Privacy Policy

1. Information We Process and Why

Social channel information is received within the scope you allowed on the official authorization screen. If photos or posts contain other people's personal information, please make sure you have the right to post or share it. Moyeo does not receive your Instagram, Threads or YouTube account passwords. Features that do not depend on an optional profile photo or social channel connection can be used without them.

When sending an inquiry, you do not re-enter your email address. The email address and display name used for replies are not stored in the inquiry record; they are read from your signed-in account information and included only in the notification email sent to the operator. The screen and browser information sent with the inquiry text are used to re-check the same issue and are kept for only 3 years, even after the inquiry has been answered.

The reason survey shown when you delete your account or cancel a subscription is optional and is used to improve the service; your account deletion or cancellation proceeds even if you do not submit it. Free-text comments are stored encrypted, and 3 years after submission we delete the free-text comments and the link to the respondent, keeping only anonymous reason statistics. When you delete your account, we immediately remove the link between your responses and your account.

Moyeo does not collect personal information of children under 14. At sign-up we receive your self-declaration that you are 18 or older, and if we learn that a child under 14 has signed up, we delete the account and information after verification.

Use of personal information for marketing purposes and receipt of promotional emails are optional, and you can use the service without consenting. You can withdraw at any time in account settings. We currently do not send promotional emails, but we provide the ability to choose and change whether to receive them. For details, see the Marketing and Promotional Email Notice.

2. Retention Period and Destruction

Personal information is destroyed without delay once the purpose of processing has been fulfilled. Deleting an account deletes the linked posts, media, comments, statistics, AI suggestions and authentication data, and disconnecting a channel deletes that channel's scheduling and publishing records, comments, statistics, AI suggestions and authentication data, in sequence, so the time of receipt and completion may differ. Posts written in Moyeo remain after a channel is disconnected, and their photos and videos remain in the library and follow the file retention rules below. However, to enforce the plan's channel limit, the record showing which channels a workspace first connected (workspace identifier, provider and channel identifier, time of first connection) remains even after the channel is disconnected, for as long as the workspace is maintained.

Photos and videos you upload are kept while they are attached to a post or used by a schedule, workspace or profile. Files not used anywhere are deleted after 7 days, and files that failed inspection are deleted after 1 day. After publishing ends, the original of a file is kept for the retention period of the workspace's plan (Free 30 days, Pro 90 days, Team 180 days) from the day its last publishing ended, and then deleted. After the original is deleted, the preview is kept for as long as the publishing record remains. When a channel is disconnected, we release the usage marks from that channel's schedules and publishing, and these rules apply from then on. Deleting an original does not delete posts already published to Instagram, Threads or YouTube.

Records Retained Under Law

When records constituting electronic commerce arise, they are kept for the following periods and managed separately from general service use purposes (Article 6 of the Enforcement Decree of the Act on the Consumer Protection in Electronic Commerce).

• Records of labeling and advertising: 6 months
• Records of contracts or withdrawal of subscription: 5 years
• Records of payment and supply of goods, etc.: 5 years
• Records of consumer complaints or dispute resolution: 3 years

Retention is limited to the records needed to verify the relevant transaction or dispute. Not every activity record of every member is kept for the same period.

Destruction Procedure and Method

• Time of destruction: Information is destroyed when the retention period ends or the purpose of processing has been achieved, or when you request deletion and verification is complete.
• Destruction procedure: After identifying the information to be destroyed, it is destroyed with the confirmation of the Chief Privacy Officer, and the result is recorded.
• Electronic files: Deleted from databases and storage, or identifying information is removed, so that it cannot be recovered or reproduced. Items stored encrypted are deleted together with their ciphertext.
• Printed materials: If paper documents or similar are produced, they are shredded or incinerated.
• Backups: Information remaining in disaster recovery backups disappears as the backups rotate once the retention period below has passed.

Database backups for disaster recovery are kept for 7 days and then deleted automatically, and are never used for any purpose other than recovery.

3. Provision to Third Parties

Redband does not provide personal information to third parties without your consent or a legal basis. When you request tasks such as posting, replying or deleting, or turn on auto-reply, we provide content and identifiers to the relevant platform as described below to carry out that request. This is provision to a third party at your request, and since all recipients below are overseas businesses, their country, retention period and how to refuse are also disclosed in the cross-border provision table in §5. Processing and deletion after provision are governed by each platform's policies.

If you do not want this provision, you can choose not to request the task or disconnect the channel. Once disconnected, posting and comment tasks for that channel are not provided. Redband does not sell user data and does not provide data from connected channels for third-party ad targeting.

3-2. Information Processed on Your Behalf

For comments, replies and mentions on channels you have connected and their authors' display names and account identifiers, replies and DMs sent by comment auto-reply and their results, and received DMs checked and replies sent by DM auto-reply (hereinafter "commenter information"), you are the personal information controller and Redband processes it as entrusted by you. This relationship follows Article 5-4 of the Terms of Service.

