Privacy Policy
Effective date: 2026. 7. 30.
DelightLabs Inc. (the “Company”) establishes and publishes this Privacy Policy to protect users’ personal information and to handle privacy-related inquiries promptly and appropriately in accordance with the Personal Information Protection Act of the Republic of Korea and other applicable laws.
vooy is a service in which an AI agent interprets a user’s natural-language request received through a messenger environment such as Telegram, LINE, or KakaoTalk, performs the necessary tasks, and returns the result.
To provide the service, vooy may process the user’s request content, messenger channel identifiers, service usage records, agent execution records, and, where necessary, information associated with connected external services.
Article 1 (Purposes of Processing Personal Information)
The Company processes personal information for the purposes listed below. Personal information will not be used for purposes other than those stated below. If a purpose changes, the Company will take necessary measures, such as obtaining separate consent.
- Account registration and management: confirming registration intent, login, identity verification, maintaining and managing account status, responding to inquiries, and delivering notices
- Service provision: providing the messenger-based AI agent service, receiving and responding to user requests, interpreting requests from conversation context, planning and performing tasks, returning execution results, calling external services or connected tools, and providing user-visible conversation context and AI agent memory features
- External service connection and requested task execution: performing tasks requested by the user through connected external services, including search, reservation, ordering, and the management of documents, files, email, and calendars, as well as retrieving transportation, location, weather, and legal information
- Security and reliability: error analysis, incident response, prevention of misuse, security log management, and service health monitoring
- Service improvement: analysis of service usage statistics, quality improvement, and development of new features. The Company does not use users’ personal information or conversation content to train AI models. Article 11 takes precedence for Google API User Data, which is used only to provide or improve user-facing Google integration features.
- Marketing communications: sending product news, events, and benefits only where the user has separately opted in. Google API User Data is not used for marketing communications.
Article 2 (Categories of Personal Information Processed)
The Company processes the following categories of personal information.
| Category | Information processed |
|---|---|
| Account registration and identification | Messenger platform account information, user ID, messenger platform ID, nickname or profile name, email address, and similar information |
| Messenger channel information | Connected Slack, Telegram, or other channel IDs, conversation or thread identifiers, and identifiers required to send and receive messages |
| Conversation and request information | Messages, commands, request content, and the contents of attached documents or files provided by the user |
| Task execution information | AI agent execution process, external tool, API, or MCP call records, execution results, and error information |
| External service connection information | External service account information, authentication and connection information, sessions, or tokens required for a connection or requested task |
| Google API User Data | Google account identifiers; OAuth tokens; Gmail messages, metadata, labels, and drafts; Calendar events, calendars, and free or busy information; Drive files, folders, metadata, and permissions; Docs document content; Sheets cell and formatting information; Tasks task lists and tasks; Google API results; and data derived from them as necessary to perform user-requested features |
| AI agent memory information | Persistent preferences, settings, relationships, or facts organized for future responses based on an explicit memory request or information confirmed in a conversation |
| Automatically collected information | IP address, access time, service usage records, device and browser information, cookies or similar identifiers, and access logs |
| Marketing consent information | Email address, email marketing consent status, consent time, and the version of the consent notice shown |
Article 3 (Processing and Retention Periods)
The Company processes and retains personal information for the period prescribed by law or for the period consented to by the data subject when the information is collected.
The applicable processing and retention periods are as follows.
| Category | Retention period | Basis |
|---|---|---|
| Account information | Until account deletion | User consent |
| Conversation content | Deleted promptly after the service purpose is fulfilled, with a maximum retention period of 90 days | User consent |
| Google OAuth authentication information | Until the Google connection is disconnected or the account is deleted | User consent |
| Google service request data and original processing results | Deleted after the request is completed; if included in conversation history, retained for no longer than 90 days | User consent |
| AI agent memory derived from Google API User Data | Until the user requests deletion of the memory or deletes the account | User consent |
| Payment information | 5 years | Act on Consumer Protection in Electronic Commerce |
| Access records | 3 months | Protection of Communications Secrets Act |
| Consumer complaint and dispute records | 3 years | Act on Consumer Protection in Electronic Commerce |
| Marketing consent information | Until consent is withdrawn or the account is deleted | User consent |
Article 4 (Provision of Personal Information to Third Parties)
① The Company processes personal information only within the purposes specified in Article 1 and provides it to a third party only with the user’s consent or where specifically permitted by law.
