Privacy Policy
English reference translation · Version 1.4
Effective Date: August 5, 2026
This English version is provided for reference only. The Korean version is the official document and prevails in case of any discrepancy.
Read the official Korean version (한국어 원문)
The Korean version has been updated (version 1.3). This translation reflects version 1.4 and may be out of date.
WITIM Privacy Policy
Introduction
3W Inc. (the "Company") establishes and discloses this Privacy Policy in accordance with Article 30 of the Personal Information Protection Act (개인정보 보호법) in order to inform data subjects of the procedures and standards for processing personal information and to handle related grievances promptly.
Scope of This Policy
This Policy describes separately each of the two roles in which the Company processes personal information.
Role as a personal information controller — where the Company itself determines the purposes and methods of collecting personal information
Role as a personal information processor — where the Company processes personal information entrusted to it by a client company (legal entity)
Applicability
Where the Company is the controller:
When you sign up for and use the WITIM service
When you apply for a free trial or demo
When you request a consultation or make an inquiry about the Service
When you visit the website
Where the Company is the processor:
Personal information of Members managed by client companies using the WITIM HR platform
Personal information processed using the WITIM attendance and payroll management service
Personal information processed through the WITIM chat and collaboration services
Personal information processed through the WITIM AI Agent ("AI TIMI") service
The controller of such personal information is the client company, and data subjects may exercise their rights, such as access to, correction of, and deletion of personal information, against the company they belong to (the client company). Please refer to Article 3 for details of the processing performed as a processor.
Exclusions
Third-party services provided through business partnerships or linked services within the WITIM platform
Personal information that is anonymized in accordance with applicable laws
Chapter 1: Processing of Personal Information as a Personal Information Controller
Article 1 (Processing of Personal Information for the Performance of Contracts)
In order to provide the Service and perform contracts, the Company processes the following personal information without the separate consent of data subjects in accordance with Article 15(1)4 of the Personal Information Protection Act.
WITIM Sign-up and Use of the Service
Items processed: (Required) name, email address, password, company name, mobile phone number
Purposes of processing: identification of users, provision of the Service, account management
Retention period: until withdrawal from membership or termination of the service agreement by the Company
Identity Verification (KCP PASS)
Items processed: (Required) mobile phone number, CI (connecting information), mobile carrier, date of birth, gender
Purposes of processing: identity verification, confirmation of age 14 or older, prevention of multiple account registrations
Retention period: 30 days after withdrawal from membership
Information Collected When Linking a Google Account
Items processed: Google profile information (name, email address, profile photo), and data necessary to create Google Meet links through the Google Calendar API
Purposes of processing: identification and authentication of users through social login, automatic creation of Google Meet meeting links
Retention period: until the user disconnects the Google integration, withdraws from membership, or the Company terminates the service agreement
※ The Company does not read or store calendar data from Google Calendar and calls the API solely for the purpose of creating Meet links.
Essential Service Operation Notices
Items processed: (Required) name, email address, mobile phone number
Purposes of processing: essential notices, such as changes to the Terms, service outages, and transaction notices regarding payments, subscriptions, refunds, etc.
Retention period: until the user opts out, withdraws consent, or withdraws from membership, or the Company terminates the service agreement
Payment and Refunds for Paid Services
Items processed: (Required) payment method identification information (card issuer name, approval number, etc., processed through the payment gateway provider), payment and refund history, subscription status
Purposes of processing: payment for paid services and recurring payments (automatic renewal), processing of refunds, transaction notices regarding payments, subscriptions, refunds, etc.
Retention period: records of contracts and withdrawals of offers and records of payments, 5 years under the Act on the Consumer Protection in Electronic Commerce, Etc. (전자상거래법, the "E-Commerce Act") (Article 4)
※ The Company does not directly store payment information such as card numbers; the payment gateway provider (PG) processes it securely in accordance with the Electronic Financial Transactions Act (전자금융거래법) and other laws.
