Privacy Policy
Klipse Privacy Policy
SfacSpace Co., Ltd. (hereinafter "Company") complies with the Personal Information Protection Act, the Act on Promotion of Information and Communications Network Utilization and Information Protection, and other applicable laws and regulations in operating the Klipse service (hereinafter "Service"), and makes every effort to protect users' personal information.
This policy describes how the Company processes personal information through the Klipse service (including generation and editing of videos, images, voice, and music using external AI models, YouTube and Instagram upload and insight analysis, payment services, and all related features).
Article 1 (Purpose of Processing Personal Information)
The Company processes personal information for the following purposes. Personal information processed shall not be used for any purpose other than those listed below. If the purpose changes, the Company will take necessary measures such as obtaining separate consent pursuant to Article 18 of the Personal Information Protection Act.
- Membership Registration and Management: Member identification, provision of membership-based services, prevention of unauthorized use
- AI Content Generation Service: Generation of videos, images, voice, and music using external AI models, and editing features such as highlight extraction, based on prompts entered and files uploaded by users
- YouTube Integration Service: YouTube account linking via OAuth 2.0 authentication, upload/edit/deletion of videos, and collection and provision of channel insights (views, subscribers, impressions, etc.)
- Instagram Integration Service: Instagram professional account linking via Instagram Business Login, Reels posting, and collection and provision of account insights (reach, views, likes, comments, shares, saves, etc.)
- Payment and Settlement: Billing for paid services, payment processing, and handling of order withdrawals and refunds
- Customer Support: Handling inquiries, complaints, and delivery of notices
- Ambassador Application Review: Reviewing applicants to the Ambassador Program, notifying selection results, and checking for duplicate or fraudulent applications
- Service Improvement and Statistics: Analysis of service usage, measurement of advertising acquisition performance, identification and correction of errors, and development of new features
Article 2 (Categories of Personal Information Processed)
① Collection Items
| Category | Items Collected | Collection Method | Required |
|---|---|---|---|
| Membership Registration | Email address, password (one-way encrypted), nickname | Direct input upon registration | Required |
| Sign-up Survey | Survey responses such as job role, purpose of use, and how the user heard about the Service | Survey after registration | Optional |
| Acquisition Information | Advertising and campaign tags (UTM, etc.), ad click identifiers (gclid, etc.), referring site address, first page visited | Automatically collected upon registration | Required |
| YouTube Integration | YouTube channel ID, channel name, channel handle, channel thumbnail, refresh token | YouTube Data API v3 | Required (upon integration) |
| Instagram Integration | Instagram user ID, username, profile picture URL, access token | Instagram Business Login API | Required (upon integration) |
| AI Content Generation | Input prompts, uploaded image, video, and audio files, generated output | Input during service use | Required (upon use) |
| Payment Information | Card issuer name, masked card number, payment method identification key (encrypted), payment and purchase history | Integration with PG (Toss Payments) | Required (upon payment) |
| Order Withdrawal | Target payment, reason for withdrawal, processing result | Order withdrawal request within the Service | Required (upon request) |
| Customer Support | Email, inquiry content, attached images | 1:1 inquiry submission | Required (upon inquiry) |
| Coupons | Coupon code entered, time and result of redemption attempt, access IP | Automatically collected upon coupon use | Required (upon use) |
| Ambassador Application | Name or handle, contact email, main channel and link, follower or subscriber count, cross-posting channels, preferred collaboration type, content field and formats, links to representative work, AI production tools used, pieces per month, content the applicant wants to make, reason for applying, time of consent, and account identifier | Ambassador application submission | Required (upon application) |
| Service Usage Records | Screen and feature usage records, session identifier, device type, access IP, browser info, cookies, error logs | Automatically collected | Required |
② Detailed YouTube Data Collection Items
Upon YouTube channel integration, the following data is collected via YouTube Data API v3 and the YouTube Analytics API:
- Channel Information: Channel ID, channel name, channel handle, subscriber count, channel icon
- Video Insights: Views, likes, comments, impressions, click-through rate (CTR), average view duration
- Upload Metadata: Title, description, tags, thumbnail URL, visibility status
- Analytics Data: Traffic sources, viewer geography, age and gender distribution (aggregated data per YouTube standards)
⚠️ Important: Authentication information such as YouTube account passwords is not collected. Only tokens issued in accordance with the OAuth 2.0 standard are processed.
