Privacy Policy

Effective November 14, 2026

BizCrush Privacy Policy

Notice Date: 2026.11.7 · Effective Date: 2026.11.14

The Korean version of this Privacy Policy is the authoritative text. This English version is a translation provided for convenience. In the event of any conflict in interpretation, the Korean version prevails.

BizCrush Inc. (a Delaware C-Corporation; registered address: 1111B South Governors Avenue STE 28430, Dover, DE 19904, USA; U.S. operating address: San Francisco, California) (the "Company") has established and publishes this Privacy Policy pursuant to Article 30 of the Personal Information Protection Act of Korea ("PIPA") in order to protect the personal information of data subjects and to handle related grievances promptly.

This Privacy Policy applies to the BizCrush application, website, meeting assistant, the KeyCrush companion application, and related services (the "Services").

1. Information Collected, Purposes, and Retention Periods

Purpose	Items Collected	Retention and Use Period	Legal Basis
Account registration and management	Required: Email address, name, SNS account integration (Google/Apple), account identifiers Optional: Phone number and verification information, profile image	Until account deletion	PIPA Art. 15(1)(1)
External service integration (optional)	Calendar event information (title, time, organizer and attendees, location, description, meeting link, event identifiers), connected account email, OAuth credentials	Until the integration is removed or the account is deleted	PIPA Art. 15(1)(1)
Meeting assistant	Meeting title and time, meeting URL, participant information, meeting audio, transcript data, in-meeting speaker separation information, summaries, notes, action items, follow-up email drafts, translation output, speech synthesis output, vector embeddings, assistant operational metadata	As set out in Section 4	PIPA Art. 15(1)(1)
Meeting invitations	Email address and display name of an invitee, as entered and provided by the Member	As set out in Section 4	PIPA Art. 15(1)(1)
Personal vocabulary	Proper nouns and terminology appearing in meetings; corrections made by the Member	Until the entry is deleted or the account is deleted	PIPA Art. 15(1)(1)
KeyCrush	Microphone audio, transcription output, on-device vocabulary, keyword and substitution dictionaries, and recent-use history (including inserted text)	As set out in Section 4	PIPA Art. 15(1)(1)
Service usage records and security	Access logs, access IP address, use and suspension records, authentication/access/security logs, cookies	As set out in Section 4.5	PIPA Art. 15(1)(1)
Device optimization, error handling, and usage analytics	Device and browser type, OS and application version, device identifiers, push tokens, crash reports, diagnostic information, feature usage records	Until account deletion	PIPA Art. 15(1)(1)
Attribution analysis and advertising measurement	Advertising identifiers (ADID/IDFA), install and launch events, referral link information, device information	Until account deletion (see Section 7)	PIPA Art. 15(1)(1)
Customer support	Email address, contents of the inquiry, attachments	3 years after the inquiry is resolved	PIPA Art. 15(1)(1)
Payment and settlement	Payment method information, transaction records, billing information	As set out in Section 1.2	PIPA Art. 15(1)(4)
Deck viewing confirmation and follow-up	The email you enter (if any) and viewing records (time and number of views, time spent per page, link clicks within the deck, language, country code)	Email: 1 year from entry; viewing records: until the deck is deleted	PIPA Art. 15(1)(1)
Creator program operation and commission settlement	Creators: name, email address, social media account, payout details (PayPal, Wise or bank account), tax form (W-8BEN/W-9) / Customers who used a creator code or link: the code or link used, payment customer identifier, payment amount and time	Until the creator leaves the program or the program ends (payout records as set out in Section 1.2)	PIPA Art. 15(1)(1) and (4)

Where a Member uploads a file containing another person's voice or meeting content, uses the recording feature, or enters another person's email address or other contact details in order to invite that person to a meeting, the Member is responsible for providing any notice and obtaining any consent required under applicable law directly from that person.

Follow-up emails. The Company generates a follow-up email draft based on meeting content and passes it to the default mail application on the Member's device. The Member reviews the content and sends the message directly; the Company does not send email on the Member's behalf.