Customer Consultation and Inquiry Handling
Items processed: (Required) name, email address, company name, mobile phone number, inquiry details
Purposes of processing: handling consultations, responding to complaints, service improvement
Retention period: 3 years from the date the consultation is completed
Collection of Feedback on Use of the Service
Items processed: (Optional) user identifier, feedback category, free-text input, app version at the time of response
Purposes of processing: service improvement and gathering user opinions, and replying where an individual response is deemed necessary
Retention period: 12 months from the date of collection
※ Free-text input may contain personal information; in that case, it is destroyed without delay once the purpose of collection has been achieved or the retention period has expired.
Information Collected Automatically During Use of the Service
Items processed: access IP, access logs, cookies, service usage records, device information (OS, browser type, etc.)
Purposes of processing: usage statistics, prevention of fraudulent use, service improvement
Retention period: until withdrawal from membership or termination of the service agreement by the Company (access logs: 3 months under the Protection of Communications Secrets Act, 통신비밀보호법)
Article 2 (Personal Information Processed with the Consent of Data Subjects)
The Company processes personal information for the following purposes, and data subjects may refuse to consent. However, if consent is refused, use of the related services may be restricted.
Management of Free Trial and Demo Applicants
Items processed: (Required) company name, number of employees, name of the person in charge, email address, mobile phone number, job role
Purposes of processing: providing free trials, supporting adoption consultations
Retention period: 1 year after the free trial expires. Data subjects may request immediate destruction through the contact details in Article 12.
Receipt of Marketing and Advertising Information
Items processed: (Optional) name, email address, mobile phone number
Purposes of processing: information on new features, promotions, and events
Retention period: until consent is withdrawn. The Company confirms the consent with the data subject every 2 years from the date on which consent to the transmission of advertising information was obtained.
Consent to receive advertising information is obtained collectively, covering all transmission channels, including email, SMS/AlimTalk, and app push notifications, and a data subject who consents will receive advertising information through all of the above channels. Consent may be withdrawn at any time through the My Page settings or the opt-out method included in the advertising information received, and upon withdrawal, transmission of advertising information through all channels stops.
Chapter 2: Processing of Personal Information as a Personal Information Processor
Article 3 (Processing of Personal Information as a Processor)
Where a client company (legal entity) is the personal information controller, the Company processes personal information as a processor in accordance with Article 26 of the Personal Information Protection Act, as follows.
Scope of Entrusted Work
HR Platform Service (Human Resources Management)
Entrusting party: each client company (legal entity using the WITIM HR platform)
Entrusted work: provision and operation of the HR platform system, storage and management of HR information, maintenance and technical support
Items processed: Member name, email, mobile phone number, department, position, job role, employee number, hire date, departure date, etc.
Retention period: until the service agreement with the client company ends
Attendance and Payroll Management Service
Entrusting party: each client company (legal entity using the WITIM attendance and payroll service)
Entrusted work: management of clock-in/clock-out records, calculation of working hours, payroll calculation and pay statement management
Items processed: Member name, employee number, attendance information (clock-in/clock-out, annual leave), payroll information (base salary, allowances, deductions, etc.)
Retention period: until the service agreement with the client company ends
Chat/Messenger and File Sharing/Collaboration Services
Entrusting party: each client company (legal entity using the WITIM chat and collaboration services)
Entrusted work: transmission and storage of messages, uploading and sharing of files, maintenance and technical support
Items processed: Member name, account information, chat messages, uploaded files, etc.
Retention period: until the service agreement with the client company ends
AI Agent ("AI TIMI") Service
Entrusting party: each client company (legal entity using the WITIM AI Agent)
Entrusted work: summarizing conversations and documents, search and question answering based on workspace data, suggesting draft replies, creating, classifying, and recommending schedules and tasks, transcription (speech-to-text) and summarization of meeting recordings, generating work reports
Items processed: the conversation, document, and work data on which a Member ran the AI Agent, the request entered by the Member, meeting audio and transcribed text, AI Outputs, conversation history with the AI Agent, and author and attendee display information
Retention period: until the service agreement with the client company ends. However, conversation history with the AI Agent is retained until the earliest of the Member's deletion request, deletion of the Member's account, the Member's withdrawal from the workspace, or the end of the service agreement with the client company.
