Privacy Policy
Upstage Co., Ltd. (collectively the "Company") complies with the "Personal Information Protection Act" and other related laws to protect the freedom and rights of information subjects and processes and safely manage personal information by the law. Accordingly, by Article 30 of the "Personal Information Protection Act," the Company establishes and discloses the following privacy policy to inform the subject of the procedures and standards for processing personal information and ensure that complaints are handled promptly and smoothly.
Last Revised: Sep 26, 2024
Disclaimer: Governing Law
So, as you know, the laws and regulations of the Republic of Korea have formulated this Privacy Policy. While it applies to our global operations, the policy is primarily governed by South Korean legal standards and practices (opens in a new tab). Users outside of South Korea should be aware that the policy might reference legal concepts and frameworks specific to South Korea, which may differ from local laws.
Table of Contents
1. Purpose, items, and retention period of personal information processing
2. Children’s Privacy
3. Entrustment of personal information processing
4. Personal data transfer abroad
5. Procedure and method of destroying personal information
6. Rights, obligations, and exercise methods of the information subject and legal representative
7. Measures to ensure the safety of personal information
8. Installation and operation of personal information automatic collection devices and refusal
9. Additional use·provision judgment criteria
10. Chief Privacy Officer and Personal Information Disclosure Claim
11. Methods of Exercising Rights
12. Changes to the Privacy Policy
1. Purpose, items, and retention period of personal information processing
The Company processes personal information for the following purposes. It obtains the data subject's consent for processing their personal information items by Article 15 Paragraph 1 Clause 1 and Article 22 Paragraph 1 Clause 7 of the Personal Information Protection Act. If the purpose of use changes, the Company will take necessary measures such as obtaining separate consent by Article 18 of the Personal Information Protection Act.
A. Membership registration and management: Until the member withdraws
However, in the following cases, until the end of the relevant reason
• If there is an ongoing investigation or inquiry due to a violation of related laws, until the end of the investigation or inquiry
• If there is a remaining debt or credit relationship due to the service use until the settlement of the debt or credit relationship
B. Provision of goods or services: Until the completion of the supply of goods or services and the payment and settlement of fees
However, in the following cases, until the end of the relevant period
• Records on display, advertisement, contract contents, performance, and transactions under the Act on Consumer Protection in Electronic Commerce, etc.
• Records on display and advertisement: 6 months
• Records on contract or withdrawal of the offer, payment of the price, and supply of goods, etc.: 5 years
• Records on consumer complaints or dispute resolution: 3 years
• Communication confirmation data retention under Article 41 Paragraph 2 of the Enforcement Decree of the Protection of Communications Secrets Act
• Service usage records, access logs, access IP addresses: 3 months
Category | Purpose of collection | Items collected | Retention and use period |
---|---|---|---|
Membership registration and management | To confirm the intention of membership registration, to identify and authenticate the member for the provision of membership services, to maintain and manage the membership status, to prevent fraudulent use of services, to enhance user security, to improve service quality, to develop new features and services, to deliver various notices and notifications. | (Required) Email | Until the withdrawal of membership. |
Provide goods or services | • We are providing services, payment processing, and settlement for personalized services. | (Required) Card number, card expiry, CVC code.(Optional) Data entered by the user in the service is automatically generated during service usage. | Completed supply of goods or services, and payment settled.Exceptions: Preservation by law is required for five years. |
Playground | • To provide LLM and Document AI services | Conversation content, uploaded documents, and voting content entered by the user who registered for membership | Until the withdrawal of membership or the termination of the outsourcing contract |
Asynchronous API | • To provide Document AI services | Inference request data, inference result data | Inference Request Data: Temporarily store inference requests until completion.Inference Result Data: Store inference results for 30 days after completion. |
Support | • Consumer Complaints • Handling Grievances | Counseling services, the purpose of the request, name, phone number, email, consultation records (contents, date, and time), complaint or grievance resolution. | Three years |
Marketing information utilization | • To send newsletters | (Optional) Name, email address | Until the user expresses their intention to refuse to receive or withdraw their consent |
- Provision of events and advertising information | (Optional) Name, email address, phone number, affiliation (company and department name/school and department name), job title | Until the user expresses their intention to refuse to receive or withdraw their consent |
2. Children’s Privacy
a. We do not intend for our websites or online services to be used by anyone under the age of 14. We do not knowingly collect, sell, or share information of the ages of 14. If you are a parent or guardian and believe we may have collected information about your child, please contact us immediately as described in this Policy's “10. Personal Information Disclosure Claim” section. For more information, please see our Terms of Use (opens in a new tab).
