This English version is provided for convenience. In case of any conflict, the Korean version prevails.
HyperReality Co., Ltd. (the "Company") complies with the Personal Information Protection Act of Korea (the "Act") and other applicable laws in providing Spear (the "Service"). This Privacy Policy explains what personal information the Company processes, why, for how long, and to whom it entrusts or provides that information.
At a glance
| What | Details |
|---|---|
| Information we collect | Google account email and name, team invitation emails, identifiers, handles and access tokens (encrypted) of connected social accounts, service usage records |
| How we use it | Sign-in, team operations, publishing social posts users request and collecting performance metrics, notifications, customer support, security |
| Who we entrust it to | Sign-in (Google), email delivery (AWS), operational alerts (Discord) — Articles 4 and 5 |
| Retention | Until account deletion. Only records required by law are kept for the legally required period |
| Contact | Chief Privacy Officer Juyoung Kang · privacy@spear.im |
The Company's two roles
The Service is a marketing tool used by businesses and teams. Within the same Service, the Company's role differs depending on the information.
| Information | The Company's role | Applicable document |
|---|---|---|
| Member account information, access logs, inquiries, payment and billing information | Personal information controller — the Company determines the purposes and means | This Privacy Policy |
| Data that customers (the teams and businesses Members belong to) upload to or connect with the Service — "Customer Data." For example: social posts and their publishing results and engagement metrics, campaigns and tracking links, content calendars, voice guides, trend topics, brand channels, and the customer's own app keys and ad account information | Processor — processes only for the purpose of providing the Service, on the customer's instructions | The customer's privacy policy, and the Terms of Service between the Company and the customer (Customer Data clause) |
Please direct requests to access or delete personal information contained in Customer Data to the relevant customer first. If such a request reaches the Company, we will forward it to that customer.
Article 1 (Items, Purposes, Legal Bases and Retention Periods)
| When | Items | Purpose | Legal basis | Retention period |
|---|---|---|---|---|
| Sign-up and sign-in (Google sign-in) | Email, name (nickname) | Member identification, sign-in, announcements | Performance of contract (Article 15(1)(4) of the Act) | Until account deletion |
| Team invitations | Invitee's email, role to be granted | Sending invitation emails, processing team membership | Performance of contract | 1 year from the date the invitation ends (accepted, cancelled or expired) |
| Social channel connection (when connected by the user) | Platform account identifier, handle (display name), platform user identifier, access and refresh tokens (stored encrypted), token expiry time | Publishing posts the user requests, collecting engagement metrics, connection status notices | Performance of contract | Tokens are deleted immediately upon disconnection or account deletion. Account identifiers and handles are kept with past publishing records until the team's data is deleted |
| Notifications | In-service notifications (title, content, read status), notification email delivery records (recipient email, subject, body, delivery result) | Notices about invitations, publishing failures, expired connections, etc.; delivery confirmation and resending | Performance of contract | In-service notifications until account deletion; email delivery records for 1 year after sending |
| Access token (MCP) issuance | Token name, token hash, last used time, revocation time | Connecting external AI tools, security audits | Performance of contract | Until the token is revoked or the account is deleted |
| Customer inquiries | Email inquiries: email, inquiry content, attachments. Contact form: name, email, phone, company or team name, project name, budget, inquiry content | Responding to inquiries, sales consultations, dispute handling | Performance of contract; steps taken at the data subject's request before entering into a contract | 3 years after resolution |
| Service use | Access IP, browser information (User-Agent), access time, service usage records, error records | Security, preventing fraudulent use, incident response | Legitimate interests (Article 15(1)(6) of the Act) | 1 year (access logs at least 3 months under the Protection of Communications Secrets Act) |
| Paid payments (domestic, once introduced) | Partial payment method information, payment and refund history, business information for tax invoices | Billing, refunds, issuing tax invoices | Performance of contract, legal obligation | 5 years (Act on Consumer Protection in Electronic Commerce; Framework Act on National Taxes) |
| Paid payments (international, once introduced) | Paddle collects international payment information directly (Article 6). The Company receives only payment status, plan and country | Subscription status management | Performance of contract | 5 years |
- Paid payments are not currently available in the Service. Once payments begin, we will process the payment items above.
