Privacy Policy

1. Scope

(1) This Policy applies to the website, admin console, and online services (licensing, updates, remote support, and AI) operated by Anexton ("Anexton", "we").

(2) For data on a Host Server a customer installs, and for personal data of end users the customer has us process, the customer is the controller and Anexton processes it as a processor within the scope the customer sets. Requests from those data subjects are handled by the customer.

(3) The Service is not offered in the European Union, the European Economic Area, the United Kingdom, or Switzerland.

2. Purposes and Data

(1) [Processed without consent] Legal basis: PIPA Art.15(1)(iv) (performance of a contract) and Art.15(1)(vi) (legitimate interests).

(2) Account: email, password (encrypted), Google sign-in identifier (if you sign up with Google), display name, department (if you ask to join a company device when you sign up), organization name (at licence issuance). If you sign up with Google, the name on your Google account is saved once as your display name when the account is created; later Google sign-ins do not change it. If you sign up with email and ask to join a company device, we collect the name and department you enter. Otherwise no display name is collected at signup, and you can add one in account settings. The display name is used to show who you are in the console and in member lists, and when you ask to join a device, your display name and department are sent to that device’s administrators. You can change your display name in account settings at any time; your display name and department are kept with the rest of your account data until account deletion. Organization name is not collected at signup.

(3) Access security: request IP, User-Agent, sign-in time.

(4) Passkeys (if you register one): the passkey public key, credential identifier, authenticator type (AAGUID), whether it is synced, signature count, passkey name, and registration and last-use times. Biometric data such as fingerprints or faces and the private key are never sent to Anexton, so we do not collect them (for a passkey synced across your devices, the private key is kept by the passkey manager you use).

(5) Licensing and device management: licence ID, host ID, installation ID, software version, hardware fingerprint (hashed), device status, CPU/memory/disk usage.

(6) Billing: plan, billing cycle, payment status, tax-invoice details. Card details are processed by the payment provider and are not stored by Anexton.

(7) Support and remote support: support messages, support history, and commands, output, recordings, and consent records of remote-support sessions.

(8) Console technical support (help desk): message contents, the console screen the question was opened from, the email address of the signed-in account, and device identifiers (host ID, hardware ID, hostname, OS details). Processed on the basis of the service relationship; conversations are sent to Slack (United States) so a support engineer can reply, on a channel separate from sales inquiries. Passwords and tokens are masked before sending on a best-effort basis; because masking cannot catch every form, the input field tells you not to enter them.

(9) Enterprise onsite installation and maintenance: contact details, visit schedules, device identifiers, disk/storage work records. User file contents are viewed only with customer authorization and to the extent the work requires.

(10) AI features: questions, conversation contents, retrieved document passages. Processed on servers Anexton operates in Korea.

(11) [Processed with consent] Each item is consented to separately and can be withdrawn at any time in account settings or with "Reopen Cookie Preferences" on the cookie policy page.

(12) Cross-border transfer to external AI: questions, selected conversation turns, retrieved passages, the file contents the AI reads and tool results in AI-employee tasks, model name, and token counts. Sent to Anthropic only when the licence holder has consented to cross-border transfer; sent to OpenAI when the Anthropic account limits are used up and for requests carrying Google user data. Luvo engine mode sends to OpenAI or Anthropic.

(13) Marketing: email, organization name, consent and withdrawal records.

(14) Web analytics cookies: analytics events (Google Analytics).

(15) Website chat: message contents (including any company name or contact details you send), the page where the chat started, a session identifier, and the consent record. Processed only after you agree to the notice shown before starting. Where automatic replies use external AI (OpenAI) or the conversation is sent to Slack (United States) so a person can reply, the pre-chat notice says so.

(16) Automatically collected items and how to refuse: we automatically collect sign-in and security cookies and access records (request IP, User-Agent, sign-in time). You can decline analytics cookies in the cookie banner or withdraw them with "Reopen Cookie Preferences" on the cookie policy page, and block cookies in your browser settings. Blocking strictly necessary cookies prevents you from staying signed in.

