[POSTREAM] Privacy Policy
(Version 1.4.3 — 7th revision, effective August 5, 2026)
※ Voithru Inc. (the "Company") complies with the Personal Information Protection Act, the Act on Promotion of Information and Communications Network Utilization and Information Protection, and other applicable laws.
※ Where the Company amends this Privacy Policy, it will announce the changes on the service screen at least 7 days before the effective date (30 days for changes unfavorable to users or material changes).
1. Purpose of Collection and Use of Personal Data
- The Company complies with the Personal Information Protection Act and other applicable laws, and processes personal data within the following purposes.
- The Company processes personal data for the following purposes:
- Membership registration and management: verifying intent to register, account identification/authentication, blocking abusive members, customer support
- Service provision: video upload/publishing workflow execution, platform API integration, status notifications
- Connected Platform publishing: publishing to the user's own account/channel (YouTube, Instagram, TikTok, etc.), verifying publishing status, and transmitting AI-generated content labels
- Payment and refund processing: paid subscription payment, withdrawal, refund
- System operation and security: log analysis, abuse prevention, error monitoring
- Marketing and statistics (optional consent): new feature announcements, transmission of advertising information (email), usage statistics
2. Items Collected and Methods
- The Company collects the following personal data for registration, service applications, and support:
- Required: profile information (Google/TikTok/Instagram ID, channel/account name), email, password (encrypted), video metadata (filename, resolution, length, size), access IP, cookies and similar technologies (see Section 10), service usage records, payment information (for paid plans: card information (encrypted by Toss Payments), billing address)
- Connected Platform items: YouTube channel ID/name, uploaded video ID and publishing status, OAuth tokens (encrypted), video metadata (title/description/tags), AI-generated content label
- Optional: name, date of birth, gender, mobile number; with marketing consent, usage statistics and event participation history
- The Company collects personal data via web/app registration, account linking, customer inquiries, automatic collection tools, and events.
3. Retention and Use Period
- The Company destroys members' personal data without delay upon achievement of the collection/use purpose or expiry of the statutory retention period.
- The following is retained per statutory minimum retention periods:
| Data retained | Retention | Legal basis |
|---|
| Records on contracts or withdrawal of subscription | 5 years | Act on Consumer Protection in Electronic Commerce |
| Records on payment and supply of goods | 5 years | Act on Consumer Protection in Electronic Commerce |
| Records on consumer complaints or dispute handling | 3 years | Act on Consumer Protection in Electronic Commerce |
| Records on labeling/advertising | 6 months | Act on Consumer Protection in Electronic Commerce |
| Records on electronic financial transactions | 5 years | Electronic Financial Transactions Act |
| Website/app visit records | 3 months | Protection of Communications Secrets Act |
- Retention and destruction of Connected Platform data follow these standards: (i) original video files are destroyed within 24 hours after the upload completes; (ii) OAuth tokens are retained while the connection remains active; when the user disconnects the account or revokes access, the Company immediately invalidates the token so that it can no longer be used, and the stored token is destroyed in accordance with (v); (iii) data obtained through the YouTube API (channel identifiers and names, video identifiers, and the like) is retained for no longer than 30 calendar days, after which it is deleted or refreshed; (iv) the user’s service usage records (upload date and time, success or failure, and the title, description and privacy setting entered by the user) are retained while the user’s membership remains active; and (v) upon account deletion or a data-deletion request, the foregoing data is destroyed within 7 days.
4. Use and Third-Party Provision of Collected Personal Data
- The Company uses members' personal data within the scope notified under "Purpose of Collection and Use," and does not use it beyond this scope or provide it to third parties.
- To publish content to the user's own connected account/channel, videos and related metadata are transmitted to external platform APIs (YouTube, TikTok, Instagram, etc.). This constitutes publishing at the user's own direction and does not constitute provision to a third party; it is processed only within the scope consented to at the account-linking stage.
- To process paid-plan payments, information is provided to the following payment processor:
| Recipient | Purpose | Items | Retention |
|---|
| Toss Payments | Payment and refund processing | Card information (encrypted), email, billing address | 5 years after payment completion (Electronic Financial Transactions Act) |
- The Company does not transfer or disclose the user's information to third parties for any purpose beyond those stated in this Policy.
5. User Rights and How to Exercise Them
- A data subject may, at any time, exercise the rights to request access, correction, deletion, and suspension of processing of their personal data.
- When a member requests the exercise of rights in writing, by email, etc., the Company replies with the result within 10 days.
