Policy
Privacy Policy
Last revised · 2026-10-09 / Effective · 2026-10-16
This English translation is provided for convenience only. If there is any discrepancy between this translation and the Korean original, the Korean original prevails.
widecore Corp.(the “Company”) provides the Autopli service and, in accordance with the Personal Information Protection Act and other applicable laws and regulations, publishes this Privacy Policy in order to protect the personal information of users and to handle related complaints promptly.
1. Personal Information Processed and Methods of Collection
- Sign-up and login (required): name, email address, profile image, Google account identifier
- When using a paid subscription (required): subscription status; payment history (order number, amount, date and time of payment, receipt information); the billing key for recurring payments issued by the payment service provider; and card display information (card issuer and partially masked number). The Company does not store full card numbers.
- Automatically generated while using the service: service usage records, access logs, device and browser information, app startup error records (installation identifier, OS and app version, error details), and help chatbot usage records (model used, token usage)
- Product usage analytics: member identifier, fixed screen identifier, web or desktop designation, visit start time and last collection time, active status, and estimated active time. IP addresses, user agents, search terms, URL query strings, project or file identifiers, and click content are not included.
- When connecting YouTube (optional): identifying information of the connected account and channel, YouTube API data within the scope approved by the member, and OAuth tokens
- When using AI features (optional): request content entered by the member, such as manuscripts and metadata, and information on the selected AI provider
- When consenting to receive marketing communications (optional): whether consent was given and the date and time of consent
Personal information is collected when members enter it directly on the sign-up or settings pages, when members approve Google login and the YouTube connection, from the payment service provider during the payment process, and automatically during use of the service. The Company does not collect sensitive information or unique identification information such as resident registration numbers.
2. Purposes of Processing Personal Information
The Company processes personal information for the following purposes: member identification and authentication; provision of the service and integration with the desktop app; handling of subscriptions, payments, and refunds; responding to customer inquiries and resolving disputes; understanding usage by screen and improving service performance; responding to errors; preventing fraudulent use; and, where the member has consented, providing information on benefits and news. Product usage analytics information may be viewed only by authorized administrators.
3. Processing and Retention Periods
The Company destroys personal information without delay once the purpose of processing has been achieved. The retention period for each item is as follows.
| Item | Retention period |
|---|---|
| Member information | Until the member withdraws |
| YouTube connection information and OAuth tokens | Until the connection is revoked or the member withdraws (deleted within 7 days of the request) |
| Billing key for recurring payments and card display information | Until the card is changed, the subscription ends, or the member withdraws |
| Product usage analytics records | 180 days from the date of collection |
| Help chatbot usage records | 180 days from the date of collection |
| App startup error records | 90 days from the date of collection |
| Records on contracts or withdrawal of subscription, etc. | 5 years (Act on the Consumer Protection in Electronic Commerce) |
| Records on payment and supply of goods, etc. | 5 years (Act on the Consumer Protection in Electronic Commerce) |
| Records on consumer complaints or dispute resolution | 3 years (Act on the Consumer Protection in Electronic Commerce) |
| Records on labeling and advertising | 6 months (Act on the Consumer Protection in Electronic Commerce) |
| Service access records | 3 months (Protection of Communications Secrets Act) |
Records retained under applicable laws are stored separately from other personal information and are not used for any purpose other than the relevant statutory purpose.
4. Provision of Personal Information to Third Parties
The Company processes members’ personal information only within the scope of the purposes set out in Section 2, and does not provide it to any third party except where the member has consented or where otherwise specifically provided by law.
When a member connects and uses external services directly through the desktop app, such as Suno, sunoapi.org, kie.ai, and DistroKid, information is transmitted directly from the member’s PC to the relevant service at the member’s request. The API keys and login sessions of those external services are stored only on the member’s PC and are not stored on the Company’s servers. The processing of such information is governed by the privacy policy of each service.
5. Entrusted Processing of Personal Information
The Company entrusts the processing of personal information as follows in order to provide the service, and supervises the processors through entrustment agreements and other measures to ensure that they handle personal information securely.
| Processor | Entrusted tasks |
|---|---|
| Supabase Inc. | Operation of the member database, authentication, and server functions (storage location: Seoul region, Republic of Korea) |
| Vercel Inc. | Website hosting (Seoul region; static files are served through a global CDN) |
| Toss Payments Co., Ltd. | Payment processing and recurring payment management |
| Google LLC | Google login authentication, YouTube API integration, AI features and help chatbot (Gemini), and website visit analytics (Google Analytics) |
| OpenAI, L.L.C. | AI features and help chatbot |
| Anthropic, PBC | AI features and help chatbot |
6. Overseas Transfer of Personal Information
In order to perform the service contract, the Company entrusts the processing of personal information outside Korea as follows (Article 28-8(1)(iii) of the Personal Information Protection Act). The transfer takes place over an encrypted network when the member uses the relevant feature.
