Last Updated: October 20, 2026 (effective October 27, 2026)
Anvel (the "Company") collects the following personal information to provide the CALEUP service (website, desktop app, and iOS/Android mobile apps). • Required Information - During registration: Email address, password, name - During service use: Project information, task details, team information - During payment: Payment information (processed through payment gateway) • When you sign in with a social account - Google sign-in: Google account identifier, email address, name, profile photo - Sign in with Apple: Apple user identifier, email address (or the private relay address Apple creates if you choose Hide My Email), and name (if Apple provides it on your first sign-in) - The token Apple issues is used to confirm your sign-in, and when you delete your account we ask Apple to revoke it. • When you use certain features (optional) - Attendance (web and desktop): Check-in/check-out records and, if you allow location access in your browser, your location (latitude and longitude) at check-in/check-out - If you allow notifications in the mobile app: Device push token (Firebase Cloud Messaging registration token) and device type (iOS or Android) - If you report an AI answer: your member ID, a copy of the reported AI answer, the reason and any description you write, and the related channel and workspace • Automatically Collected Information - Service usage records, access logs, cookies, IP address - Device information (OS, browser type, etc.) - Error reports: When an error occurs on screen, the error message and where it occurred (stack trace), page path, platform (web, desktop, iOS, Android), app version, and your member ID if you are signed in - Website usage statistics via Google Analytics (page views, scrolls, clicks, etc.). Not collected in the mobile app. - User behavior analysis via Microsoft Clarity (session recordings, heatmaps, etc.). Not collected in the mobile app.
The Company uses collected personal information for the following purposes: • Member Management - Member identification and verification - Customer inquiry and complaint handling • Service Provision - Project management and collaboration services - AI-powered workflow automation - Chat and notification services (including mobile app push notifications) • Service Improvement - Service usage statistics analysis - Finding and fixing the causes of errors - New service development and personalized services
In principle, the Company destroys personal information without delay after the purpose of collection and use is achieved. • Upon membership withdrawal (account deletion): Destruction without delay. If you delete your account yourself via "Delete account" at the bottom of the profile screen in the app or on the web, it is processed immediately. If you request it by email, it is processed within 7 days of the request. See the Account Deletion page (https://caleup.ai/account-deletion) for the steps. - Deleted or made unidentifiable: Account information such as name, email, profile photo, and phone number; sign-in methods (including social sign-in links) and sign-in tokens; mobile push tokens; external service integrations and their stored tokens; EVEN personal memory and custom instructions; personal search data (including search vectors); your AI answer reports; and your personal workspace - A workspace where you are the last owner and that has never had other members is deleted together with your account, and any paid subscription of that workspace is canceled so that it is not charged from the next billing date. A workspace that had other members in the past is not deleted, even if you are now the only one left, so that its members' work records are preserved. It remains without an owner, and only the auto-renewal of its paid subscription is canceled so that it is not charged from the next billing date. If you are the last owner of a workspace that still has other members (including guests), you can delete your account after transferring ownership. - Retained: Messages, tasks, comments, and attachments left in workspaces shared with other members remain as that workspace's records, with the author shown as "Deleted user." • Mobile push tokens: We delete a device's token when you sign out on it, a token that is no longer valid (for example, after the app is removed), and all of your tokens when you delete your account. • Server logs such as access logs and error reports: Kept for 7 days, then deleted automatically. • However, when preservation is required by law: - Records on contracts or withdrawal: 5 years - Records on payment and supply of goods: 5 years - Records on consumer complaints or dispute resolution: 3 years
In principle, the Company does not provide users' personal information to third parties. However, exceptions are made in the following cases: • When users have given prior consent • When required by law or requested by investigative agencies in accordance with legal procedures
