YouViCo Privacy Policy

This document is an English translation of the Korean-language YouViCo Privacy Policy, provided for convenience. If this translation differs from the Korean version, the Korean version governs.

Effective date: September 17, 2026

ELBA America, Inc. ("we", "us" or the "Company") operates YouViCo. This policy explains what information we collect and how we use it. It also explains how information is shared, stored and deleted, and the rights you have. The appendices at the end list data categories, retention periods and service providers in detail.

Scope

This policy applies to personal information we process in connection with the YouViCo service. It covers you when you create an account or upload content, and also when you receive a collaboration invitation or contact us.

Business content managed in an organization's workspace is processed under our agreement with that organization and the permission settings in the service. The organization manages its members' access and the sharing scope of its content. For questions about how an organization manages its content, contact that organization's administrator.

Third-party services are governed by their own privacy policies. Processing that we entrust to service providers is described in this policy.

Information we collect

We collect information you enter when you sign up or use the service. This includes account information such as your email address and name, content you upload, and AI generation requests and attachments. When you make a payment or contact us, we collect the information needed for that purpose.

Using the service also generates access, usage and error records and device and browser information. For example, we record page visits and errors that occur while you use a feature. To diagnose some errors and improve usability, we may record the screen and your interactions during use.

If you connect an external account, we receive from that service the information needed to provide the connected feature. If another user invites you to collaborate, we may receive your email address from that user. Appendix A lists the data categories in detail.

How we use information

We use account information to identify you and verify your access to the service. We use the content you upload to provide the features you request, such as storage, sharing and conversion. In AI features, we use your input and attachments to generate the result you request.

We use payment and transaction information to provide paid services, manage subscriptions, and confirm and settle payments. We use contact details and notification settings for authentication, collaboration notifications and service announcements. When you contact us, we use your message and contact details to respond and resolve the issue.

We use access, usage and error records to keep the service stable and secure, for example to detect abnormal access or investigate the cause of an error. We use feature-usage data and survey responses to improve usability.

Sharing within collaboration

Workspace and project participants can see content and author information according to the permissions they have been granted. Content you add to a collaborative space follows that space's sharing scope. For example, files and comments in a project are visible to participants with viewing permission.

Organization administrators and users with sharing permission manage participants and the visibility of content within their permissions. Changing the sharing scope changes who can access the content. Content that someone has already downloaded may remain on that person's device even after sharing is turned off.

Deleting your account and deleting shared content are separate. Content shared with other participants follows the deletion rules of the project or workspace it belongs to. You may ask us to exercise your rights regarding your personal information contained in such content.

AI features

To provide the AI features you choose, we send your input and the necessary attachments to AI providers. If an attachment contains personal information, that information is processed as well. We use providers we consider trustworthy with respect to privacy and security.

We do not use your input, attachments or generated results to train models. Generated results saved in the service follow the same project access and deletion rules as other collaborative content. Retention periods for the Company and for AI providers are listed in Appendices A and C respectively.

You can choose whether to use AI features. If a generated result contains personal information inappropriately, you may ask us to delete it or take other action.

Service providers and international transfers

We entrust parts of service operation, content storage, AI generation, payments, notifications and usage analytics to service providers. We share with them the personal information needed for that work. We are located in the United States, and our primary servers are in South Korea. Our providers process personal information in the United States and the other countries listed in Appendix C.

When you connect an external service yourself, we send it the information needed for the connected feature. For example, if you set up notifications in an external collaboration tool, we send notification content to that tool. You can disconnect it in your integration settings.

Appendix C lists each provider's legal entity, processing country, data transferred, retention period and contact. Processing for optional features occurs only when you use those features.

We do not sell personal information. We share it with service providers only to perform work for us, and we disclose it to others only in response to a lawful request under applicable law.

Retention and deletion

We keep personal information for as long as needed to provide the service. When the retention period ends or the purpose is fulfilled, we delete it without undue delay. Records we must keep under applicable law, such as transaction records, are kept separately for the required period.

When you delete your account, we delete or change your account, authentication and integration information. Shared content follows its own deletion rules, separate from account deletion. Content scheduled for deletion has a 7-day waiting period.

Retention periods by data category are listed in Appendices A and C. Legally required retention periods and deletion methods are described in Appendix B.

