Privacy Policy
Effective Nov 1, 2026 · Revised Oct 25, 2026 · Version 1.5 (previous version 1.4: Aug 28, 2026) · English translation for reference; the Korean version prevails in case of conflict.
DragonEyes Inc. (“the Company”) establishes and discloses this Privacy Policy pursuant to Article 30 of the Korean Personal Information Protection Act (PIPA) to protect the personal information of data subjects and to handle related grievances promptly.
1. Purposes of Processing
The Company processes personal information for the purposes below and obtains prior consent when a purpose changes.
- Service user management — account creation, identity verification, authorization, and prevention of misuse
- Online harmful-content monitoring work — assigning tasks to monitoring agents and recording their work and attendance
- Online-safety campaigns — managing school/education-office participation, running surveys, and issuing volunteer certificates
- Customer support — contract and license management, preparation of statutory filings on a customer's behalf, and inquiry handling
- Keyword trend monitoring — judging public posts on keywords chosen by a customer and providing statistics
- University research and industry-collaboration service — registering, approving and managing research projects, industry-collaboration projects and tasks; running research surveys; handling research-data requests; managing university ESG data
- AI-assisted analysis — first-pass classification of harmful content, auto-filling registration forms, and drafting summaries and suggestions (results are used only after the user reviews them)
- Paid services — payment and refund processing and retention of related records
- Security — retaining access logs and using audit logs to detect unauthorized access (including to fulfill legal obligations)
2. Categories of Personal Information Processed
| Category | Items | Notes |
|---|---|---|
| Monitoring agents | name, user ID, email, mobile number, guardian contact (optional), affiliated organization | Mobile and guardian contacts are stored encrypted. Other HR information is held by the employer (customer) and is not collected by the Company. |
| Customer / partner contacts | name, user ID, email, contact, title, organization | For contract and business communication |
| Students (campaign) | name, user ID, school/grade/class, record of guardian consent | Users under 14 join only after legal-guardian consent |
| School staff | name, email, school, title, grade/class in charge | May be bulk-registered at the request of an education office or school |
| Parents / guardians | name, email, contact, child-linking information | When using paid content or notification services |
| University users (administrators, researchers, partner-company contacts) | name, user ID, email, affiliation (university, department, lab, company), title, role in a project, project and task records | Accounts are issued by the university or the Company; viewing scope is limited by affiliation and role |
| Research-survey respondents | survey answers and respondent attributes chosen by the researcher (e.g., gender, age band, region, occupation) | Anonymous by default (no name or contact is asked); exported research data remains anonymous |
| Research-data requesters | name, receiving email, purpose of use, request and approval records | Data is emailed to the given address only after the project lead approves |
| Automatically collected | access date/time, access IP, browser information, service usage records | For secure operation and detection of unauthorized access |
| AR experience (camera) | camera image (for AR display only) | The image is processed and shown only on the user's device and is never transmitted to or stored on the Company's servers |
| Payment | payment date/time, amount, method, transaction number | Card numbers and similar payment details are handled by the payment gateway and not stored by the Company |
As a rule the Company does not collect sensitive information (beliefs, political views, health, etc.) or resident registration numbers. Only where a customer requests the Company to prepare statutory filings on its behalf (e.g., for the Korea Employment Agency for Persons with Disabilities) does the Company process unique identifiers to the extent needed for those documents; such data is stored encrypted and masked on screen.
3. Processing and Retention Periods
- Member information — until membership withdrawal or contract termination; destroyed without delay thereafter
- Access logs — 2 years by default (configurable to 6 months / 1 year / 2 years per customer or region); automatically destroyed when the period elapses
- Audit records — retained separately as a tamper-evident integrity ledger to verify access and export history
- Payment / transaction records — 5 years under the Act on Consumer Protection in Electronic Commerce
- Monitoring reports / evidence — for the period necessary for reporting to relevant authorities and for dispute response
- University service records (projects, approvals, tasks, surveys, data requests) — kept by year for the term of the contract with the university, and returned or destroyed at the university's request when the contract ends
4. Provision to Third Parties
The Company provides personal information to third parties only where Article 17 of PIPA applies, such as with the data subject's consent or under specific legal provisions. When submitting materials to relevant authorities (e.g., the Korea Communications Standards Commission) during the harmful-content reporting process, only information about the reported content is included; users' personal information is not.
5. Outsourcing of Processing
| Processor | Entrusted work |
|---|---|
| NAVER Cloud Corp. | Cloud infrastructure and data storage for service operation |
| Payment gateway | Payment and refund processing for paid services |
| SMS / notification providers | Sending notifications and informational messages |
The Company specifies safeguards for the secure management of personal information in its outsourcing contracts and supervises its processors.
