In order to protect the freedom and rights of data subjects (users) who use the company's services (including the official website upstage.ai, Upstage Console console.upstage.ai, AI Space space.upstage.ai, Upstage Studio studio.upstage.ai, Education edu.upstage.ai, etc., collectively referred to as 'Upstage Service'), the company complies with the Personal Information Protection Act and related laws, and processes personal information lawfully and manages it securely.
In compliance with Article 30 of the Personal Information Protection Act, Upstage establishes and discloses the following privacy policy to inform information subjects of the procedures and standards for processing personal information and to handle grievances promptly and smoothly.
Country-specific supplementary provisions on personal information
This Privacy Policy has been drafted in accordance with the laws of the Republic of Korea. If you reside in any of the regions listed below, please also review the supplementary provisions, which provide additional information regarding your rights and our obligations under the relevant local laws.
Disclaimer: Governing law
So, as you know, the laws and regulations of the Republic of Korea have formulated this privacy policy. While it applies to our global operations, the policy is primarily governed by South Korean legal standards and practices. Users outside of South Korea should be aware that the policy might reference legal concepts and frameworks specific to South Korea, which may differ from local laws.
1. Purpose, items, and retention period of personal information processing
The Company processes personal information for the following purposes. It obtains the data subject's consent for processing their personal information items by Article 15 Paragraph 1 Clause 1 and Article 22 Paragraph 1 Clause 7 of the Personal Information Protection Act. If the purpose of use changes, the Company will take necessary measures such as obtaining separate consent by Article 18 of the Personal Information Protection Act.
A. Membership registration and management: Until the member withdraws
However, in the following cases, until the end of the relevant reason
- If there is an ongoing investigation or inquiry due to a violation of related laws, until the end of the investigation or inquiry
- If there is a remaining debt or credit relationship due to the service use until the settlement of the debt or credit relationship
B. Provision of goods or services: Until the completion of the supply of goods or services and the payment and settlement of fees
C. Non-member services: Information collected through non-member services will be retained for one year and deleted thereafter in accordance with our Privacy Policy.
- However, if a non-member requests deletion through a personal information access request, it will be deleted without delay.
However, in the following cases, until the end of the relevant period
- Records related to transactions, such as labeling and advertising, contract details, and fulfillment, pursuant to Article 6 of the Act on Consumer Protection in Electronic Commerce, etc.
- Records on display and advertisement: 6 months
- Records on contract or withdrawal of the offer, payment of the price, and supply of goods, etc.: 5 years
- Records on consumer complaints or dispute resolution: 3 years
- Retention of communication data in accordance with Article 15-2, Paragraph 2 of the Communications Secrets Protection Act:
- Service usage records, access logs, access IP addresses: 3 months
| Service |
Category |
Purpose of collection |
Items collected |
Retention and use period |
| Upstage Service |
Membership registration and management |
To confirm the intention of membership registration, to identify and authenticate the member for the provision of membership services, to maintain and manage the membership status, to prevent fraudulent use of services, to enhance user security, to improve service quality, to develop new features and services, and to deliver various notices and notifications. |
(Required) Email address, password However, if you sign up without a password with Google Oauth, we collect email as a required field and password as an optional field. |
Retained for 90 days after withdrawal, then deleted |
| Upstage Service |
Console, Studio - Provide services |
We are providing services, payment processing, and settlement for personalized services. |
(Required) Card number, card expiry, CVC code. (Optional) Data entered by the user in the service is automatically generated during service usage. |
Completed supply of goods or services, and payment settled. Exceptions: Preservation by law is required for five years. |
| Upstage Service |
Console - Playground |
- To provide LLM and Document AI services
- To improve and develop our Services and conduct research, for example, to develop new product features.
|
Conversation content, uploaded documents, and voting content entered by the user who registered for membership. |
Until the withdrawal of membership or the termination of the outsourcing contract. |
| Upstage Service |
Console - Non-member services (Playground) |
- To provide LLM and Document AI services
- To improve and develop our Services and conduct research, for example, to develop new product features.
|
Conversation content, uploaded documents, and voting content entered by non-member users. |
1 year * However, if a non-member user requests deletion through a personal information access request, it will be deleted without delay. |
| Upstage Service |
Console - Asynchronous API |
To provide asynchronous services |
Inference request data, inference result data |
Inference Request Data: Temporarily store inference requests until completion. Inference Result Data: Store inference results for 30 days after completion. |
| Upstage Service |
Support |
- Consumer complaints
- Complaint resolution
|
Counseling services, the purpose of the request, name, phone number, email, consultation records (contents, date, and time), and complaint or grievance resolution. |
3 years |
| Upstage Service |
Marketing information utilization |
To send newsletters |
(Optional) Email address |
Until the user expresses their intention to refuse to receive or withdraw their consent |
| Upstage Service |
Provision of events and advertising information |
(Optional) Name, email address, phone number, affiliation (company and department name/school and department name), job title |
Until the user expresses their intention to refuse to receive or withdraw their consent |
| Upstage Service |
AI Space - Chat |
To provide AI services |
Conversation content, uploaded documents, and voting content entered by the user who registered for membership. |
Until the withdrawal of membership or the termination of the outsourcing contract. |
| Studio - My workflows |
- To provide Document AI services
- To improve and develop our Services and conduct research, for example, to develop new product features.
|
Uploaded documents by the user who registered for membership. |
Until the withdrawal of membership or the termination of the outsourcing contract. |
| AI Education - Membership registration and management |
To confirm the intention of membership registration, to identify and authenticate the member for the provision of membership services, to maintain and manage the membership status, to prevent fraudulent use of services, to enhance user security, to improve service quality, to develop new features and services, and to deliver various notices and notifications. |
(Required) Email address, password However, if you sign up without a password with Google Oauth, we collect email as a required field and password as an optional field. |
Until the withdrawal of membership or the termination of the outsourcing contract. |
| Upstage Service |
Homepage - Solutions |
Lead management and data enrichment |
Name, email address, company name |
Until the withdrawal of membership or the termination of the outsourcing contract. |
| Upstage Service |
Homepage - Contact Us |
Provision of events and advertising information |
Name, email address, phone number, company name, industry, position, inquiry content |
1 year |
| Upstage Service |
Console - Contact Us |
Provision of events and advertising information |
Email address, phone number, company name, National Information, inquiry content |
Deleted within 90 days or without delay if deletion is requested |
| Upstage Service |
Homepage - Newsletter |
- To send newsletters
- Provision of events and advertising information
|
Email address |
1 year |
| Upstage Service |
Homepage - Careers |
Career |
Name, email address, phone number (optional)
Information included in the resume (education, work experience, military service, qualifications, language skills) |
3 years
* However, if the applicant wishes to delete, the deletion should be made immediately. |
2. Children's Privacy
a. We do not intend for our websites or online services to be used by anyone under the age of 18. We do not knowingly collect, sell, or share information of individuals under the age of 18. If you are a parent or guardian and believe we may have collected information about your child, please contact us immediately as described in this Policy's “10. Chief Privacy Officer and Personal Information Disclosure Claim” section. For more information, please see our Terms of Use.
