Privacy Policy

Article 1 (Information Collected)

The Company collects and retains the following items in order to provide the Service.

· User ID (username) — used for login and member identification.

· Nickname — entered at sign-up and used as the display name on public comments and as the meeting host name.

· Email — used for sign-up confirmation, login, account recovery, and verification, password-reset, and payment emails. If you use Google login, we receive the email address verified by Google and your Google account identifier.

· Password — stored only as a hash; the original is not kept.

· Session token — kept only as a hash.

· Display settings (such as theme) and usage-environment identifiers.

· Meeting inputs and results — the meeting's topic, goal, background, and constraints; intervention messages; answers to follow-up questions from the AI; attachments; documents written during the meeting; participation records; AI provider identifiers and the outputs produced; and meeting history.

· Public comments and when they were written.

· Custom presets, personas, and document templates created by the member.

· Records of credits granted and used, and of coupon and invitation-key use.

· API key identifiers and API request records — only where the API feature is provided and the member uses it.

· IP address — used to prevent abuse, such as by limiting request rates. The Company does not store IP addresses together with member information or meeting records.

· Information entered in the payment window when paying through Eximbay (name, email) — passed through our server and kept in the order record.

· Optional items: name and phone number — stored separately only when the member turns on “Save name and phone number for next payment (optional)” on the payment screen and starts a payment. You can pay without turning it on.

· Order and payment records — order/payment identifiers, provider (PortOne, Toss Payments, Eximbay, PayPal), channel, amount and currency, payment status, refund request text, and handling decisions.

· Billing-key token for recurring payments — kept on our servers; we do not keep the full card number, password, or OTP.

· Full payment authentication takes place in the PG payment window, and the Company does not store card numbers or OTPs.

Article 2 (Purpose of Collection)

Collected information is used only for the following purposes — member identification, password verification, session maintenance, saving display appearance, meeting operation and record retention, posting public meetings and comments, sending sign-up confirmation, password-reset, and payment emails, payment settlement and refund processing, managing credits granted and used, preventing abuse and payment fraud, confirming completion of rewarded ads, retaining records as required by law, and handling complaints.

Name and phone number saved as optional items are used only to prefill the input fields at the next payment.

The Company does not send promotional information without the member's separate consent.

The Company does not use meeting inputs or outputs to train its own AI models.

Article 3 (Retention Period and Destruction)

· Member information and meeting records — When a member withdraws, we delete the user ID, email, nickname, password, login sessions, Google account link, and saved payment customer information, as well as the member's private meetings (including their utterances, attachments, outputs, and share links). Public meetings remain public, separated from the account, under the license in Article 9 of the Terms. Members can also permanently delete their public meetings before withdrawing, and after withdrawal they can ask the personal information protection officer to delete remaining public meetings or to mask personal information contained in their text.

· Records on contracts and withdrawal of offers, payment of charges, and supply of goods — 5 years. This is the retention period set by the “Act on the Consumer Protection in Electronic Commerce, Etc.”

· Consumer complaint and dispute handling records — 3 years. This is the retention period for records on handling consumer complaints or disputes set by the same Act.

· Name and phone number saved as optional items — deleted immediately when consent is withdrawn (turning off saving or pressing “Clear saved information”) or when the member withdraws from the Service.

· Session token — invalidated when the member logs out or changes their password.

· One-time tokens for password reset and email verification — consumed immediately after use or upon expiry.

· Information whose retention period has ended is destroyed without delay by a method that makes recovery impossible.

Article 4 (Provision to Third Parties and Outsourcing)

The Company does not provide personal information to third parties unrelated to providing the Service without the member's consent.

The Company outsources the processing of personal information as follows to provide the Service. Outsourcing processed overseas is also listed in Article 5. If information is provided as required by law, we will notify that fact through an in-service notice.

· Korea PortOne Co., Ltd. (PortOne · Republic of Korea) — payment window integration and relaying payment and refund requests.

· Toss Payments — KRW payments, recurring payments (billing), and refunds.

· Eximbay Inc. (Republic of Korea) — USD payments and refunds. To process overseas payments, Eximbay may pass payment information to overseas recipients disclosed in its own privacy policy (including in the United States, China, Japan, and Sweden).

· PayPal — USD payments and refunds (overseas transfer — Article 5).

· OpenRouter, LLM Gateway, and the providers of the models used in the meeting — generating AI participants' utterances and outputs, translation, and web search selected by the member (overseas transfer — Article 5).

· Google — serving and measuring web ads (Article 6).

Emails are sent through a mail server operated by the Company and are not outsourced to external sending services. The Company also operates the service servers itself. If a processor changes, we will update this list and notify you.

Article 5 (Overseas Transfer)

Utterances and outputs in a meeting are generated by models supplied by external AI providers. What the member enters in a meeting, and inputs used for AI translation or optional web search, are passed to the recipients below.

This transfer is outsourcing and storage necessary to perform the contract with the member and is made by disclosure in this Policy under Article 28-8(1)3 of the Personal Information Protection Act.

· OpenRouter, Inc. (United States · 169 Madison Avenue, New York, NY 10016 · privacy@openrouter.ai) — receives the Company's AI requests and passes them to the upstream provider running the model the member chose. Under OpenRouter's stated default settings, prompt and response bodies are not stored, and only metadata (such as token counts and latency) is kept. Upstream providers and their retention and training policies are as listed in OpenRouter's published provider list (openrouter.ai/docs/guides/privacy/provider-logging).

