Privacy Policy

1. Our role

For account and billing information we are the controller. For content that a customer organization (the “Workspace”) puts into the Service — messages, files, tasks, announcements and wiki pages — the Workspace is the controller and we process it on the Workspace's instructions. HR data (employee records, personnel orders, payslips, annual-leave notices, certificates and similar) is processed by the workspace as the employer and controller for managing the employment relationship; the Company processes it on the employer's behalf as a processor. Account numbers, resident registration numbers (only where the workspace allows storing them) and pay amounts are encrypted field by field, are never used for search, AI or external integrations (MCP), and can be viewed only by authorized HR staff and the employee, with every access logged. Please direct requests about your HR data to your workspace (employer); for questions about the Service contact [email protected]. If you use the company mail integration, the copies of mail from mailboxes a member connects (Google Workspace/Gmail, Microsoft 365/Outlook, or IMAP/SMTP services such as Naver Works, Daum and Hiworks) — sender, recipients, subject, date, body and the list of attachments — are processed with the Workspace as controller and the Company as processor. The Company does not run a mail server (MX); the Service only acts as a mail app connecting to the existing mailbox. Connected mail can be read only by the member who connected it, not by Workspace admins or other members. OAuth tokens and app passwords are stored encrypted (AES-256-GCM), and mail is excluded from workspace search and Crane AI retrieval. When a member turns a mail into a task, an approval draft or a channel post, only the parts the member selects are shared, and mail content is sent to the Workspace's AI provider only when the member presses an AI button. Remote images are blocked by default and are loaded through our servers only when the member chooses to show them. Mail integration (if used): the connected mail address, copies of mail headers and bodies, the list of attachments (attachment contents are not stored; they are fetched from the mail server when opened), encrypted OAuth tokens or app passwords, and a send log (time and number of recipients only — no addresses, subjects or bodies). Mail copies: deleted immediately when the mailbox is disconnected or the member leaves or is deactivated, and after the retention period if the Workspace sets one. Mail in the original mailbox is never deleted. Mail services you connect (e.g. Google LLC (USA), Microsoft Corporation (USA), Korean mail providers): only when a member connects a mailbox, we connect through the Gmail API, Microsoft Graph or IMAP/SMTP (TLS) to sync and send mail. These services process mail under their contract with you or your Workspace.

2. Information we collect

• Account: email address, display name, password (stored only as an Argon2id hash), language and time zone.
• Workspace: company name, departments, job titles and roles entered by administrators.
• Content: messages, files, tasks, comments, announcements and wiki pages you create. Where the Workspace uses the related features we also process: HR records (resident registration numbers, payslips and bank accounts are stored encrypted), attendance and leave records, performance reviews and 1:1 records, training completion records, connected work mailboxes, helpdesk customers and website visitors, and visitor-kiosk names, contact details (encrypted) and consent records.
• Usage and security logs: sign-in time, IP address (stored as a hash where possible), browser type, pages visited and error logs. To improve search and personalize recommendations we process, inside the Workspace, normalized search queries, the results opened with their rank and time spent, questions Crane AI could not answer, reactions to related-content suggestions, and interests computed only from your own activity (features you use, places you take part in, people you work with); members can turn this off in Settings and administrators for the whole Workspace.
• Website analytics: page path, referrer, language and approximate country. We do not use advertising cookies.

3. Purposes

• Providing the Service, authenticating users and enforcing permissions. This includes the features the Workspace enables: HR, payroll and attendance management, performance reviews, statutory training, work-mail integration, customer support and visitor management.
• Sending invitations, password resets and notifications you enabled.
• Security, fraud prevention, audit logging and incident response.
• Improving the Service with aggregated statistics.
• Answering inquiries and meeting legal obligations.

4. Retention and deletion

• Account information: until you delete your account, then deleted within 30 days.
• Workspace content: until the Workspace is terminated or the content is deleted under its retention policy, then deleted within 30 days. When deletion of a Workspace is requested, all data and files are destroyed after a 30-day grace period (which can be cancelled) and we verify that nothing remains. When a member leaves or their personal data is erased, personal-only data is destroyed immediately, shared content they wrote is anonymized, and records the law requires to be kept (e.g. employee register, payroll ledger and attendance records for 3 years under the Labor Standards Act, tax evidence for 5 years, statutory training records for 3 years) are kept only for that period and then destroyed. Visitor information is destroyed automatically after the period set by the Workspace.
• Backups: overwritten on a rolling cycle of up to 35 days. Where a separate copy of file storage is kept, it is deleted within 30 days.
• Access logs: at least 1 year (the statutory minimum for access records under Korean law), or longer where the law requires. Raw signals used for search and recommendation learning are deleted automatically after the period the Workspace sets (90 days by default), and at once when a member is erased or opts out. Other members’ search queries are only used in aggregate once 5 or more people searched the same thing.

Deleted data is destroyed in a way that cannot be restored; paper records, if any, are shredded.

5. Disclosure to third parties

We do not sell personal information. We disclose it to third parties only with your consent, at the Workspace's instruction, or when required by law.

