Privacy Policy

Article 1 (General)

HEY JAMES Inc. (the "Company") values users' personal data and complies with relevant laws including the Personal Information Protection Act, the Act on Promotion of Information and Communications Network Utilization and Information Protection, and the Protection of Communications Secrets Act. This Privacy Policy describes the personal data collected through the fingr service — which includes the AI app build subscription, the previous services of AI video creation and credit-based app creation, and related features (the "Service") — operated by the Company, including the items collected, purposes of collection, retention periods, and user rights.

Article 2 (Items collected & methods)

1. At sign-up (required)

• Name, email address, password (stored as a BCrypt hash)
• Sign-up time IP address, browser identification (User-Agent), language preference
• How you found us — ad link parameters (utm_source / utm_medium / utm_campaign / utm_content), the address of the site you came from, the first page you opened, and the time of your first visit
• ※ The IP address and User-Agent collected at sign-up are used and analyzed to block abuse — multiple sign-ups from the same IP, bot sign-ups, disposable email domains, etc.

2. Google social login (required)

• Email, name, profile image URL, Google unique identifier (UID)
• Sign-up time IP address and User-Agent

3. At payment (required)

• KRW card payments (Toss Payments): card issuer, last 4 digits of card number, billing key (auto-billing authentication), payment key, order ID
• USD card payments (Polar): email used for payment, name, country, and customer / subscription / order identifiers issued by Polar
• Bank transfer (former Unlimited plan — bank transfers are no longer accepted from October 19, 2026): payer name, amount, and date of payment
• If you pay from a demo page without logging in: we look up an existing account by the email used for payment and link it, or create a new account with that email and name. A link to set your password is sent to that email.
• ※ The full card number is not stored by the Company; it is handled by Toss Payments or Polar.

4. App build subscription

• Design: app idea text, revisions, and the IP address of the person who created the design (to prevent misuse when created before logging in)
• Requests: Request text, attachments (images, documents, etc.), answers to the Company's questions, and Request review results
• Phone check before the first app: mobile number and time of verification — used only to stop one person from making many accounts to collect welcome credits, and deleted when the account is closed. For numbers that received welcome credits, we keep a one-way hash (it cannot be turned back into the number) for 1 year after the account is closed, so the same number can't sign up again for more credits.
• Deliverables: the app's source code, database, logs, and test account information
• External service keys (if entered by the user — e.g., Toss Payments, Stripe, Solapi, Kakao, Google Maps): stored encrypted; after saving, only the last 4 characters are shown
• When a user with an upgraded app moves it to a server in their own name: a personal access token for the user's own DigitalOcean account (stored encrypted) and the address of the migrated server
• If an AI feature inside the app is switched on: time of consent, monthly cap, and AI usage records (model, token count, cost)
• ※ For data about the app's users (the user's customers) accumulated in the user's app, the user is responsible as the personal information controller, and the Company stores and processes it on the user's behalf (Article 7(2)).

5. Previous services (AI video creation and credit-based apps)

• Video: project title, topic, target audience, script, slide data, subtitles
• Voice cloning (optional): voice sample audio file, voice profile metadata (name, gender, language)
• Credit apps: app idea, follow-up Q&A, edit requests, the generated app's source code / database / logs, production-mode activation times and renewal history, connected domain name and SSL certificate issuance status

6. While using the Service (auto-collected)

• Access IP address, browser information, Service usage records
• AI usage logs (service name, model, token count, estimated cost)
• External traffic statistics on generated apps (IP, User-Agent — used to identify bot traffic)

Methods of collection

Sign-up form, Google OAuth, payment processors' (Toss Payments / Polar) checkout pages and payment notifications, bank deposit confirmation, design / Request / file upload screens, automatic collection during Service use, and collection from other sources under Article 2-2.

Article 2-2 (Personal data obtained from other sources for sales contact)

To introduce the Service, the Company builds a demo app tailored to a company and sends it to people at that company who are not yet members, at their work email address. Because this involves personal data not collected directly from the data subject, we give the following notice under Article 20 of the Personal Information Protection Act.