③ Detailed Instagram Data Collection Items
Upon Instagram Business Login integration, the following data is collected via the Instagram Graph API:
- Account Information: Instagram user ID, username, profile picture URL, account type (Business/Creator)
- Media Insights: Views, reach, likes, comments, shares, saves, total interactions
- Account Insights: Follower count, follower demographics (age, gender, city, country), impressions, reach, profile views
- Post Metadata: Caption, media type, permalink, thumbnail URL, post timestamp
⚠️ Important: Authentication information such as Instagram account passwords is not collected. Only access tokens issued in accordance with Instagram Business Login (OAuth 2.0 based) are processed.
④ Automatically Collected Information
- Screen and feature usage records, session identifiers, and device types are generated and collected during use of the Service.
- When an error occurs, the error log is sent to the error tracking service (Sentry), together with the access IP, browser information, and account identifier and email, to identify the cause. Some usage screens may be recorded to reproduce errors; in that case, on-screen text and input values are recorded in masked form.
- Google Analytics uses cookies for usage statistics. Cookies may be refused as described in Article 10.
Article 3 (Retention and Processing Period of Personal Information)
The Company processes and retains personal information within the retention and use period stipulated by applicable laws or as agreed upon at the time of collection. Personal information whose period has expired is destroyed by a scheduled job that runs daily.
| Purpose | Items Retained | Retention Period |
|---|---|---|
| Member Management | Email, nickname, registration date, survey responses, acquisition information | Destroyed 30 days after membership withdrawal (account recovery grace period) |
| YouTube Integration | Refresh token, channel ID, channel name, channel handle, channel thumbnail | Immediately deleted upon revocation of integration |
| YouTube Upload History | Upload timestamp, video title, description, tags, visibility, URL, video ID, ID and name of the channel uploaded to | Until withdrawal (retained even after revocation for history management upon re-integration) |
| Instagram Integration | Access token, username, profile picture URL | Immediately deleted upon revocation of integration |
| Instagram Integration Identifier | Instagram user ID | Until withdrawal (retained to process data deletion requests from Meta) |
| Instagram Post History | Post timestamp, caption, media ID, permalink | Until withdrawal |
| AI-Generated and Uploaded Content | Prompts, uploaded files, generated output | Until deleted by the user or until withdrawal |
| Service Usage Records | Screen and feature usage records, session identifier, device type | Until withdrawal (after withdrawal, retained in a form that cannot identify the individual, with the link to the account removed) |
| Coupon Usage Records | Coupon code, time and result of redemption attempt, access IP | Until withdrawal |
| Payment, Contract, and Order Withdrawal Records | Payment, order, and subscription history, payment method information, order withdrawal history, purchaser email | 5 years (Article 6 of the Act on the Consumer Protection in Electronic Commerce). After withdrawal, stored separately from other personal information |
| Customer Inquiry Records | Email, inquiry content, attached images, resolution result | 3 years (Article 6 of the Act on the Consumer Protection in Electronic Commerce, records of consumer complaints and dispute resolution) |
| Ambassador Applications | All application items | Deleted 30 days after the selection result is decided (an application with no decision is deleted 3 months after receipt) |
Article 4 (Provision of Personal Information to Third Parties)
In principle, the Company does not provide users' personal information to third parties. However, exceptions apply in the following cases:
- When the user has given prior consent
- When required by law or upon request from investigative agencies following legally prescribed procedures and methods for investigative purposes
To provide features directly requested by the user, personal information is provided as follows:
| Recipient | Purpose | Items Provided | Retention Period |
|---|---|---|---|
| Google LLC (YouTube) | YouTube video upload, editing, deletion, and insight retrieval requested by the user | Access token, uploaded video and metadata | In accordance with each company's privacy policy |
| Meta Platforms, Inc. (Instagram) | Instagram Reels posting and insight retrieval requested by the user | Access token, posted video and caption | In accordance with each company's privacy policy |
Article 5 (Entrustment of Personal Information Processing)
The Company entrusts personal information processing as follows to provide the Service:
| Trustee | Entrusted Tasks | Retention Period |