3. Entrustment of personal information processing
a. The Company entrusts the following personal information processing tasks to external service providers for efficient personal information management.
| Service |
Recipient (Beneficiary) |
Outsource tasks. |
Assigning tasks to subcontractors |
Retention and Use Duration |
Common (Homepage,
Console,
AI Space,
Studio) |
Amazon Web Services, Inc. |
Development and operation of systems for service provision, data storage |
https://aws.amazon.com/privacy/ |
Until the withdrawal of membership or the termination of the outsourcing contract |
| Common (Homepage, Console, AI Space) |
BREVO |
Sending emails for service and marketing information |
https://www.brevo.com/legal/privacypolicy/ |
| Common (Homepage, Console, AI Space) |
Zapier, Inc. |
Customer DB management |
https://zapier.com/privacy |
| Common (Homepage, Console, AI Space) |
Salesforce |
Customer DB management and email sending |
https://www.salesforce.com/kr/company/privacy/ |
| Common (Homepage, Console, AI Space) |
Microsoft Clarity |
Web log analysis |
https://clarity.microsoft.com/privacy |
| Common (Homepage, Console, AI Space) |
Google |
Development and operation of systems for service provision, data storage |
https://policies.google.com/ |
| Console, AI Space |
Microsoft Azure |
Development and operation of systems for service provision |
https://www.microsoft.com/ko-kr/privacy/privacystatement |
| Console, AI Space |
Atlassian Corp. |
Customer CS collection and management |
https://www.atlassian.com/legal/privacy-policy |
| Console |
Intercom, Inc., |
Customer CS collection and management |
https://www.intercom.com/legal/privacy |
| Common (Homepage, Console, AI Space) |
Elfsight |
Customer CS collection and management |
https://elfsight.com/privacy-policy/ |
| Console |
Stripe |
Payment service provision |
https://stripe.com/legal/service-providers |
| AI Space |
Nango Inc. |
Upload the connector provided |
https://www.nango.dev/privacy-policy |
| AI Education |
LearnWorlds (CY) Ltd. |
Provide an education platform |
https://www.learnworlds.com/dpa/ |
| AI Education |
EdInvent, Inc. |
Provide training certificate services |
https://www.accredible.com/legal/privacy-policy#contactus |
| Homepage |
LinkedIn Corporation |
Ad performance tracking and retargeting |
https://www.linkedin.com/legal/privacy-policy |
6 months |
| Common (Homepage, Console, AI Space) |
Airtable, Inc. |
Customer DB management |
https://airtable.com/privacy |
1 year |
| Console |
Attio Ltd. |
Corporate Customer CRM Management |
https://attio.com/legal/privacy |
1 year |
| Console |
Apollo.io, Inc. |
Lead management and data enrichment |
https://www.apollo.io/privacy-policy |
1 year |
| Console |
Fireworks.ai |
Model inference service provision |
https://fireworks.ai/privacy-policy |
Services are not saved after temporary use. |
| Console |
FriendliAI Inc. |
Model inference service provision |
https://friendli.ai/privacy-policy |
| Console |
NAVER Cloud Corp. |
Model inference service provision |
https://www.ncloud.com/policy/infou/infou |
| Console |
Tavily Inc. |
Model inference service provision |
https://tavily.com/terms |
| Console |
RunPod Inc. |
Model inference service provision |
https://www.runpod.io/legal/privacy-policy |
| Homepage |
recruitee(by Tellent) |
Career |
https://recruitee.com/privacy-policy |
3 years
* However, if the applicant wishes to delete, the deletion should be made rapidly. |
b. When entering into a contract for entrustment, the Company shall specify the matters concerning the prohibition of personal information processing other than the purpose of performing the entrusted tasks, technical and administrative protection measures, restrictions on re-entrustment, management, and supervision of the trustee, and liability for damages in the contract or other documents by Article 26 of the Personal Information Protection Act, and shall supervise the trustee to ensure that the personal information is processed safely.
c. By Article 26, paragraph 6 of the Personal Information Protection Act, the trustee shall obtain the consent of the Company when re-entrusting the personal information processing tasks entrusted by the Company.
d. If the content of the entrusted tasks or the trustee changes, we will disclose it immediately through this Privacy Policy.
e. If we entrust personal information processing tasks overseas, we will inform you in '4. Transfer of Personal Information Overseas'.
4. Personal data transfer abroad
The company provides and outsources overseas services, such as service provision, marketing, and customer management services.
| Subcontractors |
Amazon Web Services, Inc. |
| Location of the subcontractors |
The United States |
| Date and method of entrusting |
Personal information may be transferred to the company's managed cloud server for processing through network transmission. |
| Contact information |
https://pages.awscloud.com/DSAR_RTF.html |
| Personal information items entrusted |
• AI Space > Conversations entered and uploaded files when using the Chat service
• When using the Studio > workflows service, the data is entered and uploaded as files. |
| Contents of the entrusted tasks |
Development and operation of systems for service provision, data storage |
| Retention and use period of personal information |
Until the withdrawal of membership or the termination of the outsourcing contract |
| How to refuse the transfer of personal information, procedure |
You can indicate your refusal via the Upstage Help Center.
- https://get.support.upstage.ai/servicedesk/customer/portals |
| Effect of refusal of the transfer of personal information, procedure |
• Refusing the overseas transfer of personal information may result in restrictions on the use of the Upstage service. |
| Legal basis for overseas transfer |
• Article 28-8, paragraph 1, item 1 (consent of the information subject)
• Article 28-8, paragraph 1, item 3 (processing and storage for contract execution) |
| Subcontractors |
BREVO |
| Location of the subcontractors |
The United States and France. |
| Date and method of entrusting |
Personal information may be transferred to the company's managed cloud server for processing through network transmission. |
| Contact information |
contact@sendinblue.com |
| Personal information items entrusted |
Name, Contact, Email, Company Name, Job Title, Industry |
| Contents of the entrusted tasks |
For email marketing purposes. |
| Retention and use period of personal information |
Until the withdrawal of membership or the termination of the outsourcing contract |
| How to refuse the transfer of personal information, procedure |
You can indicate your refusal via the Upstage Help Center.