1.2 Information Retained as Required by Law

Item	Retention Period	Legal Basis
Records of contracts and withdrawal of subscription	5 years	Act on Consumer Protection in Electronic Commerce
Records of payment and supply of goods or services	5 years	Act on Consumer Protection in Electronic Commerce
Records of consumer complaints and dispute resolution	3 years	Act on Consumer Protection in Electronic Commerce
Records of advertising and labeling	6 months	Act on Consumer Protection in Electronic Commerce
Access logs	3 months	Protection of Communications Secrets Act Art. 15-2

2. Outsourcing of Personal Information Processing

Processor	Outsourced Task	Items Processed
Google LLC	Cloud infrastructure, storage and compute, authentication, push notifications, usage analytics, translation generation (Vertex AI)	Account information, meeting audio, transcripts, summaries, vocabulary, logs, device information, deck viewing records
MongoDB, Inc.	Database operation and vector search	Account information, meeting records, vocabulary, vector embeddings
Soniox Inc.	Real-time speech recognition	Meeting audio stream, transcription output, custom vocabulary
OpenAI OpCo, LLC	Generation of summaries, action items and follow-up email drafts; translation; speech synthesis; vector embedding generation	Meeting transcripts, text submitted for conversion
Hyperdoc Inc. (Recall.ai)	Video conference bot participation and calendar integration	Meeting audio and video, calendar event information, meeting links, OAuth credentials
Redis Ltd.	Cache and session management	Session information, transient processing data
Branch Metrics, Inc.	Attribution analysis and deep linking	Advertising identifiers, device information, install and launch events
Functional Software, Inc. (Sentry)	Error and crash tracking	Error events, device information, diagnostic information
Stripe, LLC (formerly Stripe, Inc.)	Web payment processing and settlement	Payment method information, transaction records, billing information
Channel Corporation (Channel Talk)	Receipt and management of customer inquiries	Email address, contents of the inquiry, attachments
Slack Technologies, LLC	Delivery of deck viewing alerts to an internal channel	Viewer email (if entered), recipient code, time of viewing, country code, number of pages viewed
Tolt, Inc.	Creator program attribution and creator payouts	Creator name, email, payout details and tax form; for customers who used a code or link: payment customer identifier, payment amount and time

App store payments. In-app purchases on iOS are processed directly by Apple Inc., and in-app purchases on Android are processed directly by Google LLC, each under its own privacy policy.

When entering into outsourcing agreements, the Company specifies in the contract, in accordance with Article 26 of PIPA, the prohibition on processing beyond the stated purpose, restrictions on re-outsourcing, technical and administrative safeguards, supervision, and liability including damages, and conducts periodic reviews. Any change to the outsourced tasks or processors will be disclosed through this Privacy Policy without delay.

3. International Transfer of Personal Information

Recipient	Country	Time and Method of Transfer	Contact	Items Transferred	Purpose	Retention Period
Google LLC	United States (Vertex AI is not region-pinned)	Encrypted network transmission during use of the Services	googlekrsupport@google.com	Account information, meeting audio, transcripts, summaries, vocabulary, logs, device information, deck viewing records	Infrastructure operation, authentication, analytics, translation	Until termination of the outsourcing agreement
MongoDB, Inc.	United States	Encrypted network transmission during use of the Services	privacy@mongodb.com (DPO)	Account information, meeting records, vocabulary, vector embeddings	Database operation	Until termination of the outsourcing agreement
Soniox Inc.	United States	Real-time streaming during meetings	support@soniox.com	Meeting audio stream, transcription output, custom vocabulary	Real-time speech recognition	Not retained after real-time processing
OpenAI OpCo, LLC	United States and other countries (not region-pinned)	Encrypted network transmission when the feature is used	privacy@openai.com	Meeting transcripts, text submitted for conversion	Generation of summaries, follow-up drafts, translation, speech synthesis, embeddings	Until the processing purpose is achieved
Hyperdoc Inc. (Recall.ai)	United States	Encrypted network transmission when joining a meeting	hello@recall.ai	Meeting audio and video, calendar event information, OAuth credentials	Meeting bot participation and integration	Until termination of the outsourcing agreement
Redis Ltd.	United States	TLS-encrypted transmission during use of the Services	privacy@redis.com	Session information, transient processing data	Cache and session management	Until cache expiry
Branch Metrics, Inc.	United States	Transmission upon app install and launch	privacy@branch.io	Advertising identifiers, device information, install and launch events	Attribution analysis	Until termination of the outsourcing agreement
Functional Software, Inc. (Sentry)	United States	Transmission upon error occurrence	compliance@sentry.io	Error events, device information, diagnostic information	Error tracking	Until termination of the outsourcing agreement
Stripe, LLC	United States	Encrypted network transmission when a web payment is made	privacy@stripe.com	Payment method information, transaction records, billing information	Payment processing and settlement	Until termination of the outsourcing agreement (statutory retention applies separately)
Slack Technologies, LLC	United States	Encrypted network transmission when a deck viewing alert is sent	privacy@slack.com	Viewer email (if entered), recipient code, time of viewing, country code, number of pages viewed	Deck viewing alerts	Until termination of the outsourcing agreement
Tolt, Inc.	United States	Encrypted network transmission when a creator signs up or a payment is made	compliance@tolt.com	Creator name, email, payout details and tax form; for customers who used a code or link: payment customer identifier, payment amount and time	Creator attribution and payouts	Until termination of the outsourcing agreement (statutory retention periods apply separately)