3. Host Server Data and Central Processing

(1) VMs, original files, SMB shares, and local accounts on a Host Server are stored on that Host Server.

(2) AI search index: when in-house AI search is on, text passages, vectors, and the file inventory (path, name, hash, size) are kept in the SSD storage of the Host Server. To build the index or run a search, passages and questions may be sent to AI on servers Anexton runs in Korea to compute vectors; they are used only while the vectors are computed and are not stored. An administrator can turn this off, and the Host Server then computes the vectors itself. When you delete a file, its passages, vectors, and inventory entries are also deleted from the Host Server.

(3) Licensing, device monitoring, updates, remote support, incident analysis, and external AI send the data described in this Policy to Central or to processors.

4. Google User Data (Gmail, Drive, and Calendar Integration)

(1) This section applies only when a user connects their own Google account from the host console. For mail, Anexton requests openid, email, and these Gmail permissions: https://www.googleapis.com/auth/gmail.modify (read your mail, apply the mailbox actions you take on screen — mark read, star, archive, report spam, move to trash, apply labels — and send the messages you chose to send — and, when you press Mail report, find the dates of invoices and deliveries in your last 30 days of mail) and https://www.googleapis.com/auth/gmail.settings.basic (create the auto-sorting rules you asked for). The buttons on the Mail screen (star, mark as read, archive, report spam, trash) act as soon as you press them, and each can be undone. Opening an unread message marks it as read. The Mail report runs only when you press it: on the Host Server it reads the subject, sender, and body of your last 30 days of mail to find the dates and amounts of invoices and deliveries and shows them on screen. It is not sent to the AI or Anexton Central Server and is not stored. A clean-up the AI proposes is shown on screen first and runs only after you confirm it. Sending is used only for messages you wrote and chose to send, the sender is always your own linked account, and there is no path by which the AI sends mail on its own. Anexton does not request the full-access scope https://mail.google.com/ .

(2) If you connect Google Drive on the Files screen, Anexton requests https://www.googleapis.com/auth/drive.readonly (list your files and folders, open and preview them, download them, attach a file you choose to an AI question, and connect a folder you choose to AI search) and https://www.googleapis.com/auth/drive.file (only files this app creates — to save an AI result as a new file, when you ask, in a folder this app creates — when first created it is named for the screen language (“Anexton Results” on an English-language screen, “Anexton 결과물” on a Korean-language screen); a folder this app already created is reused under its existing name, and a folder in the trash is not reused). Anexton does not change or delete files already in your Drive — every save is a new file — and does not request the full Drive scope https://www.googleapis.com/auth/drive .

(3) If you connect Google Calendar on the Calendar screen, Anexton requests https://www.googleapis.com/auth/calendar.events (see your events, and create or delete the events you confirmed on screen) and https://www.googleapis.com/auth/calendar.calendarlist.readonly (see the list of calendars you subscribe to). Every calendar change is shown on screen before it runs and happens only after you confirm it; there is no path by which the AI changes a calendar on its own. Anexton does not request https://www.googleapis.com/auth/calendar , which would also change the settings and sharing of your calendars.

(4) What we access: the email address of the connected Google account, the subject, sender, recipients, received time, labels, and body of Gmail messages together with the message change history used to detect new mail, your label list and the auto-sorting rules you asked us to create, — if you connect Drive — the list of your Drive files and folders, the contents of the files you open or attach to an AI question, the contents of the files in a folder you connect to AI search, the files this app created, and — if you connect Calendar — your calendar names and colours and the title, time, location, organiser, and guests of the events inside the range being displayed.

(5) Linked-account count monitoring: to stay within the user cap (100) that Google applies to an app before verification, the Google account address you link is turned into an irreversible hash (sealed once more with a secret key on our central server) and kept only as an entry in a cumulative count. The address itself is never sent, the entry is not deleted when you disconnect, and it is deleted once the app is verified.

