Privacy Policy Previous Version

Article 3-2 (Scope of TreeTalk Processing on Behalf of Businesses)

Businesses entrust us with operating the TreeTalk consultation system. Each business determines the purposes and retention periods for its customers’ personal information. The processing arrangement is established under the service agreement with the business. The personal information processing provisions in the TreeTalk Terms of Service specify the scope of work, safeguards, subprocessors, supervision, and return or destruction of information.

Scope of processing

Storage and management of customer conversations and consultation submissions, provision of consultation materials for each business, visit and engagement analytics, and operation of the consultation system. The actual information processed and its purposes depend on each business’s services and policy.

Customer identification and consultation submissions

Customers can use the chat without logging in. We store a random visitor identifier in browser storage and do not use customer cookies or social login. Name and phone number entry is optional, but both are required when submitting them to request a reply. Each business explains any additional inquiry form fields before collecting them.

Visit Records

Items On websites where TreeTalk is installed, we process the following visit records even if the chat window is not opened: IP address, approximate location derived from the IP address (province/metropolitan city level), device and browser information (including the raw browser user-agent string), screen size, browser language setting, time zone, date and time of visit, address and title of the pages visited, referral path (referring address and utm advertising parameters — no other query values in the address are stored), visit identifier, page views, time on page, time the screen was visible, scroll depth, button and link clicks (type, displayed name and destination path of the element clicked), when the chat window was opened and closed and whether typing was started, automated-access (bot) assessment, exit reason, and use of the chat window, conversations, contact form and inquiry form. Depending on the website, only the leading part (network range) of the IP address may be stored. Typed text and keystrokes are not recorded, and names, contact details and chat contents are not included in these records. We do not create identifiers that combine several pieces of information to recognise a device or person (device fingerprints).

Purpose Visit statistics, service improvement, and prevention of fraudulent use (security). We do not use these records for any other purpose (targeted advertising, tracking of individuals, provision to third parties, or identifying individuals by combining with other information). Before changing the purpose we will first amend this policy and obtain consent where required.

Retention Records are destroyed one year after they are recorded (after 90 days they are encrypted and kept separately, and they are deleted at one year). Aggregate statistics that cannot identify individuals may be kept without a time limit. Raw IP addresses can be viewed only by operators designated by the company, and every view is logged; business customers see only location and device level information. Location is estimated only with data held on the company's own servers (DB-IP Lite, CC BY 4.0) and IP addresses are not sent outside.

How to refuse The visit identifier is stored in browser storage (localStorage), not in a cookie. You can delete or block this site's cookies and site data in your browser settings to remove the identifier or prevent it from being stored (resuming a previous chat may then be limited). If you turn on your browser's "Do Not Track" or GPC (Global Privacy Control) setting, no visit records are kept. A marker cookie (tt_self, one year) is stored on a site only when company or business staff choose to exclude their own device from visit statistics.

Exercising rights and contacting the responsible business

Customers may request access, correction, deletion, or suspension of processing through the contact listed in the relevant business’s privacy policy. We assist with the necessary processing at the business’s request (info@treeru.com). Rights concerning account information that we process directly can be exercised through the contacts in Articles 9 and 10.

Safeguards for processing on behalf of businesses

We separate consultation materials by business and encrypt submitted names and phone numbers for storage. We distinguish staff and administrator accounts and permissions, and record logins and major access and processing activities. Before storage, we mask resident registration, foreign resident registration, passport, driver’s license, and payment card numbers entered in the chat window. Only the last 4 digits of payment card numbers remain visible.

Subprocessors

We engage Anthropic, PBC as a subprocessor to generate AI answers. Approval of this arrangement follows the service agreement with the business. The information transmitted, countries, and retention periods are described in the AI processing notice below.

Article 3-3 (TreeTalk AI Processing and International Transfers)

We do not send names or contact details received through separate input fields to the AI. We mask portions detected as personal information in questions and previous conversations before sending them to the AI. We also mask portions detected as personal information in guidance materials and response instructions registered by the business before sending them to the AI. However, information published by the business, such as its address and main phone number, is excluded from masking.

Automatic masking cannot recognize every expression, so please do not enter sensitive or unnecessary personal information in the chat window. AI processing takes place outside Korea even when masking is applied.

AI provider and contact

Anthropic, PBC · privacy@anthropic.com

Countries of processing

United States. Information may be processed in other countries under the provider’s privacy policy.

Information transmitted

We send questions, previous conversations, and the business’s guidance materials and response instructions needed for answers after masking portions detected as personal information. Information published by the business, such as its address and main phone number, is excluded from masking. Values from the separate contact fields are not transmitted.

Timing and method

Whenever a question is answered, information is sent from our servers over encrypted communications.

Purpose and retention and use periods

Information is used to generate AI answers. Retention and use for training follow the provider’s policies and vary with the subscription account settings. The provider retains information for as long as reasonably necessary for the purposes and criteria in its privacy policy. When conversations on a personal subscription are deleted, they are removed from storage systems within 30 days. If model improvement is allowed, information may be retained in de-identified form for up to 5 years. Inputs and outputs flagged for policy violations may be retained for up to 2 years, safety classification scores for up to 7 years, and materials related to submitted feedback for 5 years. Exceptions apply, including legal obligations and dispute handling.

Applicability and legal basis for international transfers

If the information to be transmitted includes personal information, the business must establish a legal basis for the international transfer under applicable law and provide the necessary notices and obtain consent. Agreement to this policy or the terms alone does not constitute separate consent to international transfers.

How to decline, procedures, effects, and alternative consultation

You may choose not to use AI consultation or stop using it. AI answers will then be unavailable, and you may use the telephone, email, or other contact channels on the business’s website. Rights concerning information already processed may be exercised through the business.

Anthropic Privacy Policy · Retention information