How to refuse. You may refuse international transfer by not using the meeting assistant, disconnecting external service integrations, or deleting your account. Transfers relating to advertising identifiers may be refused individually using the methods in Section 7. Because speech recognition and summary generation are core functions of the Services, refusing them means those features cannot be provided.

4. Destruction of Personal Information

The Company destroys personal information without delay once the retention period expires or the purpose of processing is achieved.

Destruction occurs in two stages: blocking the Member's access, and actually deleting data distributed across multiple storage systems.

4.1 Upon Account Deletion

When a deletion request is received, the following information is deleted immediately:

Account information and user profile
Registered device information, records of agreement to the terms, authentication account
Session and cache data
Per-meeting personal settings and service access rights
User identifying information stored in participant lists (user ID, email, profile linkage)

For meetings owned solely by the departing Member, the meeting audio, transcripts, summaries, attachments, and vector embeddings are blocked from access immediately and then destroyed on a per-storage basis across file storage, databases, caches, and vector indexes.

4.2 Shared Meetings with Other Participants

Because such meetings also contain other participants' data, the meeting as a whole is not deleted automatically.

The departing Member's identifying information and access rights are deleted.
Speaker identifying information linked to transcripts is unlinked from the account or de-identified.
Meeting audio, transcripts, summaries, attachments, and vector embeddings may be retained for the applicable meeting retention period so that other participants can continue to use the Services.
Shared meetings owned by the departing Member may be transferred to the workspace, an administrator, or a participant designated by the Member. Meetings for which ownership is not transferred are deleted after notice to the participants. The Company does not automatically transfer administrative rights to an arbitrary participant without separate notice.

4.3 Where a Member Deletes a Meeting

When a Member deletes a meeting, the meeting is removed from the meeting view immediately, and the meeting audio, transcripts, summaries, attachments, vector embeddings, and related stored data are destroyed on a per-storage basis. Where deletion affects other participants, advance notice is provided.

4.4 Data Stored on the Device

KeyCrush's vocabulary, keyword and substitution dictionaries, and recent-use history are stored on the Member's device and are not removed by logging out or deleting the account alone. They are removed by uninstalling the application or clearing the application data on the device.

4.5 Logs and Backups

Category	Retention Period
General access, authentication, and application logs	30 days
Mandatory cloud provider security and audit logs	Up to 400 days
Backup data	Destroyed after the applicable backup retention period expires

4.6 Method of Destruction

Electronic files are permanently deleted using methods that are technically irreversible; printed materials are shredded or incinerated. Information that must be retained under applicable law is stored separately and securely from other information.

5. Provision of Personal Information to Third Parties

As a rule, the Company does not provide personal information to third parties. Exceptions apply where the data subject has given separate consent; where required by law or unavoidable in order to comply with a legal obligation; where urgently necessary for the life, bodily safety, or property interests of a data subject or third party; where the Member has explicitly requested it, such as sharing a meeting summary; or where a transfer of business occurs.