※ Conversation history with the AI Agent is stored in the AI agent system operated directly by the Company, and the Company does not use it for any purpose other than providing the Service. This is not an entrustment to an external business operator; only the data within the scope necessary for processing is transmitted to external AI processors in accordance with Articles 6 and 8, and that data is deleted immediately afterwards.
※ The specific items processed may vary depending on the client company's scope of service use and settings.
Sub-entrustment Resulting from Use of the AI Agent
When the AI Agent is run, the above data is transmitted to the Company's AI processors (see Articles 6 and 8) to the extent necessary for processing. This constitutes sub-entrustment under Article 26 of the Personal Information Protection Act.
The Super Admin who creates and manages a workspace is deemed to have consented to such sub-entrustment by agreeing to the Terms of Service (Article 5-2) and this Policy.
When sub-entrusting, the Company implements the protective measures required under the same Act (prohibition on processing for other purposes, technical and administrative protective measures, management and supervision, etc.), and if an AI processor changes, the Company discloses this without delay through this Policy.
AI processors delete the relevant data immediately after carrying out the Company's processing request and do not use it for any other purpose, such as training their own models.
Destruction of Personal Information
When the service agreement with a client company ends, the Company retains the data for 30 days and then destroys it, or returns it at the client company's request.
Upon a request for immediate deletion, the Company destroys the data within a reasonable period.
Data in backup systems is completely deleted within 90 days at most, according to the backup cycle.
Information that is subject to a statutory retention obligation is retained for the relevant period.
Obligations as a Processor
The Company complies with the following obligations in accordance with Article 26 of the Personal Information Protection Act.
The Company does not use personal information beyond the scope of the entrusted work or provide it to third parties.
Technical measures: access rights management, encryption (in transit and at rest), operation of security programs, retention of access records and prevention of their forgery or alteration
Administrative measures: establishment of an internal management plan, training of personal information handlers at least once a year, periodic review of access rights, immediate revocation of the rights of departing employees
Physical measures: access control for computer rooms, secure storage of auxiliary storage media
In the event of a leak incident, the Company notifies the client company within 24 hours and establishes measures to prevent recurrence.
Exercise of the Rights of Data Subjects
The procedure for exercising rights with respect to personal information processed by the Company as a processor is as follows.
Submit a request to the HR manager or administrator of the company you belong to (the client company).
If it is difficult to exercise your rights through the client company, contact the Company's grievance handling department (Article 12), and the Company will provide guidance in cooperation with the client company.
Requests are processed within 10 days of receipt, and this period may be extended by 10 days in unavoidable circumstances (with notice of the reason).
Information for Client Companies
Under Article 26 of the Personal Information Protection Act, client companies are obligated to train, manage, and supervise their processors. The Company actively cooperates with the management and supervision of client companies and, where necessary, provides processing status reports, the status of implementation of safety measures, the status of access rights management, etc.
Chapter 3: General Provisions
Article 4 (Retention of Personal Information Under Laws)
Where retention is required under relevant laws, personal information is retained as follows.
Records on contracts or withdrawal of offers: 5 years (E-Commerce Act)
Records on the handling of consumer complaints or disputes: 3 years (E-Commerce Act)
Records on labeling and advertising: 6 months (E-Commerce Act)
Records of all transactions prescribed by tax laws: 5 years (Framework Act on National Taxes, 국세기본법)
Service usage records, access logs, and access IP information: 3 months (Protection of Communications Secrets Act)
Article 5 (Processing of Pseudonymized Information)
In accordance with Article 28-2 of the Personal Information Protection Act, the Company may pseudonymize collected personal information so that specific individuals cannot be identified, and use it for purposes such as service improvement, analysis of HR industry trends, and compiling statistics.
Items processed: company information (size, industry, etc.), Member information (job role, position, organization name, etc.), service usage information (work, payroll, chat usage patterns, etc.)
Retention period: until the purpose of processing is achieved
Pseudonymized information is stored and managed separately from additional information, and protective measures such as separation of access rights are taken.