(6) How we use it: only for features that are visible and prominent in the product interface — listing your mailbox, opening a message, producing the mail or calendar summary or answer you asked for, applying the mailbox actions you take on the Mail screen, applying the clean-up and creating the auto-sorting rules the AI proposed and you confirmed, finding the dates of invoices and deliveries in your last 30 days of mail when you press Mail report, opening, previewing, or downloading Drive files and attaching a file you choose to an AI question, using a Drive folder you connect only for your own AI search, saving an AI result to Drive when you ask, drawing your calendar, and creating or deleting the events you confirmed on screen. We do not use it for advertising, profiling, sale to third parties, or training AI models.

(7) How we store it: the refresh token is encrypted and stored on the customer Host Server and is not transmitted to Anexton Central Server. Message subjects, addresses, and bodies are used only for as long as the request being served needs them, are not stored separately, and are excluded from AI query audit records. Drive files you open or download are held on the Host Server only for as long as that takes and are then discarded; a Drive file you attach to an AI question is kept on the Host Server for 7 days, like any other attachment, and is then deleted automatically. The files in a Drive folder you connect to AI search are kept on the Host Server as copies and a search index for as long as the folder stays connected, and are not sent to Anexton Central Server. They are synced with Drive every 15 minutes and fully once a day, and a file you delete in Drive or move out of the folder is removed at the next sync. Only you can search those copies — no other user can. When you disconnect the folder in the product, the copies and the search index are deleted at once; if the Google connection stays lost for 30 days, they are deleted then. Event titles, locations, and guests are used only while your calendar is on screen or your request is being served, and are not stored separately. The questions you ask about your mail, events, or attached files and the AI answers are saved in your conversation history on the Host Server and are deleted when you delete the conversation. Audit records for clean-up actions keep only the kind of action and the number of messages — never addresses, subjects, or bodies. The result of the Mail report is used only while it is on screen and is not stored, and neither the logs nor the audit records keep a subject, address, or body.

(8) When an AI summary, draft or answer uses the OpenAI API, Anexton sends it with store=false. OpenAI (OpenAI OpCo, LLC) may keep requests for up to 30 days for abuse monitoring, unless longer retention is required by law or is reasonably necessary to protect our services or any third party from harm, and may process them in the United States or elsewhere. This path is used only when the company has allowed transfer abroad.

(9) Whether we share it: to produce the summary or answer you asked for, the message body, — when you ask the assistant to search your mail — the sender, subject, and date of up to 15 matching messages, the sender and subject of a message you select for the mail assistant, the contents of a Drive file you attached to an AI question, the parts of the files in a connected folder that match your question, and — when you use the calendar assistant — the titles and start times of the events on screen (at most 30) are transmitted to Anexton-operated AI servers in Korea, used only for as long as that request needs them, and not stored separately. Transmission to an external LLM provider (OpenAI) happens only where the licence holder has given separate consent to cross-border transfer for the organization and the sensitivity policy permits it. If that consent cannot be confirmed, no transfer occurs — the default is no consent. The Mail report is computed on the Host Server only and is never sent to the AI or Anexton Central Server.

(10) Human access: Anexton personnel do not read your Gmail, Drive, or Calendar data. The only exceptions are when the user has given affirmative agreement to view specific messages, files, or events, when it is necessary for security purposes, or when it is necessary to comply with applicable law.

(11) Disconnecting and deletion: you can revoke Anexton’s access at any time at https://myaccount.google.com/permissions. When you choose “Disconnect Google” on the Mail, Drive, or Calendar screen, the stored token is deleted at once, Anexton asks Google’s token revocation endpoint to revoke it, and the copies and search index of the Drive folders connected to AI search through that connection are deleted too. When an administrator deactivates or deletes your account, the stored token is deleted at once and Anexton asks Google to revoke it. A revoked connection works again only after you reconnect it.

(12) Anexton’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.

5. Retention and Deletion

(1) Account data is kept until account deletion.

(2) Under Korean law we keep contract, withdrawal, and payment records for 5 years, consumer complaint and dispute records for 3 years, advertising records for 6 months, access logs for 3 months, and tax records for 5 years. Retained records are stored separately from other personal data.

(3) Host audit logs are kept for 365 days; records needed for integrity verification may be kept longer. Performance metrics are kept for 30 days and anonymized or pseudonymized telemetry for 12 months.

