LETR AI
En
User guide Getting started

Privacy Policy

Effective : 2026-10-26

Twigfarm Co., Ltd. (the “Company”, “we”, “us”) operates the LETR AI service (formerly LETR WORKS) at https://www.letr.ai (the “Service”). This Privacy Policy explains how we collect, use, store, share, retain, and delete your personal information, including Google User Data received via Google API services.

The Company’s use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy(https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements. See Article 5 for the full Limited Use disclosure.

Article 1 Purpose of Collecting and Using Personal Information

The Company collects and uses personal information only for the purposes listed below. Information provided by users will not be used for any other purpose, and if the purpose of use is changed, prior consent will be obtained.

As a data controller, the Company complies with applicable laws and regulations, including the Personal Data Protection Act 2012 (PDPA) of Singapore, the Personal Information Protection Act of the Republic of Korea, and the Google API Services User Data Policy.

  • Membership management: Provision of membership services, personal identification, prevention of fraudulent and unauthorized use, confirmation of intention to join, age verification (under-14 prohibition), and handling of complaints.

  • Service delivery and billing: Recording service use, processing payment information, fulfilling contracts.

  • Service development and marketing (NON-Google data only): Statistical analysis of usage patterns, access frequency, and service performance. Google User Data is NEVER used for these purposes.

  • External service integration: Providing user-facing features that let users upload, download, translate, transcribe, render, and publish content via authorized links to YouTube, Google Drive, Dropbox, and OneDrive. Use of Google User Data is strictly limited to providing or improving these user-facing features as set out in Article 5.

Article 2 Items and Methods of Collecting Personal Information

When collecting personal information, the Company informs the user in advance of the purpose and items of collection and obtains the user’s consent.

  1. Methods of collection. Information is collected through the following methods.

    • The user voluntarily enters information during sign-up or service use.

    • A third party (such as an affiliate) provides information after obtaining the user’s consent in accordance with applicable law.

    • Device information, IP address, cookies, visit timestamps, and unlawful-use records may be automatically generated while using the PC web or mobile apps.

    • Information is received from external services (YouTube, Google Drive, Dropbox, OneDrive) via authorized OAuth 2.0 flow.

    • Event applications and participation.

  2. Items collected.

    • a. When registering or modifying membership — Required: Name or nickname, email, password, date of birth.

    • b. When signing up with a social account (Google, Naver, Kakao, Apple, Microsoft) — Required: email and the social account identifier. Where the provider supplies them: name and profile photo. Enterprise customers may sign up through enterprise SSO under a separate agreement.

    • c. Payment information — Bank account or credit card information for paid services and payment processing.

    • d. External service integration — Google User Data. Subject to the OAuth scopes you explicitly authorize, we may receive: (i) YouTube — channel name, subscriber count, video count, full video list, video titles, descriptions, tags, thumbnails, captions/subtitles, video privacy status, upload date, view count, channel analytics, and OAuth access and refresh tokens; (ii) Google Drive — only for files the user selects directly through the Google Picker (drive.file scope): file name, format, size, modification date, and the file contents necessary to perform the requested task. The Company does not access the user’s full Drive listing or any file the user has not selected.

    • e. Other external service integration — Dropbox, OneDrive: file metadata such as name, format, size, modification date.

    • f. Automatically collected non-identifying data — Device information, cookies, and basic service-usage statistics in a form that does not identify the user.

  3. Purposes of collection and use.

    • User identification, sign-up confirmation, fraud prevention.

    • Providing services, handling inquiries, delivering notices.

    • Recording use and settling fees for paid services.

    • Preventing and sanctioning actions that disrupt operations.

    • Developing new content and services, sending event information, marketing and advertising. Google User Data is NEVER used for these purposes beyond user-facing features the user has explicitly requested.

    • Building a secure and privacy-respecting service environment.

    • Executing the specific external-service tasks the user has requested.

  4. YouTube API Services — Notice. This Service uses YouTube API Services. By using features that connect to a YouTube account, you agree to be bound by:

You may revoke our access to your Google or YouTube account at any time at https://myaccount.google.com/permissions. The handling of all data received via YouTube API Services and other Google APIs (collectively, “Google User Data”) is governed by Article 5 of this Privacy Policy.

Article 3 Consent to Collection of Personal Information

If your personal data is shared with a third party acting jointly with Twigfarm Co., Ltd. as a co-manager under the PDPA, we will provide additional information about the primary contact manager regarding the request for your rights to the extent required by law.

  1. Users may agree to this Privacy Policy and the Terms of Use by clicking the “Agree” button. Once you click “Agree”, the information you entered will be stored in our customer database and used for the purposes specified above.

  2. Ifyou enter and save additional personal information by modifying your member information, you are deemed to have consented to that additional collection.

  3. When consent is collected through an affiliate, the affiliate also provides an “Agree” button procedure for the Privacy Policy and Terms of Use.

  4. For Google User Data specifically, additional consent is obtained through Google’sOAuth 2.0 consent screen at the moment of account linking. You retain the right to revoke this consent at any time as described in Article 5.

