개인정보처리방침

디스틸은 dupy.app, studio.dupy.app 및 MCP 연결에서 아래와 같이 개인정보를 처리합니다. 결제 관련 정보는 구매·결제 확인·환불과 고객지원에 필요한 범위에서 처리합니다.

개인정보처리자와 연락처

디스틸 · 대표 및 개인정보 보호책임자: 박성일 · 사업자등록번호: 271-04-03553

• 이메일: help@dupy.app
• 고객센터 전화: 070-8065-1516
• 우편 문의: 디스틸, 서울특별시 강남구 테헤란로20길 18, 2층 8호(역삼동, 부봉빌딩)

수집 항목·목적·기간

• 로그인·계정 관리: Google이 검증한 이메일 또는 이메일 가입 정보, 비밀번호의 단방향 해시, 초대 내역, 서명된 로그인 쿠키를 처리합니다. 이메일 가입 비밀번호는 원문으로 보관하지 않으며 Google 비밀번호는 받지 않습니다. 계정·초대 정보는 탈퇴 또는 접근 권한 삭제까지, 세션은 최대 24시간 보관합니다.
• 콘텐츠 제작: 상품 링크, 제휴 링크, 상품 자료, 초안, 편집·저장 내역, 프로젝트와 사용자가 업로드한 이미지·영상·음성을 저장하고 제작·재열람·문의 대응에 사용합니다. 삭제 요청 또는 서비스 종료까지 보관합니다.
• 구독·결제: 결제자 이메일·이름·연락처, 주문번호, 상품·금액·결제일, 승인·취소 결과, 카드사와 마스킹 카드번호, 암호화한 빌링키, 월별 크레딧과 사용·복구 내역을 처리합니다. 카드 전체 번호·CVC·비밀번호는 dupy 서버에 저장하지 않습니다.
• 연결 계정: 사용자가 연결한 Instagram·Threads·YouTube·TikTok의 계정 또는 채널 식별자, 이름, 허용 범위, 암호화한 인증 토큰, 게시·업로드 설정 및 이력을 해당 기능 운영에 사용합니다. 연결 해제 시 인증 토큰을 삭제합니다. 이미 외부에 게시된 콘텐츠는 자동 삭제하지 않습니다.
• 내 Threads 게시물 조회: 연결한 사람이 직접 목록을 열면 본인이 작성한 게시물의 본문, 사진·동영상 링크, 게시일과 원문 링크를 Threads에서 가져와 표시합니다. 이 조회 화면은 해당 계정을 연결한 사람에게만 제공하며 다른 팀원에게 공유하지 않습니다. 조회한 본문·미디어는 dupy 데이터베이스에 저장하지 않고, 이 조회 기능에서 생성 AI로 전송하지 않습니다. 연결을 해제하면 이후 조회를 중단합니다.
• 쿠팡파트너스 API 연결: 선택적으로 입력한 Access Key·Secret Key를 연결 확인과 제휴 링크 생성에 사용합니다. 키는 암호화하여 보관하며 연결 해제 시 삭제합니다. 전체 키를 화면이나 일반 로그에 표시하지 않습니다.
• 공개 레퍼런스: 공개된 SNS 본문·미디어 URL·작성자명·반응 수를 조사·레퍼런스 제공에 사용합니다. 공개 정보에도 개인정보가 포함될 수 있으며 권리자·정보주체의 삭제 요청을 접수합니다.
• 기술·고객지원: IP, 접속시각·주소, 브라우저 정보, 응답 코드와 이메일 문의 내용을 보안·서비스 제공·문의 해결에 사용합니다. 문의 내용은 목적 달성 후 삭제하고 분쟁에 필요한 기록은 법정 기간 보관합니다.

