Privacy Policy

1. Personal Information We Collect

Hanary collects the following information to provide our services:

• Email address (via Google OAuth login)
• Name and profile photo (from Google account)
• Service usage records (tasks, messages, etc.)
• Usage records for preregistered campaign links (channel and post identifiers, pseudonymous visitor and MCP session identifiers, and the stages and times of sign-up, MCP connection, first value, and reuse)
• Payment information (processed by the external payment provider identified at checkout; Hanary does not store card details directly)

2. Purpose of Using Personal Information

• Service provision and account management
• Customer support and inquiry response
• Service improvement and new feature development
• Validate sign-up and product activation by campaign
• Payment processing and subscription management
• Legal compliance

3. Retention and destruction of personal information

When account deletion is complete, personal information no longer needed to operate the account is destroyed without delay. However, when retention is required by applicable law, including the Act on the Consumer Protection in Electronic Commerce, etc. and its Enforcement Decree, only the minimum fields needed to fulfill those obligations are retained in the records below for the specified periods.

• Records of displays and advertisements (such as content and publication time): 6 months
• Records of contracts or withdrawal from contracts (such as the time and processing outcome): 5 years
• Records of payments and the supply of goods or services (such as payment time, amount, and payment and supply status): 5 years
• Records of consumer complaints or dispute resolution (such as the content and processing outcome): 3 years

Records retained by law are separated from active account information, access is restricted, and the records are destroyed without delay when the retention period ends. Electronic records are securely deleted so they cannot be recovered or reproduced; any printed records are shredded or incinerated.

Campaign funnel events linked to your account are deleted with your account information when you delete your account. Pseudonymized events not linked to an account are retained for up to 90 days from collection and then deleted by a daily cleanup process.

Messages, tasks, and other content created or shared with other users in shared spaces may be retained to protect their collaboration history. In that case, links to the deleted account and identifying information for authors or assignees are removed or anonymized as "Deleted user".

If you have made a paid purchase, external payment providers may retain transaction and settlement records for a period required by applicable law or their own recordkeeping obligations. Hanary does not hold card details directly. When you delete your account, Hanary deletes payment account links it holds that are no longer needed to operate the service. Records held by external payment providers are handled under their legal obligations and privacy policies; Hanary cannot guarantee deletion of those providers’ records.

4. Third-Party Disclosure of Personal Information

Hanary does not provide personal information to third parties as a rule. However, exceptions are made in the following cases:

• When the user has given prior consent
• When required by law or requested through legal procedures for investigation purposes
• If you make a paid purchase, the minimum information needed to process it is shared with the external payment provider identified at checkout.
• When you use AI assistance, the task titles, descriptions, notes, and other content you request are sent to OpenRouter and the selected model provider to generate a response.

5. Use of Cookies

Hanary uses first-party session cookies to keep you signed in and attribute the first visit from a preregistered campaign link when that feature is explicitly enabled. Campaign attribution contains only an opaque random identifier and a campaign ID, and is removed when sign-up is completed, when you sign out, or when the session expires after at most 30 days. Funnel events do not store raw IP addresses, raw User-Agent strings, API or OAuth tokens, or task and decision content. We do not use third-party analytics cookies. If your browser sends a DNT or GPC signal, campaign visits are not recorded and any existing attribution is removed. You can block cookies in your browser settings, but some features, including sign-in, may become unavailable.

6. User Rights

Users may exercise the following rights at any time:

• Request to view, correct, or delete personal information
• Request to stop processing personal information
• Account deletion

7. Privacy Officer

For inquiries regarding personal information, please contact us at:

• Email: gutmutcode@gmail.com

8. Changes to Privacy Policy

This privacy policy may be modified due to changes in laws or services, and changes will be announced within the service.