BuronAI Privacy Policy

Effective Date: March 1, 2026

BURON LABS Co., Ltd. (“Company”) establishes and discloses this Privacy Policy to protect the personal information of users and to handle related complaints promptly and smoothly, in accordance with applicable laws.

Article 1 (Purpose of Processing Personal Information)

The Company processes personal information for the following purposes:

• Member registration and management: identity verification, membership maintenance, prevention of unauthorized use
• Service provision: AI-based content creation, video editing, SNS upload via BuronAI platform
• Payment and settlement: billing, settlement, and refunds for paid services
• Marketing and advertising: providing event and promotional information (with optional consent)
• Complaint handling: inquiry confirmation, fact-finding, and notification of results

Article 2 (Personal Information Collected)

• Required: Email, password (excluding social login), nickname
• Social login: Account identifier, email, profile image
• Auto-generated: IP address, access logs, cookies, usage history, device information
• Payment: Processed via payment gateway (not stored directly by the Company)
• SNS integration: OAuth tokens and account identifier (channel/username). Additional data collected and stored per platform (display name, profile image, etc.) follows the table in Article 2-A.

Article 2-A (SNS OAuth Permission Scopes)

The Company requests the following OAuth permissions when you use Multi Publisher, Comment Center and Insights. Data accessed is used solely for the purposes listed below.

Data accessed via these OAuth scopes is used solely to provide the Multi Publisher feature. It is never sold, used for advertising, or shared with third parties.

BuronAI complies with the developer policies of each integrated platform:

• Google API Services User Data Policy (including the Limited Use requirements)
• Meta Platform Terms
• TikTok for Developers Terms of Service
• X Developer Agreement and Policy
• Pinterest Developer Guidelines

Article 2-B (Deletion of SNS Integration Data)

Data collected through the Multi Publisher feature (OAuth access tokens and account information — the scope collected and stored per platform follows the table in Article 2-A) can be deleted immediately using any of the following methods:

• In-app deletion: Log in to BuronAI → Multi Publisher → click the [Disconnect] button at the bottom of the connected SNS account card. All tokens and account data for that platform are deleted immediately.
• Email request: Send a deletion request to [email protected]. The Company will process it within 3 business days.
• Via Meta platform: Facebook Settings → Apps and Websites → Remove BuronAI. This will delete all associated Facebook, Instagram, and Threads tokens and account data.
• Via Pinterest: Pinterest Settings → Security → Connected apps, where you can revoke BuronAI's access directly. Clicking [Disconnect] in Multi Publisher immediately deletes the stored token and account identifier (username). For Pinterest, profile picture and display name are not stored and are fetched live for display only.

After disconnecting, upload functionality to that SNS will be disabled. Upload history records may be retained for the period specified in Article 3 for service improvement purposes.

Article 2-C (Processing of Third-Party Data such as Commenters)

Because the Comment Center collects comments left on a member's channels, it necessarily includes information about third parties (commenters) who are not members of BuronAI. Such information is processed only within the scope made available by each platform, and only for the purpose of helping the member manage their own channel.

• Data collected: platform account ID, username, profile image URL, comment or message text, timestamp, and a link to the original post
• Purpose: displaying the member's unified inbox and sending replies the member composes
• Retention: retained while the member uses the service, and destroyed immediately upon a deletion request as described below
• Deletion requests: both the member and the commenter themselves may request deletion at [email protected]. Requests are processed within 3 business days.

If the original comment is later edited or deleted on the platform, the copy already collected is not updated automatically. Please use the channel above to request deletion.

Article 2-D (YouTube API Services Notice)

BuronAI uses YouTube API Services to upload videos to a member's own YouTube channel and to manage comments on those videos. By using this service, members are deemed to agree to the YouTube Terms of Service.

• YouTube Terms of Service
• Google Privacy Policy
• Google security settings — manage or revoke third-party app access

Members may revoke BuronAI's access to their YouTube data at any time through the Google security settings page above, or by clicking [Disconnect] on the Multi Publisher screen in the BuronAI app. Once a revocation is confirmed, BuronAI deletes that member's YouTube data promptly and within 7 days.

Data obtained through the YouTube API (video information, comment text, commenter channel names, and the like) is deleted or refreshed within 30 days of collection, in accordance with the YouTube API Services Terms of Service. Members may request deletion of this data at [email protected]; such requests are processed within 7 days.

Article 3 (Retention Period)

• Member information: until withdrawal (except as required by law)
• E-commerce records: 5 years for contracts/cancellations, 5 years for payments, 3 years for disputes
• Access logs: 3 months (pursuant to applicable law)

Article 4 (Disclosure to Third Parties)

Personal information is not provided to third parties without legal basis or user consent.

Article 5 (Entrusted Processing)

Article 6 (User Rights)

Users may request access, correction, deletion, or suspension of processing via email ([email protected]). The Company will respond without delay.

Article 7 (Destruction)

Personal information is destroyed without delay upon expiration of the retention period. Electronic files are deleted using methods that prevent recovery.

Article 8 (Security Measures)

• Administrative: internal management plan, minimized access by personnel, staff training
• Technical: access control, encryption, security software
• Physical: access control to server rooms and data storage facilities

Article 9 (Cookies)

The Company uses cookies to provide personalized services. Users may refuse cookies via browser settings, though some services may be restricted as a result.

Article 10 (Privacy Officer)

Article 11 (Remedies)

For privacy-related complaints, users may contact the Company or the relevant data protection authority in their jurisdiction.

Article 12 (Changes)

This policy is effective from March 1, 2026. Users will be notified at least 7 days before any changes take effect.