Privacy Policy

Effective August 21, 2026

BizCrush Privacy Policy

Notice Date: 2026.8.21 · Effective Date: 2026.8.28

The Korean version of this Privacy Policy is the authoritative text. This English version is a translation provided for convenience. In the event of any conflict in interpretation, the Korean version prevails.

BizCrush Inc. (a Delaware C-Corporation; registered address: 1111B South Governors Avenue STE 28430, Dover, DE 19904, USA; U.S. operating address: San Francisco, California) (the "Company") has established and publishes this Privacy Policy pursuant to Article 30 of the Personal Information Protection Act of Korea ("PIPA") in order to protect the personal information of data subjects and to handle related grievances promptly.

This Privacy Policy applies to the BizCrush application, website, meeting assistant, the KeyCrush companion application, and related services (the "Services").

1. Information Collected, Purposes, and Retention Periods

Where a Member uploads a file containing another person's voice or meeting content, uses the recording feature, or enters another person's email address or other contact details in order to invite that person to a meeting, the Member is responsible for providing any notice and obtaining any consent required under applicable law directly from that person.

Follow-up emails. The Company generates a follow-up email draft based on meeting content and passes it to the default mail application on the Member's device. The Member reviews the content and sends the message directly; the Company does not send email on the Member's behalf.

1.2 Information Retained as Required by Law

2. Outsourcing of Personal Information Processing

App store payments. In-app purchases on iOS are processed directly by Apple Inc., and in-app purchases on Android are processed directly by Google LLC, each under its own privacy policy.

When entering into outsourcing agreements, the Company specifies in the contract, in accordance with Article 26 of PIPA, the prohibition on processing beyond the stated purpose, restrictions on re-outsourcing, technical and administrative safeguards, supervision, and liability including damages, and conducts periodic reviews. Any change to the outsourced tasks or processors will be disclosed through this Privacy Policy without delay.

3. International Transfer of Personal Information

How to refuse. You may refuse international transfer by not using the meeting assistant, disconnecting external service integrations, or deleting your account. Transfers relating to advertising identifiers may be refused individually using the methods in Section 7. Because speech recognition and summary generation are core functions of the Services, refusing them means those features cannot be provided.

4. Destruction of Personal Information

The Company destroys personal information without delay once the retention period expires or the purpose of processing is achieved.

Destruction occurs in two stages: blocking the Member's access, and actually deleting data distributed across multiple storage systems.

4.1 Upon Account Deletion

When a deletion request is received, the following information is deleted immediately:

Account information and user profile
Registered device information, records of agreement to the terms, authentication account
Session and cache data
Per-meeting personal settings and service access rights
User identifying information stored in participant lists (user ID, email, profile linkage)

For meetings owned solely by the departing Member, the meeting audio, transcripts, summaries, attachments, and vector embeddings are blocked from access immediately and then destroyed on a per-storage basis across file storage, databases, caches, and vector indexes.

4.2 Shared Meetings with Other Participants

Because such meetings also contain other participants' data, the meeting as a whole is not deleted automatically.

The departing Member's identifying information and access rights are deleted.
Speaker identifying information linked to transcripts is unlinked from the account or de-identified.
Meeting audio, transcripts, summaries, attachments, and vector embeddings may be retained for the applicable meeting retention period so that other participants can continue to use the Services.
Shared meetings owned by the departing Member may be transferred to the workspace, an administrator, or a participant designated by the Member. Meetings for which ownership is not transferred are deleted after notice to the participants. The Company does not automatically transfer administrative rights to an arbitrary participant without separate notice.

4.3 Where a Member Deletes a Meeting

When a Member deletes a meeting, the meeting is removed from the meeting view immediately, and the meeting audio, transcripts, summaries, attachments, vector embeddings, and related stored data are destroyed on a per-storage basis. Where deletion affects other participants, advance notice is provided.

4.4 Data Stored on the Device

KeyCrush's vocabulary, keyword and substitution dictionaries, and recent-use history are stored on the Member's device and are not removed by logging out or deleting the account alone. They are removed by uninstalling the application or clearing the application data on the device.

4.5 Logs and Backups

4.6 Method of Destruction

Electronic files are permanently deleted using methods that are technically irreversible; printed materials are shredded or incinerated. Information that must be retained under applicable law is stored separately and securely from other information.

