Privacy Policy

RRLLAB ("Company") complies with the Personal Information Protection Act and other applicable laws of the Republic of Korea, and has established and published this Privacy Policy to protect the personal information of users. This Policy applies to the application "Omni AI Workspace" (displayed in-app as "Omni Workspace") ("Service") provided by the Company, and applies equally to the desktop app (Windows, macOS) and the mobile app (iOS, Android).

Article 1 (Personal Information Collected and Collection Methods)

1. Information Received at Sign-In

The Service offers sign-in with a Google account or an Apple account, and receives the following information from each provider:

Based on this information, the Company generates its own internal user identifier (a Supabase user UUID). The Company does not collect or store the password of the user's Google or Apple account.

If a user selects "Hide My Email" during Apple sign-in, the Company receives a private relay address generated by Apple (@privaterelay.appleid.com) instead of the user's actual email address. In that case the Company cannot know the user's real email address, and customer support communications and identity verification are carried out using that relay address.

2. Information Generated or Collected During Use of the Service

• Account identifier, subscription status (Free/Pro), free trial usage, coupon/promo code usage history
• If the sync feature is used: workspace settings, memos, favorites, user prompts
• Session tokens for Service authentication (stored on the device, protected using the operating system's secure storage feature)

3. Payment-Related Information

The Company does not process payments directly. Depending on the channel through which the user pays, payment is handled in one of the following two ways. The two channels never apply at the same time.

(1) Payments made on the Company's website or in directly distributed apps — payment service provider (Polar)

• Information the Company sends to Polar: email address, the Company's internal user identifier, selected product information (monthly/annual)
• Information the Company receives from Polar: payment/subscription identifiers, subscription status, product type (monthly/annual), billing cycle, current billing period end date, subscription change/cancellation events

(2) In-app purchases made through an app marketplace (App Store, Mac App Store, Google Play, etc.) — the app marketplace operator and a subscription management tool (RevenueCat)

• Information the Company sends to RevenueCat: the Company's internal user identifier, and the purchase receipt or purchase token issued by the app marketplace
• Information the Company receives from RevenueCat: subscription status, product type (monthly/annual), the app marketplace where the purchase was made, current billing period end date, subscription renewal/cancellation/refund events, transaction identifiers
• In the course of this processing, the RevenueCat SDK also processes device type and operating system information and the time the user last used the app

In neither channel does the Company collect actual payment method details such as card numbers; these are processed directly by Polar or by the relevant app marketplace operator. For in-app purchases, the party to whom the user pays is the app marketplace operator, and the handling of that payment and billing information is governed by that operator's own privacy policy. For further information regarding the Company's relationship with Polar and RevenueCat, please refer to Articles 4, 5, and 6.

4. Information Collected via Customer Support Inquiries

When using the "Contact Us" feature within the settings screen, the following information is collected and delivered by email:

• Email address
• Inquiry subject and message content

Inquiry content is transmitted through an email delivery service located overseas (see Article 6). Users should avoid including sensitive information such as passwords, authentication tokens, national ID numbers, or payment method details in inquiry messages.

5. Automatically Collected Information

• The Service does not currently use cookies for advertising or analytics purposes. If analytics tools are introduced in the future, this Policy will be amended and users will be notified in advance. However, External AI Services used within web slots in the Service may use their own cookies or similar storage technologies for login persistence, service provision, analytics, and other purposes, and such processing is governed by each External AI Service's own privacy policy.
• In apps that include in-app purchases, the RevenueCat SDK processes device type and operating system information and the time the user last used the app, as described in Article 1(3)(2). This information is used solely to confirm subscription status and to resolve payment issues.
• Server (Supabase, Edge Function) access and error logs may record the date/time of access and error details. Such logs are handled so that authentication credentials (tokens, etc.) or the original content of user input are not retained.

Article 2 (Purposes of Collection and Use of Personal Information)

The Company uses collected personal information for the following purposes:

1. Member identification and Service account management
2. Processing of paid subscription (Pro) payments, subscription status management, automatic renewal and cancellation
3. Synchronization of workspace, memo, prompt, and favorites data across devices
4. Responding to customer inquiries and handling complaints
5. Preventing fraudulent use of the Service and maintaining security
6. Fulfilling obligations under applicable law

The Company does not use content that users input into or synchronize with the Service for the purpose of training or improving its own artificial intelligence models.

Article 3 (Processing and Retention Period of Personal Information)

1. In principle, the Company destroys users' personal information without delay once the purpose of collection and use has been achieved.
2. Users may request withdrawal and deletion of their personal information at any time using the account deletion feature within the Service (Settings → Privacy → Delete account). In this case, the user's email, profile information, and Service usage data such as workspaces, memos, and prompts are destroyed without delay.
3. However, the following information is retained separately from other personal information for the periods below in accordance with applicable law, and is not used for any purpose other than the stated retention purpose.

