Privacy Policy
LinqplusAI Co., Ltd. ("the Company") establishes and discloses this Privacy Policy in accordance with the Personal Information Protection Act of the Republic of Korea to protect users' personal information and to handle related concerns promptly. This Policy applies to alladhere ("the Service") operated by the Company.
Effective date: October 6, 2026
1. Service overview and processing principles
alladhere is a B2B service for corporate marketing teams. It periodically reviews and records the publicly available content and public performance metrics of social media accounts designated by a client company (the client's own accounts and third-party accounts such as competitors) and presents them in a dashboard. The Company processes three categories of information:
(A) User account information — login accounts of client staff and Company administrators
(B) Publicly available information of monitored accounts — content information and metrics that anyone can view on the platform
(C) Connected account information — the user's own accounts linked directly through official authentication (OAuth); an optional feature
The Company processes only the minimum information necessary to provide the Service, does not access private accounts, private content, information that requires a user's login, or other non-public information, and does not sell or rent the information it processes for advertising or any other separate purpose.
2. Categories of personal information and how they are obtained
2-1. User account information (A)
| Type | Items | How obtained |
|---|---|---|
| Required | Name, email address, password (stored encrypted), client company | Registered by the Company upon invitation at the client's request; password set by the user |
| Optional | Phone number | Registered at invitation or entered by the user |
| Google sign-in | Google account email, display name | Approved by the user on Google's authentication screen |
| Generated automatically | Login time and method, service activity records (data uploads, settings changes, etc.), IP address, browser and device information, cookies | Generated in the course of using the Service |
At present, accounts are issued by the Company under its contract with each client. If a public sign-up process is introduced, this Policy will be revised and announced in advance.
2-2. Publicly available information of monitored accounts (B)
For public accounts designated by a client, the Company periodically records the following information that anyone can view on social media platforms.
- Account information — platform, account name (handle), country/region
- Content information — post URL, publication date, format, paid/organic classification, caption
- Public performance metrics — the view and engagement figures the platform makes public
- Content files — video and image files uploaded to the Service by the client for analysis
Collection takes place through the official APIs that platforms provide for public data. Where no such official API is available, Company staff view the public pages directly and record the information; in those cases the Company does not perform automated collection. This currently applies to third-party accounts on TikTok. Information from the Facebook Ad Library is likewise not obtained through an API; Company staff view the public pages directly and record it.
In all cases the Company processes only what each platform makes available as public data, and does not access private accounts, private content, information that requires a user's login, or other non-public information. The Company does not process comment text, the identity of commenters or likers, follower lists, or non-public statistics.
Where a monitored account belongs to an individual rather than a business or brand, the account name and similar items may constitute personal information. The Company processes such information only within the scope the data subject has made public, solely for the purpose of the client's marketing analysis, and the data subject may request deletion under Section 8.
2-3. Connected account information (C, optional)
When a client connects an account that it owns or is authorized to operate, the Company automatically retrieves detailed information about that account through the platform's official API. Connection requires the user's explicit approval on the platform's authentication screen for each account; nothing is retrieved without that approval. Users may disconnect at any time.
TikTok — TikTok Login Kit and Display API
| Information retrieved | Details |
|---|---|
Basic account information (user.info.basic) | Account identifier, display name, profile image |
Account statistics (user.info.stats) | Follower count, following count, total likes, video count |
Post list and metrics (video.list) | Post URL and publication time, duration, thumbnail, caption, view count, like count, comment count, share count |
The Company does not access, and does not request permission to access, private messages, follower personal information, profile bio, watch history, or location data.
Information retrieved from TikTok is used solely to generate the dashboard and reports of the client that connected the account. The Company does not share it with other clients, does not use it for advertising targeting or user profiling, and does not use it as training data for any artificial intelligence model.
If connection features for Meta (Instagram, Facebook) or Google (YouTube) accounts are offered, retrieval likewise takes place only through those platforms' official APIs with the user's explicit approval, and the items retrieved will be announced in advance by revising this Policy. Use of the YouTube and Instagram APIs to receive public information about public accounts is governed by Sections 15 and 16.
2-4. Content analysis processing
The Company processes the videos, images, and captions uploaded by clients or retrieved from connected accounts using an analysis engine that the Company operates itself, extracting quantified attributes such as shot composition, product exposure, on-screen text, and sound. This processing takes place within infrastructure managed by the Company, and the results are displayed only in the dashboard of the relevant client.
The Company does not provide content or analysis results obtained in this process to other clients, and does not use them as training data for any artificial intelligence model.
3. Purposes of processing
| Purpose | Items used |
|---|---|
| User identification, login, per-client access control | (A) Name, email, password, client company |
| Invitations, notices, inquiry responses | (A) Email, phone number |
| Security incident prevention and tracing, prevention of misuse | (A) Login and activity records, IP address, device information |
| Content status and performance trend analysis of client-designated accounts; dashboard delivery | (B) Account, content, and performance metric information |
| Content attribute analysis and performance pattern reports | (B) Content files, captions |
| Displaying connected-account content and metrics in the dashboard | (C) Items retrieved from connected accounts |
| Service improvement and error handling | (A) Activity records, device information |
The Company does not use the information for purposes other than those stated above and obtains prior consent if a purpose changes.