- When a data deletion request is made through Meta (Facebook, Instagram, Threads), the Company deletes the tokens for that connection and records only the deletion confirmation code, channel and number of connections deleted. This record contains no personally identifiable information.
- We do not store information about people who click campaign tracking links. We count only daily clicks, and we read browser information to filter out bots but do not store it.
Records retained under law are stored separately from other information and used only for that purpose.
| Record | Period | Legal basis |
|---|---|---|
| Records of contracts or withdrawal of offers | 5 years | Act on Consumer Protection in Electronic Commerce |
| Records of payments and supply of goods | 5 years | Act on Consumer Protection in Electronic Commerce |
| Records of consumer complaints or dispute resolution | 3 years | Act on Consumer Protection in Electronic Commerce |
| Website visit (sign-in) records | 3 months | Protection of Communications Secrets Act |
Article 2 (Processing of Customer Data)
- The Company processes Customer Data only to provide the Service, maintain security and comply with laws, and does not use it for any other purpose or provide it to third parties. Posts that a customer instructs us to publish to a social platform are transmitted to that platform according to the instruction (Article 5).
- If Customer Data contains personal information, the customer is responsible for securing a legal basis for collecting it and for informing the data subjects.
- When a customer deletes a team or the service agreement ends, the Company provides an opportunity to export (download) the data for 30 days and then destroys the Customer Data. Copies remaining in backups are deleted according to the backup cycle (up to 30 days).
- External service credentials registered by customers (their own app keys, ad account keys, Naver DataLab keys) are stored encrypted and never shown in plain text on screen or in responses.
- At the request of business customers, we enter into a data processing agreement (DPA).
Article 3 (AI Features)
- The Service does not currently offer generative AI features. If we introduce them, we will amend this Privacy Policy.
- When a user connects their own AI client using an access token (MCP), that client can read the Service's data and request publishing. Processing by that client's provider is governed by the terms between the user and that provider. Publishing requests received via MCP are published only after a team member approves them.
Article 4 (Entrustment of Personal Information Processing)
| Entrustee | Entrusted task |
|---|---|
| Google LLC | Google account sign-in (authentication) |
| Amazon Web Services, Inc. | Sending notification emails (Amazon SES, Seoul region) |
| HyperReality Co., Ltd. (self-operated cloud "zerocloud") | Operating the Service's servers and databases, relaying notification emails |
| Discord Inc. | Internal operator alerts (partially masked email, name and member identifier upon new sign-ups) |
If an entrustee changes, or a payment service provider is added when paid payments begin, we will amend this Privacy Policy and give notice.
Trend reports send only the search terms set by the customer to Naver DataLab (Republic of Korea), and no personal information.
Article 5 (Overseas Transfer of Personal Information)
The Company transfers personal information overseas as follows to provide the Service (performance of contract) (Article 28-8(1)(3) of the Act). Transfers take place over the network when the Service is used.
| Recipient (contact) | Country | Items | Purpose | Retention period | How to refuse and effect of refusal |
|---|---|---|---|---|---|
| Google LLC (privacy.google.com) | United States | Email, name | Google sign-in | Until account deletion | To refuse, do not sign up. Since Google is currently the only sign-in method, you cannot use the Service if you refuse |
| Discord Inc. (discord.com/privacy) | United States | Partially masked email, name, member identifier | Internal operator alerts | Per Discord's policy | Operational alerts are necessary to run the Service and cannot be refused separately. To refuse, do not sign up |
| X Corp. (x.com/privacy) | United States | Posts to be published (text, images), access tokens of connected accounts | Publishing requested by the user, retrieving engagement metrics | Per the platform's policy | No transfer occurs if you do not connect that platform. All other features remain available |
| Meta Platforms, Inc. — Threads, Instagram, Facebook (facebook.com/privacy) | United States | Posts to be published (text, images), access tokens of connected accounts | Publishing requested by the user, retrieving engagement metrics | Per the platform's policy | Same as above |
| LinkedIn Corporation (linkedin.com/legal/privacy-policy) | United States | Posts to be published (text, images), access tokens of connected accounts | Publishing requested by the user, retrieving engagement metrics | Per the platform's policy | Same as above |
| Bluesky Social, PBC (bsky.social/about/support/privacy-policy) | United States | Posts to be published (text, images), access tokens of connected accounts | Publishing requested by the user, retrieving engagement metrics | Per the platform's policy | Same as above |
| Operator of the Mastodon server specified by the user | Varies by server | Posts to be published (text, images), access tokens of connected accounts | Publishing requested by the user, retrieving engagement metrics | Per the server's policy | Same as above |
Notification emails are sent from the Amazon SES Seoul region and therefore do not constitute an overseas transfer.
