This English version is provided for convenience. In case of any conflict, the Korean version prevails.
HyperReality Co., Ltd. (the "Company") complies with the Korean Personal Information Protection Act and other applicable laws in providing ZeroCloud (the "Service"). This Privacy Policy explains what personal information the Company processes, why, for how long, and to whom it entrusts or transfers that information.
The Service is unified cloud infrastructure that lets developers and businesses use AI, notifications (email, SMS, Kakao AlimTalk, push, etc.), storage, and electronic tax invoice features through APIs. The website is zerocloud.im, the management console is console.zerocloud.im, and the APIs are provided under zerocloud.im subdomains such as api, ai-api, storage-api, and notification-api.
At a Glance
| Topic | Details |
|---|---|
| Information we collect | Google account email, name, and profile image; Service usage records (IP address, browser information, request paths); contact details when you make an inquiry |
| How we use it | Sign-in, Team and Project operations, customer support, security |
| Who we entrust | Sign-in (Google), email delivery (AWS), error alerts (Slack), etc. (Articles 4 and 5) |
| Customer Data | Messages, files, device information, and tax invoice information that Customers send through the Service are processed on the Customer's instructions as entrusted data (Article 2) |
| Retention | Until you withdraw your membership. Only records required by law are kept for the prescribed periods |
| Contact | Chief Privacy Officer Juyoung Kang · ben@hyperreality.gg |
The Company's Two Roles
The Service is a tool used by businesses and teams. Within the same Service, the Company's role differs depending on the information.
| Information | Company's role | Governing document |
|---|---|---|
| Member account information, access and audit logs, Access Tokens, inquiry content | Personal information controller: the Company determines the purposes and means | This Privacy Policy |
| Data that Customers (the Teams or businesses Members belong to) upload to the Service or send through the API ("Customer Data"). Examples: notification recipients' email addresses, phone numbers, and message content; device information and push tokens of the Customer's app users; uploaded files; counterparty and contact information on tax invoices | Processor (entrusted party): processes data only on the Customer's instructions and only to provide the Service | The Customer's privacy policy, and the Terms of Service between the Company and the Customer (Article 8 Customer Data, Article 18 cloud special provisions) |
Please direct requests to access or delete personal information contained in Customer Data (for example, the contact details of a Customer's own customers) to the relevant Customer first. If such requests come to the Company, we will forward them to the Customer.
Article 1 (Personal Information Processed: Items, Purposes, Legal Bases, and Retention Periods)
| When | Items | Purpose | Legal basis | Retention period |
|---|---|---|---|---|
| Sign-up and sign-in (Google sign-in) | Email, name (nickname), profile image, sign-in provider, sign-up channel, consent status for terms, privacy, and marketing communications | Member identification, sign-in, notices | Performance of contract (Article 15(1)4 of the Act) | Until membership withdrawal |
| Email and password sign-up (when signing up via the API) | Email, password (stored with one-way encryption) | Member identification, sign-in | Performance of contract | Until membership withdrawal |
| Team invitations | Invitee's email, inviting Member, invitation expiry time | Sending invitation emails, processing Team membership | Performance of contract | Until leaving the Team or the invitation is canceled |
| Service use (audit logs) | Actor email and identifier, IP address, browser information (User-Agent), request method and path, response code, timestamp | Security, fraud prevention, incident response, audit trail | Legitimate interests (Article 15(1)6 of the Act) | 1 year (access logs at least 3 months under the Protection of Communications Secrets Act) |
| Issuing Access Tokens (MCP, API, and service tokens) | Token name, token hash, ciphertext for re-retrieval, display prefix, last used time, expiry time | Connecting external tools and servers, security audits | Performance of contract | Until the token is revoked or membership is withdrawn |
| Suspension of use | Suspension status, suspension start and end times | Responding to Terms violations | Performance of contract | Until membership withdrawal |
| Website inquiries | Name, email, mobile phone number, company name, project name, budget, inquiry content | Responding to inquiries, quote consultations | Consent (Article 15(1)1 of the Act) | 3 years after handling is complete |
| Paid transactions | Not applicable. We do not currently accept online payments. This Privacy Policy will be amended if payments are introduced | — | — | — |
Records retained under applicable laws are stored separately from other information and used only for that purpose.
| Record | Period | Legal basis |
|---|---|---|
| Records on contracts or withdrawal of offers | 5 years | Act on Consumer Protection in Electronic Commerce |
| Records on payment and supply of goods | 5 years | Act on Consumer Protection in Electronic Commerce |
| Records on consumer complaints or dispute resolution | 3 years | Act on Consumer Protection in Electronic Commerce |
| Website visit (sign-in) records | 3 months | Protection of Communications Secrets Act |
Article 2 (Processing of Customer Data)
- The Company processes Customer Data only to provide the Service, maintain security, and comply with laws, and does not use it for any other purpose or provide it to third parties.
