1. Personal Information Collected
- Required: Email address, name (nickname)
- Automatically collected: Service usage records, access logs, IP address (for API Rate Limiting and abuse prevention, hashed with TTL)
- User-provided: Chat conversations, uploaded files, connected-account authentication tokens
- Optional: Profile image, organization name
2. Purpose of Collection and Use
- Service provision and membership management
- Transmission of inputs to third-party AI providers to deliver AI features (see Section 5, Outsourcing)
- Service quality and agent performance improvement (Company-internal purpose)
- Usage statistics analysis, customer inquiry response, and notice delivery
3. Retention Period
Personal information is destroyed immediately upon account deletion. However, if retention is required by applicable laws, it is retained for the period prescribed by such laws.
Service Data Retention
- Free plan: Chat messages retained for 30 days
- Pro plan: Chat messages retained for 90 days
- Team plan: Chat messages retained indefinitely
- Agent metrics: Retained for 30 days
- Access logs (user_access_log): Retained for 1 year
Legal Retention Requirements
- E-Commerce Act: Contract/withdrawal records — 5 years
- Telecommunications Privacy Act: Access logs — 3 months
- IT Network Act: Identity verification — 6 months
4. Third-Party Disclosure
The Company does not provide personal information to third parties without user consent, except as required by law or with prior user consent.
5. Data Processing Outsourcing & International Transfer
The Company entrusts personal information processing to the entities below and discloses international transfer details pursuant to Article 28-8 of the Personal Information Protection Act. The full, up-to-date list of providers actually in use is available under "AI Subprocessors & International Transfer List" below.
| Entity | Purpose | Country | Data Items |
|---|
| Supabase Inc. | Database hosting, authentication | USA (AWS us-east-1) | Email, profile, chat history |
| Vercel Inc. | Web application hosting | USA (Edge Network) | Access logs, cookies |
| Anthropic PBC | AI model inference (Claude) | USA | User messages (not used for model training under API terms; briefly retained for abuse prevention, then deleted) |
| Daytona Platforms Inc. | AI agent execution environment (sandbox) | USA (us-east-1) | Agent code, files |
| Functional Software, Inc. (Sentry) | Error monitoring | USA | Diagnostic logs on error |
| Google LLC | Web analytics (Google Analytics) | USA | Anonymized usage statistics |
| Upstash Inc. | Rate Limiting (Redis) | USA | IP address hash (deleted after TTL) |
User-Connected Services
- Slack, Microsoft Teams, and similar services are external channels that the user connects directly and exchanges messages with under the user's direction; they differ in nature from the outsourcing above.
- The scope of information transmitted to such services upon connection depends on the permissions granted by the user.
6. AI Training and Internal Improvement
- The third-party AI providers used by the Company do not use user inputs to train their models, in accordance with their API terms.
- The Company may use certain data such as conversation history for Company-internal purposes to improve service quality and agent performance; this is unrelated to third-party AI model training.
7. Automated Decision-Making
- The Company's AI agents act on the user's behalf, but do not make decisions that significantly affect the user's rights or obligations fully automatically without human involvement.
- Outbound and important actions are designed to require the user's approval (human review and consent).
- Regarding automated processing, users may request an explanation or object via admin@gemmy.studio.
8. User Rights
Users may view, modify, or delete their personal information at any time through the service settings page or by contacting support at admin@gemmy.studio.
9. Chief Privacy Officer (CPO)
- Title: CEO (concurrent CPO)
- Name: Woojae Lim
- Email: admin@gemmy.studio
10. AI Subprocessors & International Transfer List
The Company publishes the full list of AI providers and infrastructure subprocessors actually in use, along with international transfer details, on a separate page kept up to date.
View AI subprocessors list →
11. Internal Management Plan
The Company establishes and implements an internal management plan in accordance with Article 4 of the "Standards for Safety Measures for Personal Information" (PIPC Notice).
View full internal management plan →
Gemmy Studio Inc. | W-1 Building, Room 901, B-1, 99 Daehak-ro, Yuseong-gu, Daejeon, 34134, Republic of Korea