3. Entrustment of personal information processing
a. The Company entrusts the following personal information processing tasks to external service providers for efficient personal information management.
Recipient (Beneficiary) | Outsource tasks | Assigning tasks to subcontractors | Retention and Use Duration | |
Amazon Web Services, Inc. | Analysis, processing, linking, interfacing, editing, correction, recovery, use, and other related tasks of personal information | https://aws.amazon.com/privacy/ (opens in a new tab) | Until the withdrawal of membership or the termination of the outsourcing contract | |
BREVO | Email sending for marketing purposes | https://www.brevo.com/legal/privacypolicy/ (opens in a new tab) | Until the withdrawal of membership or the termination of the outsourcing contract | |
salesforce | Customer DB management and email sending | https://www.salesforce.com/kr/company/privacy/ (opens in a new tab) | Until the withdrawal of membership or the termination of the outsourcing contract | |
Zapier, Inc. | Customer DB management | https://zapier.com/privacy (opens in a new tab) | Until the withdrawal of membership or the termination of the outsourcing contract | |
Stripe | Payment service provision | https://stripe.com/legal/service-providers (opens in a new tab) | Until the withdrawal of membership or the termination of the outsourcing contract | |
Elfsight | Customer CS collection and management | https://elfsight.com/privacy-policy/ (opens in a new tab) | Until the withdrawal of membership or the termination of the outsourcing contract | |
Atlassian Corp. | Customer CS collection and management | https://www.atlassian.com/legal/privacy-policy (opens in a new tab) | Until the withdrawal of membership or the termination of the outsourcing contract | |
OpenAI, Inc. | OpenAI model provision for model comparison in Playground > Chat service | https://openai.com/policies/privacy-policy/ (opens in a new tab) | Until the withdrawal of membership or the termination of the outsourcing contract | |
NAVER Cloud Corp. | HyperCLOVA X model provision for model comparison in Playground > Chat service | https://www.ncloud.com/policy/infou/infou (opens in a new tab) | Until the withdrawal of membership or the termination of the outsourcing contract | |
Fireworks.ai | Model inference service provision | https://fireworks.ai/privacy-policy (opens in a new tab) | Services not saved after temporary use. | |
Together Computer, Inc. | Model inference service provision | https://www.together.ai/privacy (opens in a new tab) | Services not saved after temporary use. | |
FriendliAI Inc. | Model inference service provision | https://friendli.ai/privacypolicy (opens in a new tab) | Services not saved after temporary use. | |
OctoAI, Inc. | Model inference service provision | https://octo.ai/legals/privacy-policy/ (opens in a new tab) | Services not saved after temporary use. |
b. When entering into a contract for entrustment, the Company shall specify the matters concerning the prohibition of personal information processing other than the purpose of performing the entrusted tasks, technical and administrative protection measures, restrictions on re-entrustment, management, and supervision of the trustee, and liability for damages in the contract or other documents by Article 26 of the Personal Information Protection Act, and shall supervise the trustee to ensure that the personal information is processed safely.
c. By Article 26, paragraph 6 of the Personal Information Protection Act, the trustee shall obtain the consent of the Company when re-entrusting the personal information processing tasks entrusted by the Company.
d. If the content of the entrusted tasks or the trustee changes, we will disclose it through this Privacy Policy without delay.
e. If we entrust personal information processing tasks overseas, we will inform you in '04. Transfer of Personal Information Overseas'.
4. Personal data transfer abroad
The company provides and outsources services for marketing, customer management, and AI models overseas.