5-1. Overseas Transfer of Personal Information (AI Analysis)
To provide AI-assisted features, the Company sends some information to an overseas AI provider as shown below. Documents uploaded or text entered by a user are sent only when that user uses an AI feature.
| Recipient (country) | Items | When / how | Purpose / retention |
|---|---|---|---|
| Anthropic, PBC (USA) | Text or document content submitted for AI analysis (may include names and affiliations written in uploaded forms); titles and summaries of public posts | Each time the feature is used, over an encrypted API connection | Used only to generate the result and not used for AI training; deleted after a period under the provider's retention policy |
If you do not wish your information to be transferred overseas, you may enter it manually instead of using AI auto-fill. Contact: support@dragoneyes.co.kr
6. Personal Information of Children Under 14
When processing the personal information of children under 14, the Company obtains and records the consent of a legal guardian. It requests only the minimum information needed to use the service, and a legal guardian may at any time request access to, correction or deletion of, or suspension of processing of the child's personal information. Monitoring-work screens are blocked from access by minor accounts.
7. Rights of Data Subjects and How to Exercise Them
Data subjects may at any time request access, correction, deletion, or suspension of processingof their personal information. You may review or edit your information directly on the [User Info] screen within the service, or submit a request in writing or by email to the Privacy Officer below. The Company will act within 10 days of receiving the request and inform you of the result.
8. Destruction Procedure and Method
Personal information whose retention period has elapsed or whose processing purpose has been achieved is destroyed without delay. Electronic files are permanently deleted by irrecoverable means, and printed materials are shredded or incinerated. Information that must be retained under other laws is stored separately.
9. Security Measures
- Encrypted storage (AES-256) of personal-information items such as mobile numbers
- Role-based access control and two-factor authentication for administrator accounts
- A tamper-evident audit log (recording access and export history)
- Authorized administrators may access customer data only to the minimum extent necessary for customer support and system operation; all access, viewing, and export is recorded in the audit log
- When a partner or another customer's administrator views or searches a specific customer's information, that customer's administrator is notified, and access beyond one's scope is blocked
- One-way encryption of passwords and login-attempt limits
- Retention and periodic review of access logs, with automatic destruction of access logs
10. Privacy Officer
| Privacy Officer | Choi Seung Hyun · support@dragoneyes.co.kr · +82-70-5100-0994 |
| Grievance handling | Support Team · support@dragoneyes.co.kr |
For counseling on personal-information infringement in Korea you may contact the Personal Information Infringement Report Center (privacy.kisa.or.kr, 118), the Supreme Prosecutors' Office Cybercrime Division (1301), or the National Police Agency Cyber Bureau (ecrm.police.go.kr, 182).
11. Changes to This Policy
If this policy is changed, we will announce it through in-service notices at least 7 days before it takes effect (30 days before for material changes).
12. Notice on Use of YouTube API Services
The Company's service uses YouTube API Services to detect and review harmful content. By using the service you agree to be bound by the YouTube Terms of Service, and the Google Privacy Policy applies to information processed through the YouTube API.
- Data collected and used — Through the YouTube API we collect only public metadata of public videos (video ID, title, description, channel name, publish date, public comments), used solely to detect, review, and report content harmful to children and adolescents. We do not use Google-account authentication (OAuth) and do not access users' YouTube account information.
- Storage and destruction — YouTube API data is kept only as long as needed to operate the review queue and is periodically refreshed via the API; it is never stored longer than 30 days.Report bodies are destroyed 24 hours after filing, and only evidence for high-risk cases (severity 4 or higher) needed for legal reporting is retained separately.
- No third-party provision — We do not sell or provide YouTube API data to third parties and do not download, copy, or re-host videos. Playback occurs only through the official YouTube embedded player or links to YouTube.
- Revoking access — If you have connected a Google account to our service, you may revoke it at any time via Google security settings. For inquiries, contact support@dragoneyes.co.kr and we will act without delay.
13. Cookies and Device Storage
To keep users signed in, maintain session security, and operate the service, the Company stores, accesses and collects information on and from users' devices and browsers, including by placing, accessing and recognizing cookies and similar technologies such as browser local storage (localStorage and sessionStorage).
- Stored items — only the minimum needed to operate the service, such as a login session token and interface/accessibility preferences
- Purpose — keeping users signed in, security (e.g., preventing unauthorized access), and providing service functionality
- No third-party tracking — we do not use third-party advertising cookies or cross-site tracking technologies
- Your choices — you can delete or block cookies and storage in your browser settings, though some features (such as staying signed in) may then be limited