Under Article 28-7 of the Personal Information Protection Act, rights such as access, correction, deletion, and suspension of processing are restricted. However, where the processing of pseudonymized information clearly infringes the rights of a data subject, the data subject may request that its use be stopped or that it be destroyed.
Article 6 (Entrustment of Personal Information Processing)
The Company entrusts the processing of personal information as follows in order to provide the Service.
Domestic Processors
Processor | Details of entrusted work |
|---|---|
NAVER Cloud Corp. (NAVER Cloud Platform, Seoul region) | Provision of cloud computing, server hosting, data storage and management, infrastructure operation |
Amazon Web Services (AWS Seoul region) | Provision of external file storage |
Aligo (주식회사 알리는사람들) | Sending SMS (verification codes and transaction notices regarding payments, subscriptions, refunds, etc.) and KakaoTalk AlimTalk messages |
KG Inicis Co., Ltd. (주식회사 케이지이니시스) | Processing of payments, recurring payments (automatic renewal), and refunds for paid services |
NHN KCP Corp. (엔에이치엔케이씨피 주식회사) | Identity verification (PASS) processing — mobile phone identity verification, issuance of CI (connecting information), confirmation of date of birth and gender |
Returnzero Inc. (VITO, 주식회사 리턴제로) | Meeting audio transcription and speaker diarization (speech-to-text) |
Overseas Processors
Processor | Details of entrusted work | Country of transfer |
|---|---|---|
Twilio SendGrid | Sending service-related emails (verification, notifications, etc.) | United States |
Google LLC (Firebase Cloud Messaging) | Sending web and mobile push notifications | United States |
Apple Inc. (APNs) | Sending iOS push notifications | United States |
Sentry (Functional Software, Inc.) | Application error tracking and performance monitoring | United States |
Google LLC (Gemini) | AI Agent processing (summarizing conversations and documents, data search and question answering, reply suggestions, creating and classifying schedules and tasks, meeting summaries, generating work reports, etc.) | United States |
OpenAI, L.L.C. | AI Agent processing (summarizing conversations and documents, reply suggestions, creating and classifying schedules and tasks, generating work reports, etc.) | United States |
Anthropic PBC | AI Agent processing (meeting summaries, etc.) and substitute processing in the event of a failure of another AI processor | United States |
Cloudflare, Inc. (R2) | External file storage | United States |
※ To ensure the quality and stability of AI features, the Company selects some of the above AI processors (Google LLC, OpenAI, Anthropic PBC) for processing, and the processors actually used may vary by feature and over time. If the processors used are changed or added, the Company discloses this without delay through this Policy.
When concluding an entrustment contract, the Company specifies in the contract, in accordance with Article 26 of the Personal Information Protection Act, the prohibition on processing for other purposes, technical and administrative protective measures, restrictions on sub-entrustment, etc., and regularly manages and supervises processors so that they process personal information safely. If a processor changes, the Company discloses this without delay through this Policy.
Article 7 (Provision of Personal Information to Third Parties)
As a rule, the Company does not provide personal information to third parties without the consent of the data subject. However, exceptions apply where the data subject has consented in advance, where there is a request from relevant authorities under laws, and where information is provided for statistical or research purposes in a form that cannot identify a specific individual.
If provision to a third party occurs in the future, the Company will specify the recipient, purpose, items, and retention period in this Policy and obtain the consent of the data subject.
Article 8 (Overseas Transfer of Personal Information)
The Company transfers personal information overseas as follows in order to provide the Service. Under Articles 28-8 and 28-9 of the Personal Information Protection Act, data subjects may refuse to consent to the overseas transfer; however, if they refuse, use of some or all of the Service may be restricted.