• https://get.support.upstage.ai/servicedesk/customer/portals |
| Effect of refusal of the transfer of personal information, procedure |
Refusing the overseas transfer of personal information may result in restrictions on providing you with marketing and service information. |
| Legal basis for overseas transfer |
• Article 28-8, paragraph 1, item 1 (consent of the information subject)
• Article 28-8, paragraph 1, item 3 (processing and storage for contract execution) |
| Subcontractors |
Salesforce.com, Inc |
| Location of the subcontractors |
Japan |
| Date and method of entrusting |
Personal information may be transferred to the company's managed cloud server for processing through network transmission. |
| Contact information |
privacy@salesforce.com |
| Personal information items entrusted |
Name, Contact, Email, Company Name, Job Title, Industry |
| Contents of the entrusted tasks |
Customer DB management and email sending |
| Retention and use period of personal information |
Until the withdrawal of membership or the termination of the outsourcing contract |
| How to refuse the transfer of personal information, procedure |
You can indicate your refusal via the Upstage Help Center.
- https://get.support.upstage.ai/servicedesk/customer/portals |
| Effect of refusal of the transfer of personal information, procedure |
This may affect support service access. |
| Legal basis for overseas transfer |
• Article 28-8, paragraph 1, item 1 (consent of the information subject)
• Article 28-8, paragraph 1, item 3 (processing and storage for contract execution) |
| Subcontractors |
Zapier, Inc. |
| Location of the subcontractors |
The United States |
| Date and method of entrusting |
Personal information may be transferred to the company's managed cloud server for processing through network transmission. |
| Contact information |
contact@zapier.com |
| Personal information items entrusted |
Name, Contact, Email, Company Name, Job Title, Industry |
| Contents of the entrusted tasks |
Customer DB management |
| Retention and use period of personal information |
Until the withdrawal of membership or the termination of the outsourcing contract |
| How to refuse the transfer of personal information, procedure |
You can indicate your refusal via the Upstage Help Center.
- https://get.support.upstage.ai/servicedesk/customer/portals |
| Effect of refusal of the transfer of personal information, procedure |
This may affect support service access. |
| Legal basis for overseas transfer |
• Article 28-8, paragraph 1, item 1 (consent of the information subject)
• Article 28-8, paragraph 1, item 3 (processing and storage for contract execution) |
| Subcontractors |
Nango Inc. |
| Location of the subcontractors |
The United States |
| Date and method of entrusting |
Personal information may be transferred to the company's managed cloud server for processing through network transmission. |
| Contact information |
hello@nango.dev |
| Personal information items entrusted |
Email, Details about Google account (Drive, Mail) integration |
| Contents of the entrusted tasks |
Upload the connector provided |
| Retention and use period of personal information |
Until the withdrawal of membership or the termination of the outsourcing contract |
| How to refuse the transfer of personal information, procedure |
You can indicate your refusal via the Upstage Help Center.
- https://get.support.upstage.ai/servicedesk/customer/portals |
| Effect of refusal of the transfer of personal information, procedure |
If you refuse the overseas transfer, you may experience difficulties using some features of the Upstage Service. |
| Legal basis for overseas transfer |
• Article 28-8, paragraph 1, item 1 (consent of the information subject)
• Article 28-8, paragraph 1, item 3 (processing and storage for contract execution) |
| Subcontractors |
Stripe |
| Location of the subcontractors |
The United States |
| Date and method of entrusting |
Personal information may be transferred to the company's managed cloud server for processing through network transmission. |
| Contact information |
privacy@stripe.com |
| Personal information items entrusted |
Credit card number, credit card expiration date, CVC number |
| Contents of the entrusted tasks |
Provide payment service |
| Retention and use period of personal information |
Until the withdrawal of membership or the termination of the outsourcing contract |
| How to refuse the transfer of personal information, procedure |
You can indicate your refusal via the Upstage Help Center. - https://get.support.upstage.ai/servicedesk/customer/portals |
| Effect of refusal of the transfer of personal information, procedure |
If you refuse an overseas transfer, you may result in restrictions on the paid services. |
| How to refuse the transfer of personal information, procedure, and effect of refusal |
• How to refuse to transfer data overseas: You can decline an overseas transfer in the support menu.
• Impact of refusing overseas transfer: If you refuse overseas transfer, you may result in restrictions on the paid services. |
| Legal basis for overseas transfer |
• Article 28-8, paragraph 1, item 1 (consent of the information subject)
• Article 28-8, paragraph 1, item 3 (processing and storage for contract execution) |
| Subcontractors |
Elfsight |
| Location of the subcontractors |
Armenian |
| Date and method of entrusting |
Personal information may be transferred to the company's managed cloud server for processing through network transmission. |
| Contact information |
help.elfsight.com |
| Personal information items entrusted |
Name, Contact, Email, Company Name, Job Title, Industry |
| Contents of the entrusted tasks |
Customer CS collection and management |
| Retention and use period of personal information |
Until the withdrawal of membership or the termination of the outsourcing contract |
| How to refuse the transfer of personal information, procedure |
You can indicate your refusal via the Upstage Help Center.
- https://get.support.upstage.ai/servicedesk/customer/portals |
| Effect of refusal of the transfer of personal information, procedure |
This may affect support service access. |
| Legal basis for overseas transfer |
• Article 28-8, paragraph 1, item 1 (consent of the information subject)
• Article 28-8, paragraph 1, item 3 (processing and storage for contract execution) |
| Subcontractors |
Atlassian Corp. |
| Location of the subcontractors |
Australia |
| Date and method of entrusting |
Personal information may be transferred to the company's managed cloud server for processing through network transmission. |
| Contact information |
privacy@atlassian.com |
| Personal information items entrusted |
Name, Contact, Email, Company Name, Job Title, Industry |
| Contents of the entrusted tasks |
Customer CS collection and management |
| Retention and use period of personal information |
Until the withdrawal of membership or the termination of the outsourcing contract |
| How to refuse the transfer of personal information, procedure |
You can indicate your refusal via the Upstage Help Center.
- https://get.support.upstage.ai/servicedesk/customer/portals |
| Effect of refusal of the transfer of personal information, procedure |
This may affect support service access. |
| Legal basis for overseas transfer |
• Article 28-8, paragraph 1, item 1 (consent of the information subject)
• Article 28-8, paragraph 1, item 3 (processing and storage for contract execution) |
| Subcontractors |
Microsoft Azure |
| Location of the subcontractors |
The United States |
| Date and method of entrusting |
Personal information may be transferred to the company's managed cloud server for processing through network transmission. |
| Contact information |
https://azure.microsoft.com/en-us/support |
| Personal information items entrusted |
Conversations are entered, and files are uploaded when using the Console or AI Space service. |
| Contents of the entrusted tasks |
Development and operation of systems for service provision |
| Retention and use period of personal information |
Until the withdrawal of membership or the termination of the outsourcing contract |
| How to refuse the transfer of personal information, procedure |
You can indicate your refusal via the Upstage Help Center.
