Privacy Policy
施行日 2026-10-25
この文書の日本語版は準備中です。英語版を表示しています（韓国語版が優先されます）。
This English version is provided for convenience. In case of any conflict, the Korean version prevails.
HyperReality Co., Ltd. (the "Company") complies with the Personal Information Protection Act of Korea and other applicable laws in providing Golem (golem.so and console.golem.so, the "Service"), a service for hiring AI coworkers and delegating work to them. This Privacy Policy explains what personal information we process, why, for how long, and with whom we share or entrust it.
At a glance
| What | Details |
|---|---|
| Information we collect | Google account email and name, Service usage records, connected channel and worker information, payment records (for paid use), usage analytics information (cookies, usage behavior, screen interaction records) |
| How we use it | Sign-in, running organizations (workspaces) and AI coworkers, customer support, billing, security and incident response |
| AI training | We never use customer data to train AI models. We send data to AI providers only under terms that prohibit training |
| Who we entrust it to | Cloud, sign-in, AI, operational alerts, payments, usage analytics (Google Analytics, Amplitude, Microsoft Clarity): see Articles 4 and 5 |
| Retention | Until you delete your account. Only records required by law are kept for the legally required period |
| Contact | Privacy Officer Juyoung Kang · support@golem.so |
The Company's two roles
The Service is a tool used by businesses and teams. Within the same Service, the Company's role depends on the information.
| Information | Company's role | Governing document |
|---|---|---|
| Member account information, access logs, payment records, inquiries | Controller: the Company decides the purposes and means | This Privacy Policy |
| Work that customers (the organizations or businesses Members belong to) assign to AI coworkers and its materials, "Customer Data". Examples: issues and task instructions, run records, outputs and reports, uploaded documents, messages exchanged with AI coworkers in connected channels (Discord, KakaoTalk Channels, etc.) and the senders' display names and identifiers | Processor: processed only to provide the Service, as the customer instructs | The customer's privacy policy and the Terms of Service between the Company and the customer (Customer Data provisions) |
Please send requests to access or delete personal information inside Customer Data (for example, the name and messages of someone who asked a question through a KakaoTalk Channel) to the relevant customer first. If such a request reaches us, we forward it to that customer.
Article 1 Personal information processed: items, purposes, legal bases, and retention
| When | Items | Purpose | Legal basis | Retention |
|---|---|---|---|---|
| Sign-up and sign-in (Google sign-in) | Email, name, profile image | Member identification, sign-in, notices | Performance of contract (Art. 15(1)(4)) | Until account deletion |
| Running an organization | Organization name, members and their roles | Running organizations (workspaces), permission management | Performance of contract | Until the organization is deleted |
| Use of the Service | Access IP, browser information (User-Agent), access time, usage records, error logs | Security, fraud prevention, incident response | Legitimate interests (Art. 15(1)(6)) | 1 year (access logs at least 3 months under the Protection of Communications Secrets Act) |
| Connecting a worker | Worker name, device information (OS, host name), token hash, last connection time | Connecting computers that run AI coworkers, security auditing | Performance of contract | Until the worker is deleted or the account is deleted |
| Connecting channels and external tools (optional) | Discord server, channel, and role identifiers, KakaoTalk Channel connection details, external tool credentials registered by the Member (credentials stored encrypted) | Handling channels and running integrations as the Member directs | Performance of contract | Until disconnected or account deletion |
| Sales inquiries (inquiry form, email) | Name, email, company name, inquiry content, the page address the inquiry was sent from and the previously visited page (referrer) | Responding to inquiries, consultation | Steps requested before entering a contract (Art. 15(1)(4)) | 3 years after resolution |
| Usage analytics (collected automatically, landing and console) | Cookie and device identifiers, member ID (when signed in; a value derived from your email), usage behavior such as visits, clicks, and scrolls, referral source (ad or search source), device, browser, and OS information, approximate location (country, city), screen interaction records (session recordings) | Service usage statistics, feature improvement, identifying errors and usability issues | Legitimate interests (Art. 15(1)(6)) | Per-tool retention in the Article 5 table |
| Paid payments (Korea) | Amount and time of payment, plan, payment status, transaction identifier returned by the payment processor (the Company does not receive card numbers) | Billing, refunds, issuing tax invoices and receipts | Performance of contract, legal obligation (Art. 15(1)(2)) | 5 years (E-Commerce Act) |
| Paid payments (overseas) | Email, country, plan, payment status, transaction and subscription identifiers returned by Paddle (Paddle receives card details directly; the Company does not) | Reflecting subscription status, handling refunds | Performance of contract | 5 years (E-Commerce Act) |
- We do not send email addresses, names, or phone numbers to analytics tools. Signed-in members are distinguished by a member ID derived from their email. Because someone who knows the same email can recreate and match this ID, the Company treats it as personal information.
