Lightive (the "Company") values your privacy and complies with applicable data protection laws, including Korea's Personal Information Protection Act (PIPA). This Privacy Policy explains how your personal information is collected, used, stored, and protected in connection with the AI writing service "Typetak" (the "Service").
- Data Controller: Lightive / 육민정
- Business Registration No.: 683-18-02375
- Contact: team@typetak.com
- Effective date: July 5, 2026
- Last updated: June 28, 2026
1. Personal Information We Collect
① Account information
- User ID, username (nickname), email address
- Password (stored using one-way encryption; the Company cannot read your plaintext password)
- For social login (Google): Google account identifier, email
- Profile settings (e.g., avatar color)
② Payment information
- Subscription payments are processed through payment service providers (PSPs). The Company does not store full card numbers directly and retains only the minimum information needed to manage payments and subscriptions (e.g., payment status, subscription status, masked card identifiers).
- Payment providers: Toss Payments, LemonSqueezy
③ User content
- Pages you create or upload (manuscripts, documents, including version history), knowledge data (World), custom settings (skills, etc.), comments and notes.
- Your user content belongs to you. The Company does not use it for purposes other than providing the Service (see Sections 4 and 5).
④ Automatically collected information
- IP address, device/browser information, cookies, access logs
- Service usage records, AI feature usage and quotas, time spent per document, etc.
⑤ Analytics information
- Key events such as sign-up, subscription creation/cancellation, and account deletion (PostHog). Your user content (manuscripts, knowledge data) is not sent to analytics tools.
2. How We Collect Personal Information
- Directly provided by you through registration, service use, and customer inquiries
- Automatically generated and collected during service use (cookies, logs, etc.)
3. Purposes and Legal Worlds of Processing
The Company processes personal information for the purposes below; where applicable, the legal bases under laws such as the GDPR are as follows.
| Purpose | Legal basis (e.g., GDPR Art. 6) |
|---|
| Account registration/authentication, service provision | Performance of a contract |
| Payment and subscription management | Performance of a contract |
| Customer support and inquiries | Performance of a contract / Legitimate interests |
| Service security, fraud prevention | Legitimate interests |
| Service quality improvement (excluding content; aggregate/statistics) | Legitimate interests |
| Compliance with legal obligations (e-commerce record retention, etc.) | Legal obligation |
| Marketing/newsletter (optional) | Consent |
4. AI Processing and User Content
To provide AI writing assistance, the Service transmits user content to third-party AI (large language model, "LLM") providers for processing, only as required by the tasks you request.
① Third-party AI providers we use
- We primarily use Anthropic (Claude), OpenAI (GPT), and Google (Gemini), and you can choose the model. Additional AI providers may be used depending on Service operation.
② Data transmitted to AI
- When you use AI features (writing, proofreading, chat, etc.), the following may be transmitted as needed for the task: the manuscript content being worked on, relevant knowledge data, writing style and guidance, conversation history, and files you attach or reference.
③ No training on your content
- The Company does not use your content to train (or fine-tune) AI models.
- The Company uses third-party AI providers that process your content only under terms that do not permit using such content to train models (each provider's business/API terms).
- Both the input to and the output from the AI are treated as your data.
④ Data retention by AI providers
- Each AI provider may process and retain data for a limited period under its own policy. Please refer to each provider's privacy policy:
5. Third-Party Provision and Sub-processors
The Company does not, as a rule, sell or share your personal information with third parties, and entrusts processing to the sub-processors below only as necessary to provide the Service. The Company enters into agreements with each sub-processor that include obligations of data protection, confidentiality, and no use for model training.
| Sub-processor | Purpose | Processing location |
|---|
| Anthropic, OpenAI, Google (and additional AI providers) | AI writing assistance | United States, etc. |
| Amazon Web Services (AWS) | Server hosting, database, email delivery | Seoul (Korea) |
| Weaviate | Semantic search of content (vectors) | [to be confirmed] |
| Toss Payments | Domestic payment processing | Korea |
| LemonSqueezy | International payment processing | United States |
| PostHog | Product usage analytics | [to be confirmed] |
| Sentry | Error tracking (frontend) | United States, etc. |
The Company does not "sell" or "share" personal information within the meaning of the California Consumer Privacy Act (CCPA/CPRA).
6. International Data Transfers
Your data is, by default, stored in the AWS Seoul region (Korea). However, to provide AI writing features, your user content may be transferred to AI providers located in the United States or elsewhere. For such international transfers, the Company seeks to apply appropriate safeguards required by applicable law, such as the EU Standard Contractual Clauses (SCCs).
7. Retention and Account Deletion
- Upon account withdrawal, the Company deletes your personal information and user content. It may be retained for a limited period (approximately 30 days) for recovery before permanent deletion.
- When you delete content such as pages or knowledge data, it is moved to the archive and kept until you permanently delete it yourself. It is not removed for the passage of time alone, and you can restore it from the archive, or permanently delete it, at any time.
- Upon account withdrawal, all user content is deleted under the withdrawal terms above, including content held in the archive.
- Semantic-search vector data is deleted together with user content under the withdrawal terms above.
- If you have an active subscription, account deletion is available after the subscription is cancelled.
- Information subject to "Retention Required by Law" below is retained for the applicable period.
Retention Required by Law
| Records | Reason | Retention period |
|---|
| Records on contracts or withdrawal of subscription | Act on Consumer Protection in Electronic Commerce | 5 years |
| Records on payment and supply of goods | Act on Consumer Protection in Electronic Commerce | 5 years |
| Records on electronic financial transactions | Electronic Financial Transaction Act | 5 years |
| Records on consumer complaints or dispute resolution | Act on Consumer Protection in Electronic Commerce | 3 years |
8. Security Measures and Breach Notification
- Personal information is protected through technical and administrative measures such as encryption in transit and at rest and access controls, with regular security reviews.
- In the event of a personal data breach, the Company will notify affected users without undue delay and take necessary measures in accordance with applicable law.
9. Use of Cookies
- The Company uses cookies for personalized service and statistical analysis.
- You can refuse cookies through your browser settings, but some Service features may be limited.
10. Your Rights and How to Exercise Them
You may exercise the following rights regarding your personal information:
- Request access, correction, deletion, and restriction of processing
- (Where GDPR applies) Request data portability, objection to processing, and withdrawal of consent
- (California residents) Access/deletion, opt-out of sale/share, and the right not to be discriminated against
To exercise your rights, contact team@typetak.com. The Company will respond within the period required by applicable law. You also have the right to lodge a complaint with the competent supervisory authority (e.g., an EU member state authority).
11. Children and Sensitive Information
- The Service is not directed to children under the age of 14 (or the minimum age set by the laws of your region), and the Company does not knowingly collect their personal information.
- The Company does not collect sensitive information (special categories of personal data), and we recommend that you do not enter sensitive information into the Service.
12. Changes to This Privacy Policy
- If this Policy changes, the Company will provide advance notice via the website or email before the effective date. The revised Policy takes effect on the announced effective date.
[Supplementary Provisions]
This Privacy Policy is effective from July 5, 2026.