Privacy Policy

This English version is provided for convenience. In case of any conflict, the Korean version prevails.

HyperReality Co., Ltd. (the "Company") complies with the Personal Information Protection Act of Korea and other applicable laws in providing Golem (golem.so and console.golem.so, the "Service"), a service for hiring AI coworkers and delegating work to them. This Privacy Policy explains what personal information we process, why, for how long, and with whom we share or entrust it.

At a glance

What	Details
Information we collect	Google account email and name, Service usage records, connected channel and worker information, payment records (for paid use), usage analytics information (cookies, usage behavior, screen interaction records)
How we use it	Sign-in, running organizations (workspaces) and AI coworkers, customer support, billing, security and incident response
AI training	We never use customer data to train AI models. We send data to AI providers only under terms that prohibit training
Who we entrust it to	Cloud, sign-in, AI, operational alerts, payments, usage analytics (Google Analytics, Amplitude, Microsoft Clarity): see Articles 4 and 5
Retention	Until you delete your account. Only records required by law are kept for the legally required period
Contact	Privacy Officer Juyoung Kang · support@golem.so

The Company's two roles

The Service is a tool used by businesses and teams. Within the same Service, the Company's role depends on the information.

Information	Company's role	Governing document
Member account information, access logs, payment records, inquiries	Controller: the Company decides the purposes and means	This Privacy Policy
Work that customers (the organizations or businesses Members belong to) assign to AI coworkers and its materials, "Customer Data". Examples: issues and task instructions, run records, outputs and reports, uploaded documents, messages exchanged with AI coworkers in connected channels (Discord, KakaoTalk Channels, etc.) and the senders' display names and identifiers	Processor: processed only to provide the Service, as the customer instructs	The customer's privacy policy and the Terms of Service between the Company and the customer (Customer Data provisions)

Please send requests to access or delete personal information inside Customer Data (for example, the name and messages of someone who asked a question through a KakaoTalk Channel) to the relevant customer first. If such a request reaches us, we forward it to that customer.

Article 1 Personal information processed: items, purposes, legal bases, and retention

When	Items	Purpose	Legal basis	Retention
Sign-up and sign-in (Google sign-in)	Email, name, profile image	Member identification, sign-in, notices	Performance of contract (Art. 15(1)(4))	Until account deletion
Running an organization	Organization name, members and their roles	Running organizations (workspaces), permission management	Performance of contract	Until the organization is deleted
Use of the Service	Access IP, browser information (User-Agent), access time, usage records, error logs	Security, fraud prevention, incident response	Legitimate interests (Art. 15(1)(6))	1 year (access logs at least 3 months under the Protection of Communications Secrets Act)
Connecting a worker	Worker name, device information (OS, host name), token hash, last connection time	Connecting computers that run AI coworkers, security auditing	Performance of contract	Until the worker is deleted or the account is deleted
Connecting channels and external tools (optional)	Discord server, channel, and role identifiers, KakaoTalk Channel connection details, external tool credentials registered by the Member (credentials stored encrypted)	Handling channels and running integrations as the Member directs	Performance of contract	Until disconnected or account deletion
Sales inquiries (inquiry form, email)	Name, email, company name, inquiry content, the page address the inquiry was sent from and the previously visited page (referrer)	Responding to inquiries, consultation	Steps requested before entering a contract (Art. 15(1)(4))	3 years after resolution
Usage analytics (collected automatically, landing and console)	Cookie and device identifiers, member ID (when signed in; a value derived from your email), usage behavior such as visits, clicks, and scrolls, referral source (ad or search source), device, browser, and OS information, approximate location (country, city), screen interaction records (session recordings)	Service usage statistics, feature improvement, identifying errors and usability issues	Legitimate interests (Art. 15(1)(6))	Per-tool retention in the Article 5 table
Paid payments (Korea)	Amount and time of payment, plan, payment status, transaction identifier returned by the payment processor (the Company does not receive card numbers)	Billing, refunds, issuing tax invoices and receipts	Performance of contract, legal obligation (Art. 15(1)(2))	5 years (E-Commerce Act)
Paid payments (overseas)	Email, country, plan, payment status, transaction and subscription identifiers returned by Paddle (Paddle receives card details directly; the Company does not)	Reflecting subscription status, handling refunds	Performance of contract	5 years (E-Commerce Act)

• We do not send email addresses, names, or phone numbers to analytics tools. Signed-in members are distinguished by a member ID derived from their email. Because someone who knows the same email can recreate and match this ID, the Company treats it as personal information.
• Session recordings capture mouse movements, clicks, scrolls, and page layout. Text typed into input fields, the console's content and conversation areas (where Customer Data appears), and member email addresses are masked.

Records kept under law are stored separately from other information and used only for that purpose.