(4) Website chat transcripts and console help desk transcripts are automatically purged one year after the last activity. Copies sent to Slack follow the Anexton Slack workspace retention policy and are outside that automatic purge.

(5) Consent and withdrawal records are kept as long as needed for dispute handling, except those for Luvo, which follow Section 11.

(6) When the retention period ends or the purpose is achieved, data is destroyed without delay: electronic files by methods that prevent recovery, paper by shredding or incineration.

6. Disclosure to Third Parties

We provide personal data to third parties only where the law allows it, such as with the data subject's consent or under a specific legal provision.

7. Processors and International Transfers

(1) Processors: Cloudflare (CDN, security, storage, encrypted backup storage of service data), Resend (email delivery), Google (sign-in, web analytics), a GeoIP provider (country lookup), Anthropic (primary external-AI provider, Luvo engine mode, remote-support AI assistance), OpenAI (external-AI fallback, Luvo engine mode, website chat auto-replies, remote-support AI assistance), Slack (website chat agent relay, console technical support), and payment providers (billing).

(2) Each processor's task, transferred data, country, timing and method, retention period, and how to refuse are listed at /sub-processors, which forms part of this Policy.

(3) Backups of service data are encrypted by us every day before they are stored in Cloudflare R2 (Cloudflare, Inc., United States), and are deleted after 30 days. The decryption key stays on our own key-management server; Cloudflare does not have it.

(4) If an external partner or hardware supplier is used for Enterprise onsite work, we disclose it in the contract or statement of work before the work begins.

(5) Transfer bases: sending an organization's questions to external AI relies on the licence holder's separate consent under PIPA Art.28-8(1)(i), which can be withdrawn in account settings. End-user data processed on a customer's appliance relies on PIPA Art.28-8(1)(iii) (processing or storage needed to perform the contract, with the Art.28-8(2) items disclosed in this Policy). Neither basis is bundled into a consent checkbox.

(6) International transfer in Luvo's engine mode (disclosure under PIPA Art.28-8(2)): the recipient is OpenAI OpCo, LLC or Anthropic, PBC, and the country is the United States and the regions where each runs inference (not pinned to a specific country). Each time you hand Luvo a task, Anexton's server sends, over an encrypted connection, your instructions, the contents of the files to be processed, screen pictures if you turned on sending screen pictures, and the results of the PC tools. The purpose is to understand the request, decide the next action, and fill in documents. Anexton's servers do not store it. Neither company trains models on what it receives. We ask OpenAI not to store it (store=false); OpenAI may keep requests for up to 30 days for abuse monitoring, unless longer retention is required by law or is reasonably necessary to protect our services or any third party from harm. Anthropic deletes inputs and outputs automatically within 30 days; if flagged by automated trust-and-safety systems as violating its Usage Policy, inputs and outputs are kept up to 2 years and classification scores up to 7 years, and longer where the law requires. To refuse the transfer, withdraw the cross-border consent under "Consent & legal" in the web account; features that use external AI then stop working. To stop sending only screen pictures, turn off the screenshot sending option in Luvo Settings > Personal. Contact the privacy officer with any question.

(7) Web search: when Luvo uses web search to answer a question that needs current information, such as weather or exchange rates, the search query the AI writes from your instruction is sent to the AI company (Anthropic or OpenAI), which runs the search through third-party search providers it designates (published in each company's sub-processor list). The query may contain part of your instruction. The names and countries of those providers are in each company's published sub-processor list, and how those providers process the query and how long they keep it follows each company's published notices. How to refuse is the same as above; if you refuse, features that use web search stop working.

8. Your Rights

(1) You may request access, correction, deletion, suspension of processing, or withdrawal of consent in account settings or at privacy@anexton.com, directly or through a legal representative or authorized agent.

(2) We act within the period set by law and may refuse or limit a request where the law allows. Where the law of your country gives you further rights, contact us to exercise them.

(3) Children under 14 cannot sign up, and we do not collect their personal data without parental consent.

9. Security Measures

(1) We maintain an internal management plan, access-right management, access control, encryption of personal data (one-way hashing of passwords), retention and review of access logs, security software, and physical access restrictions.