5. Provision of Personal Information to Third Parties

As a rule, the Company does not provide personal information to third parties. Exceptions apply where the data subject has given separate consent; where required by law or unavoidable in order to comply with a legal obligation; where urgently necessary for the life, bodily safety, or property interests of a data subject or third party; where the Member has explicitly requested it, such as sharing a meeting summary; or where a transfer of business occurs.

The Company does not sell personal information to third parties.

6. Automatic Collection Devices (Cookies)

Items collected: service usage records, access logs, device information
Purpose: maintaining login sessions, optimizing the service environment, security, and statistical analysis
How to refuse: you may refuse or delete cookies through your web browser settings. Refusing may limit the availability of some features.

7. Behavioral Information

Upon account deletion, user identifying information contained in behavioral information is deleted. Usage records from which identifying information has been removed, such that a specific individual can no longer be identified, may continue to be retained for service statistics purposes, and the Company does not attempt to re-identify such records.

Meeting content such as meeting audio, transcripts, and summaries is not collected as behavioral information and is not used for advertising purposes.

How to opt out

iOS: Settings › Privacy & Security › Tracking — you may decline an app's tracking request or turn off tracking permission per app.
Android: Settings › Privacy › Ads — you may delete your advertising ID or opt out of personalized advertising.

8. Rights of Data Subjects and Legal Representatives

Members may at any time request access to, correction of, or deletion of their personal information, request suspension of processing, and withdraw consent.

These rights may be exercised through the account settings and meeting deletion features in the Services, by revoking access through the security settings of a connected service account, or by written or email request to support@bizcrush.ai. The Company will verify that the requester is the data subject or an authorized representative and then process the request without delay.

Individuals who attended or were invited to a meeting but do not hold an account may exercise the same rights with respect to data containing their voice, statements, or contact details, by contacting support@bizcrush.ai.

The Company does not make automated decisions that produce legal effects or similarly significant effects concerning Members.

In accordance with the Terms of Use, the Company restricts membership registration by persons under 18 years of age and does not collect personal information from children under 14. If registration by a child under 14 is confirmed, the account is deleted without delay.

9. Security Measures

Encryption in transit: communications with Member devices and with processors are encrypted using TLS.
Encryption at rest: managed default encryption at rest is applied to data stored on servers, and fields designated as requiring additional protection are further encrypted at the application level. Application-level encryption keys are managed through Google Cloud KMS.
Logging: access and change records are collected.

10. Google User Data

The Company's use and transfer of information received from Google APIs complies with the Limited Use requirements of the Google API Services User Data Policy.

The scopes requested are calendar.events.readonly (reading calendar events) and userinfo.email (identifying the connected account), and the data is used only to display upcoming events, identify meeting links, schedule and operate the assistant, and troubleshoot the integration.

The Company does not use this data to create, modify, or delete events, to send invitations, for personalized advertising, sale of data, creditworthiness assessment, training of generalized artificial intelligence models, or provision to data brokers. The Company does not allow humans to read this data except with the Member's affirmative consent, for security or abuse investigation, where required by law, or where aggregated and anonymized for internal operations.

11. Personal Information Protection Officer

Personal Information Protection Officer: Ethan Kim
Title: CTO
Contact: privacy@bizcrush.ai

12. Remedies for Infringement of Rights

Personal Information Dispute Mediation Committee: 1833-6972 (www.kopico.go.kr)
Personal Information Infringement Report Center: 118 (privacy.kisa.or.kr)
Supreme Prosecutors' Office Cyber Investigation Division: 1301 (www.spo.go.kr)
National Police Agency Cyber Bureau: 182 (ecrm.police.go.kr)

A person whose rights or interests have been infringed by a disposition or omission of the head of a public institution in response to a request under Articles 35, 36, or 37 of PIPA may file an administrative appeal in accordance with the Administrative Appeals Act.

13. Changes to This Privacy Policy

The Company will provide notice at least 7 days before the effective date of any amendment, and at least 30 days in advance for changes that materially affect Members' rights. Notice will be given through in-service announcement, website posting, or email.

14. Contact

Email: support@bizcrush.ai
Website: https://bizcrush.app