This English version is provided for convenience. In case of any conflict, the Korean version prevails.
HyperReality Co., Ltd. (the "Company") complies with the Personal Information Protection Act of Korea and other applicable laws in providing Zapp (z-app.im, the "Service"), an AI-powered product planning and collaboration service. This Privacy Policy explains what personal information the Company processes, why, for how long, and to whom it entrusts or provides that information.
At a glance
| What | Details |
|---|---|
| Information we collect | Google account email and name, Service usage records, profile and onboarding survey answers you enter, credentials for external services you connect (stored encrypted) |
| How we use it | Sign-in, running Teams (workspaces), customer support, security and incident response |
| Who we entrust it to | Cloud, email, sign-in, usage analytics, operational alerts, AI (see Articles 4 and 5) |
| Retention | Until you delete your account. Only records required by law are kept for the legally required period |
| Contact | Privacy Officer Juyoung Kang · help@z-app.im |
The Company's two roles
The Service is a tool used by businesses and teams. Within the same Service, the Company's role differs depending on the information.
| Information | Company's role | Governing document |
|---|---|---|
| Member account information, access logs, inquiries | Controller: the Company determines the purposes and means | This Privacy Policy |
| Data that customers (the teams or businesses Members belong to) upload to or connect with the Service, "Customer Data". Examples: planning documents, feature specs, ideas, decision records, user interview notes (interviewee names and statements), uploaded files, AI Copilot conversations | Processor: the Company processes it only to provide the Service, as instructed by the customer | The customer's privacy policy; the Terms of Service between the Company and the customer (Customer Data article) |
For requests to access or delete personal information contained in Customer Data (for example, an interviewee's name and statements), please contact the relevant customer first. If such a request reaches the Company, we forward it to that customer.
Article 1 Personal information processed: items, purposes, legal bases, and retention
| When | Items | Purpose | Legal basis | Retention |
|---|---|---|---|---|
| Sign-up and sign-in (Google sign-in) | Email, name (used to generate a nickname) | Member identification, sign-in, announcements | Performance of contract (Art. 15(1)(4) of the Act) | Until account deletion |
| Sign-up (email sign-up) | Email, password (one-way encrypted), nickname, sign-up channel, consent to terms and marketing | Member identification, sign-in | Performance of contract | Until account deletion |
| Email verification and password reset | Email, verification code, request and verification time | Identity verification | Performance of contract | Until account deletion |
| Profile and onboarding survey (optional) | Profile image, onboarding answers such as role and experience level | Personalized guidance, Service improvement | Consent of the data subject (Art. 15(1)(1) of the Act); you can use the Service without entering these | Until account deletion or a deletion request |
| Marketing communications (optional) | Email, consent status | Announcements of events and new features | Consent of the data subject | Until consent is withdrawn or the account is deleted |
| Team invitations | Invitee's email, inviting Member | Sending invitation emails, processing Team membership | Performance of contract | Until the Team is deleted |
| Service usage | Access IP, browser information (User-Agent), access time, Service usage records, error records | Security, fraud prevention, incident response | Legitimate interests (Art. 15(1)(6) of the Act) | 1 year (access logs at least 3 months under the Protection of Communications Secrets Act) |
| Real-time activity indicator | Member identifier, project, document, and screen being worked on, last activity time | Showing teammates who is "working on" what | Performance of contract | 24 hours after last activity |
| Access token (MCP) issuance | Token name, token hash, encrypted copy for re-display, display prefix, last used time | Connecting external AI tools, security audits | Performance of contract | Until the token is revoked or the account is deleted |
| External account connections (optional) | Claude subscription token or API key, OpenAI API key, ChatGPT (Codex) credentials, Confluence and GitHub tokens with the connected account's email and address, all stored encrypted | Running AI features and external integrations as directed by the user | Performance of contract | Until disconnected or the account is deleted |
| Sending email | Recipient email, subject, body (bodies of emails containing tokens, such as verification and invitations, are not stored), delivery result | Delivery confirmation, resending, incident response | Legitimate interests | 1 year after sending |
| Sales inquiries | Name, email, mobile number, company name, project name, budget, inquiry details | Responding to inquiries, consultations | Taking steps at the data subject's request before entering into a contract (Art. 15(1)(4) of the Act) | 3 years after the inquiry is resolved |
| Paid payments (Korea) | Not applicable: the Company does not currently accept paid payments. If we introduce payments, we will amend and announce this Privacy Policy | — | — | — |
| Paid payments (overseas) | Not applicable: same as above | — | — | — |
Records retained under law are stored separately from other information and used only for that purpose.
