials by business and encrypt submitted names and phone numbers for storage. We distinguish staff and administrator accounts and permissions, and record logins and major access and processing activities. Before storage, we mask resident registration, foreign resident registration, passport, driver’s license, and payment card numbers entered in the chat window. Only the last 4 digits of payment card numbers remain visible.

Subprocessors

Treeru operates the consultation system on behalf of the businesses that install the chat window. The Company may entrust processing work to service providers to the extent necessary to provide the service. When further entrusting personal information processing, the Company obtains the business’s prior consent and identifies the service providers and their processing work in this Policy.

The purposes and retention periods for users’ personal information processed by the Company on behalf of a business follow the scope specified in that business’s privacy policy and service agreement. The purposes of use and retention periods at overseas AI service providers are separately described in the international transfer information below.

Article 3-3 (International Transfers of Personal Information)

Personal information contained in questions and earlier conversations may be processed by overseas AI service providers to generate consultation answers. The Company applies personal information protection measures. Automated protection measures have limitations, so please do not enter sensitive information or personal information unnecessary for consultation.

Transfers take place through encrypted transmission over telecommunications networks when generating a consultation answer is necessary. The names and contact channels of the actual recipients, destination countries, personal information items, purposes of use, and retention periods are described below.

If you do not want an international transfer, you may choose not to start an AI consultation or stop an ongoing consultation. In that case, AI answers will not be provided. For other consultation options, please use the telephone or inquiry channels provided by the relevant business. You may ask that business to access, correct, or delete information already processed.

The legal bases, notices, and consent procedures required for the relevant processing apply to international transfers. Acceptance of this Policy or the Terms of Service alone is not treated as separate consent to an international transfer.

The information below describes international transfers by provider. Legal entity names, countries, retention and use periods, and contact channels are compiled from each provider’s official public policies. The date checked is shown for each provider.

Claude

Recipient: Anthropic, PBC
Country: United States
Personal information items: Questions and earlier conversation content entered in the chat window, and personal information contained in them
Purpose: Generating consultation answers
Retention and use period: Information is retained for as long as reasonably necessary for the processing purposes under the provider’s official retention policy. When a conversation is deleted with the provider, it is deleted from storage systems within 30 days. Content for which model improvement has been permitted may be retained in de-identified form for up to 5 years. Inputs and outputs flagged for policy violations may be retained for up to 2 years, safety classification scores for up to 7 years, and materials related to feedback submitted to the provider for 5 years. Exceptions apply, including legal obligations and dispute handling.
Contact channel: https://www.anthropic.com/legal/privacy
Official disclosure: https://privacy.claude.com/en/articles/10023548-how-long-do-you-store-my-data
Date checked: 2026-10-22

GPT

Recipient: OpenAI OpCo, LLC
Country: United States
Personal information items: Questions and earlier conversation content entered in the chat window, and personal information contained in them
Purpose: Generating consultation answers
Retention and use period: According to the provider’s disclosures, standard security and abuse monitoring logs are retained for up to 30 days, subject to possible legal and safety exceptions. Separate information retention periods and deletion conditions apply depending on the service feature.
Contact channel: https://privacy.openai.com/
Official disclosure: https://openai.com/policies/privacy-policy/
Date checked: 2026-10-22

Gemini

Recipient: Google LLC
Country: United States
Personal information items: Questions and earlier conversation content entered in the chat window, and personal information contained in them
Purpose: Generating consultation answers
Retention and use period: According to the provider’s disclosures, information subject to abuse monitoring is retained for 55 days. Different retention and deletion conditions may apply depending on the service used and the type of information.
Contact channel: https://policies.google.com/privacy#infodelete
Official disclosure: https://policies.google.com/privacy
Date checked: 2026-10-22

Grok

Recipient: SpaceXAI LLC
Country: United States
Personal information items: Questions and earlier conversation content entered in the chat window, and personal information contained in them
Purpose: Generating consultation answers
Retention and use period: Under the provider’s enterprise terms, standard input and output content is deleted within 30 days after the conversation or task ends, subject to possible contractual, legal, and safety exceptions. Personal information processing requires the conditions specified by the provider for exclusion from storage.
Contact channel: https://x.ai/privacy-portal/
Official disclosure: https://x.ai/legal/terms-of-service-enterprise
Date checked: 2026-10-22

