SAI Privacy Policy
DopeAI ("we") operates the SAI service (the "Service"). We comply with Korea's Personal Information Protection Act (PIPA) and related laws, and we publish this policy to protect personal information and handle related concerns promptly. This English version is a translation. If it differs from the Korean version, the Korean version prevails.
Article 1 (Definitions)
- 1. "Service" means the work collaboration service we provide at sai.dope-ai.kr and through the SAI desktop and mobile apps.
- 2. "Customer" means a company, organization or individual that creates and runs a workspace on the Service.
- 3. "User" means a person who signs in to the Service, including workspace owners, admins, members and guests.
- 4. "Workspace content" means messages, files, documents, calendar events, mail, call recordings and other material that users write, upload or connect to the Service.
Article 2 (Purposes)
We process personal information only for the purposes below. If a purpose changes, we take the steps PIPA Article 18 requires, such as obtaining separate consent.
- 1. Accounts: identity checks at sign-in, creating workspaces and invitations, managing member roles, preventing misuse
- 2. Service features: messages, files, documents, calendar, mail, voice and video calls and screen sharing, meeting recordings and notes, AI features, and connections to outside services
- 3. Requests and credits: receiving and quoting Ask DopeAI requests, recording credits granted and used, and billing records
- 4. Support: handling questions and feedback, and sending service notices
- 5. Usage analysis and improvement: analyzing which screens and features are used and for how long, improving quality, and setting prices
- 6. Security and stability: preventing abnormal use and responding to outages
Article 3 (Information we process and how we collect it)
(1) We process the following personal information.
| Category | Items | How collected |
|---|---|---|
| Account | Name, email address, account identifier from the sign-in provider | Provided by Google or Apple when you sign in with that account |
| Profile (optional) | Full name, job title, status message, time zone, profile photo | Entered by the user |
| Workspace | Workspace name, membership, role (owner, admin, member, guest), invitation and joining records | Entered by users or created while using the Service |
| Workspace content | Messages and attachments, files, documents, lists, canvases, calendar events, meeting recordings and notes, AI feature use | Entered by users |
| Connected services (optional) | Address and sign-in credentials of connected mail accounts (Gmail, Outlook, iCloud, IMAP); connection details for Google Calendar, Google Drive, GitHub, Jira, Slack and KakaoTalk; mail, messages and events brought in from those services | When the user approves the connection |
| Personal messengers (optional) | Messages and attachments from WhatsApp and iMessage conversations the user selects, and the names and contact details (phone number or email address) of people in them | When the user installs the connector on their own device and selects conversations |
| AI service connections (optional) | Connection details or API keys for AI service accounts the user registers | Entered by the user |
| Requests and credits | Title and details of Ask DopeAI requests, quotes, credits granted and used, billing records | Entered by users or created while using the Service |
| Usage records | Screens used and time spent, names of menus and buttons clicked, key actions (message sent, file uploaded, call started and similar), access times, IP address, browser and operating system details, device type, screen size, time zone, language setting, app version | Collected automatically while the Service is used |
| Notifications | Device token or browser subscription for push notifications | When the user allows notifications |
| App pilot (optional) | Email address | When the user asks to join the iPhone or iPad pilot (TestFlight) |
(2) When we record usage, we exclude text users type, the content of messages, mail and documents, file names, and the names of people and channels.
(3) We do not collect resident registration numbers or other unique identifiers, or sensitive information. If a user writes or uploads such information in workspace content, it is stored as part of that content, so please do not upload it unless necessary.
Article 4 (Workspace content)
(1) Customers manage workspace content for their business, and we process it to provide the Service to them.
(2) Requests to access, correct or delete personal information in workspace content can be made to the workspace owner or admin. We support them at the Customer's request or as the law requires.
(3) Mail and messages brought in from connected services and personal messengers may include other people's personal information, such as the people in a conversation. We process it only to provide the Service to the user who connected it.
(4) A call is recorded only when a participant starts recording, and every participant is shown that recording is on. Live captions run only when every participant agrees. They are processed by a speech recognition model on our own equipment and are not saved.