Subcontractors | BREVO |
Location of the subcontractors | The United States and France. |
Date and method of entrusting | Personal information may be transferred to the company's managed cloud server for processing through network transmission. |
Contact information | contact@sendinblue.com |
Personal information items entrusted | Name, Contact, Email, Company Name, Job Title, Industry |
Contents of the entrusted tasks | Email marketing purposes. |
Retention and use period of personal information | Until the withdrawal of membership or the termination of the outsourcing contract |
How to refuse the transfer of personal information, procedure, and effect of refusal | • To object to data transfer: Contact Support to express your objection. • Impact of objecting: Objecting may limit marketing information access. |
Legal basis for overseas transfer | • Article 28-8, paragraph 1, item 1 (consent of the information subject) • Article 28-8, paragraph 1, item 3 (processing and storage for contract execution) |
Subcontractors | Salesforce.com, Inc |
Location of the subcontractors | Japan |
Date and method of entrusting | Personal information may be transferred to the company's managed cloud server for processing through network transmission. |
Contact information | privacy@salesforce.com |
Personal information items entrusted | Name, Contact, Email, Company Name, Job Title, Industry |
Contents of the entrusted tasks | Manage customer database and send emails. |
Retention and use period of personal information | Until the withdrawal of membership or the termination of the outsourcing contract |
How to refuse the transfer of personal information, procedure, and effect of refusal | • How to refuse international transfer: Contact Support to refuse. • Consequences of refusing international transfer: This may affect support service access. |
Legal basis for overseas transfer | • Article 28-8, paragraph 1, item 1 (consent of the information subject) • Article 28-8, paragraph 1, item 3 (processing and storage for contract execution) |
Subcontractors | Zapier, Inc. |
Location of the subcontractors | The United States |
Date and method of entrusting | Personal information may be transferred to the company's managed cloud server for processing through network transmission. |
Contact information | contact@zapier.com |
Personal information items entrusted | Name, Contact, Email, Company Name, Job Title, Industry |
Contents of the entrusted tasks | Manage customer database |
Retention and use period of personal information | Until the withdrawal of membership or the termination of the outsourcing contract |
How to refuse the transfer of personal information, procedure, and effect of refusal | • How to refuse international transfer: Contact Support to refuse. • Consequences of refusing international transfer: This may affect support service access. |
Legal basis for overseas transfer | • Article 28-8, paragraph 1, item 1 (consent of the information subject) • Article 28-8, paragraph 1, item 3 (processing and storage for contract execution) |
Subcontractors | Stripe |
Location of the subcontractors | The United States |
Date and method of entrusting | Personal information may be transferred to the company's managed cloud server for processing through network transmission. |
Contact information | privacy@stripe.com |
Personal information items entrusted | Credit card number, credit card expiration date, CVC number |
Contents of the entrusted tasks | Payment service provided by |
Retention and use period of personal information | Until the withdrawal of membership or the termination of the outsourcing contract |
How to refuse the transfer of personal information, procedure, and effect of refusal | • How to refuse overseas transfer (procedure): You can refuse overseas transfer by indicating your refusal to Support. • Impact of refusing overseas transfer: If you refuse overseas transfer, you may experience difficulties using paid services. |
Legal basis for overseas transfer | • Article 28-8, paragraph 1, item 1 (consent of the information subject) • Article 28-8, paragraph 1, item 3 (processing and storage for contract execution) |
Subcontractors | Elfsight |
Location of the subcontractors | Armenian |
Date and method of entrusting | Personal information may be transferred to the company's managed cloud server for processing through network transmission. |
Contact information | help.elfsight.com |
Personal information items entrusted | Name, Contact, Email, Company Name, Job Title, Industry |
Contents of the entrusted tasks | Customer CS collection and management |
Retention and use period of personal information | Until the withdrawal of membership or the termination of the outsourcing contract |
How to refuse the transfer of personal information, procedure, and effect of refusal | • How to refuse international transfer: Contact Support to refuse. • Consequences of refusing international transfer: This may affect support service access. |
Legal basis for overseas transfer | • Article 28-8, paragraph 1, item 1 (consent of the information subject) • Article 28-8, paragraph 1, item 3 (processing and storage for contract execution) |
Subcontractors | Atlassian Corp. |
Location of the subcontractors | Australia |
Date and method of entrusting | Personal information may be transferred to the company's managed cloud server for processing through network transmission. |
Contact information | privacy@atlassian.com |
Personal information items entrusted | Name, Contact, Email, Company Name, Job Title, Industry |
Contents of the entrusted tasks | Customer CS collection and management |
