This English version is provided for convenience. In case of any conflict, the Korean version prevails.
HyperReality Co., Ltd. (the "Company") complies with the Personal Information Protection Act of Korea and other applicable laws in providing Scaler (the "Service"). This Privacy Policy explains what personal information the Company processes, why, for how long, and to whom it entrusts or provides it.
At a glance
| What | Details |
|---|---|
| Information collected | Google account email, name and profile image; Service usage records; team invitation emails; Access Token information; notification email logs |
| Used for | Sign-in, team (workspace) operations, payments, customer support, security |
| Entrusted to | Cloud, file storage, email, sign-in, AI reply drafts, operator alerts — see Articles 4 and 5 |
| Retention | Until account deletion. Only records required by law are kept for the legally required period |
| Contact | Chief Privacy Officer Juyoung Kang · ben@hyperreality.gg |
The Company's two roles
The Service is a tool that businesses and teams use to run customer support (CS), customer management and company documents from a single team account. Within the same Service, the Company's role differs depending on the information.
| Information | Company's role | Applicable document |
|---|---|---|
| Member account information, payment and billing information, access logs, inquiries | Controller — the Company determines the purposes and means | This Privacy Policy |
| Data that a Customer (the team or business a member belongs to) uploads to or integrates with the Service — "Customer Data". Examples: support emails, KakaoTalk channel messages and web inquiries (with attachments) sent by the Customer's own customers; support contacts (email, name, Kakao user identifier) and notes; agent replies and AI reply drafts; company information registered by the Customer (representative's name, contact person, contact details, bank account), seal images and company document files; support channel addresses and webhooks connected by the Customer | Processor — processes only for the purpose of providing the Service, on the Customer's instructions | The Customer's privacy policy; the Terms of Service between the Company and the Customer (Article 8, Customer Data) |
Requests to access or delete personal information contained in Customer Data (for example, the contact details of a person who contacted a Customer's support) should first be made to that Customer. If such requests reach the Company, we forward them to the Customer.
The Customer's support touchpoints (such as the customer conversation page) display: "This support service is operated by ○○, and Scaler (HyperReality Co., Ltd.) processes it on their behalf."
Article 1 (Personal Information Processed: Items, Purposes, Legal Basis and Retention)
| When | Items | Purpose | Legal basis | Retention |
|---|---|---|---|---|
| Sign-up and sign-in (Google sign-in) | Email, name, profile image, Google account identifier | Member identification, sign-in, announcements | Performance of contract (PIPA Art. 15(1)(4)) | Until account deletion |
| Team invitations | Invitee's email, inviting member, role | Sending invitation emails, processing team membership (invitation links expire after 7 days) | Performance of contract | 30 days after the invitation is accepted, expires or is canceled |
| Service use | IP address, browser information (User-Agent), access time, Service usage records, error logs | Security, abuse prevention (including rate limiting), incident response | Legitimate interests (PIPA Art. 15(1)(6)) | 1 year (access logs at least 3 months under the Protection of Communications Secrets Act) |
| Access Token (MCP) issuance | Token name, token hash, last used time, revocation time | Connecting external AI tools, security audits | Performance of contract | Until the token is revoked or the account is deleted |
| Notifications | In-app notifications (title, content, link, read time), notification email logs (recipient address, subject, body, delivery result) | Providing notifications, checking failed emails and resending | Performance of contract | Notifications until account deletion; email logs 1 year after sending |
| AI usage records | Calling member's identifier, feature, AI provider and model, token count, cost, time (input and output content are not stored) | Showing usage per team, managing usage limits | Performance of contract | Until account deletion or team deletion |
| Customer inquiries | Email, inquiry content, attachments | Responding to inquiries, handling disputes | Performance of contract | 3 years after resolution |
| Paid payments (domestic) | Partial payment method information, payment and refund history, business information for tax invoices | Billing, refunds, issuing tax invoices | Performance of contract, legal obligation | 5 years (Electronic Commerce Act, Framework Act on National Taxes). Paid plans are not yet open; this applies once introduced |
| Paid payments (international) | International payments are collected directly by Paddle (Article 6). The Company receives only payment status, plan and country | Managing subscription status | Performance of contract | 5 years. Applies once introduced |
Records retained under law are stored separately from other information and used only for that purpose.
| Record | Period | Legal basis |
|---|---|---|
| Records of contracts or withdrawal of offers | 5 years | Electronic Commerce Act |
| Records of payment and supply of goods | 5 years | Electronic Commerce Act |
| Records of consumer complaints or dispute resolution | 3 years | Electronic Commerce Act |
| Website visit (sign-in) records | 3 months | Protection of Communications Secrets Act |
Article 2 (Processing of Customer Data)
- The Company processes Customer Data only to provide the Service, maintain security and comply with laws, and does not use it for any other purpose or provide it to third parties.
