Privacy Policy
Effective: April 7, 2026 | Last updated: July 31, 2026
Villion Inc. (the “Company”) establishes and discloses this Privacy Policy in accordance with Article 30 of the Personal Information Protection Act (PIPA) to protect the personal information of data subjects and to promptly and smoothly handle related grievances.
Article 1 (Items of Personal Information Processed and Collection Methods)
① Items Collected
| Category | Items Collected | Required/Optional |
|---|---|---|
| Sign-up (Email) | Email address, password (hashed) | Required |
| Sign-up (Google OAuth) | Email address, Google account ID (sub), profile name | Required |
| Profile settings | Contact name, company name, phone number | Optional |
| GEO audit | Email, website URL, company name, industry, monthly visitors, CMS | Required (email, URL), optional (others) |
| Sales inquiry | Name, email, phone (optional), message | Required (name, email), optional (others) |
| Service use | Service usage records, access logs, IP address, cookies, analysis request domains and URLs | Automatically collected |
| AI chatbot (Lion) support | Conversation content (questions entered by the user, chatbot responses) | Optional (when used) |
| External service integration | Google Analytics 4, Google Search Console, Bing Webmaster authentication tokens and property IDs (within OAuth delegated scope) | Optional (when integrated) |
② Collection Methods
- Entered directly by the user during sign-up and service use
- Provided by Google during Google OAuth 2.0 authentication
- Automatically generated during service use (logs, cookies, sessions)
- Collected via the platform's API when integrating external services (GA4, GSC, Bing)
Article 2 (Purposes of Processing Personal Information)
| Purpose of Processing | Related Items |
|---|---|
| Membership registration and identity verification | Email, password (hashed), Google account ID |
| Providing the GEO audit service and sending reports | Email, website URL, company name, industry |
| Operating the platform service (dashboard, analytics, code improvement, deployment) | Usage records, analysis domains and URLs, integration tokens |
| Customer inquiries and support | Name, email, message |
| Responding to AI chatbot inquiries and improving response quality | Chatbot conversation content (questions, responses) |
| Improving service quality and statistical analysis (de-identified) | Access logs, IP, usage records |
| Marketing and new feature announcements (with separate consent) | |
| Preventing illegal and fraudulent use, and security | IP, access logs, usage records |
Article 3 (Retention and Use Period of Personal Information)
| Item | Retention Period | Basis |
|---|---|---|
| Member information | Destroyed within 30 days of account withdrawal | User consent |
| GEO audit usage records | 3 years after the audit is completed | Service re-use and dispute preparation |
| Sales inquiry records | 3 years | Complaint handling and dispute preparation |
| Access logs | 3 months | Protection of Communications Secrets Act, Article 15-2 |
| Records of contracts or withdrawal of subscription | 5 years | Act on Consumer Protection in Electronic Commerce, Article 6 |
| Records of payment and supply of goods | 5 years | Act on Consumer Protection in Electronic Commerce, Article 6 |
| Records of consumer complaints and dispute handling | 3 years | Act on Consumer Protection in Electronic Commerce, Article 6 |
Article 4 (Provision of Personal Information to Third Parties)
The Company does not provide personal information to third parties without the data subject's consent, except in the following cases:
- Where there is a special provision in law, or it is unavoidable to comply with legal obligations
- Where an investigative agency requests it for investigative purposes in accordance with the procedures and methods prescribed by law
- Where prior consent cannot be obtained because the data subject or legal representative is unable to express intent, or their address is unknown, and it is clearly necessary for the urgent life, bodily safety, or property interests of the data subject or a third party
Article 5 (Outsourcing of Personal Information Processing)
For service operation, the Company outsources the processing of personal information as follows.
| Processor | Outsourced Task | Retention Period |
|---|---|---|
| Supabase Inc. (USA) | Member authentication and database operation | Until termination of the outsourcing contract |
| Amazon Web Services, Inc. (USA) | Cloud infrastructure and server operation | Until termination of the outsourcing contract |
| Cloudflare, Inc. (USA) | CDN, edge deployment, security | Until termination of the outsourcing contract |
| OpenAI, L.L.C. (USA) | AI analysis and content generation processing | Immediately upon completion of processing |
| Google LLC (USA) | OAuth authentication, email delivery (Gmail SMTP), Search Console integration, visitor analytics (Google Analytics, Tag Manager) | Until termination of the outsourcing contract (analytics data up to 14 months) |
| Microsoft Corporation (USA) | On-screen behavior analytics (Microsoft Clarity) — recording of mouse movement, clicks, and scrolling | Up to 13 months from the date of collection |
| Resend Inc. (USA) | Transactional email delivery | Immediately upon delivery |
Some of the processors above are located overseas. In accordance with Article 28-8 of the Personal Information Protection Act, the Company notifies users of the destination country, the items transferred, the date and method of transfer, the processor's name and contact information, and the retention and use period, and includes personal information protection clauses in its contracts with processors.
Article 6 (Rights and Obligations of Data Subjects and How to Exercise Them)
Data subjects may exercise the following rights against the Company at any time:
- Request to access the status of personal information processing
- Request for correction of errors
- Request for deletion
- Request to suspend processing
Rights may be exercised in writing or by email to the Data Protection Officer below, and the Company will act without delay (within 10 days). However, the Company may decline the request in cases falling under Article 35(5) or Article 37(2) of the Personal Information Protection Act.