1. Where payment-related records for the above retention periods are held by Polar, an app marketplace operator, or RevenueCat rather than the Company, each of those parties' own privacy policies and retention periods apply.
2. The Service database does not currently operate scheduled backups. If a backup feature is introduced in the future, any personal information contained in backups will be used only for recovery purposes and will be deleted on a defined schedule; the retention period will be reflected and disclosed in this Policy at that time.

Article 4 (Provision of Personal Information to Third Parties)

In principle, the Company does not provide users' personal information to third parties. Exceptions are made where permitted by applicable law, or where the Company has disclosed the necessary matters to users and obtained a lawful basis.

Polar is not simply a payment processing vendor engaged by the Company. Polar acts as an independent Merchant of Record that sells the product directly to buyers and issues invoices in its own capacity. Accordingly, personal information handled by Polar (such as payment method and billing information) is governed by Polar's own privacy policy, which users may review before making a payment.

Where a user makes an in-app purchase through an app marketplace, the counterparty to that purchase is the app marketplace operator. The user's payment method and billing information are handled directly between the user and that operator; the Company neither collects nor receives them. The handling of that information is governed by each app marketplace operator's own privacy policy.

Article 5 (Outsourcing of Personal Information Processing)

The Company outsources the following personal information processing tasks to ensure smooth provision of the Service:

The Company supervises and manages the personal information processing status of its processors in accordance with applicable law, and implements necessary measures for personal information protection, including prohibiting the processing of personal information for purposes other than the outsourced task and applying appropriate security measures.

Article 6 (Overseas Transfer of Personal Information)

The primary data storage location for the Service's infrastructure is Seoul, Republic of Korea (Supabase project region: Seoul). However, certain features used by users involve the transfer of personal information overseas as described below.

Polar Software, Inc.

• Personal information transferred: email address, Service user identifier, selected product information (monthly/annual)
• Destination country: United States
• Timing and method of transfer: transmitted over the network at the time a paid subscription payment is made on the Company's website or in a directly distributed app
• Recipient's contact information: privacy@polar.sh / 3500 South DuPont Highway, Dover, DE 19901, USA
• Purpose of transfer: payment processing and subscription management
• Basis for transfer: necessary for the performance of the paid subscription contract requested by the user (Article 28-8(1)(3) of the Personal Information Protection Act)
• Retention and use period: per Polar's privacy policy (polar.sh/legal/privacy-policy) and applicable law

RevenueCat, Inc.

• Personal information transferred: Service user identifier, purchase receipt or purchase token issued by the app marketplace, device type and operating system information, time of last use
• Destination country: United States (stored in Amazon Web Services US regions)
• Timing and method of transfer: transmitted over the network when an in-app purchase is made through an app marketplace or when subscription status is checked
• Recipient's contact information: compliance@revenuecat.com / 1032 E Brandon Blvd #3003, Brandon, FL 33511, USA
• Purpose of transfer: validation of in-app purchase receipts and management of subscription status
• Basis for transfer: necessary for the performance of the paid subscription contract requested by the user (Article 28-8(1)(3) of the Personal Information Protection Act)
• Retention and use period: per RevenueCat's privacy policy (revenuecat.com/privacy) and the applicable processing agreement

Resend (Plus Five Five, Inc.)

• Personal information transferred: inquirer's email address, inquiry subject and message content
• Destination country: United States
• Timing and method of transfer: transmitted over the network at the time an inquiry or bug report is submitted
• Recipient's contact information: privacy@resend.com / 2261 Market Street #5039, San Francisco, CA 94114, USA
• Purpose of transfer: delivery of customer inquiry and bug report emails
• Basis for transfer: necessary to handle the customer support request made by the user (Article 28-8(1)(3) of the Personal Information Protection Act)
• Retention and use period: retained for the duration of the service agreement with Resend, and deleted within 90 days after termination of that agreement

The above overseas transfers occur only to the extent necessary to perform the contract for the service the user has requested (paid subscription payment, contact form submission). Where separate consent is required under applicable law, the Company obtains such consent from the user in advance. If a user does not use the relevant feature, the corresponding overseas transfer does not occur.

Payment method and billing information that a user provides directly to an app marketplace operator during an in-app purchase is separate from the transfers described above; it is handled by each app marketplace operator under its own policies, and the Company is not involved in that processing.

