MonoGPT Privacy Policy

(Common to Android/iOS · For users in Korea)

Publication/Enforcement Date: November 23, 2025

Scope of application: This privacy policy (hereinafter “this policy”) applies when users use MonoGPT mobile applications (Android and iOS), websites operated by the company, and other services (collectively, “Services”).

Monoflow Co., Ltd. and its affiliates (hereinafter collectively referred to as “Company”, “We”) attach great importance to the protection of users’ personal information and process personal information lawfully and safely in compliance with relevant laws and regulations.

1. Items of personal information processed and collection methods

The company collects and uses the minimum amount of personal information to the extent necessary to provide services. Personal information may be included in the prompts/conversations/files/images/audio that users enter or upload while using the service, so please refrain from entering unnecessary personal information.

1.1 Information provided directly by users

The following information may be collected when a user registers, logs in, makes a payment, inquires about customer support, or participates in an event (if applicable).

• Account information — (example) Credential information such as name, affiliation (optional), position (optional), email address, contact information, account ID, password, etc.
• Payment/purchase related information — (example) payment identifier, payment status/date, payment amount, purchased product/plan information, receipt information, etc.
• User Content — (Examples) Prompts, text, files, images, audio and other content uploaded/entered by users
• Communication information — (Example) When making inquiries through email, inquiry form, chat consultation, etc.: name, contact information, email, inquiry content, attached files, etc.

1.2 Information automatically collected during service use

The following information may be automatically generated and collected when users access the service or use its functions.

• Log information — (Example) IP address, access date and time, request URL, error log, click/interaction history within the service, browser type (when using the web), etc.
• Usage records — (Examples) Viewed screens/pages, button clicks, functions used, request/response time, time zone, country/language settings, connection device type and OS information, app version (when using mobile), etc.
• Cookies and similar technologies (when using web/web view) — We may use cookies or similar technologies to maintain logged in sessions, save preferences, and improve usability.

1.3 Mobile app permissions (when using this function)

In the mobile app, the permissions below can be accessed only when the user uses the corresponding function (can be denied).

• (Example) Photo/media/file access (upload), camera (shooting upload), microphone (voice input/audio upload)
• If permission is denied, use of some functions may be restricted.

How to change permission settings

• Android: Settings > Applications > MonoGPT > Permissions
• iOS: Settings > MonoGPT > Permissions

2. Purpose of processing personal information

The company processes collected personal information for the following purposes.

1) Service provision and operation

• MonoGPT function provided (question response, text/image/audio generation/analysis, etc.)
• Create/verify account, stay logged in
• Paid service payment processing and payment history management
• Customer inquiry response, problem handling, consultation support

2) Service analysis and quality improvement

• Error/bug analysis and stability improvement
• Improve model performance
• Development of user convenience features
• Service usage statistics analysis, UI/UX improvement

3) Development and guidance of new features, products, and events (if applicable)

• Provides information on new features, beta services, events/seminars, announcements, etc.

4) Security and prevention of illegal use

• Account theft, abnormal access and traffic detection
• Prevent and respond to spam, fraud, and malicious activity
• Strengthening service infrastructure and data security

5) Compliance with legal and regulatory obligations and response to disputes

• Fulfill storage and reporting obligations under relevant laws and regulations
• Dispute response, investigation/inquiry cooperation
• exercising and defending legal rights;

3. Processing and retention period of personal information

The company destroys personal information without delay when the processing purpose is achieved. However, if storage for a certain period of time is required according to relevant laws, it will be stored safely for that period.

3.1 General retention criteria (principles)

• Member (account) information: Until membership withdrawal (however, if there is a legal storage obligation, until the relevant period)
• User content (prompts/conversations/uploaded files, etc.): When the purpose of using the service is achieved or when membership is withdrawn
• Customer inquiry/consultation records: After the inquiry is resolved, until the retention period in accordance with relevant laws and regulations
• Logs/access records: When the purpose of ensuring security and stability is achieved or when the legal retention period ends

3.2 Storage in accordance with laws and regulations (if applicable)

If the company is subject to related laws such as e-commerce, transaction records, etc. may be kept for the period below.

• Records of labeling and advertising: 6 months
• Records of contracts or subscription withdrawals, etc.: 5 years
• Records of payment and supply of goods (or services): 5 years
• Records of consumer complaints or dispute resolution: 3 years

In addition, computer communication/Internet log records, etc. may be stored for a certain period of time in accordance with laws and regulations related to protection of communication secrets.