The Company consigns personal information processing as follows for smooth service provision: • Cloud Service Providers (AWS, Google Cloud, etc.) - Consigned work: Data storage and server management - Retention period: Until membership withdrawal or termination of consignment contract • Amazon Web Services, Inc. (Amazon SES) - Consigned work: Sending service emails (sign-up confirmation, invitations, notifications, etc.) - Processing location: Asia Pacific (Seoul) region - Retention period: Until membership withdrawal or termination of consignment contract • NICE Payments Co., Ltd. (NICEPAY) - Consigned work: Domestic (Korean) card payments and recurring billing - Retention period: Until termination of consignment contract (records the law requires us to keep are retained for the required period) • Paddle.com Market Ltd (United Kingdom) - Consigned work: Reseller for international card payments (Merchant of Record): collecting payment, calculating taxes, and processing payments - Retention period: Until termination of consignment contract (records the law requires us to keep are retained for the required period) - See Section 7 for the overseas transfer. • AI model providers: Google LLC (Gemini), Anthropic PBC (Claude), OpenAI, L.L.C. (GPT, embeddings) - Consigned work: Generating AI responses and creating vectors for search - Retention period: As set out in each provider's API terms - See Sections 6 and 7 for details. • Qdrant Solutions GmbH (Qdrant Cloud, vector database) - Consigned work: Storing the vector index (numerical representations of text) used for search - Server location: United States (Oregon) - Retention period: Until membership withdrawal or termination of consignment contract - See Section 7 for overseas transfer. • Google LLC (Firebase Cloud Messaging) - Consigned work: Sending mobile app push notifications (notifications to iPhone and iPad are passed by Firebase Cloud Messaging to Apple Inc.'s Apple Push Notification service) - Information processed: Device push token, notification title and body (sender name and a preview of the message or notification), and the screen to open when the notification is tapped - Retention period: As long as needed to deliver the notification (as set out in Firebase's terms) - See Section 7 for overseas transfer. • Google LLC (Google Analytics) - Consigned work: Website usage statistics analysis (page views, user behavior analysis, etc.) - Information collected: Cookies, anonymized IP address, browser/device information, page visit history - Retention period: In accordance with Google Analytics data retention policy (up to 14 months) - Google Privacy Policy: https://policies.google.com/privacy • Microsoft Corporation (Microsoft Clarity) - Consigned work: User behavior analysis (session recordings, heatmaps, click pattern analysis, etc.) - Information collected: Cookies, mouse movements, clicks, scrolls, page navigation history, browser/device information - Retention period: In accordance with Microsoft Clarity data retention policy (up to 30 days) - Microsoft Privacy Policy: https://privacy.microsoft.com/privacystatement
When you use the Service's AI features (EVEN, summaries, translation, and search), what you enter and the Service data needed for the response (work content such as chat messages, files, documents, and task descriptions) are sent to the external AI model providers the Company uses to generate responses. • Providers that receive the data - Google LLC (United States): Gemini - Anthropic PBC (United States): Claude - OpenAI, L.L.C. (United States): GPT, embeddings - For EVEN responses, summaries, and translation, we send the request to Google (Gemini) or Anthropic (Claude) depending on the feature. If no response is received, we may resend it to the other providers above in turn. • Vectorization for search - To provide search, we send text from tasks, chat messages, documents, and similar records to the embedding model (text-embedding-3-small) of OpenAI, L.L.C. (United States) to convert it into numerical representations (vectors). This happens automatically when a record is created or edited, even if you do not use AI features yourself. - The resulting vectors are stored in the vector database (Qdrant Cloud, servers in Oregon, United States) the Service uses for search. - If you allow an integration with an external service, information retrieved through that integration is vectorized in the same way. • Handling by the providers - How each provider handles the data sent to it (including whether it is used for model training) is governed by that provider's API terms and privacy policy. The Company does not guarantee that a provider will not handle the data beyond what those terms provide. • Notice and consent record - After you sign in, the app, website, and desktop app show a notice explaining the information above (that AI features send messages, files, and work content to external AI providers) and ask for your consent. The date and time you consented and the version of the notice are recorded in your account and kept. - If you do not consent, you cannot use the Service; from that notice you can sign out or delete your account. Even after consenting, you can request that processing be stopped at privacy@caleup.ai. • Using AI features is optional. If you do not want your input sent to overseas providers, please do not use AI features. Note that when other members of the same workspace use AI features, messages and tasks you wrote may be sent to the extent needed for their responses, and vectorization for search happens automatically as described above. See Section 7 for the overseas transfer and how to refuse it.