Recipient | Country of transfer | Purpose of transfer | Items transferred | Time and method of transfer | Retention and use period |
|---|---|---|---|---|---|
Twilio SendGrid | United States | Sending service-related emails (verification, notifications, etc.) | Email address, name | Transferred through encrypted communication (TLS/SSL) at the time an email is sent | Until the entrustment contract ends |
Google LLC (Firebase Cloud Messaging) | United States | Sending web and mobile push notifications | Device token, notification content | Transferred through encrypted communication (TLS/SSL) at the time a push notification is sent | Until the entrustment contract ends |
Apple Inc. (APNs) | United States | Sending iOS push notifications | Device token, notification content | Transferred through encrypted communication (TLS/SSL) at the time a push notification is sent | Until the entrustment contract ends |
Sentry (Functional Software, Inc.) | United States | Application error tracking and performance monitoring | Access IP, device information, user identifier, data being processed when an error occurs | Transferred through encrypted communication (TLS/SSL) at the time an error occurs | Until the entrustment contract ends |
Google LLC (Gemini) | United States | AI Agent processing (summarizing conversations and documents, data search and question answering, reply suggestions, creating and classifying schedules and tasks, meeting summaries, generating work reports, etc.) | Content that may include the conversation, document, and work data on which a Member ran the AI Agent, the request entered by the Member, meeting transcript text, and author and attendee information | Transferred through encrypted communication (TLS/SSL) at the time of an AI processing request | Deleted immediately after processing (not stored beyond processing the request and not used for model training) |
OpenAI, L.L.C. | United States | AI Agent processing (summarizing conversations and documents, reply suggestions, creating and classifying schedules and tasks, generating work reports, etc.) | Content that may include the conversation, document, and work data on which a Member ran the AI Agent, the request entered by the Member, and author information | Transferred through encrypted communication (TLS/SSL) at the time of an AI processing request | Deleted immediately after processing (not stored beyond processing the request and not used for model training) |
Anthropic PBC | United States | AI Agent processing (meeting summaries, etc.) and substitute processing in the event of a failure of another AI processor | Content that may include meeting transcript text and meeting content, the data on which a Member ran the AI Agent, and attendee and author information | Transferred through encrypted communication (TLS/SSL) at the time of an AI processing request | Deleted immediately after processing (not stored beyond processing the request and not used for model training) |
Cloudflare, Inc. (R2) | United States | External file storage | Files uploaded by Customers and Members, file metadata | Transferred through encrypted communication (TLS/SSL) at the time a file is uploaded | Until the entrustment contract ends |
When transferring personal information overseas, the Company transmits it through encrypted communication (TLS/SSL) and, through contracts concluded with the recipients, ensures that technical and administrative measures for the protection of personal information, grievance handling procedures, etc. are implemented. Data subjects may withdraw their consent to the overseas transfer through the contact details in Article 12 of this Policy.
Article 9 (Destruction of Personal Information)
① The Company destroys personal information without delay when it becomes unnecessary, such as when the retention period has expired or the purpose of processing has been achieved.
② The Company selects the personal information for which a reason for destruction has arisen and destroys it after review by the Chief Privacy Officer.
③ Electronic files are permanently deleted using methods that make restoration impossible, and paper documents are shredded or incinerated.
④ Upon termination of the service agreement, data is retained for 30 days and then destroyed, and upon a request for immediate deletion, it is destroyed within a reasonable period. Backup data is completely deleted within 90 days at most. Information that is subject to a statutory retention obligation is retained in accordance with Article 4.
⑤ Conversation history with the AI Agent is stored in the AI agent system operated directly by the Company and is destroyed without delay upon the Member's deletion request, deletion of the Member's account, the Member's withdrawal from the workspace, or termination of the service agreement. Members may request the deletion of their conversation history in accordance with Article 10.
Article 10 (Rights of Data Subjects and How to Exercise Them)
Data subjects may at any time request the Company to provide access to, correct or delete, suspend the processing of, or transmit their personal information.
How to exercise rights
Where the Company is the controller: submit a request directly through the in-service settings, by email, or through the customer center
Where the Company is the processor: submit a request to the HR manager or administrator of the client company you belong to. If it is difficult to exercise your rights through the client company, you may contact the Company directly
Requests are processed within 10 days of receipt, and this period may be extended by 10 days in unavoidable circumstances (with notice of the reason). Rights may also be exercised through a legal representative or a person delegated by the data subject, in which case a power of attorney in the form of Annex Form No. 11 of the Enforcement Rule of the Personal Information Protection Act (개인정보 보호법 시행규칙) must be submitted.