- Session recordings capture mouse movements, clicks, scrolls, and page layout. Text typed into input fields, the console's content and conversation areas (where Customer Data appears), and member email addresses are masked.
Records kept under law are stored separately from other information and used only for that purpose.
| Record | Period | Basis |
|---|---|---|
| Records on contracts or withdrawal of offers | 5 years | E-Commerce Act |
| Records on payments and supply of goods | 5 years | E-Commerce Act |
| Records on consumer complaints or dispute resolution | 3 years | E-Commerce Act |
| Website visit (sign-in) records | 3 months | Protection of Communications Secrets Act |
Article 2 Processing of Customer Data
- The Company processes Customer Data only to provide the Service, maintain security, and comply with law, and does not use it for any other purpose or provide it to third parties.
- If Customer Data contains personal information (for example, the name and messages of someone who asked an AI coworker a question through a connected channel), the customer is responsible for having a legal basis to collect it and for telling the data subject that an AI is responding.
- When a customer deletes an organization or the agreement ends, the Company gives the customer 30 days to export (download) Customer Data and then destroys it. Copies remaining in backups are deleted according to the backup cycle (up to 30 days).
- At the request of business customers, we enter into a data processing agreement (DPA).
Article 3 AI Coworkers
- AI coworkers are agents that run on generative AI (Anthropic Claude). To do the work a Member assigns, they read task instructions, related materials, and messages in connected channels, and produce results.
- When an AI coworker works, its inputs and outputs are sent to the AI provider. The Company stores run records and outputs as console records until the Member deletes them or the organization is deleted.
- The Company does not use Customer Data or AI coworker inputs and outputs to train AI models. The Company uses its AI account only under commercial (API) terms under which the provider does not train on inputs.
- If a Member runs a worker on their own computer with their own AI account, processing by the AI provider is governed by the terms between the Member and that provider and the Member's account settings, and the Company is not involved in that transfer.
- If AI output is inappropriate or incorrect, please let us know at support@golem.so. We will review it, take action, and reply with the result.
- Please do not assign AI coworkers work involving sensitive information such as resident registration numbers or health information.
Article 4 Entrustment of personal information processing
| Processor | Entrusted task |
|---|---|
| Google LLC | Google account sign-in (authentication) |
| HyperReality Co., Ltd. (self-operated cloud "zerocloud") | Service servers, databases, file storage, and workers operated by the Company |
| Anthropic PBC | Running AI coworkers, when workers operated by the Company are used |
| Discord Inc. | Delivering operational alerts (internal alerts to operators: masked email, organization and AI coworker names, error summaries) |
| Payple Co., Ltd. | Processing payments in Korea |
| Google LLC | Website and Service usage analytics (Google Analytics) |
| Amplitude, Inc. | Service usage analytics (event and referral aggregation) |
| Microsoft Corporation | Usage behavior analytics (Microsoft Clarity: heatmaps and session recordings) |
Overseas payments are processed directly by Paddle.com as the Merchant of Record, so they are a provision to a third party under Article 6, not an entrustment.