- The user may revoke Postream's access to their YouTube/Google data at any time on the Google security settings page (https://myaccount.google.com/connections?filters=3,4). The user may also request deletion of stored data at any time by using the "Delete Account" function on the POSTREAM website or by emailing 📧 ai.business@voithru.com; the Company then destroys the data in accordance with Section 6.
- Users may withdraw their consent to receive marketing/advertising information (email) at any time (opt-out). Withdrawal can be made by ① turning off "Marketing email consent" in Settings > Notifications within the service, or ② following the unsubscribe instructions at the bottom of any advertising email received. Upon withdrawal, the Company will cease sending advertising information without delay.
- In accordance with Article 50 of the Act on Promotion of Information and Communications Network Utilization and Information Protection (Korea), the Company sends advertising information only to users who have given prior consent, and marks such messages with an advertising indicator and unsubscribe instructions. Withdrawing consent does not affect use of the service, and essential service/transaction/security notifications are sent regardless of marketing consent.
6. Destruction Procedure and Method
- The Company destroys personal data without delay upon achievement of the processing purpose or the user's request. In particular, it provides a Meta (Instagram) disconnect function (Instagram app > Settings > Apps and Websites > POSTREAM > Remove); upon disconnection, the Company automatically stops accessing information provided by Meta.
- When the user uses the "Delete Account" function on the POSTREAM website or requests deletion by email (📧 ai.business@voithru.com), the Company begins destruction without delay: general personal data is destroyed immediately, while data related to Connected Platforms (e.g., YouTube/Google) is fully destroyed within 7 days, accounting for technical propagation delays.
- Electronic data is destroyed in an irrecoverable manner using secure technical methods; any printed documents are shredded or incinerated.
- Retention periods and deletion timelines for YouTube/Google connected data follow the standards in Section 3 (Retention and Use Period).
7. Data Protection Officer
Pursuant to Article 31(1) of the Personal Information Protection Act, the Company designates a Data Protection Officer who oversees personal-data processing.
- Name: Sangheon Lee (이상헌) / Title: Representative / Contact: 02‑6203‑4800, sangheon.lee@voithru.com
8. Personal Data Handling for YouTube and Google API
The Company uses YouTube API Services to publish the user's videos to the YouTube channel the user connects. In connection with such use, the Google Privacy Policy (http://www.google.com/policies/privacy) also applies.
- Data accessed/processed: YouTube channel ID/name, uploaded video ID and publishing status, OAuth tokens (encrypted at rest), video metadata, AI-generated content label.
- Purpose: publishing to the user's own channel and verifying status; transmitting AI-generated content labels to target platforms. The Company does not sell or share this data with third parties or use it for advertising.
- Retention/destruction: data obtained through the YouTube API is retained for no longer than 30 calendar days, after which it is deleted or refreshed. Upon disconnection or revocation of access, the token is immediately invalidated. Detailed standards follow Section 3 (Retention and Use Period).
- Revocation: the user may revoke access at any time on the Google security settings page (https://myaccount.google.com/connections?filters=3,4).
- Compliance with the Google API Services User Data Policy (Limited Use): Postream's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
9. Quick Upload File Handling
- Items processed: video files uploaded directly by the user and their metadata (thumbnail, caption, etc.).
- Purpose: publishing to Connected Platforms (Instagram, TikTok, etc.) and providing upload history.
- Retention/destruction: destroyed within 24 hours after publishing completes; deleted earlier upon the user's deletion request, account withdrawal, or handling of unlawful-content reports.
10. Cookies and Similar Technologies: Installation, Operation, and Refusal
- The Company stores, accesses, and recognizes cookies and similar technologies (local storage, session storage, pixels, software development kits (SDKs), and device or browser identifiers) on or from users' devices and browsers, for the purposes of providing the Service, maintaining sign-in state, security, usage analysis, and advertising performance measurement.
- The Company also allows the following third parties to store, access, and recognize cookies and similar technologies on or from users' devices and browsers. Each provider's processing of the information it collects is governed by that provider's own privacy policy.
- Users may refuse the storage of cookies. In the web browser settings (for example, Chrome > Settings > Privacy and security > Third-party cookies), a user may choose whether to allow cookies or delete cookies already stored. However, if a user refuses cookies that are essential to providing the Service, some functions such as sign-in may be unavailable.
- The Company does not use cookies or similar technologies to collect information from users' devices for any purpose other than those stated in this Policy.
11. Changes to this Privacy Policy
- This Policy takes effect on August 5, 2026. (The previous version (v1.4.2) applied from July 22, 2026 to August 4, 2026.)
- Any addition, deletion, or change to this Policy will be announced at least 7 days before it takes effect (30 days for changes unfavorable to users or material changes).