| Record | Period | Legal basis |
|---|---|---|
| Records of contracts or withdrawal of offers | 5 years | Act on Consumer Protection in Electronic Commerce |
| Records of payments and supply of goods | 5 years | Act on Consumer Protection in Electronic Commerce |
| Records of consumer complaints or dispute resolution | 3 years | Act on Consumer Protection in Electronic Commerce |
| Website visit (sign-in) records | 3 months | Protection of Communications Secrets Act |
Article 2 Processing of Customer Data
- The Company processes Customer Data only to provide the Service, maintain security, and comply with law, and does not use it for any other purpose or provide it to third parties.
- If Customer Data contains personal information (for example, the names and statements of user interviewees), the customer is responsible for having a lawful basis to collect it and for informing the data subjects.
- When a customer deletes a workspace or the agreement ends, the Company gives the customer 30 days to export (download) the data and then destroys the Customer Data. Copies remaining in backups are deleted according to the backup cycle (up to 30 days).
- At the request of a business customer, the Company enters into a data processing agreement (DPA).
Article 3 AI Features
- The Service offers a generative AI feature (AI Copilot, a chat that reads a project's documents and issues and helps draft planning artifacts).
- When you use AI features, your input, related project materials, and the output are sent to the AI provider. The Company stores Copilot conversations (input and output) as the project's conversation history and keeps them until the user deletes the conversation or the project is deleted.
- By default, AI features run on AI accounts the user connects directly (the user's own Claude subscription, ChatGPT subscription, or OpenAI API key). In that case, the AI provider's processing is governed by the terms between the user and that provider and by the user's account settings (including whether data may be used for training), and the Company only transmits data as the user directs.
- Where the Company, by operational configuration, uses its own AI account (Anthropic API), this constitutes entrustment and overseas transfer under Articles 4 and 5.
- If AI output is inappropriate or incorrect, please let us know at help@z-app.im. We will review it, take action, and reply with the result.
- Do not enter sensitive information such as resident registration numbers or health information into AI features.
Article 4 Entrustment of personal information processing
| Processor | Entrusted task |
|---|---|
| Google LLC | Google account sign-in (authentication), website usage analytics (Google Analytics) |
| Amazon Web Services, Inc. | Sending email (Amazon SES, Seoul region) |
| HyperReality Co., Ltd. (self-operated cloud "zerocloud") | Service servers, databases, and file storage; email relay |
| Anthropic PBC | AI Copilot processing, only when the Company's AI account is used (Article 3(4)) |
| Slack Technologies, LLC | Delivering error and inquiry alerts (internal operator alerts) |
| Discord Inc. | Delivering operational alerts (new sign-up alerts: nickname, masked email) |
| PAYPLE Co., Ltd. | Not applicable: before paid payments are introduced |
Transfers to external services that users connect themselves (Claude, ChatGPT, and OpenAI accounts, Confluence, GitHub, webhooks registered by users, AI tools connected via MCP) are not entrusted by the Company but made at the user's direction. Such processing is governed by the terms between the user and that service.
If our processors change, we will amend and announce this Privacy Policy.
Article 5 Overseas transfer of personal information
To provide the Service (perform the contract), the Company stores and entrusts the processing of personal information overseas as follows (Art. 28-8(1)(3) of the Act). Transfers take place over the network when you use the Service.
| Recipient (contact) | Country | Items | Purpose | Retention | How to refuse and effect |
|---|---|---|---|---|---|
| Google LLC (privacy.google.com) | United States | Email, name | Google sign-in | Until account deletion | You can refuse by not signing up. Because Google is currently the only sign-in option, refusing means you cannot use the Service |
| Google LLC (privacy.google.com) | United States | Cookie identifiers, pages visited, device and browser information, access IP | Usage analytics (Google Analytics) | According to Google Analytics data retention settings | You can refuse using the methods in Article 8; refusing does not affect your use of the Service |
| Anthropic PBC (privacy@anthropic.com) | United States | AI feature input, related project materials, output | Providing AI features (only when the Company's AI account is used) | Deleted within up to 30 days under the provider's policy; not used for training | Not transferred if you do not use AI features. All other features remain available |
| Slack Technologies, LLC (slack.com/trust/privacy) | United States | On errors: access IP, browser information, request path and content (excluding passwords, tokens, and cookies), Member identifier / On sales inquiries: company name, inquiry details, masked name and contact | Incident response, inquiry intake | 1 year | These are internal alerts needed to operate the Service and cannot be refused separately. If you do not want this, stop using the Service or contact help@z-app.im |
| Discord Inc. (discord.com/privacy) | United States | Nickname, masked email, sign-up channel | Operator sign-up alerts | 1 year | Same as above |
| Amazon Web Services, Inc. (aws.amazon.com/compliance/contact) | Republic of Korea (Seoul region), not an overseas transfer | Recipient email, email content | Sending email | According to AWS policy after sending | — |
Article 6 Provision of personal information to third parties
The Company does not provide personal information to third parties except with the data subject's consent or where specifically permitted by law.