② Because the service uses AI agents, the minimum information necessary to complete a user-requested task may be transmitted to an external service when the user asks the agent to act on that service or directs the agent to connect it. At the initial connection or execution stage, the Company provides required notices regarding the recipient, purpose, data categories, retention period, the right to refuse consent, and the consequences of refusal, and obtains consent where required.
| Recipient | Purpose | Information provided | Retention and use period |
|---|---|---|---|
| Google LLC | Google login and execution of user-requested tasks through connected Google services, including Google Calendar, Docs, Drive, Gmail, Sheets, and Tasks | Basic Google account information and content selected or entered by the user for the requested task, together with processing results | In accordance with the recipient’s policies |
| Catch Table, Yogiyo | Restaurant search, reservation, waitlist registration, ordering, and other user-requested tasks | Request content and information required to process a reservation, waitlist, or order, together with results | In accordance with each recipient’s policies |
| Charan, Naver Shopping | Product search, product information retrieval, and purchase or application-related requests | Search terms, request content, information required for the purchase or application, and results | In accordance with each recipient’s policies |
| KakaoMap, Modu Parking, Swing Taxi, Naver Flights, MyRealTrip, Korean weather services | Location- or schedule-based requests involving places, routes, parking, transportation, flights, travel, and weather | Addresses, place names, origin and destination, schedule, region, request content, and results | In accordance with each recipient’s policies |
| Shipment tracking services | Shipment status and related user-requested tracking | Tracking number, other information required for tracking, and results | In accordance with each recipient’s policies |
| Legal search services, web search services | Search of laws, cases, agency materials, web documents, and related information | Search terms, request content, and results | In accordance with each recipient’s policies |
③ Transfers of personal information to overseas third parties are described in Article 6.
Article 5 (Outsourcing of Personal Information Processing)
① The Company outsources the following personal information processing activities to provide the service.
| Processor | Processing activity | Subprocessor | Retention and use period |
|---|---|---|---|
| Cloudflare, Inc. | Service infrastructure, security, traffic management, and storage environment operation | As listed in Cloudflare’s privacy policy or subprocessor list | Until account deletion, termination of the processing agreement, or fulfillment of the processing purpose |
| OpenRouter, LLC | AI response generation, interpretation of user requests, and connection to AI model providers | AI model providers called through OpenRouter | Until account deletion, termination of the processing agreement, or fulfillment of the processing purpose |
| Mixpanel, Inc. | Service usage analytics and quality improvement. Google API User Data is excluded from this processing | As listed in Mixpanel’s privacy policy or subprocessor list | Until account deletion, termination of the processing agreement, or fulfillment of the processing purpose |
| RudderStack, Inc. | Collection, transmission, and operation of the service analytics environment. Google API User Data is excluded from this processing | As listed in RudderStack’s privacy policy or subprocessor list | Until account deletion, termination of the processing agreement, or fulfillment of the processing purpose |
| PostHog, Inc. | AI agent execution tracing, error analysis, and service quality and reliability improvement. Google API User Data is excluded from this processing | As listed in PostHog’s privacy policy or subprocessor list | Until account deletion, termination of the processing agreement, or fulfillment of the processing purpose |
| Google LLC | Google login and processing of user-requested tasks through connected Google services | As listed in Google’s privacy policy or subprocessor list | Until disconnection, termination of the processing agreement, or fulfillment of the processing purpose |
② When entering into an outsourcing arrangement, the Company documents requirements concerning prohibition of processing outside the outsourced purpose, technical and organizational safeguards, restrictions on subprocessors, supervision, and liability in the applicable agreement, terms, privacy documents, or equivalent records, and supervises the processor’s handling of personal information.
③ Where a processor engages a subprocessor, the Company requires the processor to obtain the Company’s approval. Current subprocessors may be found in the processor’s privacy policy, subprocessor list, or equivalent public documentation.
④ If outsourced activities or processors change, the Company will disclose the change through this Privacy Policy without undue delay.
⑤ Overseas outsourcing is described in Article 6.
Article 6 (Overseas Transfers of Personal Information)
The Company transfers personal information collected from service users overseas as described below. An overseas transfer may include storage, access, outsourced processing, third-party provision, or transmission over a network.