Transfers to external services that users connect themselves (Discord servers, KakaoTalk Channels, external tools registered by the Member, and AI accounts used by a worker on the Member's computer) are made at the user's direction, not entrusted by the Company. Their processing is governed by the terms between the user and that service.
If our processors change, we will amend and announce this Privacy Policy.
Article 5 Overseas transfer of personal information
To provide the Service (perform the contract), the Company entrusts the storage and processing of personal information overseas as follows (Art. 28-8(1)(3)). Transfers occur over the network when you use the Service.
| Recipient (contact) | Country | Items | Purpose | Retention | How to refuse and effect |
|---|---|---|---|---|---|
| Google LLC (privacy.google.com) | United States | Email, name, profile image | Google sign-in | Until account deletion | To refuse, do not sign up. Google is currently the only sign-in method, so you cannot use the Service if you refuse |
| Anthropic PBC (privacy@anthropic.com) | United States | AI coworker inputs (task instructions, related materials, channel messages) and outputs | Running AI coworkers (when workers operated by the Company are used) | Deleted after up to 30 days under the provider's policy; not used for training | This transfer does not occur if you run AI coworkers on a worker on your own computer with your own AI account |
| Discord Inc. (discord.com/privacy) | United States | Masked email, organization and AI coworker names, error summaries | Internal alerts to operators | 1 year | These internal alerts are necessary to operate the Service and cannot be refused separately. If you do not want this, stop using the Service or contact support@golem.so |
| Google LLC (privacy.google.com) | United States | Cookie identifiers, member ID (when signed in), pages visited, usage behavior, device and browser information, approximate location | Usage analytics (Google Analytics) | 14 months from collection | You can refuse using the methods in Article 8; refusing does not affect your use of the Service |
| Amplitude, Inc. (privacy@amplitude.com) | United States | Device identifiers, member ID, usage behavior, referral source, device and browser information | Usage analytics | 14 months from collection, then deleted without delay | Same as above |
| Microsoft Corporation (aka.ms/privacyresponse) | United States | Screen interaction records (session recordings and heatmaps, excluding input), cookie identifiers, member ID, device and browser information | Usage behavior analytics (Microsoft Clarity) | 30 days after recording (some samples up to 9 months) | Same as above |
Transfers to analytics tools occur over the network each time you view the Service. Records of your first AI coworker hire and of sales inquiries are also sent to Amplitude, and records of your first AI coworker hire to Google Analytics (GA4), from the Company's servers.
Article 6 Provision of personal information to third parties
The Company does not provide personal information to third parties except with the data subject's consent or where specifically permitted by law.
| Recipient | Country | Items | Purpose | Retention |
|---|---|---|---|---|
| Paddle.com Market Limited (paddle.com/legal/privacy) | United Kingdom | Email, country, plan purchased, payment details (received directly by Paddle) | Processing payments, taxes, and refunds as the Merchant of Record for overseas payments | According to Paddle's privacy policy |
When you pay from overseas, we ask for your consent to this provision on the checkout screen. If you do not consent, you can use domestic payment.
Article 7 Destruction of personal information
- We destroy personal information without delay once the retention period ends or the purpose is achieved.
- Electronic files are deleted in a way that cannot be recovered, and paper documents are shredded or incinerated.
- After account deletion, we keep the information for 30 days so the account can be restored if deleted by mistake, and then destroy it. Records required by law are stored separately for the periods in Article 1.
Article 8 Cookies and other automatic collection tools
- The Service uses essential cookies (or browser storage) to keep you signed in.