When a data subject exercises their rights, the Company may carry out procedures such as email verification or identity verification (PASS verification) to confirm that the request is made by the data subject.
The Company may refuse a request in the following cases and, if it refuses, notifies the data subject of the reason without delay.
Where specifically provided by law or where unavoidable to comply with statutory obligations
Where there is a risk of harming the life or body of another person or of unfairly infringing the property or other rights of another person
Where there is a risk of significantly harming legitimate interests, such as where performance of the service contract would become difficult
Article 11 (Measures to Ensure the Security of Personal Information)
The Company takes the following measures to ensure the security of personal information.
Administrative measures: establishment and implementation of an internal management plan, designation of a Chief Privacy Officer, operation of a dedicated organization, training of personal information handlers at least once a year, immediate revocation of the access rights of departing employees and employees whose duties have changed
Technical measures: access rights management, encryption of personal information (in transit: TLS/SSL; at rest: AES-256, etc.), installation and updating of security programs, retention of access records (for at least 1 year) and prevention of their forgery or alteration, monitoring of access records, workspace-level access isolation during AI processing
Physical measures: access control for computer rooms and data storage rooms, secure storage of documents and auxiliary storage media containing personal information
Article 12 (Chief Privacy Officer)
The Company designates a Chief Privacy Officer as follows to take overall responsibility for work related to the processing of personal information and to handle complaints and provide remedies for damages of data subjects.
Name: Dongeun Cheon
Position: CTO (Chief Technology Officer)
Department: Technology Team
Contact: info@3w.ai.kr
You may direct all inquiries, complaints, and requests for remedies regarding personal information that arise while using the Service to the above contact.
Article 13 (Remedies for Infringement of Rights)
If you need a remedy for an infringement of personal information, you may seek consultation from or file an application with the following organizations.
Personal Information Dispute Mediation Committee: 1833-6972 / www.kopico.go.kr
Personal Information Infringement Report Center: 118 / privacy.kisa.or.kr
Cyber Investigation Division, Supreme Prosecutors' Office: 1301 / www.spo.go.kr
Cyber Investigation Bureau, Korean National Police Agency: 182 / ecrm.cyber.go.kr
Article 14 (Cookies)
① The Company uses cookies to keep users logged in, analyze usage patterns, and improve the Service.
② Users may refuse the storage of cookies through their web browser settings. However, if cookies are refused, some features, such as staying logged in, may be limited.
Chrome: Settings > Privacy and security > Cookies and other site data
Safari: Preferences > Privacy > Manage cookies and website data
Edge: Settings > Cookies and site permissions > Cookies and site data
Article 15 (Collection, Use, and Refusal of Behavioral Information)
① The Company may collect behavioral information of data subjects in order to analyze service usage, provide customized services, and improve the Service.
② The behavioral information collected by the Company consists of records of activity within the Service, frequency of use, information on the devices used for access, page visit records, etc.
③ Behavioral information is collected automatically at the time the Service is used and is destroyed without delay when the purpose of collection is achieved or the data subject refuses its collection.
④ Data subjects may refuse the collection of behavioral information by changing the cookie settings of their web browser, resetting the advertising identifier of their mobile device (Google Advertising ID, Apple IDFA), etc.
⑤ The Company does not currently collect behavioral information for advertising purposes through third-party behavioral information collection tools. If such collection is introduced in the future, the Company will give prior notice through this Policy.
Article 16 (Processing of Location Information)
① The Company provides location-based features, such as clock-in/clock-out records, through its mobile application, and collects and uses location information with the consent of data subjects in accordance with the Act on the Protection, Use, Etc. of Location Information (위치정보의 보호 및 이용 등에 관한 법률).
② The purposes of collecting and using location information are limited to the service features provided by the Company, such as clock-in/clock-out records, attendance management, and location-based authentication, and location information is not used for any other purpose.
③ Data subjects may withdraw their consent to the collection of location information at any time through the settings of their mobile device or the in-app settings. However, use of location-based features may be restricted if consent is withdrawn.
④ The Company takes technical and administrative protective measures for the safe processing of location information in accordance with the Act on the Protection, Use, Etc. of Location Information and other applicable laws. Details regarding the processing of location information are as set forth in this Policy.
