axi-live Privacy Policy

1.Scope of processing and the Company's role

The Service processes personal data in two ways. Account data that customer staff need to use the console is collected and used by the Company directly. Visitor conversations and follow-up requests from the web chat on customer websites are processed by the Company on behalf of the customer, only for the purposes set by the customer and within the scope of this policy.

2.Personal data we collect and how

We process only the minimum data needed to provide the Service.

A. Customer staff (console users)

• Required: email, display name, password (stored with one-way hashing), customer, role, language and time zone settings
• Generated at sign-in: sign-in time, IP address, sign-in count, failed attempts and lock status
• How: entered by the customer's administrator or a Company operator when creating the account; sign-in records are generated automatically during use.

B. Web chat visitors

• Conversation: questions entered by the visitor and AI answers, conversation language and time
• Conversation identifier: a random conversation token kept in browser storage and a cookie
• Visitors do not create accounts, and a conversation alone does not collect a visitor's name or contact details. Anything a visitor types into a question is stored as part of the conversation.

C. Follow-up requests

• When the AI cannot find an answer in the documents and the visitor asks to be contacted: name, phone number, and the request
• How: the visitor enters them in the web chat request form and confirms before sending.

D. Data generated automatically while using the Service

• Server access logs: IP address, requested URL and request content, request time
• Security records: email, IP address, and browser information (User-Agent) of staff who change documents, settings, or follow-up requests in the console
• Usage records: number of answers, tokens, and voice time (no data identifying individuals)

E. Documents uploaded by customers

• If documents uploaded as answer sources (PDF, DOCX, designated Excel templates) contain personal data, it is stored and indexed as is. Customers should upload only documents containing what is needed.

3.Information we do not collect

• We do not store web chat visitors' IP addresses or browser information in conversation records (the database). Like every request, they do appear in server access logs.
• We do not record or store voice audio on our servers. Audio travels directly between the user's browser and the voice AI provider (OpenAI).
• We do not use advertising, behavioral analytics, or third-party analytics tools such as tracking pixels.
• Names and phone numbers from follow-up requests are never sent to AI models.

4.Purposes of processing

• Staff accounts: identity verification, sign-in and permission management, preventing unauthorized sign-ins, service notices
• Visitor conversations: answering based on documents, keeping context for follow-up questions, letting the customer review conversations and improve quality
• Follow-up requests: so the customer's staff can contact the visitor
• Server access logs and security records: service stability, preventing and investigating security incidents, handling outages
• Usage records: measuring usage per customer and providing statements

5.Retention period

We destroy personal data without delay once the purpose is achieved. Retention periods by item are as follows.

• Visitor conversations: kept for the period set by the customer (90 days by default, configurable from 1 to 3,650 days) after the last message, then deleted automatically every day.
• Names and phone numbers in follow-up requests: deleted automatically 30 days after the request is completed or cancelled. Unconfirmed request drafts are deleted after 1 day. The request text may remain for statistics for the conversation retention period.
• Staff accounts and sign-in records: kept for the term of the service agreement and destroyed after it ends under the procedure agreed with the customer.
• Security and usage records: kept for the term of the service agreement for security audits and usage settlement.
• Server access logs: kept as long as needed to investigate security incidents and handle outages, then deleted.
• Where laws require a retention period, data is kept for that period.

6.Destruction procedure and method

Personal data whose retention period has passed or whose purpose has been achieved is destroyed by automated deletion jobs or by staff deletion procedures. Electronic files are deleted in a way that cannot be recovered, and paper documents are shredded or incinerated.

7.Provision to third parties

The Company does not provide personal data to third parties, except with the user's consent, where laws specifically require it, or where investigative authorities request it following legal procedures. Visitor conversations and follow-up request data are provided to the customer that deployed the Service, as processing entrusted by that customer.

8.Entrustment of processing

The Company entrusts the following processing to provide the Service. We set the necessary terms in our contracts so that personal data is managed safely, and we supervise the processors.

We will announce any change in processors or tasks through this policy.

9.Overseas transfer of personal data

The Company transfers personal data overseas for the entrusted tasks as follows. Transfers take place over encrypted networks each time the Service is used.

If you do not want your data transferred overseas, tell us at [email protected]. Because these transfers are essential to the Service, refusing them means you cannot use the web chat or voice answers.

10.Your rights and how to exercise them

You may exercise the following rights over your personal data at any time. Send requests to [email protected]; we verify that you are the data subject or a legitimate representative and handle the request without delay. Web chat visitors may also contact the customer operating the website they used, and staff may also go through their customer's administrator.

• Request access to your personal data
• Request correction or deletion of errors
• Request suspension of processing
• Withdraw consent
• You may exercise these rights through a legal representative or an authorized agent.
• Access and suspension requests may be limited under Articles 35(4) and 37(2) of the Personal Information Protection Act, and data that other laws require to be collected cannot be deleted on request.

11.Cookies and similar technologies

The Service uses the following cookies and browser storage to keep you signed in, continue conversations, and remember your language. We do not use cookies for advertising or tracking.

• Sign-in session cookie: keeps staff signed in (up to 1 week if "remember me" is selected)
• Conversation cookie (axi_chat_…): continues an ongoing conversation on the standalone chat page, 7 days
• Browser storage (axi-live:chat:…): continues an ongoing conversation in the chat widget embedded on a website
• Language cookie (locale): remembers the language you chose
• You can refuse or delete cookies and site data in your browser settings. If you do, staying signed in or continuing conversations may not work.

12.Security measures

• One-way password hashing (bcrypt) and encrypted storage of names and phone numbers in follow-up requests
• HTTPS encryption for all traffic
• Data separation per customer and access control by role (owner, admin, agent)
• Account lockout after repeated failed sign-ins and request rate limiting to block abnormal access
• Security records of key actions such as document and setting changes
• Keeping the number of people handling personal data to a minimum and training them

13.Privacy officer

The Company designates the following privacy officer, who oversees personal data processing and handles complaints and remedies. Please contact the privacy officer for privacy questions, deletion requests, or security vulnerability reports.

• Name: Eunho Jeong
• Title: CEO
• Phone: +82-10-3140-2180
• Email: [email protected]

14.Children under 14

The Service is a business service deployed by customers and is not directed at children under 14. We do not knowingly collect personal data from children.

15.Remedies for infringement

If you need to report or consult about a personal data infringement, you can contact the following Korean authorities.

• Personal Information Infringement Report Center (KISA): 118 / privacy.kisa.or.kr
• Personal Information Dispute Mediation Committee: 1833-6972 / www.kopico.go.kr
• Supreme Prosecutors' Office Cyber Investigation: 1301
• Korean National Police Agency Cyber Bureau: 182 / ecrm.police.go.kr

16.Changes to this policy

This policy applies from the effective date. If we change it because of legal or service changes, we will announce it on this page and in service notices 7 days before it takes effect (30 days for changes that are unfavorable or significant to users).