Privacy Policy
LinqplusAI Co., Ltd. ("the Company") establishes and discloses this Privacy Policy in accordance with the Personal Information Protection Act of the Republic of Korea to protect users' personal information and to handle related concerns promptly. This Policy applies to alladhere ("the Service") operated by the Company.
Effective date: September 9, 2026
1. Service overview and processing principles
alladhere is a B2B service for corporate marketing teams. It periodically reviews and records the publicly available content and public performance metrics of social media accounts designated by a client company (the client's own accounts and third-party accounts such as competitors) and presents them in a dashboard. The Company processes three categories of information:
- (A) User account information — login accounts of client staff and Company administrators
- (B) Publicly available information of monitored accounts — content information and metrics that anyone can view on the platform
- (C) Connected account information — the user's own accounts linked directly through official authentication (OAuth); an optional feature
The Company processes only the minimum information necessary to provide the Service, does not access private accounts, private content, or information that requires login, and does not sell or rent the information it processes for advertising or any other separate purpose.
2. Categories of personal information and how they are obtained
2-1. User account information (A)
| Type | Items | How obtained |
|---|---|---|
| Required | Name, email address, password (stored encrypted), client company | Registered by the Company upon invitation at the client's request; password set by the user |
| Optional | Phone number | Registered at invitation or entered by the user |
| Google sign-in | Google account email, display name | Approved by the user on Google's authentication screen |
| Generated automatically | Login time and method, service activity records (data uploads, settings changes, etc.), IP address, browser and device information, cookies | Generated in the course of using the Service |
Accounts are created by invitation only. There is no public sign-up.
2-2. Publicly available information of monitored accounts (B)
For public accounts designated by a client, the Company periodically (by default once a week) reviews and records the following information that anyone can view on each platform (TikTok, Instagram, Facebook, YouTube).
| Category | Items |
|---|---|
| Account | Platform, account name (handle), country/region |
| Content | Post URL, publication date, format (video, image, etc.), paid/organic classification, part of the caption |
| Performance metrics | Views, likes, comments, saves, shares (public values at the time of recording) |
Recording is performed by Company staff who directly view the platform's public pages. The Company does not send automated requests to any platform. Where a platform provides an official API for public data (for example, the YouTube Data API), the Company retrieves the information through that API. The Company does not process comment text, the identity of commenters or likers, follower lists, or non-public statistics.
Where a monitored account belongs to an individual rather than a business or brand, the account name and similar items may constitute personal information. The Company processes such information only within the scope the data subject has made public, solely for the purpose of the client's marketing analysis, and the data subject may request deletion under Section 8.
2-3. Connected account information (C, optional)
When a user connects their own account to the Service, the Company retrieves the following information through the platform's official API. Connection requires the user's explicit approval on the platform's authentication screen for each account; nothing is retrieved without that approval.
TikTok — TikTok Login Kit and Display API
| Scope | Items retrieved |
|---|---|
user.info.basic | Unique account identifier (open_id), display name, profile image URL |
video.list | Video ID, video URL, publication time, duration, thumbnail URL, caption, view count, like count, comment count, share count |
The Company does not access, and does not request permission to access, private messages, follower personal information, watch history, or location data. If connection features for other platforms are added, this Policy will be revised and announced in advance.
3. Purposes of processing
| Purpose | Items used |
|---|---|
| User identification, login, per-client access control | (A) Name, email, password, client company |
| Invitations, notices, inquiry responses | (A) Email, phone number |
| Security incident prevention and tracing, prevention of misuse | (A) Login and activity records, IP address, device information |
| Content status and performance trend analysis of client-designated accounts; dashboard delivery | (B) Account, content, and performance metric information |
| Displaying connected-account content and metrics in the dashboard | (C) Items retrieved from connected accounts |
| Service improvement and error handling | (A) Activity records, device information |
The Company does not use the information for purposes other than those stated above and obtains prior consent if a purpose changes.
4. Retention and use period
| Category | Retention period |
|---|---|
| (A) User account information | Until account deletion or termination of the client contract; destroyed within 30 days thereafter |
| (A) Login and activity records (audit records) | 1 year from creation |
| (B) Publicly available information of monitored accounts | Destroyed within 30 days after termination of the client contract; within 10 days upon a data subject's deletion request |
| (B) Original files uploaded by the client | 1 year from upload |
| (C) Connected account authentication tokens | Destroyed immediately upon disconnection |
| (C) Information retrieved from connected accounts | Destroyed within 30 days after disconnection or account deletion |
The following are retained for the periods required by applicable law:
- Records on contracts or withdrawal of offers: 5 years (Act on Consumer Protection in Electronic Commerce)
- Records on payment and supply of goods or services: 5 years (same Act)
- Records on consumer complaints or dispute handling: 3 years (same Act)
- Communication confirmation data: 3 months (Protection of Communications Secrets Act)
5. Provision to third parties
The Company does not provide personal information to third parties, except where the user has given prior consent or where an investigative agency requests it in accordance with lawful procedures under applicable law. Information recorded for accounts designated by a client is provided only to that client; other clients cannot view it.