- https://get.support.upstage.ai/servicedesk/customer/portals |
| Effect of refusal of the transfer of personal information, procedure |
Refusing the overseas transfer of personal information may result in restrictions on using the Upstage service. |
| Legal basis for overseas transfer |
• Article 28-8, paragraph 1, item 1 (consent of the information subject)
• Article 28-8, paragraph 1, item 3 (processing and storage for contract execution) |
| Subcontractors |
Microsoft Clarity |
| Location of the subcontractors |
The United States |
| Date and method of entrusting |
Personal information may be transferred to the company's managed cloud server for processing through network transmission. |
| Contact information |
https://support.microsoft.com |
| Personal information items entrusted |
Console Web Usage Logs |
| Contents of the entrusted tasks |
Console Web Usage Log Analysis |
| Retention and use period of personal information |
Until the withdrawal of membership or the termination of the outsourcing contract |
| How to refuse the transfer of personal information, procedure |
You can indicate your refusal via the Upstage Help Center.
• https://get.support.upstage.ai/servicedesk/customer/portals |
| Effect of refusal of the transfer of personal information, procedure |
If you refuse an overseas transfer, you may be restricted in using certain services, such as logging in. |
| Legal basis for overseas transfer |
• Article 28-8, paragraph 1, item 1 (consent of the information subject)
• Article 28-8, paragraph 1, item 3 (processing and storage for contract execution) |
| Subcontractors |
Google |
| Location of the subcontractors |
The United States |
| Date and method of entrusting |
Personal information may be transferred to the company's managed cloud server for processing through network transmission. |
| Contact information |
https://support.google.com |
| Personal information items entrusted |
• Homepage > Name, contact information, email, company name, position, industry, weblog
• Conversations are entered and uploaded files when using the Console or AI Space service |
| Contents of the entrusted tasks |
• Customer management and web log analysis
• Development and operation of systems for service provision, data storage |
| Retention and use period of personal information |
Until the withdrawal of membership or the termination of the outsourcing contract |
| How to refuse the transfer of personal information, procedure |
• You can indicate your refusal via the Upstage Help Center.
• https://get.support.upstage.ai/servicedesk/customer/portals |
| Effect of refusal of the transfer of personal information, procedure |
• If you refuse the overseas transfer, you may experience difficulties using some features of the Upstage Service. |
| Legal basis for overseas transfer |
• Article 28-8, paragraph 1, item 1 (consent of the information subject)
• Article 28-8, paragraph 1, item 3 (processing and storage for contract execution) |
| Subcontractors |
Fireworks.ai |
| Location of the subcontractors |
The United States |
| Date and method of entrusting |
Personal information may be transferred to the company's managed cloud server for processing through network transmission. |
| Contact information |
help@fireworks.ai |
| Personal information items entrusted |
Conversation content, uploaded documents, and voting results entered by a registered user into the service |
| Contents of the entrusted tasks |
To provide inference services. |
| Retention and use period of personal information |
Services are not saved after temporary use. |
| How to refuse the transfer of personal information, procedure |
You can indicate your refusal via the Upstage Help Center. - https://get.support.upstage.ai/servicedesk/customer/portals |
| Effect of refusal of the transfer of personal information, procedure |
If you refuse the overseas transfer, you may experience difficulties using some features of the Upstage Service. |
| Legal basis for overseas transfer |
• Article 28-8, paragraph 1, item 1 (consent of the information subject)
• Article 28-8, paragraph 1, item 3 (processing and storage for contract execution) |
| Subcontractors |
FriendliAI Inc. |
| Location of the subcontractors |
The United States |
| Date and method of entrusting |
Personal information may be transferred to the company's managed cloud server for processing through network transmission. |
| Contact information |
privacy@friendli.ai |
| Personal information items entrusted |
Conversation content, uploaded documents, and voting content entered by a member into the service |
| Contents of the entrusted tasks |
To provide inference services. |
| Retention and use period of personal information |
Services are not saved after temporary use. |
| How to refuse the transfer of personal information, procedure |
You can indicate your refusal via the Upstage Help Center. - https://get.support.upstage.ai/servicedesk/customer/portals |
| Effect of refusal of the transfer of personal information, procedure |
If you refuse the overseas transfer, you may experience difficulties using some features of the Upstage Service. |
| Legal basis for overseas transfer |
• Article 28-8, paragraph 1, item 1 (consent of the information subject)
• Article 28-8, paragraph 1, item 3 (processing and storage for contract execution) |
| Subcontractors |
AlphaAI Technologies Inc.(Tavily Inc.) |
| Location of the subcontractors |
The United States |
| Date and method of entrusting |
Personal information may be transferred to the company's managed cloud server for processing through network transmission. |
| Contact information |
support@tavily.com |
| Personal information items entrusted |
Conversation content, uploaded documents, and voting results entered by a registered user into the service |
| Contents of the entrusted tasks |
To provide inference services. |
| Retention and use period of personal information |
Services are not saved after temporary use. |
| How to refuse the transfer of personal information, procedure |
You can indicate your refusal via the Upstage Help Center.
- https://get.support.upstage.ai/servicedesk/customer/portals |
| Effect of refusal of the transfer of personal information, procedure |
If you refuse the overseas transfer, you may experience difficulties using some features of the Upstage Service. |
| Legal basis for overseas transfer |
• Article 28-8, paragraph 1, item 1 (consent of the information subject)
• Article 28-8, paragraph 1, item 3 (processing and storage for contract execution) |
| Subcontractors |
RunPod Inc. |
| Location of the subcontractors |
The United States |
| Date and method of entrusting |
Personal information may be transferred to the company's managed cloud server for processing through network transmission. |
| Contact information |
help@runpod.io |
| Personal information items entrusted |
Conversation content, uploaded documents, and voting results entered by a registered user into the service |
| Contents of the entrusted tasks |
To provide inference services. |
| Retention and use period of personal information |
Services are not saved after temporary use. |
| How to refuse the transfer of personal information, procedure |
You can indicate your refusal via the Upstage Help Center.