Article 4 Processing and Retention Period of Personal Information

  1. Retention and use period. We retain personal data only as long as necessary for the purposes for which it was collected, in accordance with applicable laws. When you withdraw from membership or withdraw consent, your data will be destroyed without undue delay upon achievement of the purpose or expiry of the retention period. The following records are kept separately for the periods set by applicable law, after which they are destroyed without delay:

    • a. Records of contracts and application withdrawal — Basis: Act on Consumer Protection in Electronic Commerce; Period: 5 years.

    • b. Records of payment and supply of goods — Basis: Act on Consumer Protection in Electronic Commerce; Period: 5 years.

    • c. Records of consumer complaints or dispute resolution — Basis: Act on Consumer Protection in Electronic Commerce; Period: 3 years.

  2. Membership withdrawal and re-signup. On withdrawal, personal information and activity records are permanently deleted and cannot be recovered. The account is also disconnected from all linked social media accounts. After withdrawal, you may sign up again using the same email or social account.

  3. Rights of data subjects. You may refuse consent to the collection of personal information. However, if you refuse to provide information that is essential, you cannot sign up or use the Service.

  4. Retention of Google User Data. Google User Data is subject to the stricter retention and deletion rules in Article 5, Section 6.

Article 5 Google API Services User Data — Limited Use

LETR AI’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy(https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.

  1. Categories of Google User Data we receive. Subject to the OAuth scopes you explicitly authorize:

    • a. Profile information: name, email address, profile image.

    • b. YouTube data: channel information, video metadata (titles, descriptions, tags, thumbnails), captions, channel analytics, and upload/edit permission scope.

    • c. Google Drive data: metadata and content of the files you select directly through the Google Picker (limited to the drive.file scope).

    • d. OAuth access tokens and refresh tokens necessary to maintain the authorized connection.

  2. Howwe USE Google User Data. We use Google User Data ONLY to provide or improve user-facing features that the user has explicitly requested:

    • a. Reading, displaying, uploading, editing, or deleting YouTube channel content within the Connect.YouTube module on the user’s instruction.

    • b. Translating, captioning, QC-checking, rendering, or otherwise processing files the user has selected from Google Drive.

    • c. Returning the processed output back to the user’s authorized Google account when requested.

    • d. Providing customer support relating to the foregoing.

  3. Howwe DO NOT USE Google User Data — Limited Use disclosures. In accordance with Google’s Limited Use requirements, the Company DOES NOT use Google User Data for any of the following purposes:

    • a. Training, fine-tuning, or evaluating any artificial-intelligence (AI) or machine-learning(ML) model, including generalized models and any proprietary LETR AI translation, dubbing, or synthesis models.

    • b. Serving advertisements, including but not limited to targeted, personalized, retargeted, or interest-based advertising.

    • c. Selling or licensing Google User Data to data brokers or information resellers.

    • d. Determining credit-worthiness or for lending purposes.

    • e. Building, contributing to, or enriching any database for purposes other than providing the user-facing features described in Section 2.

    • f. Any human reading of Google User Data, except (i) with the user’s affirmative agreement for specific messages, (ii) where necessary for security purposes(such as investigating abuse), (iii) to comply with applicable law, or (iv) where the data has been aggregated and is used for internal operations in accordance with applicable privacy laws.

  4. Howwe SHARE Google User Data. We do NOT transfer Google User Data to third parties except:

    • a. With the user’s prior, explicit consent.

    • b. To service providers (cloud infrastructure, security vendors) under a written agreement that requires them to apply protections at least as restrictive as this Privacy Policy and to use Google User Data solely to support our operations.

    • c. As necessary to comply with applicable law, regulation, legal process, or enforceable governmental request.

In every case, the transfer remains subject to the Limited Use restrictions in Section 3.

  1. Howwe STORE and PROTECT Google User Data.

    • a. Encrypted in transit using TLS 1.2 or higher.

    • b. Encrypted at rest using AES-256 or equivalent.

    • c. OAuth tokens and credentials stored in a dedicated secure vault with role-based access control, audit logging, and periodic security reviews.

    • d. Access strictly limited to authorized personnel who require it to operate the user-facing features.

  2. How long we RETAIN, and how to DELETE, Google User Data.

    • a. We retain Google User Data only as long as necessary to provide the user-facing features described in Section 2.

    • b. When you disconnect your Google account from LETR AI, withdraw from membership, or request deletion, we will permanently delete the associated Google User Data(including OAuth tokens) without undue delay, and in any event within thirty(30) days, except where retention is required by law.

    • c. You may request deletion of your Google User Data at any time by: (i) contacting our Data Protection Officer at hyuntaek.park@twigfarm.net; (ii) disconnecting the integration within LETR AI settings; or (iii) revoking access at https://myaccount.google.com/permissions.

    • d. Data received from YouTube API Services and stored by the Company (authorized data) is not retained for more than thirty (30) days; after thirty (30) days it is refreshed via the YouTube API Services or deleted.