Cookies and usage analytics

We use cookies and similar technologies to keep you signed in and to analyze usage. A cookie is a small piece of information that a website stores in your browser. We use it to maintain your session and to understand how the service is visited and used.

We use third-party analytics and diagnostic tools to improve the service and resolve issues. These tools collect information about feature usage and errors. Some tools record the screen and your interactions during use. Appendix D describes each tool's collection method and protection settings.

You can block collection with your browser's tracking protection or cookie settings. Blocking essential cookies may limit sign-in or file access. We do not currently respond to "Do Not Track" browser signals.

Your choices and rights

You can view and edit your information in your account settings. You can manage content according to your permissions. You can disconnect external services in your integration settings, and turn off app notifications in your device settings.

Processing that is essential to operating the service may not be stopped individually. If you do not want such processing, you may stop using the service or request account deletion. You can stop using optional AI features at any time.

You may request access to, correction or deletion of, or restriction of processing of your personal information, and you may withdraw consent. Where applicable law provides a right to data portability, you may exercise it as well. A legal guardian or an authorized agent may also make requests on your behalf.

Requests that cannot be handled in the service settings can be submitted to the privacy contact below. We may verify your identity or the agent's authority as needed. We respond within the time required by applicable law. If we must limit a request for a legal reason, we explain the reason and how to object.

Security

We apply safeguards such as password protection, encryption of stored data and secure connections. We manage access permissions to the service. We use access logs for security review and troubleshooting. You can enable two-factor authentication to further protect your account.

We do not allow individuals under 16 to create an account. We verify the age requirement at sign-up. Appendix E describes our safeguards and policies in more detail.

Contact and complaints

You can send questions about privacy and requests to exercise your rights to the contact below. You can also contact us if you suspect exposure of personal information or unauthorized use of your account.

You may also lodge a complaint with the data protection authority in your jurisdiction.

Region-specific information

Language. This policy is published in Korean and English. If the two versions differ, the Korean version governs.

Users in the Republic of Korea. Records listed in Appendix B are retained under the Act on the Consumer Protection in Electronic Commerce. Contract, cancellation, payment and service delivery records are kept for 5 years, complaint and dispute records for 3 years, and advertising records for 6 months. We transfer personal information overseas as described in Appendix C because it is necessary to perform our contract with you, under Article 28-8(1)(3) of the Personal Information Protection Act. You may also contact the Personal Information Infringement Report Center (privacy.kisa.or.kr, 118) or the Personal Information Dispute Mediation Committee (www.kopico.go.kr, 1833-6972).

Users in California. You have the right to know what personal information we collect and how we use and disclose it, to request deletion or correction, and not to be discriminated against for exercising these rights. We do not sell or share personal information as those terms are defined in California law. You can exercise these rights through the contact above.

Changes to this policy

We may update this policy when our processing practices or applicable laws change. When we do, we publish the changes and their effective date. We provide separate notice of changes that materially affect your rights.

Appendix: Processing details

A. Data we collect and use

We process the personal information needed for sign-up and for the services you request in order to perform our contract with you. We process usage analytics and error diagnostics on the basis of our legitimate interest in improving the service and keeping it stable. Information for optional features is processed when you use those features. Legally required retention periods are listed in Appendix B.

Payment methods and billing details are entered directly into the payment service.

B. Legal retention and deletion

We keep the following records for the periods required by applicable law, separately from other data.

We delete data according to the retention periods in Appendix A. Account deletion and shared-content deletion are handled separately. Electronic files are permanently deleted in a way that prevents recovery. Paper documents are shredded or incinerated.

Backup copies of deleted data are removed within 7 days of deletion.

C. Service providers and international transfers

We send data to providers over the network when you use the related feature. Global means data may be processed anywhere in the world depending on your access location.

Processing essential to operating the service, such as storage, transmission, authentication and transaction notices, cannot be stopped individually. If you do not want such processing, you may stop using the service or request account deletion.

You can stop using optional AI features. You can disconnect Slack in your integration settings. Appendix D describes your choices regarding analytics and diagnostics.

D. Analytics and your choices

Data collected and retention periods are listed in Appendix C.

E. Safeguards and policies