|---|---|---|
| Amazon Web Services, Inc. | Server infrastructure operation, file storage and transfer (Seoul region, Republic of Korea) | Until termination of the entrustment contract or membership withdrawal |
| Supabase, Inc. | Database and member authentication operation (Seoul region, Republic of Korea) | Until termination of the entrustment contract or membership withdrawal |
| Toss Payments Co., Ltd. | Online payment processing | Retention period under the Act on the Consumer Protection in Electronic Commerce |
| Resend, Inc. | Email delivery (sign-up verification, password reset, inquiry and order withdrawal receipt notifications) | For the duration of delivery processing |
| Functional Software, Inc. (Sentry) | Error tracking and root cause analysis | In accordance with the trustee's retention policy |
| Google LLC | Usage statistics analysis (Google Analytics), AI video, image, and voice generation and prompt assistance, caption generation, YouTube video analysis (Vertex AI, Gemini) | Until the entrusted task is completed |
| OpenAI, L.L.C. | AI image generation | Until the entrusted task is completed |
| Features & Labels, Inc. (fal) | AI image editing | Until the entrusted task is completed |
| Kling AI Pte. Ltd. | AI video generation | Until the entrusted task is completed |
| Nanonoble Pte. Ltd. (MiniMax) | AI video generation | Until the entrusted task is completed |
| Alibaba Cloud | AI video generation | Until the entrusted task is completed |
| BytePlus | AI video generation | Until the entrusted task is completed |
| ElevenLabs, Inc. | AI background music and sound effect generation | Until the entrusted task is completed |
The trustee that processes an AI generation request depends on the feature and model the user selects, and only the prompts and files required for each request are passed to that trustee.
When entering into entrustment agreements, the Company specifies in contracts and other documents matters such as prohibition of processing personal information beyond the entrusted purpose, technical and administrative protective measures, restrictions on re-entrustment, management and supervision of trustees, and liability for damages, pursuant to Article 26 of the Personal Information Protection Act, and supervises whether trustees process personal information safely.
Article 6 (International Transfer of Personal Information)
The Company's servers and database are located in the Republic of Korea (Seoul). However, personal information is transferred abroad to provide the features below. The transfer takes place over an encrypted network (TLS) when the user uses the relevant feature.
| Recipient | Destination Country | Items Transferred | Purpose | Retention Period |
|---|---|---|---|---|
| Google LLC | United States | Prompts, uploaded files, YouTube video URLs, usage statistics (cookies) | AI generation and analysis, usage statistics | Until the entrusted task is completed |
| OpenAI, L.L.C. | United States | Prompts, uploaded images | AI image generation | Until the entrusted task is completed |
| Features & Labels, Inc. (fal) | United States | Uploaded images | AI image editing | Until the entrusted task is completed |
| ElevenLabs, Inc. | United States | Background music and sound effect prompts | AI music and sound effect generation | Until the entrusted task is completed |
| Kling AI Pte. Ltd. | Singapore | Prompts, uploaded images | AI video generation | Until the entrusted task is completed |
| Nanonoble Pte. Ltd. (MiniMax) | United States (storage), China (possible transfer to affiliates) | Prompts, uploaded images | AI video generation | Until the entrusted task is completed |
| Alibaba Cloud | Singapore | Prompts, uploaded images | AI video generation | Until the entrusted task is completed |
| BytePlus | Singapore | Prompts, uploaded images and videos | AI video generation | Until the entrusted task is completed |
| Resend, Inc. | United States | Email address, email body (including the content of inquiries and order withdrawal requests) | Email delivery | For the duration of delivery processing |
| Functional Software, Inc. (Sentry) | United States | Error logs, access IP, browser information, account identifier and email | Error tracking | In accordance with the trustee's retention policy |
| Google LLC (YouTube) | United States | Access token, uploaded video and metadata | YouTube upload and insights requested by the user | In accordance with each company's privacy policy |
| Meta Platforms, Inc. (Instagram) | United States | Access token, posted video and caption | Instagram posting and insights requested by the user | In accordance with each company's privacy policy |
Users may refuse the international transfer. To do so, users may refrain from using the relevant features (AI generation features, YouTube and Instagram integration, etc.) or submit a request by the method in Article 7; in that case, the relevant features cannot be used.