- On the landing site (golem.so) and the console, the following tools set cookies (or browser storage) for usage analytics. The Company views this information only as statistics that do not identify individuals and to improve the Service.
| Tool (vendor) | Example cookies | Purpose |
|---|---|---|
| Google Analytics (Google LLC) | _ga, _ga_<property> |
Visit and page statistics |
| Amplitude (Amplitude, Inc.) | AMP_…, AMP_MKTG_… |
Device identifier and session, referral source |
| Microsoft Clarity (Microsoft Corporation) | _clck, _clsk (Company domain), MUID etc. (Microsoft domains) |
Session recordings and heatmaps, browser identification across Microsoft sites |
| Company (browser storage) | golem:first-touch |
Records the first referral source (ad or search source, first landing page). Cleared when you sign out |
We partner with Microsoft Clarity to capture how you use and interact with our website through behavioral metrics, heatmaps, and session replay to improve the Service. Website usage data is captured using first and third-party cookies and other tracking technologies, and Microsoft may also use this information to provide Microsoft services, including Microsoft Advertising. For more information about how Microsoft collects and uses your data, see the Microsoft Privacy Statement (privacy.microsoft.com/privacystatement).
How to refuse: refusing analytics cookies does not affect your use of the Service. If you refuse essential cookies, you will not stay signed in.
- Browser settings: Chrome Settings → Privacy and security → Third-party cookies / Safari Settings → Privacy / Edge Settings → Cookies and site permissions
- Google Analytics: the Google Analytics Opt-out Browser Add-on (tools.google.com/dlpage/gaoptout)
- Microsoft Clarity: choose Microsoft at optout.aboutads.info, or turn on Global Privacy Control (GPC) in your browser
Article 9 Children under 14
The Service does not accept sign-ups from children under the age of 14. If we find that a user is under 14, we delete the account without delay.
Article 10 Rights of data subjects and how to exercise them
- Data subjects may at any time request access to, correction or deletion of, suspension of processing of, or transfer of their personal information, or withdraw consent.
- For requests to access, correct, or delete, and for account deletion, email support@golem.so and we will process the request within 10 days.
- You may also exercise these rights through an agent (a legal representative or an authorized person), who must submit a power of attorney.
- You cannot request deletion of information that other laws require us to retain.
Article 11 Automated decisions
The Company does not make decisions that significantly affect data subjects' rights or obligations in a fully automated way. When an account is restricted through fraud detection, a person reviews it.
Article 12 Security measures
- Administrative: an internal management plan, minimizing who has access, regular reviews
- Technical: access control, encryption in transit (HTTPS), encrypted storage of external integration credentials, worker tokens authenticated by hash only, masking of email addresses in operational alerts, masking of input and content areas in session recordings, retention of access logs
- Physical: access control for servers and data storage locations
Article 13 Privacy Officer
- Privacy Officer: Juyoung Kang (CEO)
- Email: support@golem.so
- Phone: +82 507-0178-7546
Article 14 Remedies for infringement
If you need counseling or dispute resolution regarding infringement of personal information, you may contact the following agencies (services are provided in Korean).
- Personal Information Infringement Report Center (Korea Internet & Security Agency): privacy.kisa.or.kr / 118 (in Korea)
- Personal Information Dispute Mediation Committee: www.kopico.go.kr / 1833-6972
- Supreme Prosecutors' Office Cyber Investigation Division: www.spo.go.kr / 1301 (in Korea)
- Korean National Police Agency Cyber Bureau: ecrm.police.go.kr / 182 (in Korea)
Article 15 Changes to this Privacy Policy
- This Privacy Policy takes effect on 2026-10-25.
- If it changes, we announce the change on the Service 7 days before it takes effect. For changes important to data subjects' rights, such as adding collected items or providing data to third parties, we announce them 30 days in advance and obtain consent again where necessary.
- To obtain a previous version of this Privacy Policy, email support@golem.so.
Addendum
- This Privacy Policy takes effect on 2026-10-25.
- Revision history
- 2026-10-25: Updated collected items (Article 1), entrustment (Article 4), overseas transfers (Article 5), and cookies (Article 8) for the introduction of usage analytics tools (Google Analytics, Amplitude, Microsoft Clarity). Aligned the items collected by the sales inquiry form with actual practice.
- 2026-10-13: Established