- The Customer Data that the Service processes as a processor is as follows.
| Feature | Customer Data processed |
|---|---|
| Notifications (email, SMS, Kakao AlimTalk, Slack, Discord, push) | Sender and recipient addresses (email addresses, phone numbers, channels), subjects, bodies, attachments, template values, delivery status and failure reasons |
| App device management | Device identifiers of the Customer's app users, user identifiers assigned by the Customer, push (FCM) tokens, operating system, device model, manufacturer, screen information, app version, carrier, connection type, IP address, language, country, time zone, notification settings |
| Storage | Uploaded files and their names, sizes, formats, and uploaders |
| File conversion | Files submitted for conversion or optical character recognition (OCR) (processed on the Company's servers and not sent externally) |
| Tax invoices | Business information of the supplier and recipient, contact names, emails, and phone numbers, items and amounts |
| AI | Per-request provider, model, token count, cost, processing time, status, and character count. Prompt and response content is not stored |
- If Customer Data contains personal information, the Customer is responsible for securing a legal basis for collecting it and for notifying data subjects. Customers who send advertising information through the Service must comply with the advertising transmission rules of the Korean Act on Promotion of Information and Communications Network Utilization and Information Protection (opt-in consent, restrictions on nighttime sending, opt-out instructions, etc.).
- When a Customer registers and uses credentials for its own cloud, email, messaging, or AI accounts (for example, its own AWS S3 or Cloudflare R2 buckets, SMTP or SES, NHN Cloud, Firebase, or AI provider keys), Customer Data is transmitted to and stored with the provider the Customer selected, at the Customer's instruction. Processing by that provider is governed by the contract between the Customer and the provider, and the storage country is the region the Customer selected.
- When a Customer deletes a Project or the service agreement ends, the Company provides an opportunity to export (download) the data for 30 days and then destroys the Customer Data. Copies remaining in backups are deleted according to the backup cycle (up to 30 days).
- Upon request from a business Customer, the Company will enter into a data processing agreement (DPA).
Article 3 (AI Features)
- The Service provides an AI API relay feature (Zero AI: text generation, embeddings, and multimodal requests such as images). It receives requests through AI resources registered by the Customer, forwards them to the AI provider the Customer selected (OpenAI, Anthropic, or Google Gemini), and returns the results.
- When you send an AI request, your input and the result are transmitted to the relevant AI provider (overseas transfer, Article 5). For each request, the Company records only the provider, model, token count, cost, processing time, and character count, and does not store prompt or response content.
- When a Customer registers and uses its own AI provider key (direct connection), processing by that provider is governed by the terms between the Customer and the provider.
- If an AI result is inappropriate or incorrect, please let us know at ben@hyperreality.gg. We will review it, take action, and reply with the outcome.
- Please do not include sensitive information such as resident registration numbers or health information in AI requests.
Article 4 (Entrustment of Personal Information Processing)
| Entrusted party | Task entrusted |
|---|---|
| Google LLC | Google account sign-in (authentication), push notification delivery (Firebase Cloud Messaging) |
| Amazon Web Services, Inc. | Email delivery (Amazon SES, Seoul region), file storage (Amazon S3, Seoul region) |
| HyperReality Co., Ltd. (self-operated cloud) | Service servers, databases, and file conversion |
| NHN Cloud Corp. | SMS and Kakao AlimTalk delivery |
| Barobill Co., Ltd. | Electronic tax invoice issuance and transmission to the National Tax Service |
| Slack Technologies, LLC | Slack message delivery, Service error alerts |
| Discord Inc. | Discord message delivery |
| OpenAI, L.L.C. / Anthropic, PBC / Google LLC (Gemini) | AI request processing, forwarded only to the provider the Customer selected |
Providers for which a Customer registers and uses its own credentials (Article 2(4)) are not the Company's entrusted parties but providers selected directly by the Customer. If entrusted parties change, the Company will amend this Privacy Policy and give notice.
Article 5 (Overseas Transfer of Personal Information)
To provide the Service (performance of contract), the Company stores and entrusts the processing of personal information overseas as follows (Article 28-8(1)3 of the Act). Transfers take place over the network when the Service is used.