Retention and use period of personal information | Until the withdrawal of membership or the termination of the outsourcing contract |
How to refuse the transfer of personal information, procedure, and effect of refusal | • How to refuse international transfer: Contact Support to refuse. • Consequences of refusing international transfer: This may affect support service access. |
Legal basis for overseas transfer | • Article 28-8, paragraph 1, item 1 (consent of the information subject) • Article 28-8, paragraph 1, item 3 (processing and storage for contract execution) |
Subcontractors | OpenAI, Inc. |
Location of the subcontractors | The United States |
Date and method of entrusting | Personal information may be transferred to the company's managed cloud server for processing through network transmission. |
Contact information | privacy@openai.com |
Personal information items entrusted | Playground > Chat service conversation information (only when using compare mode) |
Contents of the entrusted tasks | Playground > Chat service provides OpenAI models for model comparison |
Retention and use period of personal information | Services not saved after temporary use. |
How to refuse the transfer of personal information, procedure, and effect of refusal | • How to refuse overseas transfer (procedure): To refuse the transfer of personal information abroad, please indicate your refusal to support. • Impact of refusing overseas transfer: If you refuse an overseas transfer, you may experience difficulties using the Playground > Chat service. |
Legal basis for overseas transfer | • Article 28-8, paragraph 1, item 1 (consent of the information subject) • Article 28-8, paragraph 1, item 3 (processing and storage for contract execution) |
Subcontractors | NAVER Cloud Corp. |
Location of the subcontractors | Republic of Korea |
Date and method of entrusting | Personal information may be transferred to the company's managed cloud server for processing through network transmission. |
Contact information | dl_ncloud_privacy@navercorp.com |
Personal information items entrusted | Playground > Chat service conversation information (only when using compare mode) |
Contents of the entrusted tasks | Playground > Chat service provides HyperCLOVA X models for model comparison |
Retention and use period of personal information | Services not saved after temporary use. |
How to refuse the transfer of personal information, procedure, and effect of refusal | • How to refuse overseas transfer (procedure): To refuse the transfer of personal information abroad, please indicate your refusal to support. • Impact of refusing overseas transfer: If you refuse an overseas transfer, you may experience difficulties using the Playground > Chat service. |
Legal basis for overseas transfer | • Article 28-8, paragraph 1, item 1 (consent of the information subject) • Article 28-8, paragraph 1, item 3 (processing and storage for contract execution) |
Subcontractors | Fireworks.ai |
Location of the subcontractors | The United States |
Date and method of entrusting | Personal information may be transferred to the company's managed cloud server for processing through network transmission. |
Contact information | help@fireworks.ai |
Personal information items entrusted | Conversation content, uploaded documents, and voting results entered by a registered user into the service |
Contents of the entrusted tasks | To provide inference services. |
Retention and use period of personal information | Services not saved after temporary use. |
How to refuse the transfer of personal information, procedure, and effect of refusal | • How to refuse overseas transfer (procedure): To refuse the transfer of personal information abroad, please indicate your refusal to support. • Impact of refusing overseas transfer: If you refuse an overseas transfer, you may experience difficulties using the inference service. |
Legal basis for overseas transfer | • Article 28-8, paragraph 1, item 1 (consent of the information subject) • Article 28-8, paragraph 1, item 3 (processing and storage for contract execution) |
Subcontractors | Together Computer, Inc. |
Location of the subcontractors | The United States |
Date and method of entrusting | Personal information may be transferred to the company's managed cloud server for processing through network transmission. |
Contact information | privacy@together.ai |
Personal information items entrusted | Conversation content, uploaded documents, and voting results entered by a registered user in the service |
Contents of the entrusted tasks | To provide inference services. |
Retention and use period of personal information | Services not saved after temporary use. |
How to refuse the transfer of personal information, procedure, and effect of refusal | • How to refuse overseas transfer (procedure): To refuse the transfer of personal information abroad, please indicate your refusal to support. • Impact of refusing overseas transfer: If you refuse an overseas transfer, you may experience difficulties using the inference service. |
Legal basis for overseas transfer | • Article 28-8, paragraph 1, item 1 (consent of the information subject) • Article 28-8, paragraph 1, item 3 (processing and storage for contract execution) |
Subcontractors | FriendliAI Inc. |
Location of the subcontractors | The United States |
Date and method of entrusting | Personal information may be transferred to the company's managed cloud server for processing through network transmission. |
Contact information | privacy@friendli.ai |
Personal information items entrusted | Conversation content, uploaded documents, and voting content entered by a member into the service |