GLM

Recipient: JINGSHENG HENGXING TECHNOLOGY PTE.LTD
Country: Singapore
Personal information items: Questions and earlier conversation content entered in the chat window, and personal information contained in them
Purpose: Generating consultation answers
Retention and use period: Under the provider’s overseas enterprise data processing agreement, input and generated content is processed in real time and is not stored on the server. Retention of other information, such as account information, follows the separate criteria in the applicable privacy policy.
Contact channel: https://chat.z.ai/legal-agreement/privacy-policy
Official disclosure: https://chat.z.ai/legal-agreement/terms-of-service
Date checked: 2026-10-22

MiniMax

Recipient: Nanonoble Pte. Ltd.
Country: Singapore
Personal information items: Questions and earlier conversation content entered in the chat window, and personal information contained in them
Purpose: Generating consultation answers
Retention and use period: According to the provider’s disclosures, information is retained for the period necessary to fulfill the purposes of collection or required by applicable law. Information that is no longer needed is handled under the applicable deletion or anonymization conditions.
Contact channel: https://platform.minimax.io/protocol/privacy-policy
Official disclosure: https://platform.minimax.io/protocol/paid-agreement
Date checked: 2026-10-22

Mistral AI

Recipient: Mistral AI, SAS
Country: France
Personal information items: Questions and earlier conversation content entered in the chat window, and personal information contained in them
Purpose: Generating consultation answers
Retention and use period: According to the provider’s disclosures, standard response processing is retained for 30 days after generation for abuse monitoring, subject to possible conditions for exclusion from storage and legal exceptions. Some features retain information until separate criteria are met, such as conversation deletion or account closure.
Contact channel: https://mistral.ai/en/contact
Official disclosure: https://legal.mistral.ai/terms/data-processing-addendum/
Date checked: 2026-10-22

Article 4 (Rights of Data Subjects and Legal Representatives and How to Exercise Them)

① Data subjects may exercise the following personal information protection rights against us at any time.
- Request access to personal information
- Request correction of errors
- Request deletion
- Request suspension of processing
② Rights under paragraph 1 may be exercised by writing, telephone, email, fax, or similar means. We will act without delay.
③ If a data subject requests correction or deletion of personal information, we do not use or provide that information until correction or deletion is complete.
④ Rights under paragraph 1 may be exercised through a legal representative or an authorized agent. In that case, a power of attorney using Form No. 11 attached to the Enforcement Rule of the Personal Information Protection Act must be submitted.
⑤ Data subjects must not infringe on their own or others’ personal information and privacy processed by us in violation of the Personal Information Protection Act or other applicable laws.

Article 5 (Categories of Personal Information Processed)

We process the following categories of personal information.

1. Website membership registration and management

Required: Name, email address, password

Optional: Company name, phone number, areas of interest

2. Marketing and information

Required: Email address

Optional: Name, areas of interest, newsletter consent status

3. Account information we process directly in TreeTalk

Business staff: login ID, encrypted password, role and permissions, display name, name, notification recipient, last login time, access address and browser information, access and processing records, and the version and time of terms acceptance.
Treeru administrators: login ID, display name, encrypted password, login access address and browser information, and access and processing records.
When issuing an account, we receive the information needed for authentication, such as an ID and password. Names and notification recipients are processed when configuring accounts and notifications. We obtain acceptance of the terms when businesses log in and record the accepted version and time. We use staff and administrator session cookies to keep users logged in. Blocking cookies prevents login to the management interface.

The scope of customer information processed on behalf of businesses is described in Article 3-2 and the relevant business’s policy. TreeTalk is not intended for children under 14, and we do not have a procedure for collecting children’s information with legal representative consent. If information is identified as belonging to a child, we work with the business to destroy it without delay.

Article 6 (Destruction of Personal Information)

① We destroy personal information without delay when it is no longer needed, including when its retention period expires or its processing purpose is fulfilled.
② If another law requires continued retention after the consented retention period expires or the processing purpose is fulfilled, we move the information to a separate database or store it in a separate location.
③ The procedures and methods for destruction are as follows.
- Destruction procedure: We select personal information for which a reason for destruction has arisen and destroy it with approval from our personal information protection officer.
- Destruction method: We destroy electronically recorded or stored personal information so that it cannot be reproduced. Paper records are shredded or incinerated.