관련 법령에 따라 계약·청약철회 및 대금결제·서비스 공급 기록은 5년, 소비자 불만·분쟁처리 기록은 3년, 표시·광고 기록은 6개월 보관합니다. 법정 보관 기록은 일반 서비스 데이터와 구분하고 그 목적에만 사용합니다. 삭제 시 복구할 수 없는 방법으로 전자 기록을 파기합니다.

처리위탁·외부 서비스

호스팅·저장·로그인은 Vercel, Google Cloud 및 Google, 데이터베이스는 Turso, 생성·분석은 OpenRouter와 선택한 모델 제공업체, 선택적 Studio·대화 기능은 Vertex AI·fal·OpenCode Go, DNS·이메일 전달은 Cloudflare를 사용합니다. 업체별 처리 위치와 목적은 아래 표에 적었습니다. 공개 콘텐츠 조사에는 TikHub 등 데이터 제공업체를 이용합니다. 선택한 기능을 실행할 때 필요한 상품 자료·프롬프트·미디어를 처리 업체에 전달하며 불필요한 로그인·결제 정보를 생성 프롬프트에 넣지 않습니다.

카드결제는 토스페이먼츠 주식회사의 결제창에서 진행합니다. 결제창을 열면 구매자 이름·연락처·이메일, 주문번호, 상품명·금액·이용 기간을 결제 처리와 거래 확인을 위해 토스페이먼츠에 전달합니다. 카드정보와 자동결제용 빌링키 발급은 토스페이먼츠가 처리하며 dupy는 카드 전체 번호·비밀번호·보안코드를 저장하지 않습니다.

국외이전

서비스 기능을 실행할 때 암호화된 통신으로 아래 업체의 처리 위치에 필요한 정보를 이전합니다. 로그인·호스팅에는 이메일·인증토큰·접속 기록, 저장에는 계정·콘텐츠 기록, 생성에는 해당 프롬프트·상품 자료·미디어를 이전합니다. 목적과 보유기간은 위 항목과 아래 상세 안내에 따릅니다. 필요한 위탁·보관에 관한 계약과 법정 고지·동의 절차를 적용합니다. 기능별 이전이 필요한 경우 해당 기능을 사용하지 않아 거부할 수 있고, 로그인·호스팅에 필요한 이전을 거부하면 온라인 서비스 이용이 제한됩니다. 업체별 문의는 해당 업체의 개인정보 안내 또는 dupy 고객센터를 통해 접수할 수 있습니다.

권리 행사와 보호

정보주체 또는 적법한 대리인은 열람·정정·삭제·처리정지·동의 철회와 계정 탈퇴를 이메일로 요청할 수 있습니다. 본인 확인 후 원칙적으로 10일 이내 처리하고 법정 보관 등의 제한이 있으면 이유를 알려드립니다. 자료는 접근 권한 제한, HTTPS, 비밀키 관리, 인증 토큰 암호화 또는 해시 등으로 보호합니다. 만 14세 미만의 가입은 받지 않습니다. 별도의 광고·추적 쿠키는 사용하지 않으며 서비스용 세션·언어·대시보드 캐시를 브라우저에 보관합니다.

침해 상담: 개인정보침해 신고센터 118, 개인정보분쟁조정위원회 1833-6972. 변경 시 적용일과 변경 내용을 공개하며 중요한 변경은 사전에 안내합니다.

YouTube 및 기술 상세 안내 (English)

This policy describes how dupy handles information on dupy.app, in the dupy workspace at studio.dupy.app and through dupy's MCP connection. Anyone can sign up with Google or email, and workspace owners can invite team members.

Who handles your information

dupy is operated by 디스틸, a business in South Korea (business registration 271-04-03553). The representative and privacy officer is 박성일. Contact details are at the end of this policy.

