This English version is provided for convenience. In case of any conflict, the Korean version prevails.
HyperReality Co., Ltd. (the "Company") complies with the Personal Information Protection Act and other applicable laws in providing Knoverse (the "Service"). This Privacy Policy explains what personal information the Company processes, why, for how long, and to whom it entrusts or provides that information.
At a Glance
| Topic | Details |
|---|---|
| Information we collect | Google account email, name, and profile image; Service usage records; books, PDFs, notes, and documents that members upload to their library |
| How we use it | Sign-in, providing library and study features (including page text conversion and chapter summaries), team management, customer support, security |
| Who we entrust it to | Sign-in, file storage, AI summaries, and email — see Articles 4 and 5 |
| Retention | Until account deletion. Only records required by law are kept for the periods the law prescribes |
| Contact | Chief Privacy Officer Juyoung Kang · ben@hyperreality.gg |
The Company's Role — Personal Libraries and Team Spaces
The Service is primarily used by individuals as their own knowledge space, and members may also create teams to use it together. The Company's role depends on where content is uploaded.
| Information | Company's role | Governing document |
|---|---|---|
| Member account information, access logs, notifications, inquiries | Personal information controller — the Company determines the purposes and means of processing | This Privacy Policy |
| Content a member uploads to their personal space (a library only they can see) — book and PDF files and their page images and converted text, tables of contents, notes, chapter summaries, study documents | Personal information controller — processed as the member's own content solely to provide the Service to that member | This Privacy Policy; Terms of Service (Member Content clause) |
| Content a member uploads to a team space (a space shared with team members) | Processor — processed solely to provide the Service, on the instructions of that team (the "Customer") | The Customer's privacy policy; Terms of Service (Member Content clause) |
Please direct requests to access or delete personal information contained in team space content to the owner of that team first. If such a request is sent to the Company, we will forward it to the team owner.
Article 1 (Personal Information Processed, Purposes, Legal Bases, and Retention Periods)
| When | Items | Purpose | Legal basis | Retention period |
|---|---|---|---|---|
| Sign-up and sign-in (Google Sign-In) | Email, name, profile image URL, Google account identifier | Member identification, sign-in, notices | Performance of contract (Article 15(1)4 of the Act) | Until account deletion |
| Using the library | Titles, authors, and notes of items registered by the member; uploaded files (books, PDFs) and their file names and sizes; page images, page text (including OCR), and tables of contents generated from files; notes and highlights written by the member; chapter summaries; study documents | Providing library, reading, practice question, and summary features | Performance of contract | Until the member deletes it or deletes their account |
| Team management | Team name, team member roles, invitee email addresses, inviter | Sending team invitation emails, processing team membership and permissions | Performance of contract | Until leaving or deleting the team (invitations become unusable after 7 days and are deleted if cancelled) |
| Notifications | Notification type, title, content, read status | Providing the in-Service notification inbox | Performance of contract | Until account deletion |
| Issuing access tokens (MCP) | Token name, token hash, token prefix, last-used time, revocation time | Connecting an AI tool of the member's choice to their library, security auditing | Performance of contract | Until the token is revoked or the account is deleted |
| Using the Service | Access IP, browser information (User-Agent), access time, error records (server access logs) | Security, prevention of fraudulent use, incident response | Legitimate interests (Article 15(1)6 of the Act) | 1 year (access records are kept for at least 3 months under the Protection of Communications Secrets Act) |
| Customer inquiries | Email, inquiry content, attachments | Responding to inquiries, handling disputes | Performance of contract | 3 years after resolution |
| Paid payments | Not applicable — the Service does not currently accept paid payments. This Privacy Policy will be amended if paid payments are introduced | — | — | — |
Records retained under applicable law are stored separately from other information and used only for that purpose.
| Record | Period | Legal basis |
|---|---|---|
| Records on contracts or withdrawal of subscription (if paid payments are introduced) | 5 years | Act on the Consumer Protection in Electronic Commerce |
| Records on payment and supply of goods (if paid payments are introduced) | 5 years | Act on the Consumer Protection in Electronic Commerce |
| Records on consumer complaints or dispute resolution | 3 years | Act on the Consumer Protection in Electronic Commerce |
| Website visit (sign-in) records | 3 months | Protection of Communications Secrets Act |
Article 2 (Processing of Member Content)
- The Company processes content uploaded by members solely to provide the Service (page image and text conversion, table of contents and summary generation, search, practice questions), maintain security, and comply with law, and does not use it for any other purpose or provide it to third parties.
- Content in a personal space can be viewed only by the member who uploaded it. Even the owner or administrators of the same team cannot view it.
- Content uploaded to a team space can be viewed by members of that team. If team space content contains another person's personal information, the team (Customer) is responsible for securing a legal basis to collect that personal information and for notifying the data subject.
- When a member deletes content or deletes their account, the Company destroys that content. Before deleting their account, members can download their content within the Service. Copies remaining in backups are deleted according to the backup cycle (up to 30 days).
Article 3 (AI Features)
- The Service provides generative AI features (chapter summaries of books).
- When a chapter summary is generated, the converted text of that chapter is sent to an AI provider (see cross-border transfer in Article 5). The Company stores the resulting summary in the member's library and does not separately retain the text sent to generate it.
- When a member uses an access token to connect their own AI tool (for example, Claude or another AI client that supports MCP) to their library (direct connection), library content is sent to that tool to the extent the member instructs. Processing by that tool and its provider is governed by the terms between the member and that provider. Summaries and study documents created through this route are also stored in the member's library.
- If an AI summary is inappropriate or incorrect, please let us know at ben@hyperreality.gg. We will review it, take action, and reply with the outcome.
- Please do not upload content containing sensitive information such as resident registration numbers or health information.