Article 6 (Provision of Personal Information to Third Parties)
The Company does not provide personal information to third parties except with the data subject's consent or where specifically required by law. Sending posts to social platforms connected by the user is a transmission made on the user's instructions (Article 5). Paid payments are not currently available; once international payments begin, we will provide information as follows.
| Recipient | Country | Items | Purpose | Retention period |
|---|---|---|---|---|
| Paddle.com Market Limited | United Kingdom | Email, country, payment method information, billing address, payment and refund history | Payment and tax processing as the Merchant of Record for international payments | Per Paddle's privacy policy |
We obtain consent to this provision on the international payment screen. If you do not consent, you cannot use international payment, but domestic payment remains available.
Article 7 (Destruction of Personal Information)
- When the retention period ends or the purpose has been achieved, we destroy the information without delay.
- Electronic files are deleted using methods that make them unrecoverable, and paper documents are shredded or incinerated.
- When we process an account deletion request, we destroy the member's information without delay. Records retained under law are stored separately for the periods set out in Article 1.
Article 8 (Cookies and Other Automatic Collection Tools)
- The Service uses essential cookies (or browser storage) to keep you signed in.
- The Service does not use visitor analytics tools or advertising tracking pixels.
- You can refuse cookies in your browser settings. If you refuse essential cookies, you will not stay signed in.
- Chrome: Settings → Privacy and security → Third-party cookies
- Safari: Settings → Privacy
Article 9 (Children Under 14)
The Service does not accept sign-ups from children under the age of 14. If a user is confirmed to be under 14, we delete the account without delay.
Article 10 (Rights of Data Subjects and How to Exercise Them)
- Data subjects may at any time request access to, correction or deletion of, suspension of processing of, or transfer of their personal information, or withdraw consent.
- You can disconnect social channels yourself in the console's channel management, and revoke access tokens under Settings → MCP in the console.
- Send account deletion and other requests to privacy@spear.im (see the Data Deletion Instructions). We process them within 10 days.
- You may also exercise these rights through a representative (a legal representative or an authorized person). In that case, a power of attorney must be submitted.
- You cannot request deletion of information that other laws require us to retain.
Article 11 (Automated Decisions)
The Company does not make decisions that significantly affect data subjects' rights or obligations in a fully automated manner. When we restrict an account through fraud detection, a person reviews it.
Article 12 (Security Measures)
- Administrative: establishing an internal management plan, minimizing personnel with access, regular inspections
- Technical: access control based on team membership, encryption in transit (HTTPS), encrypted storage of social account tokens and external integration credentials, storing access tokens only as hashes, partially masking emails in operational alerts, retaining access logs
- Physical: access control to servers and data storage locations
Article 13 (Chief Privacy Officer)
- Chief Privacy Officer: Juyoung Kang (CEO)
- Email: privacy@spear.im
- Phone: +82-507-0178-7546
Article 14 (Remedies for Infringement)
If you need counseling or dispute resolution regarding infringement of personal information, you may contact the following organizations (Republic of Korea).
- Personal Information Infringement Report Center (Korea Internet & Security Agency): privacy.kisa.or.kr / 118 (no area code)
- Personal Information Dispute Mediation Committee: www.kopico.go.kr / 1833-6972
- Supreme Prosecutors' Office Cyber Investigation Division: www.spo.go.kr / 1301 (no area code)
- Korean National Police Agency Cyber Investigation Bureau: ecrm.police.go.kr / 182 (no area code)
Article 15 (Changes to This Privacy Policy)
- This Privacy Policy takes effect on 2026-10-16.
- If its contents change, we will give notice on the Service 7 days before the effective date. Important changes to data subjects' rights, such as adding collected items or providing information to third parties, will be announced 30 days in advance, and we will obtain consent again where necessary.
- Previous versions of this Privacy Policy are available under "Previous versions" at the bottom of this page.