What we collect and how we use it

Sign-in and access

• Email sign-in. For email signup we store your email address and a salted password hash. We never store the original password. Accounts created with email signup have their own workspace and are not automatically linked to Google accounts or existing email invitations.
• Google sign-in. When you sign in, Google sends us a signed token. We check it and use only your verified email address to decide whether you have access. Google may show your name and profile photo on its sign-in screen, but dupy does not store them. dupy never receives your Google password.
• Session cookie. After sign-in we set one signed, HttpOnly cookie that contains your email address and expires after 24 hours or when you sign out.
• Team access list. When the workspace owner grants access, we store the invited email address, who added it and when.
• MCP connections. If you connect an AI client to dupy over MCP, we store the client's name and redirect addresses, and hashed authorization codes and tokens linked to your email address. Codes expire after 5 minutes, access tokens after 1 hour and refresh tokens after 30 days.

Threads profile connections and your own posts

If you explicitly connect a Threads profile, we store its identifier, username, granted permissions and encrypted access token to operate the connection. When you open your own posts, we retrieve the text, media links, publication times and original links from the authorised profile. Only the individual who connected that profile can view this feed in dupy; membership in the same workspace does not give another person access. This viewer does not store post contents or media in the dupy database or send them to generative AI services. You can disconnect in account settings to delete the stored credential and stop further reads, or revoke dupy's access in Threads website permissions. Disconnecting does not delete posts on Threads.

YouTube channel connections

If you choose to connect YouTube, dupy uses YouTube API Services to read the channel you authorise and upload completed videos to it. We store your channel ID and name, an encrypted refresh token, your upload settings, and upload records including video IDs and visibility. We request upload and read-only permissions; we do not receive your Google password. Your connected YouTube data is used to operate these features and is not used to train general-purpose AI models.

Completed videos are prepared for your review. An upload starts only after you select publish or schedule on the review screen, with the title, description, channel, visibility, audience and synthetic-media settings you confirm. We retain the approved video revision, channel and approval time with the upload record. You can disconnect YouTube in channel settings or revoke all permissions through Google Account connections. Disconnecting deletes the stored refresh token and upload-session credentials and cancels pending uploads. It does not delete videos already uploaded to YouTube. You can request deletion of remaining upload records using the contact details below.

dupy's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. YouTube also processes uploaded videos under the Google Privacy Policy.

TikTok account connections

If you choose to connect TikTok, dupy uses TikTok Login Kit, the Content Posting API and the Display API with the permissions you grant. We store your TikTok open ID, display name and avatar, the permissions you granted, encrypted access and refresh tokens, and records of the posts and drafts you send, including their status and TikTok post IDs. Your follower, following, like and video counts and your public videos with their view, like, comment and share counts are fetched from TikTok when you open them and are not stored. We do not receive your TikTok password.

A video is sent to TikTok only after you review it and select Post to TikTok or Send to TikTok as draft. Direct Post sends the caption, audience, interaction, content disclosure and AI-generated label settings you choose in Dupy. Sending a draft transfers the video to your TikTok inbox; you finish editing and choose posting settings in the TikTok app. TikTok downloads the video from a temporary studio.dupy.app address that expires within 75 minutes. Disconnecting deletes stored tokens and post records and requests TikTok to revoke access. If revocation cannot be confirmed, we tell you to remove Dupy from your connected apps in TikTok. It does not delete videos already on TikTok. TikTok processes posted content under the TikTok Privacy Policy.

Content you create in the workspace

• Projects, topics, search keywords, themes, followed channels, review decisions and saved references.
• Studio workflows, productions, scripts, edits and the video, image, voice and music files generated for them.
• Personas and the media you attach to them, such as names, descriptions, face or style images and voice samples, and files you upload to the media library. Only upload images or voices of people who have agreed to that use.

We use this content to run the features you ask for: finding and analysing videos, and producing and rendering new ones.

Ask dupy conversations

Ask dupy saves your conversations in the workspace database, linked to your email address, so you can reopen them from any browser. A saved conversation includes your messages, the images you attach, the assistant's replies, the tools it ran with their results, and the project and topic you were viewing. Large images are reduced in size before they are sent and saved. Other members of the workspace cannot see your conversations in dupy.