Article 7 (Relationship with External AI Services)

1. The Service helps users access multiple external AI web services — including Claude, ChatGPT, Gemini, Grok, and Perplexity ("External AI Services") — together within a single application screen.
2. Content that a user inputs, uploads, or exchanges directly with an External AI Service through a web slot is transmitted directly to that External AI Service. The Company does not separately collect or store such conversation content, uploaded files, or the passwords for External AI Service accounts.
3. The manner of processing, retention period, and provision to third parties of information a user inputs into an External AI Service are governed by that External AI Service provider's own privacy policy, and users should review that policy before using each service.
4. The feature that allows a user to send a selected file to an External AI Service processes that file on the user's device; the file is not stored on the Company's servers.
5. However, content that a user saves using the Service's own memo, prompt library, or workspace synchronization features is stored on the Company's server infrastructure (Supabase) and is subject to this Policy.
6. The Service stores login sessions for each External AI Service in a separate storage area, and access to that session information is blocked when a user switches to a different Omni account or logs out.

Article 8 (User Rights and How to Exercise Them)

1. Users may request access to, correction of, deletion of, or suspension of processing of their personal information at any time.
2. Such rights may be exercised through the account deletion feature within the Service (Settings → Privacy → Delete account), or by email as described in Article 11. The Company will take action without delay in accordance with applicable law.
3. Where a user requests account deletion, the treatment of any active paid subscription is governed by applicable law and the Refund & Subscription Policy. For subscriptions purchased on the Company's website or in a directly distributed app, the Company maintains procedures intended to prevent automatic payment renewal from unintentionally continuing after account deletion. However, a subscription purchased through an app marketplace belongs to that app marketplace account and cannot be canceled by the Company; the user must cancel it directly in the app marketplace in order to stop automatic renewal.
4. Where a user is 18 years of age or older but is considered a minor under the laws of their place of residence and uses the Service with parental consent, the parent or legal guardian may exercise the same rights as the user with respect to that minor's personal information.

Article 9 (Personal Information of Users Under 18)

The Service does not permit use by individuals under the age of 18, and the Company does not knowingly collect personal information from users under 18. If the Company becomes aware that it has collected personal information from a user under 18, it will take necessary measures, including prompt deletion of such information, in accordance with applicable law.

Article 10 (Measures to Ensure the Safety of Personal Information)

In accordance with Article 29 of the Personal Information Protection Act, the Company implements the following measures to ensure the safety of personal information:

1. Minimizing access privileges to personal information and applying per-user server access controls
2. Applying encryption in transit (TLS, etc.)
3. Applying necessary protective measures for Service authentication information, including the operating system's secure storage features (e.g., encrypted local storage) and encrypted communications
4. Restricting per-user data access through database access controls
5. Storing login sessions separately for each External AI Service, and blocking access to session information upon logout or account switching
6. Verifying signatures on incoming payment-related webhooks to prevent tampering
7. Validating app marketplace purchase receipts on the server and linking a subscription only to the user's own account identifier, preventing a subscription from being attached to another person's account
8. Masking authentication credentials and user content in access and error logs
9. Operating incident response and notification procedures in the event of a security incident

Article 11 (Data Protection Officer)

The Company has designated a Data Protection Officer, as set out below, who is responsible for overseeing personal information processing and handling user complaints and remedies.

• Name: Heunggi Kim
• Title: Representative
• Email: contact@rrllab.com

Users may direct any inquiries, complaints, or requests for remedy relating to personal information arising from use of the Service to the contact information above, and the Company will respond and take action without delay.

Article 12 (Remedies for Infringement of Rights)

Users may contact the following organizations for reports or consultations regarding infringement of personal information rights. (The contact details below may change at the discretion of the relevant organizations; please verify the most current information before use.)

• Personal Information Dispute Mediation Committee: 1833-6972 (no area code) (kopico.go.kr)
• Personal Information Infringement Report Center: 118 (no area code) (privacy.kisa.or.kr)
• Supreme Prosecutors' Office: 1301 (no area code) (spo.go.kr)
• Korean National Police Agency Cyber Crime Reporting System: 182 (no area code) (ecrm.police.go.kr)

Article 13 (Automated Decision-Making)

The Company does not make decisions that have a material effect on a user's rights or obligations based solely on automated processing. However, the reflection of subscription status and subscription period may be processed automatically based on information received from the payment service provider (Polar) or from app marketplaces and the subscription management tool (RevenueCat), together with pre-established criteria. Users may request confirmation and correction of such results through the contact information in Article 11.

Article 14 (Changes to this Privacy Policy)

1. This Policy may be added to, deleted from, or amended due to changes in applicable law, policy, or security technology.
2. Where this Policy is amended, the Company will announce the change at least 7 days before the effective date (or at least 30 days before the effective date for changes that materially affect user rights) through an in-Service notice or on its website.

This Policy is effective as of September 1, 2026.