■ Legal basis for overseas transfer: Article 28-8(1)(3) of the Personal Information Protection Act
If a user refuses an overseas transfer, all or part of the service may be unavailable. A user who does not want an overseas transfer may disconnect an external service in the account or connection management screen or contact customer support to request account deletion, withdrawal of consent, or suspension of processing.
| Overseas recipient or processor and contact | Country | Information transferred | Purpose | Timing and method | Retention and use period |
|---|---|---|---|---|---|
| Cloudflare, Inc. (subprocessor, dpo@cloudflare.com) | United States | Account and usage information required to operate the service, encrypted Google API User Data and authentication information, access information, and security and error logs | Service infrastructure, security, traffic management, and storage environment operation | Transmitted over a network when the service is used | Until account deletion, termination of the processing agreement, or fulfillment of the processing purpose |
| OpenRouter, LLC (subprocessor, privacy@openrouter.ai) | United States | User requests and conversation content, the minimum Google API User Data needed to generate a response to a Google-connected request, and processing results | AI response generation, interpretation of user requests, and connection to AI model providers | Transmitted through encrypted communications when the service is used | Until termination of the processing agreement or fulfillment of the processing purpose |
| Mixpanel, Inc. (subprocessor, compliance@mixpanel.com) | United States | Service usage events, access and device information, anonymous or pseudonymous identifiers, and email address used for account identification. Google API User Data is excluded | Service usage analytics and quality improvement | Transmitted through encrypted communications when the service is used | Until account deletion, termination of the processing agreement, or fulfillment of the processing purpose |
| RudderStack, Inc. (subprocessor, privacy@rudderstack.com) | United States | Service usage events, access and device information, anonymous or pseudonymous identifiers, and email address used for account identification. Google API User Data is excluded | Collection, transmission, and operation of the service analytics environment | Transmitted through encrypted communications when the service is used | Until account deletion, termination of the processing agreement, or fulfillment of the processing purpose |
| PostHog, Inc. (subprocessor, privacy@posthog.com) | United States | User requests and conversation content, AI agent execution records, and bounded or de-identified tool call records. Google API User Data is excluded | AI agent execution tracing, error analysis, and service quality and reliability improvement | Transmitted through encrypted communications when the service is used | Until account deletion, termination of the processing agreement, or fulfillment of the processing purpose |
| Google LLC (subprocessor, data-protection-office@google.com) | United States | Basic Google account information and information required to process user-requested tasks through connected Google services | Google login and execution of connected Google service requests | Transmitted through encrypted communications during Google login, connection, or use | Until disconnection, termination of the processing agreement, or fulfillment of the processing purpose |
| Telegram Messenger Inc. (subprocessor, info@telegram.org) | British Virgin Islands | Telegram account and channel information, message content, and reply content | Sending and receiving Telegram messages and delivering user requests and responses | Transmitted over a network when Telegram is connected or messages are sent or received | Until disconnection, termination of the processing agreement, or fulfillment of the processing purpose |
| LY Corporation (subprocessor, ly-kr-representative@linecorp.com) | Japan | LINE account and channel information, message content, and reply content | Sending and receiving LINE messages and delivering user requests and responses | Transmitted over a network when LINE is connected or messages are sent or received | Until disconnection, termination of the processing agreement, or fulfillment of the processing purpose |
■ Legal basis for overseas transfer: Article 28-8(1)(1) of the Personal Information Protection Act
If a user refuses an overseas transfer, the relevant external connection feature may be unavailable. The user may disconnect the external service in the account or connection management screen or contact customer support to withdraw consent.
| Overseas recipient and contact | Country | Information transferred | Purpose | Timing and method | Retention and use period |
|---|---|---|---|---|---|
| An overseas external service provider described in Article 4 or a provider using overseas infrastructure | Country in which the external provider or its infrastructure is located | Information entered or connected by the user for the requested task, request content, and processing results | Execution of the external service connection or task directed by the user | Transmitted over a network when the service is connected or the task is executed | Until the user’s request is completed or the connection is disconnected, except where the recipient must retain it under applicable law or policy |
Article 7 (Deletion Procedures and Methods)
When personal information is no longer necessary because the retention period has expired or the processing purpose has been fulfilled, the Company deletes it without undue delay.
Electronic files are deleted using technical methods designed to prevent recovery or reconstruction. Paper records and other non-electronic records are shredded or incinerated.
Article 8 (Rights and Obligations of Data Subjects and How to Exercise Them)
A user may exercise the following privacy rights at any time.
- Request access to personal information
- Request correction of inaccurate information
- Request deletion
- Request suspension of processing
- Withdraw consent or delete the account
- Disconnect an external service
These rights may be exercised through the account or connection management screen, by emailing privacy@vooy.com, or through support@vooy.com. The Company will verify the requester’s identity and respond without undue delay.
Article 9 (Safeguards for Personal Information)
The Company implements the following measures to protect personal information.
- Organizational measures: establishing and implementing an internal privacy management plan, regular employee training, and supervision of processors
- Technical measures: access-right management and access controls for personal information systems, encryption of personal information, encrypted storage of authentication information and tokens, installation and updating of security software, and audit log management
- Physical measures: access controls for data centers, records storage rooms, and other physical storage locations
Article 10 (Special Provisions for AI Services)
- No use as training data: The Company does not use users’ personal information, conversation content, or Google API User Data to develop, improve, or train any AI or ML model.