4. Retention and use period
| Category | Retention period |
|---|---|
| (A) User account information | Until account deletion or termination of the client contract; destroyed within 30 days thereafter |
| (A) Login and activity records (audit records) | 1 year from creation |
| (B) Publicly available information of monitored accounts | Destroyed within 30 days after termination of the client contract; within 10 days upon a data subject's deletion request. For data received through YouTube API Services, Section 15 prevails. For data received through Meta APIs, Section 16 prevails |
| (B) Original files uploaded by the client | 1 year from upload. For original files containing data received through YouTube API Services, Section 15 prevails (deleted within 30 days of receipt). For original files containing data received through Meta APIs, Section 16 prevails |
| (C) Connected account authentication tokens | Destroyed immediately upon disconnection |
| (C) Information retrieved from connected accounts | Destroyed within 30 days after disconnection or account deletion |
The following are retained for the periods required by applicable law:
- Records on contracts or withdrawal of offers: 5 years (Act on Consumer Protection in Electronic Commerce)
- Records on payment and supply of goods or services: 5 years (same Act)
- Records on consumer complaints or dispute handling: 3 years (same Act)
- Communication confirmation data: 3 months (Protection of Communications Secrets Act)
5. Provision to third parties
The Company does not provide personal information to third parties, except where the user has given prior consent or where an investigative agency requests it in accordance with lawful procedures under applicable law. Information recorded for accounts designated by a client is provided only to that client; other clients cannot view it.
6. Outsourcing of processing
| Processor | Outsourced task | Retention |
|---|---|---|
| Supabase, Inc. | Database, file storage, and authentication infrastructure (servers: Seoul region, Republic of Korea) | Until termination of the service agreement |
| Vercel, Inc. | Web hosting and server execution (execution region: Seoul, Republic of Korea) | Until termination of the service agreement |
| Resend, Inc. | Sending invitation, verification, and notification emails | Until termination of the service agreement |
| Google LLC | Google account sign-in authentication | Until termination of the service agreement |
The Company ensures that its agreements with processors address secure handling of personal information, restrictions on sub-outsourcing, and liability for damages, and verifies compliance. Changes to processors or outsourced tasks are disclosed through this Policy.
7. Cross-border transfer
All processors listed above are headquartered in the United States. Data storage and server execution are configured to take place in the Seoul region of the Republic of Korea; however, certain processing such as authentication and email delivery may pass through servers located abroad.
| Recipient | Country | Items transferred | Timing and method | Purpose | Retention |
|---|---|---|---|---|---|
| Supabase, Inc. | United States (storage in the Republic of Korea) | Items in Section 2 (A), (B), (C) | Network transmission during use of the Service | Data storage and authentication | Until termination of the service agreement |
| Vercel, Inc. | United States (execution in the Republic of Korea) | Items in Section 2 (A), (B) | Network transmission during use of the Service | Hosting and server execution | Until termination of the service agreement |
| Resend, Inc. | United States | Name, email | When emails are sent | Email delivery | For the processor's log retention period |
| Google LLC | United States | Email, display name | Upon Google sign-in | Authentication | Per Google's policies |
Users may refuse cross-border transfer; in that case use of the Service may be restricted.
8. Rights of data subjects and how to exercise them
Users and the data subjects of monitored accounts may at any time request access, correction, deletion, suspension of processing, or disconnection. Requests are accepted by email at the address in Section 13. The Company takes action and notifies the result within 10 days of receipt. Apart from disconnection, self-service handling within the Service is not currently provided.
If the data subject of a monitored account requests deletion, the Company will verify identity, delete the recorded information related to that account within 10 days, and exclude the account from further monitoring.
How to disconnect a TikTok account
- Sign in to the Service and select "Disconnect" on the connection screen. The Company asks TikTok to revoke the permission and destroys the stored information immediately.
- Or email the Company at the address in Section 13 to request disconnection.
- Or revoke alladhere's permission in the TikTok app under Settings → Security and login → Manage app permissions.
In either case the Company destroys the information retrieved from that account within 30 days. If a user revokes permission directly in TikTok, the Company destroys that information without requiring any separate request.
9. Destruction procedure and method
Information whose retention period has expired or whose purpose has been achieved is destroyed without delay. Electronic files are deleted by methods that make recovery impossible; paper documents are shredded or incinerated. Information that must be preserved under law is stored separately and not used for any other purpose.
10. Security measures
- Administrative: Internal management plan; minimization of staff handling personal information
- Technical: Per-client data separation (row-level access control in the database), access control, retention of login and key activity records, encrypted password storage, encryption of stored data, encryption in transit (HTTPS), encrypted storage of connected-account authentication tokens, private storage of uploaded files with time-limited access links
- Physical: Data center access control by the cloud providers
11. Cookies
The Company uses cookies to maintain login sessions. No advertising or tracking cookies are used. Users may refuse cookies in their browser settings, in which case features that require login will be unavailable.