Article 7 (Rights and Obligations of Users and Legal Representatives, and How to Exercise Them)
Users may exercise the following personal information protection rights against the Company at any time:
- Request to access personal information
- Request for correction in case of errors or inaccuracies
- Request for deletion (except where retention is mandated by other laws)
- Request to suspend processing
- Withdrawal of consent (service withdrawal or revocation of YouTube/Instagram integration)
The above rights may be exercised by submitting a request to the email of the Personal Information Protection Department (klipse@sfacspace.com), and the Company will process such requests without delay (within 10 days).
However, requests for access, correction, deletion, or suspension may be refused in the following cases:
- When there is a special provision in law or compliance with legal obligations is unavoidable
- When there is a risk of harming the life or body of another person or unjustly infringing upon the property or other interests of another person
The Company does not accept membership registration from children under the age of 14.
Article 8 (Destruction of Personal Information)
① Destruction Procedure
- Personal information whose retention period has expired or whose processing purpose has been achieved is destroyed without delay by a scheduled job that runs daily.
- When a member withdraws, a 30-day grace period is provided for account recovery, after which the account information and generated and uploaded content are destroyed.
- Information that must be retained under other laws (the payment, contract, and order withdrawal records and customer inquiry records in Article 3) is stored separately from other personal information and destroyed when the retention period expires.
② Destruction Methods
- Electronic Files: Permanently deleted using methods that prevent recovery
- Paper Documents: Shredded or incinerated
Article 9 (Measures to Ensure the Security of Personal Information)
Pursuant to Article 29 of the Personal Information Protection Act, the Company takes the following technical, administrative, and physical measures to ensure security:
① Technical Measures
- Passwords: Stored using one-way hashing (bcrypt)
- Payment Information: Full card numbers are not stored, and the payment method identification key used for recurring billing is encrypted with AES-256-GCM before storage
- Integration Tokens: YouTube refresh tokens and Instagram access tokens are encrypted with AES-256-GCM before storage
- Communication Encryption: TLS applied to all data transmissions
- Access Control: Row-level access control is applied to the database, and sensitive information such as the separately stored copy of payment records is restricted to server-only access
② Administrative Measures
- Designation of a Personal Information Protection Officer
- Division of admin screen permissions by task, granted only to those who need them
③ Physical Measures
- Servers and data are protected in accordance with the physical security policies of AWS data centers
Article 10 (Installation, Operation, and Refusal of Cookies)
The Company uses "cookies" that store and retrieve usage information from time to time to provide the Service to users.
① Purpose of Cookie Use
- Maintaining login sessions and managing authentication status
- Security verification during the YouTube and Instagram integration process
- Saving user preferences (language, etc.)
- Usage statistics analysis (Google Analytics)
② How to Refuse Cookies
Users may choose to allow, selectively allow, or block cookies through their web browser settings.
- Chrome: Settings > Privacy and Security > Cookies and other site data
- Safari: Preferences > Privacy
- Firefox: Preferences > Privacy & Security
Refusing cookie storage may restrict certain service features such as maintaining login status.
Article 11 (Special Terms Regarding YouTube API Services)
Klipse uses YouTube Data API v3 and the YouTube Analytics API to provide YouTube channel integration, video upload/edit/deletion, and analytics features. The Company informs users of the following:
① Application of Google's Privacy Policy
Data collected through YouTube API services is also subject to Google's Privacy Policy.
② Scope and Purpose of YouTube API Data Access
Klipse accesses YouTube account data only within the scope of OAuth 2.0 scopes explicitly consented to by the user.