- https://get.support.upstage.ai/servicedesk/customer/portals |
| Effect of refusal of the transfer of personal information, procedure |
If you refuse the overseas transfer, you may experience difficulties using some features of the Upstage Service. |
| Legal basis for overseas transfer |
• Article 28-8, paragraph 1, item 1 (consent of the information subject)
• Article 28-8, paragraph 1, item 3 (processing and storage for contract execution) |
| Subcontractors |
LearnWorlds (CY) Ltd. |
| Location of the subcontractors |
Cyprus |
| Date and method of entrusting |
Transferred by network transfer at the time of use of the AI Education Service. |
| Contact information |
support@learnworlds.com |
| Personal information items entrusted |
Name, Email, Password |
| Contents of the entrusted tasks |
Provide and manage education services |
| Retention and use period of personal information |
Until the withdrawal of membership or the termination of the outsourcing contract |
| How to refuse the transfer of personal information, procedure |
You can decline an overseas transfer by deleting an account. |
| Effect of refusal of the transfer of personal information, procedure |
If you refuse to transfer data overseas, there will be restrictions on using AI Education services. |
| Legal basis for overseas transfer |
• Article 28-8, paragraph 1, item 1 (consent of the information subject)
• Article 28-8, paragraph 1, item 3 (processing and storage for contract execution) |
| Subcontractors |
EdInvent, Inc. |
| Location of the subcontractors |
The United States |
| Date and method of entrusting |
Transferred by network transfer at the time of use of the AI Education Certificate Service. |
| Contact information |
support@accredible.com |
| Personal information items entrusted |
Name |
| Contents of the entrusted tasks |
Provide and manage education certificate services |
| Retention and use period of personal information |
Until the withdrawal of membership or the termination of the outsourcing contract |
| How to refuse the transfer of personal information, procedure |
You can decline an overseas transfer by not using the Education Certificate Service. |
| Effect of refusal of the transfer of personal information, procedure |
If you refuse to transfer data overseas, there will be restrictions on using the education certificate services. |
| Legal basis for overseas transfer |
• Article 28-8, paragraph 1, item 1 (consent of the information subject)
• Article 28-8, paragraph 1, item 3 (processing and storage for contract execution) |
| Subcontractors |
Intercom, Inc., |
| Location of the subcontractors |
The United States |
| Date and method of entrusting |
At the time of customer inquiry reception, the information may be transmitted via the network transfer method. |
| Contact information |
https://www.intercom.com/privacy-form |
| Personal information items entrusted |
Email |
| Contents of the entrusted tasks |
Customer CS collection and management |
| Retention and use period of personal information |
Until the withdrawal of membership or the termination of the outsourcing contract |
| How to refuse the transfer of personal information, procedure |
You can indicate your refusal via the Upstage Help Center.
- https://get.support.upstage.ai/servicedesk/customer/portals |
| Effect of refusal of the transfer of personal information, procedure |
This may affect Console support service access. |
| Legal basis for overseas transfer |
• Article 28-8, paragraph 1, item 1 (consent of the information subject)
• Article 28-8, paragraph 1, item 3 (processing and storage for contract execution) |
| Subcontractors |
Airtable, Inc. |
| Location of the subcontractors |
The United States |
| Date and method of entrusting |
When submitting the lead form on the Homepage. |
| Contact information |
https://airtable.com/privacy |
| Personal information items entrusted |
Name, Email, Company Name, Job Title, Contact Information |
| Contents of the entrusted tasks |
Customer DB management |
| Retention and use period of personal information |
1 year |
| How to refuse the transfer of personal information, procedure |
You can indicate your refusal via the Upstage Help Center.
• https://get.support.upstage.ai/servicedesk/customer/portals |
| Effect of refusal of the transfer of personal information, procedure |
If you refuse to transfer overseas, the provision of customer consultation services may be restricted. |
| Legal basis for overseas transfer |
• Article 28-8, paragraph 1, item 1 (consent of the information subject)
• Article 28-8, paragraph 1, item 3 (processing and storage for contract execution) |
| Subcontractors |
Attio Ltd. |
| Location of the subcontractors |
The United States |
| Date and method of entrusting |
When submitting the lead form on the Homepage. |
| Contact information |
https://attio.com/legal/privacy |
| Personal information items entrusted |
Name, Contact Information, Email, Company Name, Job Title, Industry |
| Contents of the entrusted tasks |
Corporate Customer CRM Management |
| Retention and use period of personal information |
1 year |
| How to refuse the transfer of personal information, procedure |
You can indicate your refusal via the Upstage Help Center. - https://get.support.upstage.ai/servicedesk/customer/portals |
| Effect of refusal of the transfer of personal information, procedure |
If you refuse to transfer overseas, the provision of customer consultation services may be restricted. |
| Legal basis for overseas transfer |
• Article 28-8, paragraph 1, item 1 (consent of the information subject)
• Article 28-8, paragraph 1, item 3 (processing and storage for contract execution) |
| Subcontractors |
Apollo.io, Inc. |
| Location of the subcontractors |
The United States |
| Date and method of entrusting |
When submitting the lead form on the Homepage. |
| Contact information |
https://www.apollo.io/privacy-policy |
| Personal information items entrusted |
Name, Email, Company Name, Job Title, Industry |
| Contents of the entrusted tasks |
Lead management and data enrichment |
| Retention and use period of personal information |
1 year |
| How to refuse the transfer of personal information, procedure |
You can indicate your refusal via the Upstage Help Center. - https://get.support.upstage.ai/servicedesk/customer/portals |
| Effect of refusal of the transfer of personal information, procedure |
If you refuse to transfer overseas, the provision of customer consultation services may be restricted. |
| Legal basis for overseas transfer |
• Article 28-8, paragraph 1, item 1 (consent of the information subject)
• Article 28-8, paragraph 1, item 3 (processing and storage for contract execution) |
| Subcontractors |
LinkedIn Corporation |
| Location of the subcontractors |
The United States |
| Date and method of entrusting |
When agreeing to cookie collection |
| Contact information |
https://www.linkedin.com/legal/privacy-policy |
| Personal information items entrusted |
Profile-based user demographics, IP addresses, cookies, and advertising behavior data |
| Contents of the entrusted tasks |
Conversion tracking and retargeting |
| Retention and use period of personal information |
IP addresses are anonymized, and members' direct identifiers are removed and pseudonymized within 7 days. This pseudonymized data is deleted within 180 days. |
| How to refuse the transfer of personal information, procedure |
You can indicate your refusal via the Upstage Help Center. - https://get.support.upstage.ai/servicedesk/customer/portals |
| Effect of refusal of the transfer of personal information, procedure |
Impact of Refusing Overseas Transfer: Refusing the overseas transfer will not affect your use of the service. |
| Legal basis for overseas transfer |
• Article 28-8, paragraph 1, item 1 (consent of the information subject)
• Article 28-8, paragraph 1, item 3 (processing and storage for contract execution) |
5. Procedure and method of destroying personal information
a. The Company shall destroy personal information without delay when it is no longer necessary to retain the personal information, such as when the retention period of personal information expires or when the purpose of processing is achieved.
b. Even if the retention period of personal information has expired or the purpose of processing has been achieved, if it is necessary to preserve personal information under other statutes, the Company shall transfer it to a separate database (DB) or store it in a separate storage place.
c. The procedure and method of destroying personal information are as follows. • Destruction procedure The company selects personal information for which the destruction reason has occurred and destroys the personal information according to internal regulations. • Destruction method The company destroys personal information recorded and stored in electronic files, making reproducing the record impossible. It also shreds the personal information recorded and stores it in paper documents.