Record	Period	Basis
Records on contracts or withdrawal of offers	5 years	E-Commerce Act
Records on payments and supply of goods	5 years	E-Commerce Act
Records on consumer complaints or dispute resolution	3 years	E-Commerce Act
Website visit (sign-in) records	3 months	Protection of Communications Secrets Act

Article 2 Processing of Customer Data

1. The Company processes Customer Data only to provide the Service, maintain security, and comply with law, and does not use it for any other purpose or provide it to third parties.
2. If Customer Data contains personal information (for example, the name and messages of someone who asked an AI coworker a question through a connected channel), the customer is responsible for having a legal basis to collect it and for telling the data subject that an AI is responding.
3. When a customer deletes an organization or the agreement ends, the Company gives the customer 30 days to export (download) Customer Data and then destroys it. Copies remaining in backups are deleted according to the backup cycle (up to 30 days).
4. At the request of business customers, we enter into a data processing agreement (DPA).

Article 3 AI Coworkers

1. AI coworkers are agents that run on generative AI (Anthropic Claude). To do the work a Member assigns, they read task instructions, related materials, and messages in connected channels, and produce results.
2. When an AI coworker works, its inputs and outputs are sent to the AI provider. The Company stores run records and outputs as console records until the Member deletes them or the organization is deleted.
3. The Company does not use Customer Data or AI coworker inputs and outputs to train AI models. The Company uses its AI account only under commercial (API) terms under which the provider does not train on inputs.
4. If a Member runs a worker on their own computer with their own AI account, processing by the AI provider is governed by the terms between the Member and that provider and the Member's account settings, and the Company is not involved in that transfer.
5. If AI output is inappropriate or incorrect, please let us know at support@golem.so. We will review it, take action, and reply with the result.
6. Please do not assign AI coworkers work involving sensitive information such as resident registration numbers or health information.

Article 4 Entrustment of personal information processing

Processor	Entrusted task
Google LLC	Google account sign-in (authentication)
HyperReality Co., Ltd. (self-operated cloud "zerocloud")	Service servers, databases, file storage, and workers operated by the Company
Anthropic PBC	Running AI coworkers, when workers operated by the Company are used
Discord Inc.	Delivering operational alerts (internal alerts to operators: masked email, organization and AI coworker names, error summaries)
Payple Co., Ltd.	Processing payments in Korea
Google LLC	Website and Service usage analytics (Google Analytics)
Amplitude, Inc.	Service usage analytics (event and referral aggregation)
Microsoft Corporation	Usage behavior analytics (Microsoft Clarity: heatmaps and session recordings)

Overseas payments are processed directly by Paddle.com as the Merchant of Record, so they are a provision to a third party under Article 6, not an entrustment.

Transfers to external services that users connect themselves (Discord servers, KakaoTalk Channels, external tools registered by the Member, and AI accounts used by a worker on the Member's computer) are made at the user's direction, not entrusted by the Company. Their processing is governed by the terms between the user and that service.

If our processors change, we will amend and announce this Privacy Policy.

Article 5 Overseas transfer of personal information

To provide the Service (perform the contract), the Company entrusts the storage and processing of personal information overseas as follows (Art. 28-8(1)(3)). Transfers occur over the network when you use the Service.

Recipient (contact)	Country	Items	Purpose	Retention	How to refuse and effect
Google LLC (privacy.google.com)	United States	Email, name, profile image	Google sign-in	Until account deletion	To refuse, do not sign up. Google is currently the only sign-in method, so you cannot use the Service if you refuse
Anthropic PBC (privacy@anthropic.com)	United States	AI coworker inputs (task instructions, related materials, channel messages) and outputs	Running AI coworkers (when workers operated by the Company are used)	Deleted after up to 30 days under the provider's policy; not used for training	This transfer does not occur if you run AI coworkers on a worker on your own computer with your own AI account
Discord Inc. (discord.com/privacy)	United States	Masked email, organization and AI coworker names, error summaries	Internal alerts to operators	1 year	These internal alerts are necessary to operate the Service and cannot be refused separately. If you do not want this, stop using the Service or contact support@golem.so
Google LLC (privacy.google.com)	United States	Cookie identifiers, member ID (when signed in), pages visited, usage behavior, device and browser information, approximate location	Usage analytics (Google Analytics)	14 months from collection	You can refuse using the methods in Article 8; refusing does not affect your use of the Service
Amplitude, Inc. (privacy@amplitude.com)	United States	Device identifiers, member ID, usage behavior, referral source, device and browser information	Usage analytics	14 months from collection, then deleted without delay	Same as above
Microsoft Corporation (aka.ms/privacyresponse)	United States	Screen interaction records (session recordings and heatmaps, excluding input), cookie identifiers, member ID, device and browser information	Usage behavior analytics (Microsoft Clarity)	30 days after recording (some samples up to 9 months)	Same as above

Transfers to analytics tools occur over the network each time you view the Service. Records of your first AI coworker hire and of sales inquiries are also sent to Amplitude, and records of your first AI coworker hire to Google Analytics (GA4), from the Company's servers.

Article 6 Provision of personal information to third parties

The Company does not provide personal information to third parties except with the data subject's consent or where specifically permitted by law.