| OAuth Scope | Data Accessed | Purpose | Recipient |
|---|---|---|---|
youtube.upload | Upload request information (title, description, tags, visibility), upload result URL | Upload videos to the user's YouTube channel | User only |
youtube.readonly | Channel ID, channel name, subscriber count, existing video list | Confirm linked channel and manage upload history | User only |
youtube | Channel information, video metadata (title, description, tags, visibility, etc.) | Modify and delete metadata of uploaded videos | User only |
youtube.force-ssl | Video information, ratings (likes, etc.), comments, captions | View, modify, and delete videos, comments, and captions | User only |
yt-analytics.readonly | Views, impressions, CTR, watch time, subscriber changes, and other channel performance metrics | Provide channel insight dashboard to the user | User only |
③ Scope of Sharing, Transfer, and Disclosure of Google User Data
| Item | Details |
|---|---|
| Recipients | Data collected via the YouTube API is provided only to the owner of the relevant YouTube account (the user). It is not disclosed to other users or the general public. |
| Third-Party Sharing | Google user data is not sold, leased, transferred, or shared with any third party (individuals, corporations, or institutions). |
| External Transfer | Google user data is not transferred externally beyond service operation purposes. However, it may be provided pursuant to legal procedures in response to requests from investigative agencies under applicable laws. |
| Advertising Use | Google user data is not used for advertising or marketing purposes. |
| AI Model Training | Google user data is not used for AI model training. |
④ Data Stored on Company Servers
YouTube-related data stored on the Company's servers is limited to the following:
- Upload History: Upload timestamp, video title, description, tags, visibility, YouTube video URL, video ID, ID and name of the channel uploaded to — retained until membership withdrawal, even after revocation, for history management upon re-integration
- Integration Information: Refresh token (encrypted), channel ID, channel name, channel handle, channel thumbnail — immediately deleted upon revocation of integration
⑤ Compliance with Google API Services User Data Policy
The Company processes information collected through Google APIs in accordance with the Google API Services User Data Policy and complies with Limited Use requirements.
- Google user data is used solely to provide features requested or explicitly approved by the user.
- Google user data is not used to display advertisements or for advertising-related profiling.
- Google user data is not sold or shared with third parties.
- Human access to Google user data is permitted only with the user's explicit consent, for security purposes, or for legal compliance.
⑥ Revoking YouTube Integration
Users may revoke Klipse's access to the YouTube API at any time through the integration management menu within the Service or via Google Account Permissions. When integration is revoked within the Service, the refresh token, channel ID, channel name, channel handle, and channel thumbnail held by the Company are immediately deleted. However, upload history will be retained until membership withdrawal for history management upon re-integration.
⑦ Security of YouTube API Data
- Data collected through the YouTube API is processed in accordance with the YouTube API Terms of Service.
- Collected YouTube data is not disclosed to other users or sold commercially beyond the purpose of managing the user's own channel.
Article 12 (Special Terms Regarding Instagram API Services)
Klipse uses the Instagram Graph API to provide Instagram professional account integration, Reels posting, and insight analysis features.
① Application of Meta's Privacy Policy
Data collected through Instagram API services is also subject to Meta's Privacy Policy.
② Scope and Purpose of Instagram API Data Access
Klipse accesses Instagram account data only within the scope of permissions (scopes) explicitly consented to by the user.
| Permission (Scope) | Data Accessed | Purpose | Recipient |
|---|---|---|---|
instagram_business_basic | User ID, username, profile picture, account type, media list | Confirm linked account and content management | User only |
instagram_business_content_publish | Media container creation and publishing | Post videos as Reels | User only |
instagram_business_manage_insights | Account insights (followers, reach, impressions, etc.), media insights (views, likes, comments, shares, saves) | Provide insight dashboard to the user | User only |
③ Scope of Sharing, Transfer, and Disclosure of Instagram Data
- Data collected via the Instagram API is provided only to the owner of the relevant Instagram account (the user).
- Instagram user data is not sold, leased, transferred, or shared with any third party.
- Instagram user data is not used for advertising or marketing purposes.
- Instagram user data is not used for AI model training.
④ Data Stored on Company Servers
Instagram-related data stored on the Company's servers is limited to the following:
- Post History: Post timestamp, caption, media ID, permalink — retained until membership withdrawal
- Integration Information: Access token (encrypted), username, profile picture URL — immediately deleted upon revocation of integration
- Integration Identifier: Instagram user ID — retained until membership withdrawal to process integration revocation and data deletion requests from Meta
⑤ Revoking Instagram Integration and Data Deletion Requests
Users may revoke integration at any time through the integration management menu within the Service. Upon revocation, the Instagram access token, username, and profile picture URL held by the Company are immediately deleted. If the user requests deletion of Klipse's data from the Instagram (Meta) settings, the Company deletes the corresponding Instagram integration information it holds.