6. Rights, obligations, and exercise methods of the information subject and legal representative
a. The information subject may exercise the following rights against the company at any time.
※ The company does not collect or provide services for the personal information of children under 18.
b. The exercise of rights may be made by written, e-mail, facsimile, etc., to the company by Article 41 (1) of the Enforcement Decree of the Personal Information Protection Act, and the company will take action without delay.
c. The exercise of rights may be made through a representative such as a legal representative or a person entrusted with the exercise of rights. In this case, a power of attorney by the attached Form 11 of the "Enforcement Decree of the Personal Information Protection Act" must be submitted.
d. The right to request the disclosure of personal information and the right to request the correction, deletion, and suspension of processing may be limited by Article 35 (4) and Article 37 (2) of the Personal Information Protection Act.
e. The company may refuse to delete personal information if specified as the collection subject in other statutes.
f. The company verifies whether the person who has requested the disclosure is the person who has asked for the disclosure or a legitimate representative.
7. Measures to ensure the safety of personal information
The company is taking the following measures to ensure the safety of personal information.
• Administrative measures: Establishment and implementation of internal management plans, operation of dedicated organizations, and regular employee education
• Technical measures: Management of access rights to personal information processing systems, installation of access control systems, encryption of personal information, Installation and updating of security programs
• Physical measures: Access control of computer centers, etc.
8. Installation and operation of personal information automatic collection devices and refusal
a. The Company uses Google Analytics, MS Clarity, and LinkedIn in accordance with Article 15, Paragraph 1, Subparagraph 1 (Consent) of the Personal Information Protection Act. Information on service users is collected through each tool, and in this case, only non-identifiable information that cannot identify individual users is collected.
- Google Analytics: Install the blocking browser add-on (https://tools.google.com/dlpage/gaoptout) or [Installation, operation, and rejection of cookies] below
- MS Clarity: [Installation, operation, and rejection of cookies] below
- LinkedIn: [Installation, operation, and rejection of cookies] below
b. Cookies are small pieces of information sent to the user's computer browser by the server (HTTPS) used to operate the website and are stored on the hard disk of the user's PC.
- Purpose of use of cookies: This information is used to understand each service visited by the user, including the types of visits and usage, search terms, and whether a secure connection was used to provide optimized information to the user.
- Refusal of cookie installation and operation: In Chrome, you can refuse cookie storage through the web browser's right side (⋮) > Settings menu > Privacy and security > Cookies and other site data or a new secret window (or new InPrivate window).
- If you refuse cookie storage, there may be restrictions on using some services, such as logging in.
9. Additional use·provision judgment criteria
a. The company may use and provide personal information without the consent of the information subject by Article 15 (3) and Article 17 (4) of the 「Personal Information Protection Act」 and Article 14-2 of the Enforcement Decree of the 「Personal Information Protection Act」.
| Category |
Purpose of use and provision. |
Retention and Use Duration |
| Email |
Sending additional service-related notifications regularly |
Immediate destruction after the purpose |
b. Accordingly, the company has considered the following matters to use and provide additional information without the consent of the information subject.
• Whether the purpose of using and providing personal information is related to the original purpose of collection
• Whether there is a predictability of additional use and provision in light of the circumstances in which personal information is collected or the processing practices
• Whether the additional use and provision of personal information unreasonably infringes the interests of the information subject
• Whether necessary measures have been taken to ensure safety, such as pseudonymization or cryptography
10. Chief Privacy Officer and Personal Information Disclosure Claim
a. The company has designated a Chief Privacy Officer responsible for managing personal information and handling complaints and remedies related to processing personal data.
b. The information subject may request the disclosure of personal information under Article 35 of the "Personal Information Protection Act" to the department below. The company will make every effort to ensure that the request for the disclosure of personal information is processed promptly.
| Category |
Contact Information |
Contact |
| Chief Privacy Officer |
Position: Chief Information Security Officer
Name: Jeffrey |
Contact: 070-8098-3023
Email: infosec@upstage.ai |
| Personal Information Disclosure Claim(Console, AI space, Studio) |
Department Name:
Console - Launchpad
AI Space, Studio - AI Space |
Contact: 070-8098-3023
Email: contact@upstage.ai |
| Personal Information Disclosure Claim(AI Education) |
Department Name: AI Education |
Contact: 070-8098-3023
Email: ai-edu@upstage.ai |
| Personal Information Disclosure Claim(Careers) / Upstage People |
Department Name: Upstage People |
Contact: 070-8098-3023
Email: joinstage@upstage.ai |
c. The information subject may inquire about all matters related to protecting personal information, such as complaints and remedies, by contacting the Chief Privacy Officer and the department in charge. The company will respond to the information subject's inquiry quickly.
11. Methods of Exercising Rights
a. The company is committed to protecting the information subject's right to self-determination and is making efforts to provide counseling and remedies for personal information infringement. If you need to report or consult, please contact the department below.
| Category |
Contact Information |
Contact |
| Chief Privacy Officer |
Position: Chief Information Security Officer
Name: Jeffrey |
Email: infosec@upstage.ai |
| Personal Information Protection Department |
Department Name: Security |
Email: infosec@upstage.ai |
b. The information subject may apply for dispute resolution or consultation with the Personal Information Dispute Mediation Committee, the Korea Internet & Security Agency, etc., for remedies for personal information infringement. Please contact agencies for other reports on personal information infringement, consultations, etc.
• Personal Information Dispute Mediation Committee: +82 1833-6972 (www.kopico.go.kr)
• Personal Information Infringement Reporting Center: +82 118 (privacy.kisa.or.kr)
• Supreme Prosecutors' Office: +82 1301 (www.spo.go.kr)
• National Police Agency: +82 182 (ecrm.police.go.kr)
c. If the information subject has suffered damage due to the disposition or non-action of the head of the public institution regarding the request for the exercise of rights under Article 35 (Access to Personal Information), Article 36 (Correction, Deletion, etc. of Personal Information), and Article 37 (Suspension of Processing of Personal Information) of the Personal Information Protection Act, he/she may file an administrative appeal by the Administrative Appeals Act.