Article 5 (Retention)
(1) We keep personal information within the period set by law or agreed by the data subject, as follows.
| Category | Retention |
|---|---|
| Account and profile | Until the account is closed |
| Workspace information and content | Until the workspace is deleted or the Customer asks for deletion |
| Connected services and personal messengers | Until disconnected or the account is closed |
| Usage records | 1 year from collection |
| Notifications | Until notifications are turned off or the device is removed |
| App pilot | Until the pilot ends for that user |
| Backups | 30 days from the backup date |
(2) A deleted message has its content removed, and only a deletion marker remains. Files moved to the trash stay there until permanently deleted or until the retention period set by the workspace admin ends.
(3) We destroy personal information without delay when its retention period ends. Copies in backups are destroyed when the backup retention period in paragraph (1) ends.
(4) Where the law requires, we keep the following records for these periods:
- 1. Contracts and withdrawal of offers: 5 years (Act on the Consumer Protection in Electronic Commerce)
- 2. Payments and supply of goods or services: 5 years (same Act)
- 3. Consumer complaints and disputes: 3 years (same Act)
- 4. Service access records: 3 months (Protection of Communications Secrets Act)
Article 6 (Provision to third parties)
(1) We process personal information only within the purposes in Article 2. We provide it to a third party only where PIPA Articles 17 and 18 allow it, such as with the data subject's consent or under a specific legal provision.
(2) When a user asks the Service to act in a connected service, such as sending mail or posting a message, the information goes to that service on the user's instruction.
Article 7 (Outsourcing)
(1) We run the Service's database, file storage, sign-in, voice and video calls, and speech recognition ourselves, on our own equipment in the Republic of Korea.
(2) We outsource the following processing.
| Provider | Work | When it applies |
|---|---|---|
| OpenAI OpCo, LLC | Generating AI responses (agents, summaries, translation, questions and answers) | When a workspace uses the AI features we provide |
| Anthropic PBC | Generating AI responses (agents, summaries, translation, questions and answers) | When a workspace uses the AI features we provide |
| Apple Inc. | Delivering push notifications to the iPhone, iPad and Mac apps; sending pilot (TestFlight) invitations | When the user allows notifications on an Apple device or asks to join the pilot |
(3) If the outsourced work or a provider changes, we will announce it through this policy.
Article 8 (Transfer outside Korea)
(1) To carry out the work in Article 7, we transfer personal information outside Korea under PIPA Article 28-8(1)(iii), as follows.
- 1. OpenAI OpCo, LLC (contact: privacy@openai.com)
- Country: United States
- When and how: sent over the network when AI features are used
- Items: workspace content entered into AI features or needed for the request, and the author's name
- Purpose: generating AI responses
- Retention: as set by that company's policy
- 2. Anthropic PBC (contact: privacy@anthropic.com)
- Country: United States
- When and how: sent over the network when AI features are used
- Items: workspace content entered into AI features or needed for the request, and the author's name
- Purpose: generating AI responses
- Retention: as set by that company's policy
- 3. Apple Inc. (contact: www.apple.com/legal/privacy/contact)
- Country: United States
- When and how: sent over the network when a new-message notification or a pilot invitation is sent
- Items: device token, sender name, conversation name, message preview (up to 240 characters), email address of pilot participants
- Purpose: delivering push notifications and pilot invitations
- Retention: until the notification is delivered or the pilot ends (as set by Apple's policy)
(2) You can refuse these transfers by not using the AI features, or by turning off notifications or notification previews in your device, browser or Service settings. You then cannot use the AI features or push notifications, or notifications will not show message content.
(3) Web browser notifications pass through the push service of your browser's provider. Only an encrypted notification ID is sent, without message content.
Article 9 (Services you connect)
We exchange information with the following services, only as needed for the features the user requests, after the user approves the connection. Each provider's own privacy policy governs its processing, and some of these services may process information outside Korea. Users can disconnect at any time in the Service settings.