6. Outsourcing of processing
| Processor | Outsourced task | Retention |
|---|---|---|
| Supabase, Inc. | Database, file storage, and authentication infrastructure (servers: Seoul region, Republic of Korea) | Until termination of the service agreement |
| Vercel, Inc. | Web hosting and server execution (execution region: Seoul, Republic of Korea) | Until termination of the service agreement |
| Resend, Inc. | Sending invitation, verification, and notification emails | Until termination of the service agreement |
| Google LLC | Google account sign-in authentication | Until termination of the service agreement |
The Company ensures that its agreements with processors address secure handling of personal information, restrictions on sub-outsourcing, and liability for damages, and verifies compliance. Changes to processors or outsourced tasks are disclosed through this Policy.
7. Cross-border transfer
All processors listed above are headquartered in the United States. Data storage and server execution are configured to take place in the Seoul region of the Republic of Korea; however, certain processing such as authentication and email delivery may pass through servers located abroad.
| Recipient | Country | Items transferred | Timing and method | Purpose | Retention |
|---|---|---|---|---|---|
| Supabase, Inc. | United States (storage in the Republic of Korea) | Items in Section 2 (A), (B), (C) | Network transmission during use of the Service | Data storage and authentication | Until termination of the service agreement |
| Vercel, Inc. | United States (execution in the Republic of Korea) | Items in Section 2 (A), (B) | Network transmission during use of the Service | Hosting and server execution | Until termination of the service agreement |
| Resend, Inc. | United States | Name, email | When emails are sent | Email delivery | For the processor's log retention period |
| Google LLC | United States | Email, display name | Upon Google sign-in | Authentication | Per Google's policies |
Users may refuse cross-border transfer; in that case use of the Service may be restricted.
8. Rights of data subjects and how to exercise them
Users and the data subjects of monitored accounts may at any time request access, correction, deletion, suspension of processing, or disconnection. Requests are accepted by email at the address in Section 12. The Company takes action and notifies the result within 10 days of receipt. Self-service handling within the Service is not currently provided.
If the data subject of a monitored account requests deletion, the Company will verify identity, delete the recorded information related to that account within 10 days, and exclude the account from further monitoring.
To disconnect a TikTok account, email the Company, or revoke alladhere's permission in the TikTok app under Settings → Security and login → Manage app permissions. In either case the Company destroys the information retrieved from that account within 30 days.
9. Destruction procedure and method
Information whose retention period has expired or whose purpose has been achieved is destroyed without delay. Electronic files are deleted by methods that make recovery impossible; paper documents are shredded or incinerated. Information that must be preserved under law is stored separately and not used for any other purpose.
10. Security measures
- Administrative: Internal management plan; minimization of staff handling personal information
- Technical: Per-client data separation (row-level access control in the database), access control, retention of login and key activity records, encrypted password storage, encryption of stored data, encryption in transit (HTTPS), private storage of uploaded files with time-limited access links
- Physical: Data center access control by the cloud providers
11. Cookies
The Company uses cookies to maintain login sessions. No advertising or tracking cookies are used. Users may refuse cookies in their browser settings, in which case features that require login will be unavailable.
12. Privacy officer and contact
Privacy Officer
- Name: Joonhee Choi
- Title: Chief Executive Officer
- Email: privacy@alladhere.com
Company
- Name: LinqplusAI Co., Ltd.
- Address: #903, 5 Eonju-ro 86-gil, Gangnam-gu, Seoul, Republic of Korea
- Business registration number: 542-81-04284
Other agencies for reports and consultation: Personal Information Dispute Mediation Committee (www.kopico.go.kr / 1833-6972), Personal Information Infringement Report Center (privacy.kisa.or.kr / 118), Supreme Prosecutors' Office Cyber Investigation Division (www.spo.go.kr / 1301), National Police Agency Cyber Bureau (ecrm.police.go.kr / 182)
13. Changes to this Policy
This Policy applies from the effective date. When the Policy is revised due to changes in law or the Service, the changes are announced through the Service at least 7 days before they take effect, or at least 30 days in advance for changes that materially affect users' rights.
- Announced: September 9, 2026
- Effective: September 9, 2026
This English version is provided for reference. In the event of any discrepancy, the Korean version prevails.