· Polar Lights LLC (operator of LLM Gateway · United States · 16192 Coastal Highway, Lewes, DE 19958 · contact@llmgateway.io) — receives the Company's AI requests and passes them to the upstream provider running the model the member chose. Under LLM Gateway's stated policy, prompt and response content is not stored, and only usage metadata is kept. Upstream providers and their countries and retention and training policies are as listed in LLM Gateway's published provider list (llmgateway.io/legal/providers).

· Direct connections to model providers — when the Company sends a request directly to one of the following providers' APIs, that provider is the recipient. Each provider's retention period and whether data is used for training follow that provider's policy.

· Anthropic PBC (United States · 548 Market St, PMB 90375, San Francisco, CA 94104 · privacy@anthropic.com) — Claude models.

· OpenAI OpCo, LLC (United States · 1455 3rd Street, San Francisco, CA 94158 · privacy@openai.com) — GPT models. Under OpenAI's stated API policy, data sent to the API is not used to train models unless you opt in, and abuse-monitoring logs are kept for up to 30 days by default.

· Google Cloud Korea LLC (contracting entity — the Company billing account has a Republic of Korea billing address · processing countries: countries where Google or its agents maintain facilities · contact: Google Privacy Help Center, support.google.com/policies/troubleshooter/7575787) — Gemini models (paid API). Under Google's stated policy for paid services, prompts and responses are not used to improve its products and are logged for a limited period to detect prohibited use.

· SpaceXAI LLC (xAI · the United States and other countries — per its data processing addendum, the United States and countries where SpaceXAI and its subprocessors maintain processing operations · privacy+enterprise@x.ai) — Grok models. Under xAI's enterprise terms, user content is not used to train models.

· ANOMALY INNOVATIONS, INC. (operates OpenCode Go Plus · United States · 2443 Fillmore St #380-6343, San Francisco, CA 94115) — receives the Company's AI requests and passes them to the upstream provider running the model the member chose. The connected models (the GLM, Kimi, MiMo, DeepSeek, and Hy families) are listed by OpenCode Go with 0-day retention and no training use. Each model's retention and training policy follows the OpenCode Go documentation (opencode.ai/docs/go/).

· PayPal Pte. Ltd. (Singapore · 5 Temasek Boulevard #09-01 Suntec Tower 5, Singapore 038985 · domestic representative PayPal Korea Services LLC, skrprivacy@paypal.com) — if you choose a USD payment, the order identifier and payment amount and currency are transmitted over the network at the time of payment and are kept for payment processing for the period set by PayPal's policy and applicable law. Information you enter directly in the PayPal payment window is received directly by PayPal.

· Items transferred (AI) — the meeting's topic, goal, background, and constraints; participants' utterances; intervention messages; answers to follow-up questions from the AI; materials the member attached to the meeting; and documents written during the meeting.

· Items not transferred — Account credentials (login name, email address, password) and payment information are not deliberately transmitted. However, personal information that a user types directly into a free-input field may be passed to the AI provider as part of that input. Human participants are transmitted using a word denoting their role instead of their name.

· Purpose of transfer — to provide AI participants' utterance and output generation, translation, and the web search selected by the user.

· Time and method of transfer — transmitted over the network at the moment the relevant feature is run.

· Retention period — kept for the period set by each recipient's settings and policy above, and then deleted.

Members may refuse overseas transfer by notifying the personal information protection officer. However, because transferring AI requests is essential to running a meeting, meeting features cannot be used if you refuse, and if you refuse transfer to PayPal you must use another payment method.

Article 6 (Payment, Advertising, and Cookies)

Payments are accepted through PortOne-integrated Toss Payments (KRW) and Eximbay and PayPal (USD); Apple and Google in-app purchases are not available.

The Company uses cookies to keep you logged in and to save theme settings. Members can refuse cookie storage in their browser settings, but in that case login and theme saving may not work.

Google ads are served, and cookies and similar technologies from Google and its advertising partners may be used to serve and measure ads. Depending on your region, you can make related choices on the privacy and cookie consent screen that is displayed.

Article 7 (Rights of Data Subjects)

Members and their legal representatives may at any time request access to, correction of, deletion of, or suspension of processing of the member's personal information, or withdraw consent.

Members can view and edit their own information, such as their nickname, and withdraw their membership on the account settings screen, and can make other requests by email to the personal information protection officer. Requests can also be made through an agent, in which case the Company may ask for material confirming the authorization. The Company will notify you of the result within the period set by law.

Article 8 (Personal Information Protection Officer)

Personal information protection officer — Cha Heejoon (Representative).

· Contact — phone +82-32-255-5902 · email contact@hiaisoft.com

Article 9 (Security Measures)

The Company keeps personal information safe through measures such as storing passwords as hashes, storing session tokens as hashes, expiring and consuming one-time tokens, and separating permissions.

Article 10 (Age Information)

The Service does not collect age information and has no means of restricting use by age.

Article 11 (Handling Complaints and Remedies)

Members may submit personal-information-related complaints to the personal information protection officer.

The Company handles received complaints without delay.

You may also seek advice, report, or apply for dispute mediation regarding personal information infringement to the following Korean bodies — Personal Information Dispute Mediation Committee (1833-6972), Personal Information Infringement Report Center (118, no area code), Supreme Prosecutors' Office (1301, no area code), and Korean National Police Agency (182, no area code).

Article 12 (Changes to the Privacy Policy)

This Privacy Policy may be revised due to changes in law or the Service. General changes are announced through an in-service notice at least 7 days before the effective date, and significant or unfavorable changes at least 30 days before.

Changes already made will not be applied retroactively to the member's disadvantage for past use.

Article 13 (Version and Effectiveness)

The document version of this document is mpm-2026-10-r3.