4. Procedure and method of destruction of personal information

4.1 Destruction Procedure

• When personal information becomes unnecessary due to achievement of the purpose of use, expiration of retention period, etc., it is destroyed without delay.
• Information that needs to be stored in accordance with the law is stored separately from other personal information, and is destroyed at the end of the storage period.

4.2 Destruction method

• Electronic file format: Permanently deleted in a way that cannot be restored
• Paper documents, etc.: Destroy by shredding or incineration.

5. Provision of personal information to third parties

In principle, the company does not provide users' personal information to third parties without the users' consent. However, exceptions are made in the following cases.

1. If the user consents in advance
2. When there is a basis for law or a legitimate request from a public institution such as investigation/inquiry
3. When it is urgently necessary to protect the life, body, or property of the user or a third party (to the extent permitted by law)

※ If a user shares content/results with a third party through sharing links, external app integration, extension functions, etc., such sharing is done according to the user's will.

6. Entrustment of personal information processing

To provide smooth service, the company may entrust personal information processing to an external professional company. When concluding a consignment contract, the company manages and supervises the processing and protection of the trustee's personal information in accordance with laws and regulations related to personal information protection.

6.1 Consignment status (trustee and consignment work)

7. Overseas transfer of personal information (if applicable)

If the company transfers personal information overseas using an overseas business (overseas cloud/tool/partner, etc.), we will notify you in advance of necessary matters such as the country of transfer, transfer recipient, purpose of transfer, transfer items, transfer date and method, retention/use period, method of refusal, etc. and obtain consent (if necessary) in accordance with relevant laws and regulations.

8. Installation, operation and refusal of devices that automatically collect personal information (cookies, etc.)

The company may use cookies and similar technologies on the website or in-app web view to maintain login sessions, save preferences, and improve services.

• Chrome: Settings > Privacy & Security > Cookies
• Safari: Settings > Safari > Privacy-related settings

If you refuse to store cookies, the use of some functions may be restricted.

9. Rights, obligations and exercise methods of information subjects and legal representatives

Users can exercise the following rights regarding personal information held and processed by the company (in accordance with relevant laws and regulations).

• View personal information (right to know)
• Request for correction/update of personal information
• Request for deletion of personal information
• Request to stop processing personal information
• Withdrawal of consent if processing is based on consent

9.1 How to exercise your rights

Users may request to exercise their rights in the following manner.

• Email: [email protected]
• (If applicable) Request through the customer support/inquiry menu within the service

After going through the process of verifying the requester's identity, the company processes the request in accordance with the procedures and deadlines set forth in relevant laws and regulations.

10. Protection of personal information of children under 14 years of age

In principle, the company does not provide services to children under 14 years of age and does not intentionally collect personal information from children under 14 years of age. If we become aware that personal information of a child under the age of 14 has been collected, we will delete the information without delay or take legal action, such as obtaining consent from a legal representative.

11. Measures to ensure the safety of personal information

The Company applies or strives to apply the following measures to protect personal information from loss, theft, misuse, unauthorized access, disclosure, alteration, and destruction.

• Access permission control
• Encryption (protection measures for information requiring security during transmission/storage)
• Log monitoring and anomaly detection
• Establishment of internal management plan and personal information protection training

However, due to the nature of the Internet or electronic communication, 100% complete security cannot be guaranteed, so users are requested to follow security rules such as password management, use of two-step authentication (if provided), and logging out after using shared devices.

12. Person in charge of personal information protection and grievance handling

For inquiries, complaints, or requests to exercise rights regarding this policy and personal information protection, please contact us below.

• Person in charge: Personal Information Protection Manager Myeongjun Kim
• Email: [email protected]
• Company: Monoflow Co., Ltd.

The company will faithfully respond to inquiries received in accordance with the procedures and deadlines established by relevant laws and will take appropriate action if necessary.

13. Remedy for infringement of rights and interests

To receive relief from personal information infringement, you may apply for consultation or dispute mediation to the organizations below.

• Personal Information Infringement Reporting Center (Korea Internet & Security Agency): 118 without area code / privacy.kisa.or.kr
• Personal Information Dispute Mediation Committee: 1833-6972 / www.kopico.go.kr
• Supreme Prosecutors' Office Cyber Investigation Division: 1301 / www.spo.go.kr
• National Police Agency cyber crime reporting system: 182 / ecrm.police.go.kr

14. Changes to personal information processing policy

The company may revise this policy to reflect changes in laws and services. If this policy is changed, we will notify you of the changes and effective date through an appropriate method, such as a notice within the service or posting on the website.