プライバシーポリシー

NoCose Privacy Policy Effective Date: May 20, 2026 Last Updated: October 2026 Taro Labs (hereinafter "Company") respects User privacy and complies with the Personal Information Protection Act and related laws. 1. Collection and Use of Personal Information Item Purpose Retention Period Name, email, password, university, department, student ID Account management and identity verification See Section 6 Google sign-in data (Google account identifier, verified email, name, profile image if provided) Sign-in and account management See Sections 4 and 6 Linked service and timetable information Class schedule linkage and automatic file sorting Until membership withdrawal Google Calendar data (calendar and event identifiers, names, colors, event titles and times; read-only, only when the User links Google Calendar) Displaying the User's selected calendar and timed events, and saving the User's event preferences See Sections 4 and 6 Lecture voice recording data Text conversion and AI note generation During service provision period Text conversion results, AI notes, edits, memos Service provision and improvement of user-facing features Up to 5 years after membership withdrawal Device information, IP address, access logs, cookies Service statistics, fraud prevention, personalized service Up to 5 years after membership withdrawal 2. Methods of Collection - Direct input during sign-up and service use - Automatic collection through linked platforms - Automatically generated data during service use (recordings, logs, cookies, etc.) - Collection through customer inquiries and events 3. Use of User-Provided Audio and Notes 3.1 Audio recorded or uploaded by the User, its transcription, and the resulting notes are processed to provide transcription, note generation, editing, and related user-facing Service features. Audio and transcripts supplied separately by the User are not treated as Google Calendar API data merely because the User signed in with Google. 3.2 The Company does not use Google API data, including raw, aggregated, anonymized, or derived data, for advertising, marketing, sale, or training or improving generalized AI or machine-learning models. This restriction applies regardless of any other provision of this Policy or the Terms. 4. Google Sign-In and Calendar Data (Google User Data) 4.1 Google sign-in requests basic identity permissions. The Company uses the Google account identifier, verified email, name, and profile image when supplied to authenticate the User and maintain the User's account. It does not request access to Gmail messages. 4.2 Google Calendar access is separately initiated by the User through the read-only calendar.readonly permission. The Company receives calendar-list and event responses from Google. It uses calendar identifiers, names, colors, and primary-calendar status, plus timed event identifiers, titles, start times, and end times. Other fields in Google's responses are not used for the Calendar feature or stored as Calendar records. 4.3 The Company uses this data to let the User select a calendar, display upcoming and weekly timed events, and set an event's preference within NoCose. A preference change does not create, edit, or delete an event in Google Calendar. 4.4 Calendar names, event titles, and event times are fetched when needed and returned to the authenticated User's app; they are not retained in the Calendar integration database. The Company stores encrypted Google Calendar access and refresh tokens, the selected calendar identifier, and event identifiers with the User's on/off or hidden preferences. Google sign-in identity fields are stored in account records. 4.5 The Company's API and database are hosted by AWS in South Korea and process the Google data needed for these features. Calendar data is returned to the authenticated User's app. Google Calendar content is not sent to the Company's speech-recognition or note-generation AI providers, advertising platforms, or data brokers. Sampled product-analytics replay may record a Calendar API URL path containing an event identifier, as described in Section 5. The Company does not sell Google user data. 4.6 Google API data, including aggregated, anonymized, or derived data, is used only to provide or improve the user-facing Google sign-in and Calendar features, subject to the limited security and legal exceptions allowed by Google policy. It is not used to develop, train, or improve generalized AI or machine-learning models. The Company's use of information received from Google APIs complies with the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy) and the Google Workspace API User Data and Developer Policy (https://developers.google.com/workspace/workspace-api-user-data-developer-policy), including the Limited Use requirements. 4.7 Disconnecting Google Calendar in NoCose deletes the stored Calendar OAuth token; event preference records remain so they can be restored if the User reconnects. The User can separately revoke the Google grant at https://myaccount.google.com/connections. When a revoked token is detected during a refresh attempt, the Company deletes that stored token. An account deletion request deactivates the account but does not automatically remove existing Calendar token or event preference records, as described in Section 6. 5. Service Providers and Transfers AWS hosts the Service API and database in South Korea. It processes the Google account and Calendar data described in Section 4 for authentication, storage of linked-account settings, and delivery of the Calendar feature. The authenticated app receives the selected calendar and event data for display. Vercel hosts the web client. Cloudflare R2 stores audio separately recorded or uploaded by the User. Soniox processes separately provided audio for transcription, and OpenRouter and its inference providers process separately provided transcripts for note generation. Mixpanel receives bounded product-usage events identified by an app-generated user ID; a sign-up event may include the sign-in method (such as Google). When sampled session replay is active, Mixpanel may also receive query-free API URL paths, including a Calendar preference URL containing an event identifier. Request and response bodies and network headers are excluded from that recording; visible text and inputs are masked. Calendar names, event titles and times, and Google account identifiers or profile fields are not intentionally sent to Mixpanel. Processing by these providers may occur outside South Korea. 6. Retention and Destruction of Personal Information Calendar names, event titles, and event times are processed when requested and are not kept as Calendar records. Calendar OAuth tokens and the selected calendar identifier are retained while the integration is connected. Disconnecting removes the token and selected identifier, but the event identifiers and preferences remain for reconnection. An account deletion request disables access to the account; the current automated deletion process does not remove existing Calendar token or event preference records. Google sign-in identity and other account records also remain in the deactivated account for deletion administration and prevention of unauthorized reactivation. These records are not reused for advertising or AI training. Other personal information is handled under the Service's deletion process and applicable legal obligations. 7. User Rights Users may request access, correction, deletion, or suspension of processing of their personal information. They may disconnect Google Calendar in the app, revoke Google's grant at https://myaccount.google.com/connections, or request account deletion through the Service. Any legally required retention is handled separately from active Service use. 8. Security Measures The Company uses HTTPS/TLS for data in transit, encrypts stored Google Calendar OAuth tokens, and restricts access to account and integration data. Security and operational access is limited to authorized purposes. 9. Changes to Privacy Policy This Privacy Policy may be amended. Changes will be announced at least 7 days in advance (30 days for material changes). Continued use after announcement constitutes agreement to the revised policy.