- If Customer Data contains personal information, the Customer is responsible for securing a basis for collecting it and informing the data subjects (such as people who contacted the Customer's support).
- Support channels and integrations connected by the Customer — the Customer's KakaoTalk channel chatbot (Kakao i Open Builder), forwarded mail sent from the Customer's mail server (Google Workspace, Gmail forwarding, etc.), and webhook endpoints configured by the Customer (Discord, etc.) — are services the Customer chooses and contracts with. The Company only receives Customer Data from those services or sends it where the Customer instructs; those services are not the Company's processors.
- Records of messages that failed to be received (sender address, reason) are automatically deleted after 30 days. Raw received emails are deleted 30 days after attachments are separated.
- When a Customer deletes a workspace or the service agreement ends, the Company provides a 30-day opportunity to export (download) Customer Data and then destroys it. Copies remaining in backups are deleted according to the backup cycle (up to 30 days).
- At the request of a business customer, the Company enters into a data processing agreement (DPA).
Article 3 (AI Features)
- The Service provides a generative AI feature (drafting support replies).
- When an AI draft is created, the conversation's channel, subject, customer name and conversation content (customer messages, agent replies, internal notes) are sent to an AI provider and the result is returned (see Article 5, international transfers). Attachments are not sent. The Company keeps generated drafts as part of that conversation's record (including drafts discarded without sending, for the same period as Customer Data), and when a person edits a draft before sending, the pre-edit draft is also kept. AI usage records do not store input or output content.
- When users create drafts with their own AI tools (for example, an AI client such as Claude connected with an Access Token) (direct connection), that provider's processing is governed by the terms between the user and that provider.
- By default, AI drafts are not sent to customers directly; they go out only when an agent reviews and sends them. Replies written by AI tools are sent directly only if the Customer's team has turned on "Let AI tools send directly" in its settings.
- If AI output is inappropriate or wrong, please let us know at ben@hyperreality.gg. We will review it, take action and reply with the outcome.
- Please do not enter sensitive information, such as resident registration numbers or health information, into AI features.
Article 4 (Entrustment of Personal Information Processing)
| Processor | Tasks entrusted |
|---|---|
| Google LLC | Google account sign-in (authentication) |
| Amazon Web Services, Inc. | In the Seoul Region: sending email (Amazon SES), receiving support email (Amazon SES receiving, AWS Lambda), storing support attachments and company seal/document files (Amazon S3) |
| HyperReality Co., Ltd. (self-operated cloud "zerocloud") | Operating Service servers and databases, relaying outgoing email, relaying AI calls |
| Anthropic PBC · OpenAI, L.L.C. · Google LLC | Generating AI reply drafts (sent to the single provider of the configured model) |
| Discord Inc. | Operator alerts (operational events such as sign-ups and team creation; emails are partially masked) |
| PAYPLE Co., Ltd. | Domestic payment processing (once paid plans are introduced) |
If processors change, we will amend and announce this Privacy Policy.
Article 5 (International Transfer of Personal Information)
To provide the Service (performance of contract), the Company entrusts the storage and processing of personal information abroad as follows (PIPA Art. 28-8(1)(3)). Transfers take place over the network when the Service is used.
| Recipient (contact) | Country | Items | Purpose | Retention | How to refuse and effect |
|---|---|---|---|---|---|
| Google LLC (privacy.google.com) | United States | Email, name, profile image, Google account identifier | Google sign-in | Until account deletion | To refuse, do not sign up. Google is currently the only sign-in method, so if you refuse you cannot use the Service |
| Whichever of Anthropic PBC (privacy@anthropic.com), OpenAI, L.L.C. (privacy@openai.com) or Google LLC (privacy.google.com) provides the configured model | United States | AI draft input (conversation subject, customer name, conversation content) and output | Generating AI reply drafts | Deleted after up to 30 days under the provider's policy; not used for training | No transfer occurs if you don't use the AI draft feature. Other features such as receiving and replying to conversations remain available |
| Discord Inc. (privacy@discord.com) | United States | Member name, partially masked email, team name | Operator alerts | Per Discord's policy | To refuse, let us know at ben@hyperreality.gg. After confirmation, we will stop including that member's information in operator alerts. This does not affect your use of the Service |
| Amazon Web Services, Inc. (aws.amazon.com/compliance/contact) | Republic of Korea (Seoul Region) — not an international transfer | Recipient email, email content, support emails and attachments, company document files | Sending and receiving email, file storage | Per the retention periods above | — |
Article 6 (Provision of Personal Information to Third Parties)
The Company does not provide personal information to third parties except with the data subject's consent or where specifically required by law. However, once international payments are introduced, information will be provided as follows.