Recipient	Country	Items	Purpose	Retention
Paddle.com Market Limited (paddle.com/legal/privacy)	United Kingdom	Email, country, plan purchased, payment details (received directly by Paddle)	Processing payments, taxes, and refunds as the Merchant of Record for overseas payments	According to Paddle's privacy policy

When you pay from overseas, we ask for your consent to this provision on the checkout screen. If you do not consent, you can use domestic payment.

Article 7 Destruction of personal information

1. We destroy personal information without delay once the retention period ends or the purpose is achieved.
2. Electronic files are deleted in a way that cannot be recovered, and paper documents are shredded or incinerated.
3. After account deletion, we keep the information for 30 days so the account can be restored if deleted by mistake, and then destroy it. Records required by law are stored separately for the periods in Article 1.

Article 8 Cookies and other automatic collection tools

1. The Service uses essential cookies (or browser storage) to keep you signed in.
2. On the landing site (golem.so) and the console, the following tools set cookies (or browser storage) for usage analytics. The Company views this information only as statistics that do not identify individuals and to improve the Service.

Tool (vendor)	Example cookies	Purpose
Google Analytics (Google LLC)	_ga, _ga_<property>	Visit and page statistics
Amplitude (Amplitude, Inc.)	AMP_…, AMP_MKTG_…	Device identifier and session, referral source
Microsoft Clarity (Microsoft Corporation)	_clck, _clsk (Company domain), MUID etc. (Microsoft domains)	Session recordings and heatmaps, browser identification across Microsoft sites
Company (browser storage)	golem:first-touch	Records the first referral source (ad or search source, first landing page). Cleared when you sign out

3. We partner with Microsoft Clarity to capture how you use and interact with our website through behavioral metrics, heatmaps, and session replay to improve the Service. Website usage data is captured using first and third-party cookies and other tracking technologies, and Microsoft may also use this information to provide Microsoft services, including Microsoft Advertising. For more information about how Microsoft collects and uses your data, see the Microsoft Privacy Statement (privacy.microsoft.com/privacystatement).

4. How to refuse: refusing analytics cookies does not affect your use of the Service. If you refuse essential cookies, you will not stay signed in.

   • Browser settings: Chrome Settings → Privacy and security → Third-party cookies / Safari Settings → Privacy / Edge Settings → Cookies and site permissions
   • Google Analytics: the Google Analytics Opt-out Browser Add-on (tools.google.com/dlpage/gaoptout)
   • Microsoft Clarity: choose Microsoft at optout.aboutads.info, or turn on Global Privacy Control (GPC) in your browser

Article 9 Children under 14

The Service does not accept sign-ups from children under the age of 14. If we find that a user is under 14, we delete the account without delay.

Article 10 Rights of data subjects and how to exercise them

1. Data subjects may at any time request access to, correction or deletion of, suspension of processing of, or transfer of their personal information, or withdraw consent.
2. For requests to access, correct, or delete, and for account deletion, email support@golem.so and we will process the request within 10 days.
3. You may also exercise these rights through an agent (a legal representative or an authorized person), who must submit a power of attorney.
4. You cannot request deletion of information that other laws require us to retain.

Article 11 Automated decisions

The Company does not make decisions that significantly affect data subjects' rights or obligations in a fully automated way. When an account is restricted through fraud detection, a person reviews it.

Article 12 Security measures

• Administrative: an internal management plan, minimizing who has access, regular reviews
• Technical: access control, encryption in transit (HTTPS), encrypted storage of external integration credentials, worker tokens authenticated by hash only, masking of email addresses in operational alerts, masking of input and content areas in session recordings, retention of access logs
• Physical: access control for servers and data storage locations

Article 13 Privacy Officer

• Privacy Officer: Juyoung Kang (CEO)
• Email: support@golem.so
• Phone: +82 507-0178-7546

Article 14 Remedies for infringement

If you need counseling or dispute resolution regarding infringement of personal information, you may contact the following agencies (services are provided in Korean).

• Personal Information Infringement Report Center (Korea Internet & Security Agency): privacy.kisa.or.kr / 118 (in Korea)
• Personal Information Dispute Mediation Committee: www.kopico.go.kr / 1833-6972
• Supreme Prosecutors' Office Cyber Investigation Division: www.spo.go.kr / 1301 (in Korea)
• Korean National Police Agency Cyber Bureau: ecrm.police.go.kr / 182 (in Korea)

Article 15 Changes to this Privacy Policy

1. This Privacy Policy takes effect on 2026-10-25.
2. If it changes, we announce the change on the Service 7 days before it takes effect. For changes important to data subjects' rights, such as adding collected items or providing data to third parties, we announce them 30 days in advance and obtain consent again where necessary.
3. To obtain a previous version of this Privacy Policy, email support@golem.so.

Addendum

1. This Privacy Policy takes effect on 2026-10-25.
2. Revision history
   • 2026-10-25: Updated collected items (Article 1), entrustment (Article 4), overseas transfers (Article 5), and cookies (Article 8) for the introduction of usage analytics tools (Google Analytics, Amplitude, Microsoft Clarity). Aligned the items collected by the sales inquiry form with actual practice.
   • 2026-10-13: Established