Contents of the entrusted tasks | To provide inference services. |
Retention and use period of personal information | Services not saved after temporary use. |
How to refuse the transfer of personal information, procedure, and effect of refusal | • How to refuse overseas transfer (procedure): To refuse the transfer of personal information abroad, please indicate your refusal to support. • Impact of refusing overseas transfer: If you refuse an overseas transfer, you may experience difficulties using the inference service. |
Legal basis for overseas transfer | • Article 28-8, paragraph 1, item 1 (consent of the information subject) • Article 28-8, paragraph 1, item 3 (processing and storage for contract execution) |
Subcontractors | OctoAI, Inc. |
Location of the subcontractors | The United States |
Date and method of entrusting | Personal information may be transferred to the company's managed cloud server for processing through network transmission. |
Contact information | contact@octo.ai |
Personal information items entrusted | Conversation content, uploaded documents, and voting content entered by a member into the service |
Contents of the entrusted tasks | To provide inference services. |
Retention and use period of personal information | Services not saved after temporary use. |
How to refuse the transfer of personal information, procedure, and effect of refusal | • How to refuse overseas transfer (procedure): To refuse the transfer of personal information abroad, please indicate your refusal to support. • Impact of refusing overseas transfer: If you refuse an overseas transfer, you may experience difficulties using the inference service. |
Legal basis for overseas transfer | • Article 28-8, paragraph 1, item 1 (consent of the information subject) • Article 28-8, paragraph 1, item 3 (processing and storage for contract execution) |
5. Procedure and method of destroying personal information
a. The Company shall destroy personal information without delay when it is no longer necessary to retain the personal information, such as when the retention period of personal information expires or when the purpose of processing is achieved.
b. Even if the retention period of personal information has expired or the purpose of processing has been achieved, if it is necessary to preserve personal information under other statutes, the Company shall transfer it to a separate database (DB) or store it in a separate storage place.
c. The procedure and method of destroying personal information are as follows.
• Destruction procedure
The company selects personal information for which the destruction reason has occurred and destroys the personal information according to internal regulations.
• Destruction method
The company destroys personal information recorded and stored in electronic files, making reproducing the record impossible. It also shreds the personal information recorded and stores it in paper documents.
6. Rights, obligations, and exercise methods of the information subject and legal representative
a. The information subject may exercise the following rights against the company at any time.
※ The company does not collect and provide services for the personal information of children under 14.
b. The exercise of rights may be made by written, e-mail, facsimile, etc., to the company by Article 41 (1) of the Enforcement Decree of the Personal Information Protection Act, and the company will take action without delay.
c. The exercise of rights may be made through a representative such as a legal representative or a person entrusted with the exercise of rights. In this case, a power of attorney by the attached Form 11 of the "Enforcement Decree of the Personal Information Protection Act" must be submitted.
d. The right to request the disclosure of personal information and the right to request the correction, deletion, and suspension of processing may be limited by Article 35 (4) and Article 37 (2) of the Personal Information Protection Act.
e. The company may refuse to delete personal information if specified as the collection subject in other statutes.
f. The company verifies whether the person who has requested the disclosure is the person who has asked for the disclosure or a legitimate representative.
7. Measures to ensure the safety of personal information
The company is taking the following measures to ensure the safety of personal information.
• Administrative measures: Establishment and implementation of internal management plans, operation of dedicated organizations, and regular employee education
• Technical measures: Management of access rights to personal information processing systems, installation of access control systems, encryption of personal information, Installation and updating of security programs
• Physical measures: Access control of computer centers, etc.
8. Installation and operation of personal information automatic collection devices and refusal
a. The company uses Google Analytics, a web log analysis tool that Google provides. Google Analytics collects information about service users through cookies (Cookie) ; in this case, only non-identifiable information that cannot identify individual users is collected.
Nevertheless, users can refuse to use Google Analytics by installing the Google Analytics blocking browser add-on (https://tools.google.com/dlpage/gaoptout (opens in a new tab)) or by refusing to set cookies on the web browser.
b. Cookies are small pieces of information sent to the user's computer browser by the server (HTTP) used to operate the website and are stored on the hard disk of the user's PC.
