HanFlow AI Privacy Policy

• Effective date: May 25, 2026 · Last revised: October 8, 2026 (English version published July 22, 2026)
• Data controller: Quantum Materials Co., Ltd. (CEO: Hwan-Yeol Park · Business Registration No. 734-88-03845 · E-commerce Registration No. 2026-Chungnam-Asan-0713)
• Address: B410, Industry-Academic Cooperation Building, 22-7 Soonchunhyang-ro, Sinchang-myeon, Asan-si, Chungcheongnam-do, Republic of Korea

Quantum Materials Co., Ltd. (the "Company") complies with the Personal Information Protection Act of Korea and other applicable laws, and processes personal information as follows. This English translation is provided for convenience; in case of conflict, the Korean version (hanflowai.com/privacy) prevails to the extent permitted by applicable law.

Article 1 (Information We Collect)

※ We do not collect personal information of children under 14; sign-up includes an age-confirmation step that blocks them.

Article 2 (Purposes of Use)

1. Member identification, authentication, and account management (including new-device login checks)
2. Providing the AI document generation service and delivering/storing results
3. Paid-plan payment, refunds, and credit settlement
4. Customer support and service notices
5. (With consent) marketing and promotional communications
6. Fraud prevention (multi-account, referral abuse, etc.) and security incident response
7. Service quality improvement (statistics are de-identified)
8. Compliance with legal obligations

Article 3 (Retention Periods)

Personal information whose retention period has expired or whose purpose has been achieved is destroyed without delay by irreversible means (electronic files: permanent deletion; printouts: shredding/incineration).

Article 4 (Processors and Cross-Border Transfers)

The Company does not, in principle, provide personal information to third parties. For service provision (contract performance), processing is entrusted as follows; some processors are located abroad. Cross-border transfers are disclosed through this policy pursuant to Article 28-8(1)3 of the Personal Information Protection Act (entrustment/storage necessary for contract performance). Transfers occur over telecommunications networks at the time of service use, and information is retained until the entrusted purpose is achieved (or per Article 3).

Notice regarding payment providers (third-party provision and cross-border transfer)

To process paid checkout, the Company provides user personal information to the payment provider below. That provider acts as merchant of record and reseller, and its own Data Processing Agreement states that it is an independent data controller in respect of buyer payment data. This is therefore not entrustment but a third-party provision and cross-border transfer under the Personal Information Protection Act, and the transfer is made with the user's separate consent under Article 28-8(1)1 of that Act. Consent is obtained on the screen shown immediately before the checkout window opens.

1. Timing and method: at the moment the user opens the checkout window, the data is transmitted over the network from the user's browser to the provider's checkout page under encryption (HTTPS). Card numbers and other original payment-instrument details are collected directly by the provider and are not stored on the Company's servers.
2. Storage location and sub-processors: the data is stored in the Amazon Web Services Mumbai region (ap-south-1), India. The provider's sub-processors are Amazon Web Services, Airwallex, Stripe and Cashfree.
3. Retention: retained until the end of the applicable statutory limitation period plus two (2) months following the end of the relationship; upon termination of the service agreement the data is deleted or returned within thirty (30) business days.
4. Right to refuse and consequences: the user may refuse consent to this cross-border transfer. In that case the paid checkout cannot be used. Free use of the Service is unaffected.
5. Governing law and jurisdiction: the agreement with the provider is governed by the law of the State of Delaware, USA, and the US courts have exclusive jurisdiction.

Data-protection measures for AI subprocessors: For user inputs (prompts, uploaded content) and generated results sent to AI providers (Anthropic, OpenAI), the Company configures and manages processing so that:

1. No use for model training: These subprocessors do not use data submitted via their API to train or improve their AI models (the default policy of each provider's API terms). The Company does not consent to, and does not enable, any training-use option.
2. Minimized retention: Transmitted data is retained only briefly for limited purposes such as abuse-monitoring and is then deleted; it is not subject to long-term storage or indexing. The Company applies a store-disable setting (store=false) to API requests where available.
3. No collection on proxied routing: Where requests are routed through an intermediary, the Company enforces routing only to upstream providers that do not collect, retain, or train on data (zero data collection).
4. No secondary use: This data is not used for advertising, marketing, or sale to third parties.