(2) Passwords, tokens, API keys, and similar credentials are not stored or logged in plaintext.

(3) If we become aware of a personal-data breach, we notify affected data subjects and report to the authorities within 72 hours where the law requires it.

10. Privacy Officer and Remedies

(1) Controller: Anexton · Representative WOOKYU JANG · Business registration no. 679-07-03836 · Address Creative Enterprise Support Center, Keimyung College University, 675 Dalseo-daero, Dalseo-gu, Daegu, Republic of Korea

(2) Privacy officer: WOOKYU JANG · Email privacy@anexton.com · Phone +82-10-5959-9909

(3) Korean users may contact the Personal Information Dispute Mediation Committee, the KISA privacy infringement center, the Supreme Prosecutors' Office, or the National Police Agency.

11. Luvo (desktop app)

(1) Items processed: account information (the Anexton account used to sign in), consent and withdrawal records (document, version, time, language), sign-in session records (issue and revocation times)

(2) Purpose: sign-in, checking terms consent

(3) Retention: while the account exists; consent and withdrawal records are deleted together with the account

(4) Work content (instructions, file contents, screen pictures, results of PC tools) takes one of two routes. With an Anexton account (engine mode), it passes through Anexton's server to OpenAI or Anthropic and Anexton's server does not store it (Section 7). With your own OpenAI key, your PC sends it directly to OpenAI and Anexton does not receive it. Either way, separate consent to the transfer abroad is collected before the app is used. Consent can be withdrawn under "Consent & legal" in the web account

(5) PC check result: in engine mode (using an Anexton account), if Excel, Hangul or Chrome is not installed on this PC, Luvo sends the name of each missing one when a task starts, so the AI does not try to use a program that is not there. It does not send a list, path or version of any other program. These names reach the AI (OpenAI or Anthropic) together with the work content, through Anexton's server.

(6) Usage statistics (numbers only, can be turned off): Luvo sends only numbers and fixed words - the first start after installation, which first-run step was reached, the time until the workspace was first turned on and until the first success, how a task ended with its reason code and duration, which part crashed (manager, host, screen, workspace or setup) and how many times, the result of an update, and the number of times you marked a result as correct or incorrect, with how that task ended and its reason code. The app version is told through the request's User-Agent. The report itself contains no instructions, files, screens, window titles, or anything that points to an account, a PC or a task. The request does carry the signed-in account's token (authentication data used only to check who is sending), and Anexton's server does not link that account to the numbers, counts only totals, and keeps them for 30 days. The account ID is used only for a request limit against abuse (30 per 10 minutes) and is deleted 10 minutes after the last report. The access record that a request leaves (request IP, User-Agent) is the same as the automatically collected items in this Policy. Turn off "Send usage statistics" in Luvo's settings and nothing is sent

12. Changes

(1) This Policy first took effect on July 1, 2026; the current version takes effect on November 3, 2026.

(2) We post any change and its effective date on the website.