The Company does not sell personal information to third parties.

6. Automatic Collection Devices (Cookies)

Items collected: service usage records, access logs, device information
Purpose: maintaining login sessions, optimizing the service environment, security, statistical analysis, and confirming visits through creator links
How to refuse: you may refuse or delete cookies through your web browser settings. Refusing may limit the availability of some features.

7. Behavioral Information

Category	Details
Items collected	Advertising identifiers (ADID, IDFA), app install and launch events, referral link information, device information, service usage records
Method of collection	Automatically collected through SDKs embedded in the application upon install and launch
Purpose	Attribution and install performance analysis, usage analytics, advertising measurement
Retention and use period	Until account deletion
Processors	Branch Metrics, Inc. / Google LLC

Upon account deletion, user identifying information contained in behavioral information is deleted. Usage records from which identifying information has been removed, such that a specific individual can no longer be identified, may continue to be retained for service statistics purposes, and the Company does not attempt to re-identify such records.

Meeting content such as meeting audio, transcripts, and summaries is not collected as behavioral information and is not used for advertising purposes.

How to opt out

iOS: Settings › Privacy & Security › Tracking — you may decline an app's tracking request or turn off tracking permission per app.
Android: Settings › Privacy › Ads — you may delete your advertising ID or opt out of personalized advertising.

8. Rights of Data Subjects and Legal Representatives

Members may at any time request access to, correction of, or deletion of their personal information, request suspension of processing, and withdraw consent.

These rights may be exercised through the account settings and meeting deletion features in the Services, by revoking access through the security settings of a connected service account, or by written or email request to support@bizcrush.ai. The Company will verify that the requester is the data subject or an authorized representative and then process the request without delay.

Individuals who attended or were invited to a meeting but do not hold an account may exercise the same rights with respect to data containing their voice, statements, or contact details, by contacting support@bizcrush.ai.

The Company does not make automated decisions that produce legal effects or similarly significant effects concerning Members.

In accordance with the Terms of Use, the Company restricts membership registration by persons under 18 years of age and does not collect personal information from children under 14. If registration by a child under 14 is confirmed, the account is deleted without delay.

9. Security Measures

Encryption in transit: communications with Member devices and with processors are encrypted using TLS.
Encryption at rest: managed default encryption at rest is applied to data stored on servers, and fields designated as requiring additional protection are further encrypted at the application level. Application-level encryption keys are managed through Google Cloud KMS.
Logging: access and change records are collected.

10. Google User Data

The Company's use and transfer of information received from Google APIs complies with the Limited Use requirements of the Google API Services User Data Policy.

The scopes requested are calendar.events.readonly (reading calendar events) and userinfo.email (identifying the connected account), and the data is used only to display upcoming events, identify meeting links, schedule and operate the assistant, and troubleshoot the integration.

The Company does not use this data to create, modify, or delete events, to send invitations, for personalized advertising, sale of data, creditworthiness assessment, training of generalized artificial intelligence models, or provision to data brokers. The Company does not allow humans to read this data except with the Member's affirmative consent, for security or abuse investigation, where required by law, or where aggregated and anonymized for internal operations.

11. Personal Information Protection Officer

Personal Information Protection Officer: Ethan Kim
Title: CTO
Contact: privacy@bizcrush.ai

12. Remedies for Infringement of Rights

Personal Information Dispute Mediation Committee: 1833-6972 (www.kopico.go.kr)
Personal Information Infringement Report Center: 118 (privacy.kisa.or.kr)
Supreme Prosecutors' Office Cyber Investigation Division: 1301 (www.spo.go.kr)
National Police Agency Cyber Bureau: 182 (ecrm.police.go.kr)

A person whose rights or interests have been infringed by a disposition or omission of the head of a public institution in response to a request under Articles 35, 36, or 37 of PIPA may file an administrative appeal in accordance with the Administrative Appeals Act.

13. Changes to This Privacy Policy

The Company will provide notice at least 7 days before the effective date of any amendment, and at least 30 days in advance for changes that materially affect Members' rights. Notice will be given through in-service announcement, website posting, or email.

14. Contact

Email: support@bizcrush.ai
Website: https://bizcrush.app