Users may refuse cross-border transfer by declining to sign up or use the Service; in that case the Service cannot be provided. No cross-border transfers are made for marketing purposes.

Article 4-2 (Google Calendar in the HanFlow AI Desktop App)

The HanFlow AI desktop app (Windows and Mac) processes Google user data as described below only when the user clicks "Connect Google Calendar" in the app and agrees to the notice the app shows before Google's sign-in screen opens.

1. Data accessed and scope: through the https://www.googleapis.com/auth/calendar.events scope only — calendar events and the details Google returns for them (such as event ID and link, status, title, start/end time, time zone, location, description, attendees and their email addresses, organizer, recurrence and reminders), and the name of the primary calendar (usually the account's email address), which the app shows to tell the user which account is connected. Of these, only the event ID, title, start/end time, location, link and status are passed on to the AI bot.
2. Purpose (and no other): to show, create, update and delete events as the user asks the AI bot in the app. When an event with attendees is created, Google sends them an invitation.
3. Where it is processed: the app talks to the Google Calendar API directly from the user's computer. Event content and Google tokens are never sent to or stored on the Company's servers in readable form. (If the user also uses the HanFlow AI phone app with the computer, conversations are relayed between the two devices end-to-end encrypted, so the Company cannot read them.) The sign-in token (refresh token) is kept only on the user's computer, encrypted (Windows: DPAPI; macOS: encrypted with a key kept in the macOS Keychain).
4. Passing to an AI model: when the user asks the bot about their calendar, the event details needed to answer are sent to the AI model the user chose for that bot — the Anthropic (Claude) or OpenAI account the user signed in to on their own computer, or a local model running on the user's computer. They are sent only to carry out that request. How long that provider keeps the content, and whether it may use it to improve its models, is governed by the user's own agreement and data settings with that provider (for example, the model-improvement setting in the user's Claude or ChatGPT account). Users who do not want event details to leave their computer can use a local model.
5. Kept on the user's computer: the bot's conversation history (which can include event details the bot showed) is stored only on the user's own devices (the computer, and the phone if the phone app is used) and can be deleted at any time with the 🗑 delete function in the conversation list.
6. Limited Use: HanFlow AI's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy and the Google Workspace API User Data and Developer Policy, including the Limited Use requirements. The Company does not use Google user data for advertising, does not sell it, and does not use it to develop, improve or train generalized AI/ML models, and does not transfer it except as needed to provide the features above at the user's request. No person at the Company reads Google user data, except with the user's explicit prior consent for specific data, where necessary for security purposes (such as investigating abuse), or to comply with applicable law.
7. Disconnecting and deletion: Settings › Calendar › "Disconnect" in the app deletes the token stored on the computer and asks Google to revoke access. Access can also be revoked at any time at Google Account › Security › Third-party access. Calendar events themselves stay in the user's Google Calendar.

Article 4-3 (Gmail via Google Sign-in in the HanFlow AI Desktop App)

The HanFlow AI desktop app (Windows) can connect Gmail with Google sign-in instead of an app password. Google user data is processed as below only when the user clicks "Connect with Google sign-in" in the mail settings and agrees to the notice the app shows before Google's sign-in screen opens.