| Recipient | Country | Items | Purpose | Retention |
|---|---|---|---|---|
| Paddle.com Market Limited | United Kingdom | Email, country, payment method information, billing address, payment and refund history | Payment and tax processing as the Merchant of Record for international payments | Per Paddle's privacy policy |
Consent to this provision is obtained on the international checkout screen. If you do not consent, you cannot use international payment, but domestic payment remains available.
Article 7 (Destruction of Personal Information)
- When the retention period ends or the purpose is achieved, personal information is destroyed without delay.
- Electronic files are erased in a way that makes recovery impossible, and paper documents are shredded or incinerated.
- After account deletion, information is kept for 30 days to allow recovery in case of accidental deletion, and then destroyed. Records retained under law are stored separately for the periods in Article 1.
Article 8 (Cookies and Other Automatic Collection)
- The Service uses essential cookies (or browser storage) to keep you signed in.
- The Service does not use cookies or tracking tools for analytics or advertising.
- You can refuse cookies in your browser settings. If you refuse essential cookies, you will not stay signed in.
- Chrome: Settings → Privacy and security → Third-party cookies
- Safari: Settings → Privacy
Article 9 (Children Under 14)
The Service does not accept sign-ups from children under the age of 14. If an account is found to belong to a child under 14, it will be deleted without delay.
Article 10 (Rights of Data Subjects and How to Exercise Them)
- Data subjects may at any time request access to, correction or deletion of, suspension of processing of, or transmission of their personal information, and may withdraw consent.
- You can do this directly in the Service (viewing your profile, leaving a team, revoking Access Tokens), or by request to ben@hyperreality.gg, which we will process within 10 days. Account deletion can also be requested by email.
- These rights may also be exercised through an agent (a legal representative or an authorized person), in which case a power of attorney must be submitted.
- Deletion cannot be requested for information that other laws require to be retained.
Article 11 (Automated Decisions)
The Company does not make decisions that significantly affect the rights or obligations of data subjects in a fully automated manner. When accounts are restricted due to abuse detection, a person reviews the case.
Article 12 (Security Measures)
- Administrative: internal management plan, minimizing personnel with access, regular inspections
- Technical: access control (team membership checks), encryption in transit (HTTPS), encrypted storage of secrets and external integration credentials (reply sending tokens, webhook URLs and signing secrets), storing Access Tokens, support intake keys and customer conversation links only as hashes, file downloads only via signed temporary URLs, retention of access logs
- Physical: access control to servers and data storage locations
Article 13 (Chief Privacy Officer)
- Chief Privacy Officer: Juyoung Kang (CEO)
- Email: ben@hyperreality.gg
- Phone: 0507-0178-7546
Article 14 (Remedies for Infringement)
If you need advice or dispute resolution regarding infringement of personal information, you may contact the following organizations (Korea).
- Personal Information Infringement Report Center (Korea Internet & Security Agency): privacy.kisa.or.kr / 118 (no area code)
- Personal Information Dispute Mediation Committee: www.kopico.go.kr / 1833-6972
- Supreme Prosecutors' Office Cyber Investigation Division: www.spo.go.kr / 1301 (no area code)
- Korean National Police Agency Cyber Bureau: ecrm.police.go.kr / 182 (no area code)
Article 15 (Changes to This Privacy Policy)
- This Privacy Policy takes effect on 2026-10-12.
- If its content changes, we will announce it on the Service 7 days before the effective date. Changes significant to data subjects' rights, such as adding collected items or third-party provision, will be announced 30 days in advance, and consent will be obtained again where necessary.
- Previous versions of this Privacy Policy are available under "Previous versions" at the bottom of this page.