Privacy Policy

Article 1 (General)

HEY JAMES Inc. (the "Company") values users' personal data and complies with relevant laws including the Personal Information Protection Act, the Act on Promotion of Information and Communications Network Utilization and Information Protection, and the Protection of Communications Secrets Act. This Privacy Policy describes the personal data collected through the Fingr service (the "Service") operated by the Company — the items collected, purposes of collection, retention periods, and user rights.

Article 2 (Items collected & methods)

1. At sign-up (required)

• Name, email address, password (stored as a BCrypt hash)

2. Google social login (required)

• Email, name, profile image URL, Google unique identifier (UID)

3. At payment (required)

• Card issuer, last 4 digits of card number, billing key (auto-billing authentication)
• Payment key, order ID
• ※ The full card number is not stored by the Company; it is handled by Toss Payments.

4. Voice cloning (optional)

• Voice sample audio file
• Voice profile metadata (name, gender, language)

5. While using the Service (auto-collected)

• Access IP address, browser information, Service usage records
• AI API usage logs (service name, model, token count, estimated cost)

6. Project data

• Project title, topic, target audience, script, slide data, subtitles

Methods of collection

Sign-up form, Google OAuth, Toss Payments SDK, file upload, automatic collection during Service use.

Article 3 (Purposes of collection & use)

• Member management: sign-up / withdrawal processing, identity verification, email verification
• Service provision: AI video creation features, TTS generation, voice cloning
• Payment & subscription management: credit top-ups, subscription renewal, refund handling
• Service improvement: usage analytics, API cost management
• Customer support: handling inquiries, dispute resolution
• Legal compliance: retention of records under the e-Commerce Act
• Service safety: abuse prevention, detection of unauthorized access

Article 4 (Retention & use period)

Article 5 (Provision to third parties)

The Company does not provide personal data to third parties without the user's consent, except as required by law. To provide the Service, information is shared with the following parties:

* For voice cloning, voice data uploaded to MiniMax may be retained on MiniMax servers for the purpose of generating a voice_id.

Article 6 (Cross-border transfer of personal data)

To provide the Service, users' personal data is transferred overseas as follows:

If a user does not consent to the cross-border transfer, the use of AI script generation, TTS narration, voice cloning, and AI image generation features may be restricted.

Article 7 (Processing entrustment)

To smoothly provide the Service, the Company entrusts processing of personal data as follows:

Entrustment contracts include compliance with personal data protection laws, confidentiality, restrictions on sub-entrustment, and damages for incidents.

Article 8 (User rights & how to exercise them)

Users may exercise the following rights:

1. Right to access: view personal data the Company holds about you.
2. Right to correction / deletion: request correction or deletion of inaccurate personal data.
3. Right to suspend processing: request that processing of personal data be suspended.
4. Right to withdraw consent: withdraw consent to the collection and use of personal data.

How to exercise

• You can view, edit, and delete personal data directly from the profile page.
• Account deletion (withdrawal) can be processed from the profile page.
• You can also request via email (james@heyjames.ai).
• A legal representative or an authorized agent may exercise these rights (a power of attorney is required).

Requests are processed within 10 days, and the relevant data is not used or provided until correction / deletion is complete.

Article 9 (Destruction procedures)

1. When destroyed: when the retention period elapses, the processing purpose is achieved, or the user withdraws.
2. How destroyed:
   • Electronic files: permanently deleted in a non-recoverable manner.
   • Paper documents: shredded or incinerated.
3. Handling on withdrawal:
   • Destroyed immediately: name, email, password, OAuth info, billing key, voice profile.
   • Destroyed after 30 days: projects, generated content.
   • Statutory retention: payment records (5 years), access logs (3 months) — stored separately.

Article 10 (Cookies & sessions)

1. Session cookies: used to keep you logged in.
2. CSRF protection: security tokens are used to prevent cross-site request forgery.
3. Third-party tracking cookies and analytics tools (e.g., Google Analytics) are not used at this time.
4. You can refuse or delete cookies in your browser settings. Note that refusing cookies may restrict access to features that require login.

Article 11 (Protective measures)

Administrative measures

• Minimization of staff who handle personal data
• Regular staff training
• Establishing and operating an internal management plan

Technical measures

• Passwords stored using BCrypt encryption
• HTTPS (SSL / TLS) encrypted communication
• Role-based access control
• Retention of access logs and prevention of tampering
• Installation and updating of security software

Physical measures

• Data center access control

Article 12 (Information about automated decisions)

The following automated decisions are made within the Service:

• Automatic credit deduction: credits are automatically deducted in line with the cost of AI API calls.
• Automatic credit expiry: credits past their validity period are automatically forfeited.
• Subscription auto-renewal: when a subscription expires, the registered payment method is automatically charged.

Users may request an explanation of, or object to, an automated decision. AI content generation only runs in response to a user's explicit request.

Article 13 (Personal data of children under 14)

1. The Company does not collect personal data from children under 14, and does not allow membership for children under 14.
2. If the Company becomes aware that personal data of a child under 14 has been collected, it will destroy the data immediately.
3. A legal representative may request access, correction / deletion, or suspension of processing of a child's personal data.

Article 14 (Privacy officer)

The Company has designated the following privacy officer for the protection of users' personal data and the handling of related complaints:

For all personal data inquiries, complaints, and remedy requests arising from use of the Service, users may contact the privacy officer above.

Article 15 (Remedies for infringement)

For relief and consultation regarding personal data infringement, users may apply to the following bodies:

Article 16 (Changes to this policy)

1. If this policy changes, notice will be posted within the Service at least 7 days before the effective date.
2. For material changes unfavorable to users, notice will be given at least 30 days in advance and individually by email.

Supplementary provisions

1. This Privacy Policy takes effect on April 4, 2026.
2. The previous Privacy Policy (effective April 1, 2026) is replaced by this policy.