1. Data accessed and scope: the https://mail.google.com/ scope (the only scope that allows standard IMAP/SMTP mail access) and openid email to identify which account was connected. Through it the app receives the messages it opens (headers, body, attachments) when the user asks the AI bot to find or read mail, and sends the messages the user asks the bot to send. The app does not delete mail and does not change mail settings.
2. Purpose (and no other): to find, read and send mail as the user asks the AI bot in the HanFlow AI apps. Sending follows the in-app rules (up to 5 recipients per mail and 30 mails per day, with a sent log on the user's computer).
3. Where it is processed: the app talks to Gmail (IMAP/SMTP with OAuth) directly from the user's computer. Mail content and Google tokens are never sent to or stored on the Company's servers in readable form. The sign-in token (refresh token) is kept only on the user's computer, encrypted with Windows DPAPI, and is shared by the HanFlow AI helper apps on that computer.
4. Passing to an AI model: when the user asks the bot about their mail, the mail content needed to answer is sent to the AI model the user chose for that bot (the user's own Anthropic (Claude) or OpenAI account, or a local model), under the same terms as Article 4-2 item 4.
5. Limited Use: the commitments in Article 4-2 item 6 (Google API Services User Data Policy and Google Workspace API User Data and Developer Policy, including the Limited Use requirements; no advertising, no sale, no training of generalized AI/ML models; no human reading except as stated there) apply equally to Gmail data.
6. Disconnecting and deletion: Settings › Mail › "Remove account" asks Google to revoke access and then deletes the token on the computer. Access can also be revoked at Google Account › Security › Third-party access. The mail itself stays in the user's Gmail.

Article 4-4 (Mail via Microsoft Sign-in and Automatic Mail Server Lookup in the HanFlow AI Desktop App)

1. Microsoft sign-in: because Microsoft has turned off app-password sign-in for Outlook, Hotmail and Microsoft 365 mail, the app connects such mail with Microsoft sign-in (OAuth) only when the user presses "Connect with Microsoft sign-in" in the mail settings and agrees to the in-app notice. The scopes are IMAP.AccessAsUser.All (IMAP mailbox access), SMTP.Send (sending mail), offline_access (staying signed in) and openid email profile (identifying the connected account). Purpose, place of processing and passing to the AI model are the same as Article 4-3 items 2 to 4, and the app never deletes mail. The sign-in token is kept only on the user's computer, encrypted with Windows DPAPI, and is replaced in place when Microsoft issues a new one.
2. Disconnecting: Settings › Mail › "Remove account" deletes the token on the computer. The permission on Microsoft's side can be removed at Microsoft account › App and service permissions (work or school accounts: My Apps).
3. Automatic mail server lookup: when the user presses "Find automatically" under "Work, school or other mail", the app sends only the domain name of the mail address (for example, example.com) to Cloudflare's public DNS (cloudflare-dns.com, to look up the mail (MX) servers) and to Mozilla's public mail configuration list (autoconfig.thunderbird.net) to find the incoming and outgoing servers. The part of the address before "@", passwords and mail content are not sent, and nothing goes through our servers.

Article 5 (Your Rights)

You may at any time:

1. Request access to your personal information
2. Request correction or deletion of errors
3. Request suspension of processing
4. Withdraw consent (including marketing consent) and delete your account
5. Request data portability (download)

How to exercise: the in-service Settings menu, or the contact in Article 8 (email/phone). The Company acts without delay (within 10 days) and notifies you of the result.

Article 6 (Security Measures)

1. Passwords stored with one-way encryption (Argon2id)
2. TLS encryption in transit (HTTPS), web application firewall (WAF), and rate limiting
3. Additional email verification for logins from new devices/IPs
4. Least-privilege access control and access logging
5. Regular security reviews (including dependency vulnerability checks) and an incident response process

Article 6-2 (Breach Notification)

Under Article 34 of the Personal Information Protection Act, upon becoming aware of a breach the Company will:

1. Notify within 72 hours: notify affected users within 72 hours of awareness and, where legally required, report to the Personal Information Protection Commission (or KISA).
2. Notification contents: items leaked / time and circumstances / expected harm / the Company's countermeasures / how users can minimize harm / report and inquiry contacts
3. Method: email, in-service notice, or website announcement, whichever is fastest; for large-scale breaches a website announcement is made in parallel.
4. Follow-up: root-cause analysis, recurrence prevention, and notification of results.

Article 7 (Cookies and Similar Technologies)

The Service uses only essential cookies and local storage for login session persistence and account protection (device identification). No advertising or behavioral-analytics cookies are used. You may block cookies in your browser settings, but features requiring login will then be limited.