The information processed on your behalf and its purposes and retention are as follows.

• Comment and reply text on connected channels and the author's display name and account identifier: used for viewing comments, replying, comment auto-replies and displaying performance. Follows the comment history period and is deleted when the channel is disconnected.
• DM text, sender identifier and sent time of DMs received on channels with DM auto-reply turned on: used only for DM auto-reply, which sends the reply you saved once to a DM containing a keyword. Kept encrypted only until processed and deleted immediately after processing, upon disconnection, permission revocation, workspace deletion or a Meta data deletion request, and within 24 hours at the latest; records are kept for 30 days without the text.
• Identifier, text, author display name and handle of posts in which others mentioned the channel: used only while mention auto-reply is on, to collect and show mentions and post replies. Mention records are kept for no more than 30 days.
• Reply text of DM auto-replies and the recipient identifier, and reply text to mentions: provided to Meta to send the auto-replies you turned on (§3 Provision to Third Parties).

Redband uses commenter information only for features you request, such as viewing comments, replying, auto-replies and displaying performance, and does not use it for other purposes or provide it to third parties. We do not further entrust processing to anyone other than the processors disclosed in this policy, and the security measures in this policy apply equally to commenter information. When you disconnect a channel or delete a workspace, it is deleted according to the retention criteria in this policy.

4. Processing Entrustment

The companies to which Moyeo entrusts the processing of personal information to provide the service are as follows. Through entrustment contracts, Redband sets the purpose and scope of processing, restrictions on re-entrustment, security measures and destruction obligations, and supervises compliance.

When we add or change a processor, we revise this policy and publish it before the effective date, and make the changes viewable in the revision history. If you do not agree to the change, you can delete your account or stop using the relevant feature.

Google and Kakao are authentication providers that provide the information needed for the sign-in you choose, and Meta and Google/YouTube are external platforms that perform the functions of connected channels.

AI Writing and Reply Suggestions

Before you use AI for the first time, we show a data processing notice and keep the notice version you acknowledged and the time as an acknowledgment record separate from acceptance of the sign-up terms. Acknowledging the notice does not cause posts to be created or published automatically, and you can use the service without using AI features.

When you request an AI draft, text polishing or post topic recommendation, or press the reply suggestion button to generate a new suggestion, the Moyeo server sends the information needed for generation to Google's Gemini API. Depending on the task, this may include the request and body text you entered, the target comment, the original post, recent messages in the same conversation, recent text written on that channel, the post's engagement metrics, and channel information and language, time zone and scheduled time.

Context is limited to the necessary scope of channels you can access in the current workspace, and writing history from other workspaces is not mixed in. Merely viewing a page or reusing a saved suggestion does not send a new generation request. Generated text is an editable suggestion and is not sent to social channels until you execute publishing or sending a reply.

The commenter's display name is not sent as a separate item, and the sign-in account, workspace, generation job, comment identifiers and internal lookup values are not included in generation requests. However, personal information you enter or that is contained in reference text is not automatically removed, so please do not enter sensitive personal information or secrets.

Moyeo uses the Gemini API under paid terms with a linked billing account. Under paid terms, Google does not use the inputs Moyeo sends or the outputs it returns to improve its products or train models, and retains them for a limited period only to prevent abuse. Google's data processing is governed by the Gemini API Terms of Service, and Moyeo's internal retention period for generated results differs from Google's processing and retention terms.

Moyeo stores AI-generated suggestions encrypted and deletes AI drafts, text polishing and reply suggestions 24 hours after creation, and post topic recommendations after 7 days. Each suggestion is recorded together with the channels used to create it, and when a channel is disconnected, only AI suggestions created using that channel's data are deleted. Suggestions that used only other channels in the same workspace and suggestions created without channel data remain until the retention period above. When a workspace is deleted, all AI suggestions stored in that workspace are deleted.

Moyeo does not use AI to automatically make decisions that have legal effects or similarly significant effects on you. AI only creates suggestions that you review, edit and use.

5. Cross-Border Transfer

Servers and databases are operated in the Amazon Web Services Seoul region and are therefore not transferred overseas. Toss Payments and Kakao are domestic businesses, so they do not constitute cross-border transfer. Processing that goes overseas is disclosed in the two categories below according to its nature.

Processing Entrustment and Storage for Performance of Contract

In accordance with Article 28-8(1)(iii) of the Personal Information Protection Act, we disclose the following regarding processing entrustment and storage necessary for concluding and performing contracts.

Overseas Processing When You Request AI Features

Moyeo calls the Gemini API from a project with a linked billing account, so the data processing terms for paid services apply. Under these terms, Google does not use inputs and outputs for product improvement and retains them only for a limited period for purposes such as abuse detection. For details, see the Gemini API Terms of Service and the Google Data Processing Addendum.