Article 16-2 (Notice of Mobile App Access Permissions)
The Company uses the following device permissions in its mobile applications (iOS / Android). Each permission is requested only when the related feature is used, and even if a permission is denied, there is no restriction on the use of the Service other than the relevant feature.
Location (ACCESS_FINE_LOCATION / ACCESS_COARSE_LOCATION / ACCESS_BACKGROUND_LOCATION): Used for clock-in/clock-out records, attendance management, location-based automatic check-in/check-out, and detection of entering/leaving the workplace. Background location is used only when the automatic attendance feature is enabled and is not collected when that feature is turned off.
Address book / Contacts (READ_CONTACTS): Accessed in order to send, as a message, the contacts that the user selects directly when using the "Share contact" feature on the chat screen. Contact information is not transmitted to or stored on the Company's servers, and only the contacts that the user chooses to share are delivered to the other party in the conversation.
Notifications (POST_NOTIFICATIONS): Used to send push notifications such as chat messages, attendance alerts, and announcements.
Photos / Media (READ_MEDIA_IMAGES / READ_MEDIA_VIDEO / READ_EXTERNAL_STORAGE): Used to read media selected directly by the user when attaching photos or videos to chat messages or changing a profile photo.
Wi-Fi state (ACCESS_WIFI_STATE / CHANGE_WIFI_STATE): Used for the automatic attendance verification feature based on workplace Wi-Fi.
Background execution (FOREGROUND_SERVICE / FOREGROUND_SERVICE_LOCATION / WAKE_LOCK / RECEIVE_BOOT_COMPLETED / SCHEDULE_EXACT_ALARM / REQUEST_IGNORE_BATTERY_OPTIMIZATIONS): Used for the stable operation of background attendance features, such as automatic clock-out reminders, detection of entering/leaving the workplace, and restoring the attendance service after the device restarts.
Vibration (VIBRATE): Used to make the device vibrate when a notification is received.
All permissions can be revoked at any time in the operating system settings or the in-app settings. Information on the features restricted by revoking a permission is available through in-app guidance.
Article 17 (Processing of Personal Information Through the API)
① The Company plans to provide, in the future, an API (Application Programming Interface) so that Customers can use WITIM in their own applications, programs, or websites.
② The items, purposes of processing, retention periods, etc. of personal information processed through the API are the same as the scope of processing under Articles 1 and 3 of this Policy. The Company does not collect any separate additional personal information through the API.
③ With respect to the processing of personal information occurring in external services developed and operated by a Customer using the API, the relevant Customer bears responsibility as the personal information controller.
Article 18 (Restrictions on the Use of Google API Data)
With respect to the use of user data received through Google APIs and its transfer to other apps, the Company complies with the Google API Services User Data Policy and meets the Limited Use requirements.
① The Company uses data received through Google APIs only for the purpose of providing and improving the features of the WITIM service.
② The Company does not sell data received through Google APIs to third parties.
③ The Company does not use data received through Google APIs for serving advertisements or for ad targeting.
④ The Company does not transfer data received through Google APIs to other services unless the user has explicitly consented.
⑤ The Company does not allow humans to read Google user data in a manner that is not visible to the user, except in the following cases.
Where explicit consent has been obtained from the user
Where necessary for security purposes (e.g., investigating abuse)
Where necessary to comply with applicable laws
Where the Company's data is anonymized and used for internal operational purposes
⑥ Users may revoke WITIM's access to their Google account at any time through their Google Account settings (https://myaccount.google.com/permissions), and may also request the Company directly to disconnect the integration and delete the related data.
Article 19 (Automated Decision-Making)
① The Company does not currently operate automated decision-making (profiling, etc.) that has legal effects on, or significantly affects, data subjects. If such decision-making is introduced in the future, the Company will give prior notice through this Policy in accordance with Article 37-2 of the Personal Information Protection Act, and data subjects may exercise rights such as the right to refuse an automated decision, to request an explanation, and to request reprocessing by a human.