(3) Change history: November 3, 2026 — Added to the Luvo usage statistics in Section 11 the number of times a result was marked correct or incorrect (with how that task ended and its reason code, under the same "Send usage statistics" switch). Also added to Section 11 that, when a task starts, Luvo sends the names of programs (among Excel, Hangul and Chrome) that are not installed on this PC, and that these names reach the AI (OpenAI or Anthropic) together with the work content. Corrected how to refuse the international transfer in Section 7 and how to withdraw cookie consent in Section 2 to match the actual settings.November 2, 2026 — Corrected, in the Luvo usage statistics in Section 11, a fact the previous version left out: each report request carries the signed-in account's token (to check who is sending), the account ID is used only for a request limit against abuse (30 per 10 minutes) and is deleted 10 minutes after the last report, and the report itself contains nothing that points to a task. Also described Luvo's web search in Section 7 and in the sub-processor and international-transfer list (/sub-processors): when web search is used, the search query the AI writes from your instruction is sent to Anthropic or OpenAI, which runs the search through third-party search providers it designates (published in each company's sub-processor list). October 31, 2026 — Added Luvo usage statistics (numbers only, can be turned off) to Section 11: the kinds of numbers received (first start, first-run step, time until the workspace was turned on and until the first success, how a task ended with its reason code, which part crashed and how many times, update result), what is not received (instructions, files, screens, window titles, accounts, PCs), that it is not linked to an account, only totals are kept for 30 days, and how to turn it off. October 30, 2026 — Corrected Luvo's consent to transfer abroad (version 2026-10-30) and the work-content route in Section 11 to match what actually happens. Both routes are now described: an Anexton account (through Anexton's server to OpenAI or Anthropic) and your own OpenAI key (your PC directly to OpenAI); the consent text now names Anthropic as a recipient and states each company's training use and retention. Because the version was raised, every account is asked to consent again the next time it uses the app. October 27, 2026 — Added Anthropic as the primary external-AI processor (OpenAI is used when the Anthropic account limits are used up and for requests carrying Google user data). Changed the recipient for Luvo's engine mode to OpenAI or Anthropic, corrected the transfer country of both providers to ‘the United States and the regions where each runs inference (not pinned to a country)’ to match actual processing, added the file contents the AI reads and tool results in AI-employee tasks to the items sent to external AI, and stated Anthropic’s retention (30 days; if flagged for a Usage Policy violation, inputs and outputs up to 2 years and classification scores up to 7 years). October 21, 2026 — Section 4 gained the retention when OpenAI is used (requested with store=false, up to 30 days) and linked-account count monitoring, Sections 7 and 11 gained the disclosure of the international transfer in Luvo's engine mode (recipient, country, items, purpose, retention, how to refuse), Section 5's consent-record sentence now defers to Section 11 for Luvo, and Section 11's retention line matches what actually happens (deleted together with the account), and Section 4's Drive app folder sentence now matches what the product does (the folder is named for the screen language when it is first created; a folder the app already made is reused under its existing name; a folder in the trash is not reused). October 20, 2026 — Section 11 gained Luvo (desktop app): the items processed, purposes and retention for Luvo; that work content (instructions, file contents, screen pictures) is not sent to Anexton servers but sent directly to OpenAI by the user's PC; and that separate consent to the transfer abroad is collected before the app is used and can be withdrawn under "Consent & legal" in the web account. October 20, 2026 — Section 4 gained the Mail report: when you press it, the dates and amounts of invoices and deliveries in your last 30 days of mail are found on the Host Server only and shown on screen; nothing is sent to the AI or Anexton Central Server and nothing is stored (the Google permissions we request are unchanged). October 11, 2026 — Section 4 (Google User Data) now matches the Gmail, Drive, and Calendar permissions we request and what the product actually does. We removed features the product does not have (editing a Drive file you picked, removing auto-sorting rules, and changing events), and added that a Drive file you attach to an AI question and the titles and start times of the events on screen are sent to the AI, that attachments are kept for 7 days, that your questions and the AI answers are kept in your conversation history, and that the stored token is deleted when an administrator deactivates or deletes your account. On the same day, Section 4 gained connecting a Drive folder to AI search (copies and a search index kept on the Host Server, deleted at once when you disconnect or after 30 days with the Google connection lost) and “Disconnect Google” on the Mail, Drive, and Calendar screens (the token is deleted at once and Google is asked to revoke it). On the same day, Section 4’s mail description was corrected to match what the product does (the Mail screen buttons act as soon as you press them and can be undone, opening an unread message marks it as read, a clean-up the AI proposes runs only after you confirm it, and moving to trash is included). We added that the sender, subject, and date of up to 15 messages matching a mail search and the sender and subject of a message you select for the mail assistant are sent to the AI, and Section 7 gained encrypted backup storage of service data (Cloudflare R2, 30 days). On the same day, Section 2 was corrected to match what we do: if you sign up with Google, the name on your Google account is saved as your display name, and if you ask to join a company device when you sign up, the name and department you enter are collected and sent to that device’s administrators. On the same day, Section 2 gained passkeys (public key, credential identifier, authenticator type, and related details) and states that we do not receive biometric data or the private key.