Cross-Border Provision at Your Request

The transfers below are cross-border provision made to carry out your request when you choose a sign-in method, connect a channel and request posting, replies or performance viewing, or turn on auto-reply. They are of the same nature as the provision to third parties in §3 above, and the recipient, country, items and purpose are explained on the sign-in screen and channel connection screen; they take place only within the scope you consented to on each platform's official consent screen.

The scope of Cloudflare's processing can be found in the South Korea Privacy Addendum and the Customer Data Processing Addendum, and the scope of Google Workspace's processing in the Data Processing Amendment and the Subprocessors and processing locations notice. The list of processing locations in each notice does not indicate the actual country where a specific file is stored.

6. Use of External Platform Data

What Moyeo receives from the external platforms you connect, with which permissions, for what purpose, and when it is deleted can be found for each platform in the Platform Data Use Notice.

• Instagram · Threads: Permissions requested and data received, handling of Meta's app deauthorization and data deletion request callbacks
• YouTube: Moyeo uses YouTube API Services. Data by permission, refresh method by data type, and deletion timing
• Google Sign-In · Limited Use disclosure: Sign-in information transferred to Google LLC in the United States and compliance with the Google API Services User Data Policy
• Kakao Login: Consent items and unlinking
• Data deletion by platform: How to disconnect and revoke permissions

7. Google and YouTube Data

Moyeo uses YouTube API Services. We view and store the profile, video information, comments and performance data of connected channels within the scope of granted permissions, and use them for Shorts uploads you specify and for viewing comments and performance on connected channels. YouTube integration features are subject to the YouTube Terms of Service, and Google's processing of personal information is also subject to the Google Privacy Policy (https://policies.google.com/privacy).

Moyeo's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. This information is processed to provide and improve user-facing features, and is not used for sale, ad targeting or credit assessment. Only the necessary personnel access it, and only in permitted cases such as supporting a user's specific request, security investigations or legal requirements. We do not combine data received from YouTube with personal information from other sources without your separate request or consent.

Data received through the YouTube API is refreshed differently by type. Performance metrics are refreshed once a day for each connected channel, and comments are refreshed by re-fetching recent activity about every 3 hours and re-fetching the entire history period once a day. Channel information such as channel name, handle, profile image and description is received and stored when you connect or re-authorize the channel, and refreshed by re-fetching about every 3 days. When a comment deleted on YouTube is confirmed as deleted during a run that re-fetches the entire history period, its text is deleted immediately and its record within one day. Comments that have not been re-fetched for 30 days are deleted. Video information is re-fetched starting 27 days after it was last checked, and deleted videos or videos that could not be checked for 30 days are deleted together with related performance data. Performance metrics received from YouTube Analytics are kept up to the plan's history period while access has been verified within the last 30 days and the connection and analytics permissions remain in place. If these conditions are not met, performance metrics older than 30 days are deleted. When you disconnect a channel, delete a workspace or delete your account, we delete the related data and authentication tokens stored by Moyeo and request revocation of the authentication tokens through Google's revocation endpoint.

If you disconnect a channel, delete your account, or request deletion in the Moyeo app, we delete the YouTube data stored by Moyeo within 7 days; if you revoke Moyeo's access in your Google Account security settings, we delete it within 30 days. The same deadlines apply to data of channels that can no longer be fetched because token refresh failed.

You can revoke Moyeo's access in Manage third-party apps with account access in your Google Account. Unlinking Google sign-in in Moyeo deletes the link record kept by Moyeo, but you must revoke the app permission remaining in your Google Account yourself on the screen above. You can request deletion of information stored by Moyeo by disconnecting the channel or via support@moyeo.io. Deleting information stored by Moyeo does not delete videos posted on YouTube.

8. Kakao Login Data

When you use Kakao Login, we receive only the items you allowed on Kakao's consent screen. Kakao's consent item names and the items Moyeo stores are as follows.

You can unlink Kakao Login in account settings, and when you delete your account, Redband requests unlinking from Kakao to disconnect it from Moyeo. For detailed procedures, see the Data Deletion Instructions.

9. Cookies and Browser Storage

Moyeo uses cookies and browser storage to keep you signed in, verify devices securely and remember display settings. The items used are as follows.

You can delete or block cookies in your browser settings, but required features such as sign-in may not work. Visit analytics is collected by default. You can limit collection by deleting or blocking analytics cookies in your browser or using the Google Analytics Opt-out Browser Add-on. Add-on support varies by browser. If a previous refusal saved in Moyeo remains in this browser, analytics does not start. Clearing browser storage also removes that choice. Analytics is separate from marketing email consent, and limiting analytics does not restrict other service features. Session storage may be used to maintain temporary screen flows.