When you send a message, the conversation so far and the relevant workspace context pass through our server to an AI model provider (via OpenCode Go) to produce the reply. We use saved conversations to show you your history, and we look at them only when you ask for help, to investigate abuse or a security problem, or when the law requires it. You can delete a conversation from the chat list at any time, which removes it from the database.

Public short-form content we collect

To show what is performing in a topic, dupy collects publicly available information from TikTok, Instagram and YouTube through data providers (TikHub and the YouTube Data API). This includes video links, captions and hashtags, public view and engagement counts over time, creator handles and channel names, public channel statistics and music details. For videos selected for analysis we keep a private copy of the video, audio, captions and cover image, and produce a transcript and a structural analysis. This content can include creators' names, faces and voices. We process it to research formats and trends. We do not use it to identify or contact creators. Creators can ask us to remove their content from dupy using the contact details below.

Technical information

Our hosting and security providers process IP addresses, request times, requested addresses, browser information and response codes to deliver and protect the service.

Browser storage

Besides the session cookie, dupy stores a few settings in your browser: your interface language, the last topic you opened, a cached copy of the dashboard for faster loading and which Ask dupy conversation you had open. dupy does not use advertising or analytics cookies.

Support

If you email us, we receive your email address and the contents of your message.

How long we keep it

• Session cookies: 24 hours. MCP codes and tokens: until they expire as described above.
• Team access: until the workspace owner removes the email address.
• Ask dupy conversations: until you delete them, until you ask us to delete them, or until the service ends.
• Workspace content, collected content and generated files: until they are deleted in the workspace, until you ask us to delete them, or until the service ends.
• Support emails: as long as needed to resolve your request.
• Where Korean law requires us to keep a record for a set period, we keep it for that period only.

When information is no longer needed, we delete electronic files so they cannot be restored.

Who processes it for us

We do not sell personal information and do not share it with third parties for their own purposes. We use the service providers below to run dupy. They process information on our instructions.

Transfers outside South Korea

Using dupy transfers information to the providers above in the USA and Japan over encrypted network connections, at the time you use each feature. The items transferred are the ones described for each provider: your email address and sign-in tokens, workspace content, messages and uploads you send for processing, collected content and request logs. They are kept for the periods in this policy. You can avoid a transfer by not using the feature that requires it, for example Ask dupy or a Studio step. Because sign-in and hosting need these providers, you cannot use dupy without the transfer to Vercel and Google.

Your rights

You can ask to access, correct, delete or stop the processing of your personal information, and ask for a copy. Email us from the address you use with dupy and we will answer within 10 days. If we cannot fully meet a request, for example because the law requires us to keep a record, we will explain why. Team members can also ask the workspace owner to remove their access.

How we protect it

• All connections use HTTPS. Session cookies are signed, HttpOnly and limited to our own site.
• MCP authorization codes and tokens are stored only as hashes.
• Collected media and uploads are kept in a private storage bucket. Service accounts get only the access they need, and API keys are kept in a secrets manager.
• Access to a workspace requires an authenticated Google or email account with membership in that workspace.

Children

dupy is a tool for businesses and creators and is not intended for anyone under 14. We do not knowingly collect information from children.

Changes

We will update this policy when dupy changes how it handles information and will show the new effective date here. For material changes we will also tell users in the workspace before the change applies.

Contact and privacy officer

Privacy officer: 박성일.

• 이메일: help@dupy.app
• 고객센터 전화: 070-8065-1516
• 우편 문의: 디스틸, 서울특별시 강남구 테헤란로20길 18, 2층 8호(역삼동, 부봉빌딩)

If you are in South Korea and need further help, you can also contact the Personal Information Infringement Report Center (privacy.kisa.or.kr, 118) or the Personal Information Dispute Mediation Committee (kopico.go.kr, 1833-6972).