When processing the personal information of children under the age of 14, the Company obtains the consent of their legal representative. The Company's services are not directed at children under the age of 14.
Article 7 (Installation, Operation, and Refusal of Automatic Data Collection Devices Such as Cookies)
The Company uses cookies and similar automatic collection devices to provide personalized services and understand how the service is used. A cookie is a small text file that a website stores in the user's browser.
① Types and Purposes of Cookies Used
Except for essential cookies, only the categories the user has consented to are used. On the first visit, users can choose by category via the consent dialog; if they do not consent, those cookies are not installed.
| Category | Purpose & Data Collected | Tool & Provider | Retention | Consent |
|---|---|---|---|---|
| Essential | Maintaining login state, security (CSRF protection), saving language settings, saving cookie consent | Company (first-party) | At session end or up to 400 days | Used without consent (essential for service) |
| Analytics | Usage statistics such as pages visited, time on page, and referral path. Recording and replay of on-screen behavior (mouse movement, click positions, scrolling). Includes IP address, browser and device information, and online identifiers. | Google Analytics, Google Tag Manager (Google LLC) Microsoft Clarity (Microsoft Corporation) | Up to 14 months (Clarity up to 13 months) | Optional (only with consent) |
| Advertising | Measuring whether users who arrived via an ad went on to inquire or apply (conversion measurement). Includes ad click identifiers and hashed (encrypted) values of email addresses. | ChatGPT ad conversion measurement (OpenAI, L.L.C.) | Up to 13 months | Optional (only with consent) |
Information collected for analytics and advertising purposes is transmitted to the servers of the providers above (USA). Matters concerning overseas transfer follow Article 5.
② Notice on Recording of On-Screen Behavior
If you consent to the Analytics category, the Company records on-screen behavior (mouse movement, clicks, scrolling) to improve the service. Input values you enter, such as name, contact number, and email, as well as passwords, are automatically masked in the recording, and neither the Company nor the provider can view their contents. These recordings are not used to identify individuals.
③ Withdrawing Consent and Refusing Cookies
You can withdraw consent or re-select by category at any time. Clicking “Cookie Settings” in the page footer reopens the selection dialog. When you withdraw consent, use of the relevant cookies stops immediately, and analytics and advertising cookies already stored are deleted.
You can also refuse cookies directly in your browser settings. However, refusing essential cookies may limit some features, such as staying logged in.
- Chrome: Settings → Privacy and security → Third-party cookies
- Safari: Settings → Privacy → Manage cookies and website data
- Edge: Settings → Cookies and site permissions → Manage cookies and site data
You can also refuse Google Analytics collection by installing the opt-out add-on provided by Google (tools.google.com/dlpage/gaoptout).
Article 8 (Measures to Ensure the Safety of Personal Information)
In accordance with Article 29 of the Personal Information Protection Act, the Company takes the following technical, managerial, and physical measures necessary to ensure safety.
- Managerial measures: Minimizing staff who handle personal information, establishing and implementing an internal management plan, regular staff training
- Technical measures: Encryption of personal information (TLS 1.3 transport encryption, bcrypt password hashing), access-privilege management, installation and updating of security programs, retention of access logs, and prevention of forgery and tampering
- Physical measures: Use of cloud data centers (ISO 27001 certified), blocking of unauthorized access
Article 9 (Data Protection Officer)
The Company designates a Data Protection Officer, as below, to oversee personal information processing and to handle data subjects' complaints and provide remedies related to personal information processing.
Data subjects may direct any inquiries, complaints, or requests for remedy related to personal information protection arising from their use of the Company's services to the Data Protection Officer. The Company will respond to and handle such inquiries without delay.
Article 10 (Remedies for Infringement of Rights)
To obtain remedies for infringement of personal information, data subjects may apply for dispute resolution or consultation to the Personal Information Dispute Mediation Committee, the Korea Internet & Security Agency's Privacy Infringement Report Center, and others.
- Personal Information Dispute Mediation Committee: 1833-6972 (www.kopico.go.kr)
- Privacy Infringement Report Center: 118 (privacy.kisa.or.kr)
- Supreme Prosecutors' Office Cyber Investigation Division: 1301 (www.spo.go.kr)
- National Police Agency Cyber Bureau: 182 (cyberbureau.police.go.kr)
Article 11 (Changes to This Privacy Policy)
If content is added, deleted, or modified, the Company will give advance notice through service announcements at least 7 days before the effective date. However, for significant changes to user rights, notice will be given at least 30 days in advance.
Revision History
- July 31, 2026 — Added storage of AI chatbot (Lion) conversation content (questions and responses) to the items collected and processing purposes.
- July 30, 2026 — Revised the cookie clause (Article 7): specified the purpose, provider, and retention period of analytics and advertising cookies by category, and added prior-consent and withdrawal procedures. Added Microsoft Corporation (on-screen behavior analytics) as a processor.
- April 7, 2026 — Initial enactment
This policy takes effect on July 31, 2026.
Previous versions of the Privacy Policy are available by email inquiry.