12. Children under 14
The Service is a B2B service intended for marketing staff at corporate clients and does not accept registration by children under the age of 14. The Company does not knowingly collect personal information from children under 14 and will destroy any such information without delay upon becoming aware of it.
13. Privacy officer and contact
Privacy Officer
- Name: Joonhee Choi
- Title: Chief Executive Officer
- Email: privacy@alladhere.com
Company
- Name: LinqplusAI Co., Ltd.
- Address: #903, 5 Eonju-ro 86-gil, Gangnam-gu, Seoul, Republic of Korea
- Business registration number: 542-81-04284
Other agencies for reports and consultation: Personal Information Dispute Mediation Committee (www.kopico.go.kr / 1833-6972), Personal Information Infringement Report Center (privacy.kisa.or.kr / 118), Supreme Prosecutors' Office Cyber Investigation Division (www.spo.go.kr / 1301), National Police Agency Cyber Bureau (ecrm.police.go.kr / 182)
14. Changes to this Policy
This Policy applies from the effective date. When the Policy is revised due to changes in law or the Service, the changes are announced through the Service at least 7 days before they take effect, or at least 30 days in advance for changes that materially affect users' rights.
- Announced: October 6, 2026
- Effective: October 6, 2026
15. Use of YouTube API Services
The Service uses YouTube API Services to retrieve publicly available information about YouTube channels and videos. Users of the Service are bound by the YouTube Terms of Service (https://www.youtube.com/t/terms), and the Google Privacy Policy (https://policies.google.com/privacy) applies to information processed through YouTube API Services.
Information received through YouTube API Services
- Public channel and video metadata of channels registered by a client: title, description, publication date, channel name, channel handle, video ID and URL, video format, tags
- Public statistics: view count, like count, comment count, subscriber count, channel video count
The Company does not collect users' Google account data through YouTube API Services, and does not require Google account sign-in (OAuth) or connection of a YouTube account to use the YouTube-related features. Google sign-in as a way of logging in to the Service (Section 2-1) is separate from this and does not access YouTube data.
Retention and deletion
Data received through YouTube API Services is either refreshed by retrieving it again or deleted within 30 days of the date it was received. Deletion takes place automatically every day. If YouTube approves an extended retention period, the Company will change the retention period within the approved scope, for public statistics only, and update this Policy. For data received through YouTube API Services, this Section prevails over the table in Section 4.
Use
Data received through YouTube API Services is used only to display and compare the public statistics of registered channels within the client's Service screens. The Company does not sell or provide data received through YouTube API Services to third parties. The processors listed in Section 6 (data storage and hosting) process it on the Company's behalf, and the data is displayed only on the screens of clients that registered the channel.
The Company does not create or display new or derived metrics from data received through YouTube API Services without YouTube's approval. Where values not provided by YouTube are displayed alongside YouTube data, the Company discloses there that they are not from YouTube and are part of alladhere's own product.
Contact
Requests for access to or deletion of data received through YouTube API Services, and related inquiries, are accepted at the contact in Section 13; deletion requests are completed within 7 days of receipt.
16. Use of Meta (Instagram) APIs
The Service uses the Instagram Graph API (Business Discovery) provided by Meta to retrieve publicly available information about public Instagram professional accounts. Information received through this API is processed in accordance with the Meta Platform Terms (https://developers.facebook.com/terms/).
Information received through Meta APIs
- Metadata of public Instagram accounts registered by a client: account name (handle), display name, post ID and URL, publication date, format, caption, hashtags
- Public metrics: follower count, post count, and each post's like count, comment count, and view count
The Company does not require users or clients to sign in with or connect a Facebook or Instagram account, and does not collect users' Facebook or Instagram account information. API calls use only the credentials of an account managed by the Company. Private accounts, messages, follower lists, and commenter information are not received.
Information from the Facebook Ad Library is not obtained through an API; Company staff view the public pages directly and record it.
Use and sharing
Data received through Meta APIs is used only to display and compare public metrics on the Service screens of the client that registered the account. The Company does not sell or license this data, and does not share it with third parties other than the processors listed in Section 6 (data storage and hosting) or where required by law.
Retention and deletion
Data received through Meta APIs is retained only as long as necessary for the legitimate business purpose of providing the Service to clients, and is deleted without delay once that purpose ends (Section 4). The Company also deletes it without delay when Meta requests deletion. For data received through Meta APIs, this Section prevails over the table in Section 4.
Deletion requests and contact
Users and the data subjects of the relevant Instagram accounts may request access to, correction of, or deletion of data received through Meta APIs by email at the address in Section 13; the Company handles such requests within 10 days of receipt under Section 8.
This English version is provided for reference. In the event of any discrepancy, the Korean version prevails.