6. Processors and overseas transfer

We use the following processors. Data is transferred over encrypted networks when you use the Service.

• Cloudflare, Inc. (USA, global network): website delivery, security and proxying.
• Railway Corporation (USA): application servers and database hosting.
• AI providers such as Anthropic PBC or OpenAI, L.L.C. (USA): only when a Workspace enables AI features; only the question and the excerpts the user may access are sent, and they are not used to train models under our agreements.
• Email delivery provider (USA): invitation, password reset and notification emails.

Items transferred: the data listed in section 2 that is necessary for each function. Retention: as described in section 4. You can refuse an overseas transfer by not using the related feature or by deleting your account, but some features may then be unavailable.

7. Your rights

You may request access, correction, deletion, suspension of processing or a copy of your personal information at any time, in the app settings or by email. If your data belongs to a Workspace, we may forward your request to its administrator. We respond without undue delay and within the period required by law.

8. Security measures

• Encryption in transit (HTTPS/TLS) and hashed passwords.
• Strict tenant isolation, role-based access control and permission checks on every request.
• Short-lived download links, upload signature checks and rate limiting.
• Audit logs for administrative actions and minimal access by staff.

9. Cookies

We use strictly necessary cookies for sign-in sessions and CSRF protection. Website analytics does not use cookies; visitors are counted with a daily-rotating anonymous hash. You can block cookies in your browser, but you will not be able to sign in.

10. Children

The Service is intended for business use and is not directed at children under 14.

11. Privacy officer and contact

Privacy officer: Workbami Privacy Team

Email: [email protected]

You may also contact the Personal Information Infringement Report Center (privacy.kisa.or.kr, 118) or the Personal Information Dispute Mediation Committee (www.kopico.go.kr, 1833-6972).

12. Additional information for your region

This section adds information required by the laws of specific countries and regions. Where it gives you more protection than the rest of this policy, it applies to you if you live in that region. Each language version of this policy contains the full notice for the main market of that language.

European Economic Area (GDPR): for the data we control as controller we rely on these legal bases — performance of a contract (providing the Service and accounts), legitimate interests (security, fraud prevention, audit logs, aggregated statistics and service improvement), compliance with legal obligations, and consent where we ask for it (you can withdraw it at any time). For Workspace content, the Workspace is the controller and determines the legal basis.

GDPR rights: access, rectification, erasure, restriction, data portability, objection to processing based on legitimate interests, and withdrawal of consent. You may also lodge a complaint with the data protection supervisory authority of your country of residence or work. We do not make decisions based solely on automated processing that produce legal or similarly significant effects on you.

International transfers: the Company is based in the Republic of Korea and the Service is hosted in the United States, so personal data from the EEA is transferred outside it. Transfers rely, as applicable to each recipient, on the European Commission's adequacy decision for the Republic of Korea, the EU–U.S. Data Privacy Framework where the recipient is certified, or Standard Contractual Clauses. You can request information on the safeguards by email. We have not appointed an EU representative under Article 27 GDPR or a data protection officer; privacy requests are handled by the Workbami Privacy Team.

United Kingdom (UK GDPR): the same rights and legal bases apply. You may complain to the Information Commissioner's Office (ico.org.uk). Transfers rely on the UK adequacy regulations for the Republic of Korea, the UK Extension to the EU–U.S. Data Privacy Framework or the UK Addendum to the Standard Contractual Clauses, as applicable. We have not appointed a UK representative.

California (CCPA/CPRA), to the extent it applies to us: in the last 12 months we collected identifiers (name, email, IP address), internet activity (usage and security logs), professional or employment information entered by a Workspace, and account login credentials, for the purposes in section 3, from you, your Workspace and your devices. We do not sell personal information or share it for cross-context behavioral advertising, and we do not use sensitive personal information to infer characteristics about you. Retention is described in section 4. For Workspace content we act as a service provider to the Workspace.

California rights: to know and access, to delete, to correct, and not to be discriminated against for exercising these rights. Because we do not sell or share personal information or use sensitive personal information beyond permitted purposes, there is nothing to opt out of or limit. You or an authorized agent can send a request to [email protected]; we verify your identity by confirming control of the account email and respond within 45 days.

Other regions: the Japanese, Chinese, Vietnamese, Thai, Indonesian and Portuguese (Brazil) versions of this policy contain notices under Japan's Act on the Protection of Personal Information, China's Personal Information Protection Law, Taiwan's Personal Data Protection Act, Vietnam's personal data protection law, Thailand's Personal Data Protection Act, Indonesia's Law No. 27 of 2022 and Brazil's LGPD. Those notices apply to residents of those countries regardless of the language you read this policy in.

Data location: the application servers, database and uploaded files are currently hosted in the United States (Railway), and website delivery, security and proxying run on Cloudflare's global network. We do not currently offer hosting in the EU or in any other specific region.

To exercise any of these rights, email [email protected] from the address linked to your account. We respond without undue delay, and at the latest within the period required by the law that applies to you (for example, one month under the GDPR).

13. Changes

We will announce changes to this policy at least 7 days in advance (30 days for material changes) on this page or in the Service.