- AI model provider settings: The Company configures and manages OpenRouter and AI model providers called through OpenRouter so that information received from the Company is processed only as necessary to provide the user-requested service and is not used to develop, improve, or train their own models.
- External service credentials: Authentication information, sessions, and tokens for connected external services are stored in encrypted form and are deleted or rendered unusable without undue delay when the user disconnects the service or requests deletion.
Article 11 (Special Provisions for Google API User Data)
- Definition and scope: “Google API User Data” means data that vooy receives directly from a user’s Google account through Google Workspace APIs and data derived from it. It includes the Google account identifiers, authentication information, Gmail, Calendar, Drive, Docs, Sheets, and Tasks data, and processing results described in Article 2.
- Access and use: The Company accesses and uses Google API User Data only to the minimum extent necessary to provide Gmail search, reading, draft, and label management; Calendar viewing and event management; Drive file search, reading, creation, and permission management; Docs document reading, creation, and editing; Sheets reading, entry, and editing; Tasks viewing, creation, editing, and completion; and to maintain or improve the reliability and quality of these user-facing Google integration, conversation context, and AI agent memory features.
- Storage and deletion: Google OAuth tokens are encrypted and retained until the Google connection is disconnected or the user deletes the account. Google service request data and original processing results are deleted after the request is completed, except that information included in conversation history may be retained for no longer than 90 days to provide that history to the user. If a persistent preference, setting, relationship, or fact useful to that user is identified from a response containing Google API User Data, vooy may retain only a concise derived memory for that user and not the original tool result. Such information is not combined with other users’ information to build a general-purpose database. The user may request deletion in a conversation or by emailing privacy@vooy.com, and the memory is deleted upon request or account deletion. When the Google connection is disconnected, related authentication information is deleted or rendered unusable.
- Limited transfers: Google API User Data may be processed by Cloudflare infrastructure and by OpenRouter and connected AI model providers only where necessary to provide a feature requested by the user. When a user asks the AI agent to summarize, draft, organize, or otherwise process Google data, only the minimum Google API User Data necessary to generate the result is processed, and it is not used to develop, improve, or train a model.
- Exclusion from analytics and marketing: Original Google API User Data, tool inputs or results, and derived content are not transmitted to Mixpanel, RudderStack, PostHog, or any advertising or marketing provider. Limited operational metadata that does not contain Google API User Data, such as feature type, success or failure status, and latency, may be processed solely to improve service quality and reliability.
- Prohibited uses and transfers: The Company does not use or transfer Google API User Data for marketing; advertising; ad targeting, retargeting, personalization, or interest-based advertising; sale; data brokering or information resale; building a cross-user or general-purpose database; credit, lending, or eligibility decisions; or the development, improvement, or training of any AI or ML model, including a generalized or non-personalized model.
- Restrictions on human access: Company personnel do not read Google API User Data unless the user has affirmatively agreed to access to specific data for support, access is necessary to investigate a security issue or misuse, access is necessary to comply with applicable law, or the data, including derivations, has been aggregated and anonymized for internal operations.
- Compliance with Google policy: vooy’s use and transfer to any other app or service of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Google Workspace APIs are not used to develop, improve, or train generalized or non-personalized AI or ML models.
Article 12 (Cookies and Similar Technologies)
The Company may use cookies or similar identifiers to maintain login state, analyze service usage, trace errors, and provide customized service features. Google API User Data is not used for cookie-based analytics or customized service features.
Users may refuse cookies through their browser settings. Refusing cookies may limit login persistence, security verification, or certain service features.
Article 13 (Chief Privacy Officer)
The Company designates the following point of contact to oversee personal information processing and respond to privacy complaints and requests.
- Chief Privacy Officer
- Email: privacy@vooy.com
- Support: support@vooy.com
Article 14 (Remedies for Infringement of Rights)
Users may contact the following organizations for dispute resolution or consultation regarding a privacy infringement.
- Personal Information Dispute Mediation Committee: 1833-6972, www.kopico.go.kr
- Personal Information Infringement Report Center: 118, privacy.kisa.or.kr
- Cyber Investigation Division of the Supreme Prosecutors’ Office: 1301, www.spo.go.kr
- National Police Agency Cyber Bureau: 182, ecrm.police.go.kr
Article 15 (Changes to This Privacy Policy)
This Privacy Policy takes effect on July 30, 2026. The Company will provide advance notice of changes through a service notice or email.
Privacy Policy change history
This Privacy Policy applies from 2026. 8. 11..
Previous Privacy Policy versions are available below.