Moyeo does not collect or use behavioral information for personalized advertising. Analytics tools are used with advertising identifier linkage and ad personalization signals turned off, and the values collected are not shared with advertising businesses.

10. Notifications

Service notification emails that inform you of the status of tasks you requested, such as publishing results, are notices for performance of contract and are separate from consent to receive advertising information. You can adjust how you receive each type in notification settings, and notifications essential to using the service, such as payment, security and account status, cannot be turned off in the app.

When you sign in on a device we have not seen before, we send a new-device sign-in notice to your account email to protect your account. The notice states only the sign-in time and the browser and operating system names, and does not include your IP address or the raw device information sent by your browser. We use the authentication and security information in Section 1 to tell devices apart and collect no additional information for this notice.

Sending records and encrypted bodies of notification emails are deleted 30 days after sending, so that we can check them when you ask about an email you received. In-app notifications disappear automatically when the history period expires, and the history period may vary by plan.

Browser push notifications are used only when you turn them on yourself for each device. When turned on, we receive the subscription information issued by the browser (delivery endpoint and encryption keys) and store it encrypted with a versioned key; we do not store the full delivery endpoint, keeping only the domain that shows which service it is sent to. Push bodies contain only the notification's title and summary and information on the screen to navigate to, and do not contain account identifying information or link URLs.

Push notifications can be turned off per device in the device list in notification settings, and turning them off deletes the subscription information immediately. If you revoke notification permission in the browser, the subscription is discarded as soon as it is confirmed invalid on the next delivery attempt. When you delete your account, subscriptions for all registered devices are deleted.

11. Rights of Data Subjects and How to Exercise Them

You can manage display information and linked accounts and delete your account in account settings. Please send requests for access, correction, deletion or suspension of processing of personal information, and withdrawal of consent, to matthew@moyeo.io or support@moyeo.io. If you are signed in, you can also send the same request through the inquiry window opened by "Contact us" in the account menu at the bottom of the workspace sidebar or the floating question mark button on the screen. These requests are received by customer support (support@moyeo.io), and the Chief Privacy Officer confirms the result. We aim to respond within 2 business days. Requests through an agent are also possible, and we verify your identity or the agent's authority to the extent necessary. Requests are processed without delay, and for requests restricted by law, we explain the reason.

We do not accept sign-ups from anyone under 18 and do not collect personal information of children under 14. If we become aware of such a case, we take the necessary verification and deletion measures.

For consultation on privacy infringement, you can contact the Personal Information Infringement Report Center at 118 (privacy.kisa.or.kr); for dispute mediation, the Personal Information Dispute Mediation Committee at 1833-6972 (kopico.go.kr); and to report crimes related to personal information, the Korean National Police Agency Cyber Investigation Bureau at 182.

Automated Decisions

Comment auto-reply is a feature that executes the keyword and text rules you set exactly as they are, and Redband does not use it to make decisions in a fully automated manner that significantly affect the rights or obligations of you or commenters. Likewise, AI suggestion features only create outputs that go outside only after a person reviews and executes them.

12. Security Measures

In accordance with Article 29 of the Personal Information Protection Act and related notices, Redband takes the following measures.

• Internal management plan: We establish and implement an internal management plan for the safe processing of personal information and review it regularly.
• Access rights management: We limit personnel who can access personal information to the minimum number needed for their work, and keep records of granting, changing and revoking permissions.
• Access log management: We keep access logs of personal information processing systems, retain them for at least the period prescribed by law, and review them regularly.
• Encryption: Passwords are stored as non-reversible one-way hashes, and sensitive values such as channel access tokens, payment method identifiers, notification bodies and push subscription information are stored with AES-GCM encryption using versioned keys. IP and browser information in security records are kept as digests instead of the originals.
• Protection in transit: All communication between your browser and the server, and between the server and external services, is encrypted with TLS.
• Access control: We apply workspace- and channel-level permission checks, session and device management, blocking of abnormal access and request rate limiting.
• Physical measures: Servers and storage are operated in Amazon Web Services and Cloudflare data centers, and physical safeguards such as entry control are carried out by those businesses under the entrustment contracts.
• Responsibility and breach notification: Final responsibility for personal information protection lies with the representative. If we become aware that personal information has been or may have been lost, stolen or leaked (hereinafter a "breach"), we notify data subjects within 72 hours from that time and report to the authorities prescribed by law.

13. Chief Privacy Officer

We have designated a Chief Privacy Officer as follows to oversee personal information processing and handle users' inquiries and complaints.

For general customer support, please contact support@moyeo.io.

14. Changes to This Policy

When we change this policy, we publish the effective date and the changes, also by account email, 7 days before the effective date for general changes and 30 days before the effective date for changes that are unfavorable to users or material, and make previous versions viewable in the revision history. Changes that require separate consent under applicable law are applied after obtaining your consent.

15. Business Information

Revision history