• Central Administrative Appeals Commission: +82 110 (www.simpan.go.kr)
12. Changes to the privacy policy
a. This Privacy Policy will take effect on April. 01, 2026.
b. The previous privacy policy can be found at the link below.
- 2025. 12. 18 ~ 2026. 03. 31 (Click)
- 2025. 09. 16 ~ 2025. 12. 17 (Click)
- 2025. 05. 29 ~ 2025. 09. 15 (Click)
- 2024. 03. 08 ~ 2025. 05. 28 (Click)
- 2024. 12. 19 ~ 2025. 03. 07 (Click)
- 2024. 11. 29 ~ 2024. 12. 18 (Click)
- 2024. 09. 26 ~ 2024. 11. 28 (Click)
- 2024. 08. 01 ~ 2024. 09. 25 (Click)
- 2024. 07. 12 ~ 2024. 07. 31 (Click)
- 2024. 03. 13 ~ 2024. 07. 11 (Click)
- 2024. 02. 28 ~ 2024. 03. 12 (Click)
- 2023. 12. 20 ~ 2024. 02. 28 (Click)
Privacy Policy — U.S. Supplemental Provisions
This U.S. Supplement (“U.S. Supplement”) serves to augment the Privacy Policy (“Basic Policy”) of Upstage, Inc. (“Upstage,” “the Company,” “We”). This U.S. Supplement is applicable to U.S. residents and furnishes supplementary disclosures in adherence to relevant U.S. state privacy legislation, including the California Consumer Privacy Act (as amended by the California Privacy Rights Act, collectively referred to as the “CCPA”). Should any inconsistency arise between this U.S. Supplement and the Basic Policy, this U.S. Supplement shall take precedence for U.S. residents.
Specific disclosures are mandated by U.S. state privacy laws. The following table provides additional information on the categories of personal information collected by the Company and the methods by which such information is used and disclosed. For comprehensive details on the personal information collected by the Company, kindly consult Article 1 of the Basic Policy; for information on the outsourcing of personal information processing, please refer to Article 3 of the Basic Policy; and for details on overseas transfer, please consult Article 4 of the Basic Policy.
1. Personal Information Category
| Personal Information Category |
Purpose of use |
Subject to disclosure |
| Identifiers (e.g., name, email address, phone number, IP address, account information) |
All purposes specified in the Basic Policy |
All disclosure targets specified in the Basic Policy |
| Financial information (e.g., payment card number, expiration date, CVC) |
Payment processing and settlement |
Payment Processors (Stripe) |
| Commercial information (e.g., transaction history, service usage records) |
Service provision, payment processing, record keeping, and legal compliance |
Cloud service providers; Payment Processors |
| Internet/electronic network activity (e.g., browsing history, interaction logs, access logs, device information) |
Service improvement, analytics, security, fraud prevention |
Analytics service providers (e.g., Microsoft Clarity); Cloud service providers |
| Job/employment information (e.g., company name, job title, work experience) |
Marketing, customer relationship management, and recruitment |
CRM platforms; Marketing platforms; Recruitment platforms |
| Educational information (e.g., educational background, certifications, accreditations) |
Recruitment, provision of Upstage Services (training) |
Recruitment platforms; Training platform providers |
| Inference information (e.g., preferences and usage patterns derived from service interactions) |
Service improvement, personalization, research |
Cloud service providers |
| User-generated content (e.g., conversation history, uploaded documents, inference data, inquiries) |
Provision of AI services, model improvement, and customer support |
Cloud service providers; Model inference providers; Customer support platforms |
2. Sale and sharing of personal information
The Company does not “sell” personal information or “share” personal information for contextual behavioral advertising as defined by applicable state privacy laws. Furthermore, the Company does not process sensitive personal information to infer consumer characteristics. The Company maintains and uses anonymized information in an anonymized form and does not attempt to re-identify such information except where permitted by law.
3. Data usage for AI model training
The Company may use input and output data to improve AI models and services in accordance with the Basic Policy. For details on what data is used, how it is processed, and how settings are managed, please refer to the relevant provisions of the Basic Policy.
4. Your rights under U.S. state privacy laws
Depending on your place of residence and applicable exceptions, you may have the following privacy rights with respect to personal information:
- Right to know about the processing of personal information (including the right to access personal information in a portable format
- Right to request the deletion of personal information
- Right to request the correction of inaccurate personal information
- Right to refuse the “sale” of personal information and “sharing” for cross-contextual behavioral advertising.
- Right to restrict the use and disclosure of sensitive personal information.
- Right not to be retaliated against in connection with the exercise of personal information protection rights.\
5. How to exercise your rights
The privacy rights specified in this clause may be exercised in the following ways:
- Send an email to infosec@upstage.ai
- Submit a request via the support menu on get.support.upstage.ai
- For recruitment application data, contact joinstage@upstage.ai
Identity Verification. To protect your personal information from unauthorized access, alteration, or deletion, the Company may verify your identity before processing a request. If you do not have an account or if fraudulent activity is suspected, additional personal information may be requested.
Agents. If you submit a request through an authorized agent, the Company may require proof of that agent's authorization. Even when using an agent, you may still be required to verify your identity yourself.
The Company responds to verified consumer requests within 45 days. If additional time is required (up to an additional 45 days), we will notify you in writing of the reason and the extension period.
6. Appeals
Depending on your place of residence, you may have the right to object to the Company’s decision regarding your request to exercise your rights. To object, please send a request to infosec@upstage.ai with the subject line “Objection to Privacy Rights.” The Company will respond to objections within the period required by applicable law.
7. “Do not track.”
Some web browsers send “Do Not Track” (DNT) signals to websites. Since no unified industry standard has been established, we do not currently respond to DNT signals. However, if Global Privacy Control (GPC) signals are available and recognized under applicable state laws, we treat them as valid denial requests.
8. Child privacy protection
The Company's services are not intended for individuals under the age of 18. We do not intentionally collect personal information from children under this age. If you believe that a child's personal information has been collected, please contact infosec@upstage.ai immediately.
9. Changes to the U.S. Supplemental Provisions
The Company may update these U.S. Supplemental Provisions from time to time to reflect changes in practice or applicable laws. In the event of material changes, the Company will post an updated version on the Website with a new effective date.
10. Contact
If you have any questions regarding these U.S. Supplements or wish to exercise your rights, please contact us at the following:
Upstage Co., Ltd.