• Purpose of use of cookies: It provides optimized information to users by identifying the visits and usage patterns of each service and website visited by users, popular search terms, whether security access is made, etc.
• Installation, operation, and refusal of cookies: In Chrome, you cannot store cookies through the settings menu > privacy and security > cookies and other site data.
• You may experience difficulties using customized services if you refuse to store cookies.
9. Additional use·provision judgment criteria
a. The company may use and provide personal information without the consent of the information subject by Article 15 (3) and Article 17 (4) of the 「Personal Information Protection Act」 and Article 14-2 of the Enforcement Decree of the 「Personal Information Protection Act」.
Category | Purpose of use and provision. | Retention and Use Duration |
Sending additional service-related notifications regularly | Immediate destruction after purpose |
b. Accordingly, the company has considered the following matters to use and provide additional information without the consent of the information subject.
• Whether the purpose of using and providing personal information is related to the original purpose of collection
• Whether there is a predictability of additional use and provision in light of the circumstances in which personal information is collected or the processing practices
• Whether the additional use and provision of personal information unreasonably infringes the interests of the information subject
• Whether necessary measures have been taken to ensure safety, such as pseudonymization or cryptography
10. Chief Privacy Officer and Personal Information Disclosure Claim
a. The company has designated a Chief Privacy Officer responsible for managing personal information and handling complaints and remedies related to processing personal data.
b. The information subject may request the disclosure of personal information under Article 35 of the "Personal Information Protection Act" to the department below. The company will make every effort to ensure that the request for the disclosure of personal information is processed promptly.
Category | Contact Information | Contact |
Chief Privacy Officer | Position: Chief Privacy Officer, Name: Lucy Park | Contact: 070-8098-3023, Email: infosec@upstage.ai |
Personal Information Disclosure Claim | Department Name: SaaS Platform | Contact: 070-8098-3023, Email: contact@upstage.ai |
c. The information subject may inquire about all matters related to protecting personal information, such as complaints and remedies, by contacting the Chief Privacy Officer and the department in charge. The company will respond to the information subject's inquiry quickly.
11. Methods of Exercising Rights
a. The company is committed to protecting the information subject's right to self-determination and is making efforts to provide counseling and remedies for personal information infringement. If you need to report or consult, please contact the department below.
Category | Contact Information | Contact |
Chief Privacy Officer | Position: Chief Privacy Officer, Name: Lucy Park | Contact: 070-8098-3023, Email: infosec@upstage.ai |
Personal Information Protection Department | Department Name: Infra&Security | Contact: 070-8098-3023, Email: infosec@upstage.ai |
b. The information subject may apply for dispute resolution or consultation with the Personal Information Dispute Mediation Committee, the Korea Internet & Security Agency, etc., for remedies for personal information infringement. Please contact agencies for other reports on personal information infringement, consultations, etc.
• Personal Information Dispute Mediation Committee: +82 1833-6972 (www.kopico.go.kr (opens in a new tab))
• Personal Information Infringement Reporting Center: +82 118 (privacy.kisa.or.kr)
• Supreme Prosecutors' Office: +82 1301 (www.spo.go.kr (opens in a new tab))
• National Police Agency: +82 182 (ecrm.cyber.go.kr)
c. If the information subject has suffered damage due to the disposition or non-action of the head of the public institution regarding the request for the exercise of rights under Article 35 (Access to Personal Information), Article 36 (Correction, Deletion, etc. of Personal Information), and Article 37 (Suspension of Processing of Personal Information) of the Personal Information Protection Act, he/she may file an administrative appeal by the Administrative Appeals Act.
• Central Administrative Appeals Commission: +82 110 (www.simpan.go.kr (opens in a new tab))
12. Changes to the Privacy Policy
a. This Privacy Policy will take effect on September 26, 2024.
b. The previous Privacy Policy can be found at the link below.
• 2024. 8. 1 ~ 2024. 9. 25 (Click) (opens in a new tab)
• 2024. 7. 12 ~ 2024. 7. 31 (Click) (opens in a new tab)
• 2024. 3. 13 ~ 2024. 7. 11 (Click) (opens in a new tab)
• 2024. 2. 28 ~ 2024. 3. 12 (Click) (opens in a new tab)
• 2023. 12. 20 ~ 2024. 2. 28 (Click) (opens in a new tab)