④ Information processed on behalf of businesses in TreeTalk follows the periods and return or destruction conditions in each business’s policy and contract. When a business requests return or destruction, we assist by checking the scope of conversations, submissions, visit information, and copies such as logs and backups. Information that must be retained by law is stored separately for that purpose only.

⑤ We automatically delete backup copies stored on our servers after retaining them for no more than 6 months. We make external backups daily and automatically delete them after retention periods of 14 days for daily backups, 8 weeks for weekly backups, and 6 months for monthly backups. Backup copies are used only for recovery.

Article 7 (Measures to Safeguard Personal Information)

We take the following measures to safeguard personal information.

Administrative measures: Establishment and implementation of internal management plans, regular staff training, and similar measures
Technical measures: Management of access permissions to personal information processing systems, installation of access control systems, encryption of unique identification information, and installation of security software
Physical measures: Access controls for computer rooms, data storage rooms, and similar facilities

Article 8 (Installation, Operation, and Rejection of Automatic Personal Information Collection Tools)

① We use cookies that store and retrieve usage information to provide personalized services.
② Cookies are small pieces of information sent by the website’s HTTP server to a user’s computer browser and stored on the user’s computer or mobile device.
③ Data subjects may allow or block cookies through browser settings. Refusing cookie storage may make personalized services difficult to use.

Allowing or blocking cookies in desktop browsers

Chrome: Browser settings > Privacy and security > Delete browsing data
Edge: Browser settings > Cookies and site permissions > Manage and delete cookies and site data

Allowing or blocking cookies in mobile browsers

Chrome: Mobile browser settings > Privacy and security > Delete browsing data
Safari: Device settings > Safari > Advanced > Block All Cookies
Samsung Internet: Mobile browser settings > Browsing history > Delete browsing data

④ We collect and use information about visits and usage patterns across services and websites, popular search terms, and secure connections during service use to provide information tailored to users.

⑤ We also directly process visit records through TreeTalk on our own website (https://treeru.com). The items, purpose, retention period and how to refuse are the same as “Visit Records” in Article 3-2.

Article 9 (Personal Information Protection Officer)

We designate the following personal information protection officer to oversee personal information processing and handle data subjects’ complaints and remedies related to that processing.

Personal Information Protection Officer

Name: Kyungnam Kim
Position: Representative
Email: info@treeru.com

Data subjects may contact the personal information protection officer about any personal information protection inquiries, complaints, or remedies arising from use of our services or business. We will respond and handle them without delay.

Article 10 (Requests to Access Personal Information)

Data subjects may request access to personal information under Article 35 of the Personal Information Protection Act through the contact below. We will work to process requests promptly.

Contact for receiving and processing access requests

Email: info@treeru.com

Article 11 (Remedies for Infringement of Rights)

Data subjects may contact the following organizations for remedies and consultation regarding personal information infringements.

Personal Information Dispute Mediation Committee: 1833-6972 (no area code within Korea; www.kopico.go.kr)
Personal Information Infringement Report Center: 118 (no area code within Korea; privacy.kisa.or.kr)
Supreme Prosecutors’ Office: 1301 (no area code within Korea; www.spo.go.kr)
Korean National Police Agency: 182 (no area code within Korea; ecrm.police.go.kr/minwon/main)

Article 12 (Effective Date and Changes to This Privacy Policy)

Effective date: October 22, 2026.

2026-10-22 revision: Updated AI model provider information and the international transfer table.
Previous version effective date: October 11, 2026.
February 24, 2026: Previous Privacy Policy took effect.
September 25, 2026: Added TreeTalk account information processing, the scope and safeguards of processing on behalf of businesses, AI processing, and standards for handling children’s information.
September 26, 2026: Updated TreeTalk masking before storage, masking of business materials before AI transmission, terms acceptance records, and retention standards for accounts, access records, and backups.
October 10, 2026: Added visit record (usage analytics) processing for our own website, opt-out methods, and retention period (Article 8 ⑤).
October 11, 2026: Added TreeTalk visit record processing and items (IP address, location and more, with purpose, retention and how to refuse; “Visit Records” in Article 3-2; Articles 2 and 8 ⑤ aligned).