Rm. 815, Bldg A, 338 Gwanggyojungang-ro, Suji-gu, Yongin-si, Gyeonggi-do
Email: infosec@upstage.ai
Recruitment Inquiries: joinstage@upstage.ai
Privacy Policy — Supplementary Provisions for the European Economic Area (EEA), the United Kingdom, and Switzerland
These Supplementary Provisions for the European Economic Area, the United Kingdom, and Switzerland (hereinafter referred to as the “EU Supplementary Provisions”) supplement Upstage Co., Ltd.’s Privacy Policy (hereinafter referred to as the “Basic Policy”). It applies to individuals located in the EEA, the United Kingdom, and Switzerland. In the event of any conflict between these Provisions and the Basic Policy, these Provisions shall prevail.
Please refer to Article 1 of the Basic Policy for specific items of personal information collected, Article 3 for entrusted processing, and Article 4 for international transfer.
1. Data controller
Upstage Co., Ltd. is the data controller that processes your personal information in connection with our services.
Rooms 812–817, Spark Plus Gangnam Branch 5, Hall 2, Korea Science and Technology Center, 22 Teheran-ro 7-gil, Gangnam-gu, Seoul
Email: infosec@upstage.ai
2. Legal basis for personal information processing
We process only where there is a valid legal basis in accordance with the GDPR and UK GDPR. Please refer to Article 1 of the Basic Policy for specific items collected.
| Processing purpose |
Legal basis |
| Membership Sign-up and Management (Upstage Service) |
Performance of Contract (Article 6, Paragraph 1 (b) of the GDPR) |
| Provision of Paid Services and Payment Processing (Upstage Service) |
Performance of Contract (Article 6, Paragraph 1 (b) of the GDPR) |
| Provision of AI Services for Members (Upstage Service) |
Performance of Contract (Article 6, Paragraph 1 (b) of the GDPR) |
| Provision of AI Services for Non-Members (Upstage Service) |
Consent (Article 6, Paragraph 1 (a) of the GDPR) |
| Document AI Services via Asynchronous API (Upstage Service) |
Performance of Contract (Article 6, Paragraph 1 (b) of the GDPR) |
| Service Improvement and Research |
Legitimate Interest (Article 6, Paragraph 1 (f) of the GDPR) |
| Marketing Communication — Newsletter |
Consent (Article 6, Paragraph 1 (a) of the GDPR) |
| Marketing Communication — Event and Advertising Information |
Consent (Article 6, Paragraph 1 (a) of the GDPR) |
| Customer Support (Upstage Service) |
Performance of Contract (Article 6, Paragraph 1 (b) of the GDPR) / Legitimate Interest (Article 6, Paragraph 1 (f) of the GDPR) |
| Upstage Service Inquiries (Contact Us) |
Consent (Article 6, Paragraph 1 (a) of the GDPR) / Legitimate Interest (Article 6, Paragraph 1 (f) of the GDPR) |
| Careers (Careers) |
Consent (Article 6, Paragraph 1 (a) of the GDPR) / Pre-contractual Measures (GDPR Article 6, Paragraph 1 (b)) |
| Upstage Service (Education) |
Performance of Contract (Article 6, Paragraph 1 (b) of the GDPR) |
| Legal Compliance and Fraud Prevention |
Legal Obligation (Article 6, Paragraph 1 (c) of the GDPR) / Legitimate Interest (Article 6, Paragraph 1 (f) of the GDPR) |
3. Your rights under GDPR
If located in the EEA, the United Kingdom, or Switzerland, you have the following rights:
- Right of access (Article 15 of the GDPR) — To verify whether personal data has been processed and to request a copy
- Right of rectification (Article 16 of the GDPR) — To correct inaccurate or incomplete data
- Right of erasure (Article 17 of the GDPR) — To request the deletion of personal data under certain conditions
- Right to limit processing (Article 18 of the GDPR) — To limit processing under certain circumstances.
- Right of data portability (Article 20 of the GDPR) — To receive data in a structured, machine-readable format
- Right to object (Article 21 of the GDPR) — To object to processing based on legitimate interests or direct marketing.
- Right regarding automated decision-making (Article 22 of the GDPR) — To request human intervention regarding automated decisions with legal or material impact
- Right to withdraw consent (Article 7, Paragraph 3 of the GDPR) — To withdraw at any time; processing prior to withdrawal is not affected.
- Right to file a complaint (Article 77 of the GDPR) — To file a complaint with the relevant regional supervisory authority (UK: ICO, Switzerland: FDPIC)
Exercise your rights: Contact infosec@upstage.ai. Response within 1 month, extendable up to 2 months.
4. Overseas data transfer
Your personal information may be transferred to the Republic of Korea and other countries outside the EEA, the UK, and Switzerland. Please refer to Articles 3 and 4 of the Basic Policy for the full list and locations of recipients. Transfers rely on the following mechanisms:
- The Republic of Korea received an EU Adequacy Decision from the European Commission in December 2021. Accordingly, the transfer of personal data from the EEA to the Republic of Korea may be carried out without additional safeguards.
- Standard Contractual Clause (SCC) (Article 46, Paragraph 2 (c) of the GDPR)
- UK Annex on International Data Transfer regarding the SCC
- Copies of applicable safeguards or related information may be provided upon request.
Copies of applicable safeguards or related information may be provided upon request.
5. Data retention
We retain data only for the period necessary to fulfill the purpose of collection. Please refer to Article 1 of the Basic Policy for specific retention periods.
6. Automated decision-making and profiling
The Company currently does not make automated decisions with legal or similarly material impact as defined in Article 22 of the GDPR. We will update this provision and provide appropriate safeguards in the event of future changes.
7. Child privacy protection
We do not target individuals under the age of 18. We do not intentionally collect personal information from children under that age without the consent of a valid parent or legal representative. If you believe that a child's personal data has been collected, please contact infosec@upstage.ai.
8. DPO
Jeffrey / Email: infosec@upstage.ai
9. Cookies
We use cookies and tracking technologies, such as Microsoft Clarity and Google Analytics. In accordance with the GDPR and ePrivacy Directive, we obtain consent before installing non-essential cookies. You can manage this through the cookie consent banner or your browser settings. Please refer to our Basic Policy for more details.
10. Changes to the EU supplementary provisions
In the event of significant changes, we will post an updated version on the website along with the new effective date and provide additional notice if necessary.
11. Contact
If you have any questions regarding these U.S. Supplements or wish to exercise your rights, please contact us at the following:
Upstage Co., Ltd.
Rm. 815, Bldg A, 338 Gwanggyojungang-ro, Suji-gu, Yongin-si, Gyeonggi-do
Email: infosec@upstage.ai
Recruitment Inquiries: joinstage@upstage.ai