| Recipient | Country | Items | Purpose | Retention |
|---|---|---|---|---|
| Not applicable: the Company does not currently accept paid payments. If we introduce overseas payments (Paddle.com Market Limited, United Kingdom), we will amend this Privacy Policy and obtain consent to the provision on the checkout screen | — | — | — | — |
Article 7 Destruction of personal information
- We destroy personal information without delay once the retention period ends or the purpose is achieved.
- Electronic files are deleted in a way that cannot be recovered, and paper documents are shredded or incinerated.
- After account deletion, we keep the information for 30 days so the account can be restored if deleted by mistake, and then destroy it. Records required by law are stored separately for the periods in Article 1.
Article 8 Cookies and other automatic collection tools
- The Service uses essential cookies (or browser storage) to keep you signed in.
- The landing site (z-app.im) and the console (console.z-app.im) use Google Analytics (Google LLC, United States) for usage statistics. Google Analytics uses cookies to collect pages visited, time on page, and device and browser information, and the Company looks at this only as statistics that do not identify individuals. You can refuse with the Google Analytics Opt-out Browser Add-on (tools.google.com/dlpage/gaoptout) or the browser cookie settings below; refusing does not affect your use of the Service.
- You can refuse cookies in your browser settings. If you refuse essential cookies, you will not stay signed in.
- Chrome: Settings → Privacy and security → Third-party cookies
- Safari: Settings → Privacy
Article 9 Children under 14
The Service does not accept sign-ups from children under the age of 14. If we find that a user is under 14, we delete the account without delay.
Article 10 Rights of data subjects and how to exercise them
- Data subjects may at any time request access to, correction or deletion of, suspension of processing of, or transfer of their personal information, or withdraw consent.
- You can edit your nickname and profile image yourself in the account settings within the Service. For other requests and account deletion, email help@z-app.im and we will process the request within 10 days.
- You may also exercise these rights through an agent (a legal representative or an authorized person), who must submit a power of attorney.
- You cannot request deletion of information that other laws require us to retain.
Article 11 Automated decisions
The Company does not make decisions that significantly affect data subjects' rights or obligations in a fully automated way. When an account is restricted through fraud detection, a person reviews it.
Article 12 Security measures
- Administrative: an internal management plan, minimizing who has access, regular reviews
- Technical: access control, encryption in transit (HTTPS), one-way password encryption, encrypted storage of external integration credentials, access tokens authenticated by hash only with the re-display copy stored encrypted, masking of emails and contact details in operational alerts, retention of access logs
- Physical: access control for servers and data storage locations
Article 13 Privacy Officer
- Privacy Officer: Juyoung Kang (CEO)
- Email: help@z-app.im
- Phone: +82 507-0178-7546
Article 14 Remedies for infringement
If you need counseling or dispute resolution regarding infringement of personal information, you may contact the following agencies (services are provided in Korean).
- Personal Information Infringement Report Center (Korea Internet & Security Agency): privacy.kisa.or.kr / 118 (in Korea)
- Personal Information Dispute Mediation Committee: www.kopico.go.kr / 1833-6972
- Supreme Prosecutors' Office Cyber Investigation Division: www.spo.go.kr / 1301 (in Korea)
- Korean National Police Agency Cyber Bureau: ecrm.police.go.kr / 182 (in Korea)
Article 15 Changes to this Privacy Policy
- This Privacy Policy takes effect on 2026-10-12.
- If it changes, we announce the change on the Service 7 days before it takes effect. For changes important to data subjects' rights, such as adding collected items or providing data to third parties, we announce them 30 days in advance and obtain consent again where necessary.
- Previous versions of this Privacy Policy are available under "Previous versions" at the bottom of this page.