Privacy Policy
Effective date: 29 August 2026
Business name: 프로그 · Representative: 임광혁 · Business registration number: 191-21-01367
Data protection officer: 임광혁 · Contact: assure053@gmail.com
The Korean version of this document is the authoritative text. Versions in other languages are translations provided for convenience; in case of any discrepancy, the Korean version prevails.
chatbro (the "Company") complies with the Personal Information Protection Act and other applicable laws, and establishes and publishes this Privacy Policy in order to handle users' personal data safely. This policy applies equally to the website (chatbro.net) and the Android app.
1. Personal data we collect
| Category | Data collected | Required / optional |
|---|
| Sign up | Email, password (stored encrypted), nickname | Required |
| Conversation | The user's voice, text entered by the user, the avatar's responses | Required |
| Your own avatar | Photos uploaded by the user | Optional |
| Paid use | Payment result information such as subscription status, plan and billing date | Optional |
| Service use | Access logs, usage records, IP address, cookie and local-storage identifiers | Required |
| App notifications | Device notification token (FCM registration token), app version, marketing consent status and the time it was given | Optional |
The Company does not collect or store payment-method information such as card numbers. Payments are handled directly by Polar.
2. How we handle voice and photos
- Voice: the microphone is switched on only when you start it on the conversation screen. Transmitted audio is used solely for speech-to-text, and the original audio is not kept once the transcription is done. Speech recognition is performed on the Company's own servers as a rule; only where that is not feasible do we use Google's speech recognition (see section 5).
- Photos: used only to create an avatar and kept for as long as the created avatar is provided in the service. Deleting the avatar also deletes the source photo.
- Conversation content: kept during the session so the conversation can continue, and may be kept for a limited period to check service quality and handle reports of misuse.
- Chat recording: On the chat screen, the most recent minute of video and audio is stored temporarily on the user's device only. The clip is sent to our servers solely at the moment the user taps Share; if the chat ends without tapping it, the clip is deleted immediately. An uploaded clip is served on a share page viewable by anyone with the link and is deleted after 30 days. This feature can be turned off at any time under 'Auto-record chats' in Settings.
- The Company does not use voice, photos or conversation content for advertising, nor does it sell them.
3. Purposes of collection and use
- Identifying members and performing the service agreement (login, usage-limit management)
- Providing real-time conversation with an AI avatar (speech recognition, response generation, speech synthesis, video generation)
- Payment for paid services and subscription management
- Responding to enquiries, handling reports of inappropriate responses, preventing abuse
- Statistical analysis to improve the service
4. Retention and use period
Once the purpose of collection and use has been achieved, data is destroyed without delay. However, the following information is kept for a set period as required by law.
- Records of contracts and withdrawal of offers: 5 years (Korean Act on Consumer Protection in Electronic Commerce)
- Records of payments and supply of goods: 5 years (Korean Act on Consumer Protection in Electronic Commerce)
- Records of consumer complaints or dispute handling: 3 years (Korean Act on Consumer Protection in Electronic Commerce)
- Access records: 3 months (Korean Protection of Communications Secrets Act)
5. Sharing with third parties and processing on our behalf
| Recipient | Purpose | Data provided |
|---|
| Google LLC (Gemini) | Generating avatar responses; speech recognition (when the Company's own recognition is not feasible) | Conversation content (text), user's voice |
| ElevenLabs, Inc. | Avatar speech synthesis | Response text |
| kie.ai | Avatar image and video generation | Photos uploaded by the user |
| Polar Software Inc. | Payment and refund processing (Merchant of Record) | Email, payment amount, plan |
The providers above operate servers outside Korea, so personal data may be transferred abroad. The Company does not share personal data with third parties beyond the stated purposes, except where there is a legal basis or your separate consent.
6. App notifications and marketing messages
- If you allow notifications in the Android app, a notification tokenused to distinguish your device is stored on the Company's servers. This value cannot directly identify a user and is not used for any purpose other than sending notifications.
- We send marketing messages, such as news about new avatars and event announcements, only if you have opted in under [Settings → Notifications] in the app. You can withdraw consent at any time on the same screen; once withdrawn, you are removed from the send list immediately.
- Between 9 p.m. and 8 a.m., marketing messages are sent only with your separate consent to night-time delivery
of such messages.
- Notifications needed to perform the contract, such as payment confirmations, are not marketing messages and may be sent regardless of marketing consent.
- If you uninstall the app or turn off notifications on your device, the notification token becomes unusable, and the Company deletes tokens as soon as it detects that delivery has failed.
7. Your rights and how to exercise them
You may view and correct your personal data at any time, and you may withdraw consent to collection and use by closing your account. To close your account, see How to delete your account or use the settings screen. Requests to access, correct, delete or suspend the processing of your data can be sent to assure053@gmail.com.
8. Children under 14
The Company does not collect personal data from children under 14 and does not offer sign-up to them.
9. Destruction of personal data
Personal data whose retention period has expired or whose purpose has been achieved is destroyed without delay. Electronic files are deleted in a way that cannot be recovered, and paper documents are shredded or incinerated.
10. Security measures
- Passwords are stored in a form that cannot be decrypted.
- All transmissions are encrypted (HTTPS/WSS; audio and video use DTLS-SRTP).
- Access rights to personal-data systems are kept to a minimum.
11. Data protection officer
Contact person: 임광혁 · Email: assure053@gmail.com
12. Changes to this policy
This policy may be supplemented, removed or amended in line with changes in law, policy or security technology; any change will be announced in the service notices.