② Summaries, answers, recommendations, etc. generated by the AI Agent do not constitute automated decision-making that has legal effects on, or significantly affects, data subjects, and whether to adopt the results is decided directly by the Customer or Member.
Article 20 (Processing of Personal Information of Children Under 14)
The Company does not target children under 14 years of age and does not accept sign-ups from children under 14 years of age. The Company does not intentionally collect personal information of children under 14, and if it is confirmed during the sign-up process that the applicant is under 14, the Company refuses the sign-up. If it is confirmed that personal information of a child under 14 has been collected, the Company destroys that information without delay.
Article 21 (Handling of Dormant Accounts)
The Company plans to introduce, in the future, a policy of converting the accounts of Customers who have not accessed the Service for one year or more into dormant accounts. When the policy is introduced, the Company will notify Customers in advance at least 30 days before its effective date, and will provide details, such as the fact of conversion to dormancy, the scheduled conversion date, the personal information items to be converted, and how to reactivate a dormant account, through this Policy.
Article 22 (Changes to This Policy)
① This Policy applies from its effective date.
② This Policy may be revised in accordance with changes in laws, policies, or the Service. In the event of a change, the Company gives notice through the website or in-service announcements from 7 days before the effective date. Where there is a material change to the rights of data subjects, the Company gives notice 30 days in advance.
Company Information
Item | Details |
|---|---|
Company name | 3W Inc. (주식회사 쓰리더블유) |
Representative | Inhoe Hwang |
Business registration number | 858-87-03784 |
Mail-order sales registration number | 2026-Seoul Yeongdeungpo-1034 (제2026-서울영등포-1034호) |
Business address | Units 601-602, Yeongdeungpo D-State, 28 Seonyuseo-ro 25-gil, Yeongdeungpo-gu, Seoul, Republic of Korea |
Hosting provider | NAVER Cloud Corp. |
Contact email | cs@3w.ai.kr |
Addendum
This Privacy Policy takes effect on August 5, 2026.
Version | Effective date | Changes |
|---|---|---|
v1.0 | 2026. 04. 15 | Initial enactment |
v1.1 | 2026. 06. 04 | Added the "Collection of Feedback on Use of the Service" item to Article 1 (specifying the items collected following the introduction of the in-app feedback form); added Article 16-2 "Notice of Mobile App Access Permissions" |
v1.2 | 2026. 07. 07 | Changed the method of consent for "Receipt of Marketing and Advertising Information" under Article 2 to a single (collective) consent covering all transmission channels (including email, SMS, AlimTalk, and app push); specified that consent to receive such information can be withdrawn on My Page; deleted the statement in Article 22 on viewing previous versions of the Policy |
v1.3 | 2026. 07. 21 | Added the AI Agent service to the scope; newly established the entrusted work "AI Agent (AI TIMI) Service" and "Sub-entrustment Resulting from Use of the AI Agent" in Article 3 (specifying that conversation history is stored in the Company's own system and the basis for the Super Admin's consent to sub-entrustment); added OpenAI, L.L.C. to the overseas processors in Article 6, expanded the scope of the work entrusted to Google (Gemini) and Anthropic to AI Agent processing in general, and added a statement on the selection and change notification of AI processors; added OpenAI to the overseas transfer table in Article 8 and expanded the purposes and items of transfer (specifying that data is not used for model training); added Article 9⑤ on the destruction of AI conversation history; added workspace-level access isolation during AI processing to the technical measures in Article 11; specified in Article 19② whether AI Outputs constitute automated decision-making; specified the mail-order sales registration number in the company information |
v1.4 | 2026. 08. 05 | Reflected the introduction of paid services (AI Agent subscription) and identity verification: newly established the processing items "Payment and Refunds for Paid Services" and "Identity Verification (KCP PASS)" in Article 1; added "transaction notices regarding payments, subscriptions, refunds, etc." to the purposes of "Essential Service Operation Notices"; added Aligo (SMS and KakaoTalk AlimTalk), KG Inicis (payments), and NHN KCP (identity verification) as domestic processors in Article 6; specified the identity verification (PASS) procedure in Article 10 |
© 2026 WITIM. All rights reserved.