Article 4 (Entrustment of Personal Information Processing)
| Processor | Entrusted task |
|---|---|
| Google LLC | Google account sign-in (authentication) |
| Cloudflare, Inc. | Storage of files uploaded by members (books, PDFs) and page images (Cloudflare R2) |
| Amazon Web Services, Inc. | Sending emails such as team invitations (Amazon SES) |
| HyperReality Co., Ltd. (self-operated cloud "zerocloud") | Operating Service servers and databases, connecting file storage, generating page images and converting text (OCR), relaying AI requests |
| An AI provider selected by the Company from among Anthropic PBC · OpenAI, L.L.C. · Google LLC | Generating chapter summaries |
| Domestic payment gateway | Not applicable (to be amended if paid payments are introduced) |
If processors change, the Company will amend and announce this Privacy Policy.
Article 5 (Cross-Border Transfer of Personal Information)
To provide the Service (performance of contract), the Company entrusts the storage and processing of personal information overseas as set out below (Article 28-8(1)3 of the Act). Transfers occur over the network when the Service is used.
| Recipient (contact) | Country | Items | Purpose | Retention period | How to refuse and effect of refusal |
|---|---|---|---|---|---|
| Google LLC (privacy.google.com) | United States | Email, name, profile image, Google account identifier | Google Sign-In | Until account deletion | You may refuse by not signing up. Since Google is currently the only sign-in method, you cannot use the Service if you refuse |
| Cloudflare, Inc. (cloudflare.com/privacypolicy) | United States (stored in Cloudflare data centers) | Files uploaded by members, page images, file names | File storage | Until the member deletes it or deletes their account | No transfer occurs if you do not upload files. You can still register items and notes without files |
| A provider selected by the Company from among Anthropic PBC (privacy@anthropic.com) · OpenAI, L.L.C. (privacy@openai.com) · Google LLC (privacy.google.com) | United States | Converted text of the chapter to be summarized, generated summary | Generating chapter summaries | Deleted after up to 30 days under the provider's policy; not used for training | No transfer occurs if you do not request chapter summaries. All other features remain available |
| Amazon Web Services, Inc. (aws.amazon.com/compliance/contact) | Republic of Korea (Seoul Region) — not a cross-border transfer | Recipient email, email content | Sending emails | After sending, per AWS policy | — |
Article 6 (Provision of Personal Information to Third Parties)
The Company does not provide personal information to third parties except with the data subject's consent or where specifically required by law. Since the Service does not currently accept paid payments, there is no provision to third parties for payment purposes (not applicable). If overseas payments (e.g., Paddle) are introduced, the Company will amend this Article and obtain consent on the payment screen.
Article 7 (Destruction of Personal Information)
- Personal information is destroyed without delay once the retention period ends or the purpose has been achieved.
- Electronic files are deleted in a manner that prevents recovery, and paper documents are shredded or incinerated.
- After account deletion, information is retained for 30 days to allow recovery in case of accidental deletion, and is then destroyed. Records required to be kept by law are stored separately for the periods set out in Article 1.
Article 8 (Cookies and Other Automatic Collection Tools)
- The Service uses essential cookies (sign-in tokens) to keep you signed in.
- The Service does not use cookies or tracking tools for visit analytics or advertising.
- You can refuse cookies in your browser settings. If you refuse essential cookies, you will not stay signed in.
- Chrome: Settings → Privacy and security → Third-party cookies
- Safari: Settings → Privacy
Article 9 (Children Under 14)
The Service does not accept sign-ups from children under the age of 14. If a user is found to be under 14, the account will be deleted without delay.
Article 10 (Rights of Data Subjects and How to Exercise Them)
- Data subjects may at any time request access to, correction or deletion of, suspension of processing of, or transmission of their personal information, or withdraw consent.
- You may delete content directly within the Service, or send a request to ben@hyperreality.gg, which will be handled within 10 days. Account deletion may also be requested at this address.
- These rights may also be exercised through a representative (legal representative or authorized person). In that case, a power of attorney must be submitted.
- Deletion cannot be requested for information that other laws require to be retained.
Article 11 (Automated Decisions)
The Company does not make decisions that significantly affect the rights or obligations of data subjects in a fully automated manner. When an account is restricted through fraud detection, a person reviews it.
Article 12 (Security Measures)
- Administrative: establishing an internal management plan, minimizing personnel with access, regular inspections
- Technical: access control (personal space content viewable only by the uploading member), encryption in transit (HTTPS), encrypted storage of external integration credentials, storing access tokens only as hashes, retaining access records
- Physical: access control for servers and data storage locations
Article 13 (Chief Privacy Officer)
- Chief Privacy Officer: Juyoung Kang (CEO)
- Email: ben@hyperreality.gg
- Phone: 0507-0178-7546
Article 14 (Remedies for Infringement of Rights)
If you need counseling or dispute resolution regarding infringement of personal information, you may contact the following organizations.
- Personal Information Infringement Report Center (Korea Internet & Security Agency): privacy.kisa.or.kr / 118 (no area code)
- Personal Information Dispute Mediation Committee: www.kopico.go.kr / 1833-6972
- Supreme Prosecutors' Office Cyber Investigation Division: www.spo.go.kr / 1301 (no area code)
- Korean National Police Agency Cyber Investigation Bureau: ecrm.police.go.kr / 182 (no area code)
Article 15 (Changes to This Privacy Policy)
- This Privacy Policy is effective as of 2026-10-12.
- If its contents change, the Company will announce the change on the Service screen 7 days before it takes effect. Changes material to data subjects' rights, such as adding collected items or providing information to third parties, will be announced 30 days in advance, and consent will be obtained again where necessary.
- Previous versions of this Privacy Policy are available under "Previous versions" at the bottom of this page.