- 1. Mail, calendar and files: Gmail, Google Calendar and Google Drive (Google LLC), Outlook (Microsoft Corporation), iCloud Mail and Calendar (Apple Inc.), and IMAP and SMTP mail servers the user specifies
- 2. Work tools: Slack (Slack Technologies, LLC), GitHub (GitHub, Inc.), Jira (Atlassian)
- 3. Messengers: KakaoTalk send-to-me (Kakao Corp.), and WhatsApp and iMessage through the connector on the user's own device
- 4. AI service accounts the user registers
Article 10 (Destruction)
(1) We destroy personal information without delay when its retention period ends or its purpose is achieved.
(2) Personal information that must be kept by law is stored separately from other personal information.
(3) Electronic files are deleted so they cannot be recovered. Printed records are shredded or incinerated.
Article 11 (Rights of data subjects and legal representatives)
(1) Data subjects may at any time ask us to give access to, correct, delete or stop processing their personal information, or withdraw consent.
(2) These requests, and requests to close an account, can be made in writing or by email to the contact in Article 16. We act within 10 days of receiving the request.
(3) A legal representative or an authorized agent may exercise these rights on the data subject's behalf by submitting a power of attorney.
(4) Requests for access or to stop processing may be limited under PIPA Article 35(4) and Article 37(2).
(5) Deletion cannot be requested where another law specifies that the information must be collected.
(6) We verify that the person making a request is the data subject or a legitimate representative.
(7) Requests about workspace content follow Article 4(2).
Article 12 (Security measures)
We take the following measures to keep personal information secure:
- 1. Administrative: keeping the number of people who handle personal information to a minimum and managing access rights
- 2. Technical: encryption in transit (HTTPS); encrypted storage (AES-256-GCM) of connected-service credentials, sign-in tokens, AI service keys and personal messenger data; storing only a hash of sign-in session tokens; separation of data between workspaces and role-based access control; audit records
- 3. Physical: restricting physical access to servers and backup equipment
Article 13 (Cookies and automatic collection)
(1) We use cookies and browser storage to keep users signed in and to save their settings:
- 1. Sign-in cookie (sai_session): keeps the user signed in. Expires on sign-out or after 400 days
- 2. Cookies that confirm sign-in and service connections: expire after 5 to 10 minutes
- 3. Browser storage: drafts of messages and documents, display and notification settings, and meeting recordings made in the browser before upload
(2) After signing out, drafts, display settings and recordings not yet uploaded may remain in browser storage. Users can delete site data in their browser settings.
(3) We collect the usage records in Article 3 on our own equipment and do not use tracking tools from outside advertising or analytics companies. We do not collect or use behavioral information for targeted advertising.
(4) Users can refuse cookies in their browser settings. Without the sign-in cookie, the Service cannot be used.
Article 14 (Children under 14)
The Service is a business service and is not intended for children under 14. We do not knowingly collect personal information from children under 14, and if we learn that we have, we destroy it without delay.
Article 15 (Automated decisions)
We do not make decisions that significantly affect a data subject's rights or obligations through fully automated processing of personal information.
Article 16 (Privacy officer)
We have appointed the following privacy officer to oversee personal information processing and handle complaints and remedies. Requests for access, account closure and other rights, and any questions, can be sent here:
- Privacy officer: Paul Hong (Representative)
- Email: paul.hong@dope-ai.kr
Article 17 (Remedies)
To seek a remedy for a privacy violation, data subjects may apply for dispute resolution or advice to the following bodies. They are independent of DopeAI.
- Personal Information Dispute Mediation Committee: 1833-6972 (www.kopico.go.kr)
- Personal Information Infringement Report Center (KISA): 118 (privacy.kisa.or.kr)
- Korea Prosecution Service: 1301 (www.spo.go.kr)
- Korean National Police Agency: 182 (ecrm.police.go.kr)
Article 18 (Changes)
(1) This policy takes effect on November 5, 2026.
(2) We will announce changes at least 7 days before they take effect, through a Service notice or this page. Changes that significantly affect users' rights, such as new categories of information or new purposes, will be announced at least 30 days in advance.