Article 13 (Processing of Personal Information Related to AI-Generated Content)
Klipse generates content by integrating with external AI services via API. The Company informs users of the following in relation to AI generation:
- Prompts entered and files uploaded by users are transmitted to the API servers of the trustees (Articles 5 and 6) that provide the feature and model the user has selected.
- The transmitted data may include personally identifiable information (e.g., facial images, voices); users are advised to exercise caution when entering other people's personal information.
- Each trustee processes such data in accordance with the entrustment contract and its own privacy policy.
- Generated output and uploaded files are retained until the user deletes them or until they are destroyed after membership withdrawal.
Article 14 (Processing of Payment Information)
When using Klipse's paid services, payment information is processed as follows:
- Payment processing is handled by a Payment Gateway (PG) provider (Toss Payments), and the Company does not store full card numbers.
- Payment information retained by the Company is limited to: card issuer name, masked card number, transaction ID, payment amount, payment date and time, and payment method identification key for recurring billing (encrypted).
- Transaction records are retained for 5 years pursuant to the Act on the Consumer Protection in Electronic Commerce to resolve payment-related disputes, and after membership withdrawal they are stored separately from other personal information.
- Order withdrawals can be requested from the payment history within the Service.
Article 15 (Personal Information Protection Officer)
The Company designates a Personal Information Protection Officer to oversee all matters related to personal information processing and to handle user complaints and remedy damages:
Personal Information Protection Officer
| Item | Details |
|---|---|
| Name | Lee Seunghyun |
| Position | CTO |
| teddy@sfacspace.com | |
| Phone | +82 1050597671 |
Personal Information Protection Department
| Item | Details |
|---|---|
| Department | Service Development Team |
| klipse@sfacspace.com | |
| Processing Deadline | Within 10 days of receipt |
Users may contact the Personal Information Protection Officer or the responsible department regarding any personal information protection inquiries, complaints, or requests for damage relief arising from the use of the Company's services.
Article 16 (Request for Access to Personal Information)
Users may submit a request for access to personal information pursuant to Article 35 of the Personal Information Protection Act to the following department:
| Item | Details |
|---|---|
| klipse@sfacspace.com | |
| Processing Deadline | Within 10 days of request |
Users may also report or consult on personal information infringement to the following agencies:
- Personal Information Protection Portal: www.privacy.go.kr / Hotline: 182
- Personal Information Infringement Report Center: privacy.kisa.or.kr / Hotline: 118
- Supreme Prosecutors' Office Cyber Crime Investigation Division: www.spo.go.kr / 02-3480-3573
- National Police Agency Cyber Safety Bureau: www.netan.go.kr / Hotline: 182
Article 17 (Changes to the Privacy Policy)
This Privacy Policy takes effect from the date of enforcement. Any additions, deletions, or corrections due to changes in laws or policies will be announced through the notice board at least 7 days before the effective date of such changes.
However, in the event of significant changes to user rights, prior notice will be given at least 30 days in advance.
| Version | Effective Date | Key Changes |
|---|---|---|
| v1.0 | January 1, 2026 | Initial enactment |
| v1.1 | April 21, 2026 | Added Instagram integration-related provisions |
| v1.2 | October 13, 2026 | Added items, purpose, and retention period for Ambassador applications |
| v1.3 | October 15, 2026 | Updated collection items (sign-up survey, acquisition information, order withdrawal, coupons, usage records) and retention periods, specified the post-withdrawal destruction procedure and separate storage of payment records, updated entrusted and international transfer providers, corrected the scope of deletion upon integration revocation and Instagram permissions, and updated security measures |
Article 18 (Scope of Application)
This policy applies to the Klipse service (website and all API services) operated by SfacSpace Co., Ltd. However, the privacy policies of third-party linked or integrated external services (YouTube, Instagram, Google, Meta, etc.) apply separately to the processing of personal information by those services.
Notice Date: October 15, 2026 | Effective Date: October 15, 2026
SfacSpace Co., Ltd. — Klipse Service