1. Source: a B2B data provider that supplies business contact details (GetLeads), the business contact email that YouTube creators publish on their own channel page, and publicly available information such as company websites and LinkedIn.
2. Items: name, work email address, company name, job title, industry, country, company website and LinkedIn URL, publicly available profile details (LinkedIn headline and summary, skills, languages, when the current role started), and publicly available company details (description, size, revenue range, founding year, funding, technology used, public company contact details, office location) (for YouTube creators: channel name, channel address and channel description).
3. Purposes and processing:
   • Based on public company information, AI (Anthropic) drafts an app idea suited to that company and builds a demo app.
   • We introduce the demo app and the Service by work email (Gmail on Google Workspace) and, if there is no reply, follow up at most two more times at set intervals.
   • We record whether the demo page was viewed, the app was opened, checkout was started, payment was made, or a reply was sent, to decide whether to contact again.
4. Legal basis: using contact details that the data subject made public for business purposes to make a business-related proposal, based on the Company's legitimate interests (Article 15(1)(6) of the Personal Information Protection Act). We do not collect sensitive information or personal contact details (such as personal mobile numbers).
5. Stopping processing / opting out: click the unsubscribe link in the email or tell us at james@heyjames.ai, and we stop contacting you right away and delete your data. We keep only your email address on a do-not-contact list so that we do not contact you again. If you ask where we got your details, we will tell you right away.
6. Retention: destroyed 1 year after the last contact, or immediately on opt-out (except the email address on the do-not-contact list). Demo apps are turned off 7 days after being sent and, if no payment is made, are destroyed together with this data. If you pay and become a member, the data is moved to and managed as member data.

Article 3 (Purposes of collection & use)

• Member management: sign-up / withdrawal processing, identity verification, email verification, language preference, linking or creating accounts from the payment email
• App build subscription: design, Request review (including deciding between bug fixes and feature changes), building and modifying apps, checking and delivering results, app hosting, connecting external services, providing source code, and moving apps to the user's own server
• Payment & subscription management: card auto-pay, bank deposit confirmation, subscription renewal and cancellation, refund handling, and calculating, alerting on, and billing AI feature usage fees
• Previous services: AI video creation, TTS generation, voice cloning, credit app hosting / production mode / domain connection, credit deduction
• Service safety & abuse prevention: detecting multiple sign-ups from the same IP, using phone numbers to stop one person from collecting welcome credits on several accounts, blocking bot sign-ups, matching disposable email domains, preventing misuse of screens created without logging in, preventing fraud, detecting unauthorized access
• Sales contact: building demo apps and sending introduction emails under Article 2-2
• Service improvement: usage analytics, ad referral analysis, AI cost management, app traffic pattern analysis (separated from personally identifiable information)
• Customer support: handling inquiries, dispute resolution
• Legal compliance: retention of records under the e-Commerce Act

Article 4 (Retention & use period)

Article 5 (Provision to third parties)

The Company does not provide personal data to third parties without the user's consent, except where required by law. For USD card payments, Polar sells and processes the payment directly as the merchant of record, so the following data is provided to Polar when the user pays.

Other processing we entrust to other companies to provide the Service is described in Article 6 (cross-border transfer) and Article 7 (processing entrustment). When a user with an upgraded app moves it to their own DigitalOcean account, that server belongs to the user under the user's own contract with DigitalOcean; the Company only uses the access token the user provides to set up and deploy the app.

Article 6 (Cross-border transfer of personal data)

Member data and app build subscription apps (source code and databases) are stored on the Company's servers in the Republic of Korea. However, the following data is transferred abroad to provide the Service. Transfers take place over encrypted connections (HTTPS) each time the relevant feature is used. Each company's privacy contact can be found in the privacy policy on its website, and the Company will provide it on request.

Users may refuse cross-border transfer by contacting james@heyjames.ai. However, features that require the transfer — building and modifying apps, AI features inside apps, USD payments, receiving Service emails, Google login, and the video and voice features of the previous services — will then be unavailable.