| Recipient (contact) | Country | Items | Purpose | Retention period | How to refuse and effect of refusal |
|---|---|---|---|---|---|
| Google LLC (privacy.google.com) | United States | Email, name, profile image, Google account identifier | Google sign-in | Until membership withdrawal | You can refuse by not signing up. Because Google is currently the only console sign-in method, refusing means you cannot use the Service |
| Google LLC — Firebase (firebase.google.com/support/privacy) | United States | Push tokens, notification titles, content, and topics | Push notification delivery | Per the provider's policy after delivery | No transfer occurs if you do not use push notifications. Other features remain available |
| OpenAI, L.L.C. (privacy@openai.com) | United States | Input and output of AI requests | Providing AI Features | Deleted after up to 30 days per the provider's policy; not used for training | No transfer occurs if you do not select this provider. Other features remain available |
| Anthropic, PBC (privacy@anthropic.com) | United States | Input and output of AI requests | Providing AI Features | Deleted after up to 30 days per the provider's policy; not used for training | Same as above |
| Google LLC — Gemini API (privacy.google.com) | United States | Input and output of AI requests | Providing AI Features | Per the provider's policy; paid API data is not used for training | Same as above |
| Slack Technologies, LLC (privacy@slack.com) | United States | Slack message content and channels, Service error messages | Message delivery, error alerts | Per the provider's policy | Messages are not transferred if you do not use Slack delivery. Error alerts are necessary for Service operations and cannot be refused |
| Discord Inc. (privacy@discord.com) | United States | Discord message content and servers/channels | Message delivery | Per the provider's policy | No transfer occurs if you do not use Discord delivery |
Amazon SES and S3 are processed in the Seoul region, and NHN Cloud and Barobill process data in Korea, so these are not overseas transfers.
Article 6 (Provision of Personal Information to Third Parties)
The Company does not provide personal information to third parties except with the data subject's consent or where specifically permitted by law.
| Recipient | Country | Items | Purpose | Retention period |
|---|---|---|---|---|
| Not applicable | — | — | — | — |
Because there are currently no online payments, no information is provided to payment service providers (including a Merchant of Record for international payments). If payments are introduced, the Company will amend this Privacy Policy and obtain any required consent.
Article 7 (Destruction of Personal Information)
- Personal information is destroyed without delay once the retention period ends or the purpose has been achieved.
- Electronic files are deleted in a manner that makes them unrecoverable, and paper documents are shredded or incinerated.
- After membership withdrawal, information is kept for 30 days to allow recovery in case of accidental withdrawal, and then destroyed. Records required by law are stored separately for the periods in Article 1.
Article 8 (Cookies and Other Automatic Collection Tools)
- The Service uses essential cookies (or browser storage) to keep you signed in to the console.
- The Service does not use visitor analytics or advertising tracking tools.
- You can refuse cookies in your browser settings. If you refuse essential cookies, you will not stay signed in.
- Chrome: Settings → Privacy and security → Third-party cookies
- Safari: Settings → Privacy
Article 9 (Children Under 14)
The Service does not accept sign-ups from children under the age of 14. If a user is found to be under 14, the account will be deleted without delay.
Article 10 (Rights of Data Subjects and How to Exercise Them)
- Data subjects may at any time request access to, correction or deletion of, suspension of processing of, withdrawal of consent for, or transmission of their personal information.
- You can do this yourself in the Service's account settings, or by emailing ben@hyperreality.gg; requests are handled within 10 days.
- Rights may also be exercised through an agent (a legal representative or an authorized person). In that case, a power of attorney must be submitted.
- Deletion cannot be requested for information that other laws require to be retained.
Article 11 (Automated Decisions)
The Company does not make decisions that significantly affect data subjects' rights or obligations in a fully automated manner. When an account is restricted through fraud detection, a person reviews it.
Article 12 (Security Measures)
- Administrative: an internal management plan, minimizing personnel with access (role-based access control), regular reviews
- Technical: access control, encryption in transit (HTTPS), one-way encryption of passwords, encrypted storage of external credentials registered by Customers and of re-retrievable tokens, Access Token authentication via hash lookup, retention of audit logs
- Physical: access control to servers and data storage locations
Article 13 (Chief Privacy Officer)
- Chief Privacy Officer: Juyoung Kang (CEO)
- Email: ben@hyperreality.gg
- Phone: +82-507-0178-7546
Article 14 (Remedies for Infringement)
If you need counseling or dispute resolution regarding infringement of personal information, you can contact the following organizations (Korea).
- Personal Information Infringement Report Center (Korea Internet & Security Agency): privacy.kisa.or.kr / 118 (in Korea)
- Personal Information Dispute Mediation Committee: www.kopico.go.kr / 1833-6972
- Supreme Prosecutors' Office Cyber Investigation Division: www.spo.go.kr / 1301 (in Korea)
- Korean National Police Agency Cyber Bureau: ecrm.police.go.kr / 182 (in Korea)
Article 15 (Changes to This Privacy Policy)
- This Privacy Policy takes effect on 2026-10-12.
- If the content changes, the Company will give notice on the Service 7 days before it takes effect. Changes that materially affect data subjects' rights, such as adding collected items or providing information to third parties, will be announced 30 days in advance, and consent will be obtained again where necessary.
- Previous versions of this Privacy Policy are available under "Previous versions" at the bottom of this page.