  3. Changes to our handling of Google User Data. We will notify users at least thirty(30) days in advance of any material change to the practices set forth in this Article via email or in-product notice.

Article 6 Entrustment of Personal Information Processing

To provide reliable service, the Company entrusts the processing of personal information to the following third parties to the minimum extent. The Company will not use or provide personal information beyond the scope described in Article 2. Members may withdraw consent to provision of personal information at any time.

NOTE: None of the entrusted processors below receives Google User Data covered by Article 5.

Auth0 — Customer sign-up and account management

  • Contact: privacy@auth0.com

  • Items transferred: email address and social login account identifier (Google, Naver, Kakao, Apple or Microsoft sign-up). For email sign-up, the password is entered by the user directly on the Auth0 login screen, never passes through the Company’s servers, and is stored by Auth0 only in hashed (encrypted) form; the Company neither holds nor transfers passwords. All items are encrypted in transit and at rest.

  • Method: Transmitted over encrypted connections (TLS) at sign-up, login and withdrawal

  • Period: Until membership withdrawal or termination of the entrustment contract (subject to legal retention)

Google LLC (Google Analytics) — Statistics, performance, UX improvement

  • Contact: Google support channels

  • Items transferred: region, access history, content usage history

  • Method: Remote transmission via private network during Service use

  • Period: Until membership withdrawal or termination of the entrustment contract (subject to legal retention)

Article 7 Provision of Personal Information to Third Parties

We do not provide user information to third parties beyond the scope of consent obtained at collection, except:

  1. When necessary to settle fees for information and communication services.

  2. When required by law or to comply with statutory obligations.

For the avoidance of doubt, the provision of Google User Data to third parties is governed exclusively by Article 5, Section 4 and is NOT subject to the broader exceptions in this Article.

Overseas data transfer

Your personal data may be stored on external servers located overseas. The Company may share information with affiliated companies and third-party service providers that may be located in countries other than your country of residence. Cross-border transfers are subject to the PDPA and other applicable data protection laws.

Article 8 Procedures and Methods for Destroying Personal Information

After the purpose has been achieved, the Company destroys personal information without undue delay.

  1. Destruction procedure.

    • Information entered for sign-up is transferred to a separate database after the purpose is achieved, retained for the period required by law, and then destroyed in accordance with internal policy.

    • Information transferred to a separate database is not used for any purpose other than as required by law.

    • The Data Protection Officer selects the data to be destroyed and approves the destruction.

  2. Destruction method.

    • Electronic files are deleted using technical methods that render the records unrecoverable.

    • Paper records are destroyed by shredding or incineration.

Article 9 Personal Information Protection Measures

  1. Internal management plan. The Company has established an internal personal-information management plan, including governance, the appointment ofa Data Protection Officer, and annual compliance reviews.

  2. Access control. The Company restricts access to the personal-information processing system, sets standards for granting, changing, and revoking access, trains personnel on confidentiality, and minimizes the number of personnel who handle personal information. Violations of data-protection law are treated with the utmost seriousness.

  3. Encryption.The Company applies encryption (TLS in transit, AES-256 at rest) to safely store and transmit personal information.

  4. Integrity protection. The Company applies measures to prevent unauthorized storage, forgery, or alteration of access records to personal information.

Article 10 Cookies

A. Operation and purpose

The Company operates cookies as is standard for web services. Cookies are small pieces of information sent by a website to the user’s browser and stored on the user’s device. Cookies identify the user’s computer rather than the user personally and are used to maintain login state, remember IDs, and analyze usage patterns.

Google Analytics. This Website uses Google Analytics, a web analytics service provided by Google, Inc.(“Google”). Information generated by the cookies about your use of the Website(including your IP address) is transmitted to and stored by Google on servers in the United States.

B. Installation, operation, and rejection

You can choose whether to accept cookies or delete existing cookies through your browser settings. If you refuse cookies, some login-required features may be limited.

How to set cookies:

  • Chrome:Settings → Privacy and Security → Cookies and other site data

  • Safari:Settings → Privacy → Manage Website Data

  • Edge:Settings → Cookies and site permissions

Article 11 Data Protection Officer and Contact

The Company has designated aData Protection Officer to protect users’ personal information. For any privacy-related questions, requests, or complaints — including requests concerning Google User Data — please contact us. We respond to verifiable requests within thirty (30) days.

Data Protection Officer / Personal Information Protection Officer

Article 12 Changes to This Privacy Policy

This Privacy Policy takes effect on October 26, 2026. If we make changes, we will notify users via a notice on the Website or a separate notice at least seven (7) days before the changes take effect. For changes affecting Google User Data, we will provide notice at least thirty (30) days in advance as set out in Article 5, Section 7.

This Privacy Policy is governed by the laws of the Republic of Korea. Where applicable, the processing of personal data is also subject to other data protection laws, including the Personal Data Protection Act 2012 (PDPA) of Singapore and the Google API Services User Data Policy.

Effective Date: October 26, 2026

Previous Effective Date: May 11, 2026