Article 7 (Processing entrustment)

1. The Company entrusts the processing of personal data to the following parties to provide the Service smoothly.

The entrustment contracts specify compliance with relevant privacy laws, confidentiality, restrictions on sub-entrustment, and damages in the event of incidents. If a processor changes, we will update this Policy and let you know.

2. For data about the app's users (the user's customers) accumulated in an app build subscription app, the user is the personal information controller and the Company is the processor entrusted with running the app. The Company stores this data on its servers in the Republic of Korea and handles it only as needed to host, modify, and support the app. If an AI feature inside the app is switched on, content entered into that feature is sub-entrusted to Anthropic (USA) for processing.

Article 8 (User rights & how to exercise them)

Users (including the sales contacts in Article 2-2) may exercise the following rights:

1. Right of access: view the personal data the Company holds about them.
2. Right to correct or delete: request correction or deletion of inaccurate personal data.
3. Right to suspend processing: request that processing of personal data be suspended.
4. Right to withdraw consent: withdraw consent to the collection or use of personal data.

How to exercise

• Personal data can be viewed, edited, and deleted directly on the profile page.
• Account deletion (withdrawal) can be processed on the profile page.
• Recipients of sales emails can stop processing right away with the unsubscribe link in the email.
• Requests can also be made by email to james@heyjames.ai.
• A legal representative or duly authorized agent may exercise these rights (proxy required).

Requests are processed within 10 days. The relevant data is not used or provided until correction or deletion is complete.

Article 9 (Destruction procedures)

1. Trigger: when the retention period expires, the processing purpose is achieved, or the user withdraws.
2. Method:
   • Electronic files: permanently deleted in an unrecoverable manner
   • Paper documents: shredded or incinerated
3. On withdrawal:
   • Destroyed immediately: name, email, password, OAuth info, billing key, DigitalOcean access token, voice profiles, sign-up time IP / User-Agent, app build subscription apps and free apps (Requests, attachments, source code, database, external service keys), credit app workspaces
   • Destroyed after 30 days: video projects and generated video content
   • Statutory retention: payment records (5 years), access logs (3 months) — kept separately
4. Apps whose service has stopped: App build subscription apps are kept for 30 days from the date the service stops under Terms Article 10(4); about a week before deletion we notify the user by email, and the source code, database, logs, and external service keys are then permanently deleted in an unrecoverable manner. Free apps are kept with no set period, but if the user does not log in for 30 days we notify the user by email about a week before and delete them in the same way (Terms Article 9). Credit apps (previous service) are deleted in the same way after staying stopped in development mode for 7 days under Terms Article 13.

Article 10 (Cookies & sessions)

1. Session cookies: session cookies are used to keep users signed in.
2. CSRF protection: security tokens are used to prevent cross-site request forgery.
3. Notice-dismissal cookies: a cookie remembers that you closed a notice such as the Terms change banner.
4. Referral cookie: on your first visit while not signed in, we remember the ad link parameters (utm_source / utm_medium / utm_campaign / utm_content), the address of the site you came from, and the first page you opened in a cookie for 30 days, and save them with your account when you sign up. If you do not sign up, the cookie expires after 30 days.
5. The Service screens do not currently use third-party tracking cookies or analytics tools (e.g., Google Analytics).
6. Users may refuse or delete cookies in their browser settings. Refusing cookies may, however, restrict use of features that require sign-in.