The Service uses cookieless visit analytics to understand which pages are opened and how often. These analytics do not identify individuals and do not track users across sites; what is aggregated is the page URL, referrer, browser and operating-system type, country, screen size, performance metrics such as how long the page took to load, and a temporary identifier used to distinguish a single page view. No separate cookie or advertising identifier is set for this purpose. The analytics are not activated at all on pages whose URL is itself a secret (share links and invitation links).

Article 8 (Privacy Officer)

• Name: Hwan-Yeol Park
• Title: CEO
• Email: info@qmscience.net
• Phone: +82-70-7609-1376

Article 9 (Remedies)

• Personal Information Dispute Mediation Committee (+82-1833-6972, www.kopico.go.kr)
• Personal Information Infringement Report Center (118, privacy.kisa.or.kr)
• Supreme Prosecutors' Office (1301, www.spo.go.kr)
• National Police Agency Cyber Bureau (182, ecrm.police.go.kr)

Article 10 (Changes to This Policy)

This policy took effect on May 25, 2026. Changes are announced in the Service at least 7 days before taking effect (30 days for material changes).

• Revised July 21, 2026: processor list aligned with the current service (Anthropic, OpenAI, Kakao, Resend, backup storage), file retention aligned with actual operation (workspace storage), cross-border transfer basis updated to the amended Personal Information Protection Act (Article 28-8), cookie usage corrected to reflect essential-only use.
• July 22, 2026: English version published.
• Revised July 24, 2026: added "Data-protection measures for AI subprocessors" to Article 4, stating that AI providers do not use user data for model training, retain it only briefly before deletion, and that requests are routed only to providers that do not collect data.
• Revised August 6, 2026: Article 4 now states that as of the revision date no personal information is entrusted to any payment gateway. Any new payment gateway will be disclosed in advance by revising this policy.
• Revised August 7, 2026: the planned adoption of a payment gateway was cancelled, and the corresponding entry — listed in anticipation of that adoption — was removed from the processor list. This Service has never put any payment-gateway integration into operation, and no user personal information has ever been provided to or entrusted with a payment gateway.
• Revised August 27, 2026: with the launch of paid checkout, Article 4 adds a Notice regarding payment providers (third-party provision and cross-border transfer). Because the provider is a merchant of record and therefore an independent controller, the disclosure is made as a third-party provision and cross-border transfer rather than as entrustment, and states the entity names, countries (United States, United Kingdom, India), categories transferred, timing, method, storage location and retention period. Because this change rests on the user’s separate consent, it applies from the moment that consent is given, as set out in the proviso to Article 9.
• Revised September 12, 2026: with the start of visit analytics to see which pages are opened and how often, Article 4 adds visit analytics to Cloudflare's entrusted work and Article 7 states that the analytics are cookieless. No new processor is added (Cloudflare is already our hosting/CDN processor); no cookies, advertising identifiers or cross-site tracking are used.
• Revised October 7, 2026: with the launch of Google Calendar in the HanFlow AI desktop app, Article 4-2 is added, stating the data and scope accessed (calendar.events), the purpose, where it is processed (on the user's computer, never sent to the Company's servers), passing to the AI model, adherence to the Google API Services User Data Policy including the Limited Use requirements, and how to disconnect. No new processor is added.
• Revised October 7, 2026 (2): with HanFlow AI desktop 1.2.31, Article 4-2 now states that the app asks for consent in an in-app notice before Google sign-in, and Article 4-3 is added for connecting Gmail with Google sign-in (scope, purpose, processing on the user's computer, passing to the AI model, Limited Use, disconnecting), and Article 4-4 is added for connecting mail with Microsoft sign-in and automatic mail server lookup, and the retention table now lists HanFlow AI desktop installer download records (IP deleted after 3 months). No new processor is added.
• October 8, 2026 revision: HanFlow AI installer download records now also store the city and network provider estimated from the IP, and device registration (device key issuance) records the IP and country (license-misuse prevention and download statistics). The IP, city and network provider are deleted after 3 months (download records keep only country and counts as statistics; the country of a device registration is kept with that registration record).