| Recipient (country) | Items transferred | Purpose | Retention period | Contact |
|---|---|---|---|---|
| Google LLC (United States) | Google account identifier and email, YouTube connection information, AI request content (manuscripts, metadata, help chatbot questions, etc.), and visit analytics information (cookie identifiers, etc.) | Login, YouTube integration, AI features, and visit analytics | Until the entrusted purpose is achieved or the relevant processing period expires | policies.google.com/privacy |
| OpenAI, L.L.C. (United States) | AI request content (manuscripts, metadata, help chatbot questions, etc.) | Provision of AI features and help chatbot | For the period set by the provider’s policy after the request is processed | openai.com/policies/privacy-policy |
| Anthropic, PBC (United States) | AI request content (manuscripts, metadata, help chatbot questions, etc.) | Provision of AI features and help chatbot | For the period set by the provider’s policy after the request is processed | anthropic.com/legal/privacy |
Members may refuse such overseas transfer by not using the AI features and the YouTube integration, in which case those features will not be available. Google login is required for sign-up, so if a member refuses it, the member cannot use the service.
7. Procedures and Methods for Destroying Personal Information
Personal information whose retention period has expired or whose purpose of processing has been achieved is destroyed without delay. Electronic files are deleted by a method that makes recovery impossible, and paper documents are shredded or incinerated. Records retained under applicable laws are stored separately and destroyed when the retention period ends. YouTube connection information and OAuth tokens can also be deleted separately in the app settings; detailed procedures are described in Section 12.
8. Rights of Data Subjects and How to Exercise Them
Members may at any time request access to, correction of, deletion of, or suspension of the processing of their personal information, and may withdraw their consent. Members may do so directly on the My Account page or by sending a request to contact@autopli.ai, and the Company will take action without delay after verifying the member’s identity. A request may be restricted where retention is required by law or where it may infringe the rights of another person; in that case, the Company will inform the member of the reason. Rights may also be exercised through a legal representative or an authorized agent.
9. Installation, Operation, and Refusal of Automatic Collection Tools (Cookies, etc.)
The Company uses cookies and browser storage to keep members logged in and to maintain security, and may use Google Analytics cookies to analyze website visits. The Company does not use cookies for advertising purposes. Members may refuse or delete cookies in their browser settings, and may opt out of visit analytics by using the Google Analytics opt-out browser add-on. If a member refuses login cookies, the member cannot use features that require login.
10. Measures to Ensure the Security of Personal Information
The Company takes administrative and technical protective measures, including managing and minimizing access rights to personal information, encrypting data in transit, storing OAuth tokens and service keys in encrypted form, and retaining and reviewing access records.
11. Personal Information Protection Officer and Remedies for Infringement of Rights
- Personal information protection officer: Personal Information Protection Team · contact@autopli.ai
If you need to report or seek consultation on an infringement of personal information, you may contact the following organizations.
- Personal Information Dispute Mediation Committee: 1833-6972 (www.kopico.go.kr)
- Personal Information Infringement Report Center: 118 (privacy.kisa.or.kr)
- Supreme Prosecutors’ Office Cyber Investigation Division: 1301 (www.spo.go.kr)
- National Police Agency Cyber Bureau: 182 (ecrm.police.go.kr)
The Company does not accept sign-ups from children under the age of 14, and confirms at sign-up that the user is 14 years of age or older.
12. Use of YouTube API Services and Data Deletion
The service uses YouTube API Services. Where a user has approved the YouTube connection, the Company uses data within the approved scope solely for the purpose of providing the functions of viewing, uploading, editing, and deleting for the relevant account and channel. The use of information received through YouTube API Services, and its transfer to other apps, complies with the Google API Services User Data Policy, including the Limited Use requirements. Users are deemed to have agreed to the YouTube Terms of Service and the Google Privacy Policy.
How to delete data and revoke the connection
- In the desktop app, you can delete the connected account and channel or the authentication token under Settings > YouTube account & channel management.
- You can revoke Autopli’s access at any time under your Google Account’s third-party apps and services access settings.
- If you are unable to use the app, you can request deletion by contacting contact@autopli.ai (identity verification required).
Data to be deleted and processing period
Upon a deletion request or revocation of access, the Company deletes the metadata of the connected YouTube account and channel, OAuth tokens, data received and stored through the YouTube API, and the credential information stored for that connection. The Company will process the request without delay after verifying your identity and will complete it within 7 days of the request. Transaction records that the Company is legally required to retain are stored separately for the applicable period. Data stored by YouTube and Google is managed in accordance with the policies of those services.
13. Changes to This Privacy Policy
This Privacy Policy applies from October 16, 2026 (notice date: October 9, 2026). If any content is added, deleted, or amended, the Company will give notice through the service screens from 7 days before the effective date, and will give notice from 30 days before the effective date for changes that materially affect members’ rights. Main changes: specification of processors and overseas transfers, addition of the table of retention periods by item, cookie operation, and the personal information protection officer and remedies for infringement of rights.