Article 11 (Protective measures)

Administrative

• Minimization of personnel handling personal data
• Regular employee training
• Internal management plan and execution

Technical

• Passwords stored as BCrypt hashes
• External service keys and DigitalOcean access tokens stored encrypted (only the last 4 characters are shown after saving)
• HTTPS (SSL/TLS) for communication
• Role-based access control
• Access-log retention with tamper protection
• Isolation between generated apps (memory, CPU, disk, and process separation) to prevent information leakage
• Installation and updating of security software

Physical

• Access controls at the data center in Korea where the Company's servers are located

Article 12 (Information about automated decisions)

The Service makes the following automated decisions:

• Request review: when an app Request comes in, AI first reads it and checks whether it is a bug fix or a feature change, whether external services need to be connected, and whether the Request is unsafe. Results built by AI are delivered right away without a staff check; a Request held as unsafe goes ahead only after a person at the Company has checked it.
• Card auto-pay: an app upgrade is charged automatically to the registered card every 30 days, and if credit auto top-up is on, a credit pack is charged to the registered card when credits fall to the chosen level (up to 3 times every 30 days). If an upgrade payment fails it is retried once a day, and the service stops 2 days after the end of the usage period (Terms Article 9).
• AI feature cap: when a month's usage fees for AI features inside the app reach 80% and 100% of the agreed cap, an alert email is sent, and at 100% the feature is paused for the rest of that month (Terms Article 11).
• Automatic app deletion: app build subscription apps are deleted automatically 30 days after the service stops, free apps when the user has not logged in for 30 days, and credit apps after staying stopped in development mode for 7 days (Terms Articles 10 and 13). Apps owned by suspended users are permanently deleted 30 days after suspension.
• (Previous service) credit deduction, expiry, and production-mode demotion: credits are deducted automatically based on AI costs and forfeited when they expire, and if credits are insufficient at renewal, a credit app returns to development mode (Terms Articles 13 and 14).
• Automatic abuse blocking: sign-up time IP, User-Agent, and email domain are analyzed; same-IP multiple sign-ups, bot sign-ups, and disposable-domain matches result in an automatic temporary suspension and a request for operator review.

Users may request an explanation of, or object to, an automated decision. If automatically suspended for suspected abuse, the user may dispute the decision by emailing james@heyjames.ai; an operator will review the request and either lift the block or provide reasoning. AI content generation is performed only at the user's direct request (or to build demo apps under Article 2-2).

Article 13 (Personal data of children under 14)

1. The Company does not collect personal data from children under 14, and does not allow them to sign up.
2. If the Company learns that personal data of a child under 14 has been collected, that data is destroyed immediately.
3. Legal representatives may request access, correction or deletion, or suspension of processing for the child's personal data.

Article 14 (Privacy officer)

The Company designates the following privacy officer to protect users' personal data and to handle related complaints.

Users may direct any privacy-related inquiries, complaints, or remediation requests to the officer above.

Article 15 (Remedies for infringement)

Users may request remediation, consultation, or other relief for personal-data infringement at the following bodies.

Article 16 (Changes to this policy)

1. Any changes to this Policy will be announced within the Service at least 7 days before the effective date.
2. For changes that materially disadvantage users, notice will be given at least 30 days in advance, with individual notice by email.

Supplementary provisions

1. This Privacy Policy takes effect on November 16, 2026 (notice date: October 16, 2026).
2. The previous Privacy Policy (effective April 30, 2026) continues to apply until the effective date and is replaced by this Policy from that date.
3. The key changes in this revision are:
   • New items collected for the app build subscription: Request text and attachments, the IP address of the person who created screens, external service keys, a DigitalOcean access token for moving the app, AI feature consent and usage records, bank-transfer payer names, and accounts created from the payment email.
   • Notice of the source, purposes, opt-out method, and retention of personal data obtained from other sources for sales contact (Article 2-2).
   • Retention of app build subscription apps set to 30 days after the service stops, with the 7-day deletion of credit apps separated as a previous-service rule.
   • Updated cross-border transfers and processors: Anthropic PBC, Amazon Web Services, Polar, Resend, Google, Cloudflare, and Twilio added; Lemon Squeezy removed.
   • New items collected for the phone check before the first app: mobile number and time of verification (to prevent duplicate accounts; deleted when the account is closed — numbers that received welcome credits are kept as a one-way hash for 1 year after closing).
   • Beta sign-up data removed (the beta sign-up feature has ended), and collection of referral parameters (UTM) extended to the main landing page.