To provide the Service, the Company transfers personal information overseas (consignment of processing and storage) as described below. These are consignments of processing and storage necessary to perform our contract with you, disclosed in this Privacy Policy under Article 28-8(1)(3) of the Korean Personal Information Protection Act. • Where Service data is stored - Service data is stored on servers in the Amazon Web Services Asia Pacific (Seoul) region. This is not an overseas transfer. - Profile images and similar files may be temporarily copied to Amazon CloudFront edge locations outside Korea to speed up delivery. • Google LLC - Contact: https://policies.google.com/privacy (privacy contact information) - Destination country: United States - Items transferred: Your input when using AI features and the Service data needed for the response (chat messages, documents, task content, and any names they contain) - When and how: Each time you use an AI feature, sent via API over encrypted connections (TLS) - Purpose: Generating AI responses - Retention period: As set out in Google's API terms • Anthropic PBC - Contact: https://www.anthropic.com/legal/privacy (privacy contact information) - Destination country: United States - Items transferred: Your input when using AI features and the Service data needed for the response (chat messages, documents, task content, and any names they contain) - When and how: Each time you use an AI feature, sent via API over encrypted connections (TLS) - Purpose: Generating AI responses - Retention period: As set out in Anthropic's API terms • OpenAI, L.L.C. - Contact: https://openai.com/policies/privacy-policy (privacy contact information) - Destination country: United States - Items transferred: Text from tasks, chat messages, documents, and similar records that is vectorized for search, and, when the other providers do not respond, your input when using AI features and the Service data needed for the response - When and how: Automatically when a record is created or edited, and when you use AI features, sent via API over encrypted connections (TLS) - Purpose: Creating vectors for search and generating fallback AI responses - Retention period: As set out in OpenAI's API terms • Qdrant Solutions GmbH (Qdrant Cloud) - Contact: https://qdrant.tech/legal/privacy-policy/ (privacy contact information) - Destination country: United States (servers in Oregon) - Items transferred: Search vectors (numerical representations of text) and the internal identifiers that scope search (member, organization, project, and channel IDs, record type and date). The original text is not sent. - When and how: Automatically when a record is created or edited, sent via API over an encrypted connection (TLS) - Purpose: Storing and searching the vector index used for search - Retention period: Until the original record is deleted or membership is withdrawn, or until the consignment contract ends • Paddle.com Market Ltd - Contact: https://www.paddle.com/legal/privacy (privacy contact information) - Destination country: United Kingdom - Items transferred: Name, email address, billing country and city, subscription plan, and billed amount (payment details such as card numbers are collected directly by Paddle) - When and how: When you pay by international card (Paddle checkout), sent through the checkout and via API - Purpose: Payment processing, recurring billing, fraud detection, and record keeping required by law - Retention period: As set out in Paddle's privacy policy and applicable laws • Google LLC (Firebase Cloud Messaging) - Contact: https://policies.google.com/privacy (privacy contact information) - Destination country: United States - Items transferred: Device push token, notification title and body (sender name and a preview of the message or notification), and the screen to open when the notification is tapped - When and how: If you allow notifications in the mobile app, sent via API over encrypted connections (TLS) each time a notification is created. Notifications to iPhone and iPad are delivered through Apple Inc.'s (United States) Apple Push Notification service. - Purpose: Sending mobile app push notifications - Retention period: As long as needed to deliver the notification (as set out in Firebase's terms) • Google LLC (Google Analytics), Microsoft Corporation (Microsoft Clarity) - Destination country: United States - Items transferred and retention: The cookie identifiers, IP address, browser and device information, and page visit and on-screen interaction records described in Sections 5 and 11 - When and how: Sent automatically from your browser when you use the website or the desktop app. Not sent from the mobile app. - Purpose: Usage statistics and improving our screens • How to refuse the overseas transfer and what happens if you do - AI features: If you do not use them, your input is not sent. In that case, AI features are unavailable to you. - Vectorization for search and transfers caused by other members' use of AI features: These are core processing of the Service and cannot be turned off individually. If you do not want them, you can request that processing be stopped at privacy@caleup.ai or withdraw your membership; in that case, your use of the Service may be limited. - International card payments: If you do not pay for a paid plan, or you pay with NICEPAY (domestic) when it is shown at checkout, no data is sent to Paddle. - Mobile push notifications: If you do not allow notifications in the app, no push token is registered and nothing is sent. If you already allowed them, the device's token is deleted when you sign out. In that case, you will not receive mobile push notifications. - Analytics tools: You can refuse them at any time via "Cookie preferences" in the website footer, with no effect on your use of the Service. The mobile app does not use analytics tools.
Users can exercise the following rights at any time: • Request to view personal information • Request to correct personal information • Request to delete personal information • Request to stop processing personal information Users can modify or delete their personal information directly on the settings page or request through customer service. • Account deletion: You can delete your account yourself via "Delete account" at the bottom of the profile screen in the app or on the web. If you cannot sign in, you can request deletion by emailing privacy@caleup.ai from the email address you signed up with. See the Account Deletion page (https://caleup.ai/account-deletion) for the steps and what is deleted. • Push notifications: You can turn them off at any time in your device settings.
The Company takes the following measures to safely manage users' personal information: • Technical Measures - Encryption of personal information - Installation and periodic updates of security programs - Access rights management • Administrative Measures - Minimization of personal information handlers and training - Establishment and implementation of internal management plans
The Company has designated the following Privacy Officer to oversee personal information processing and handle complaints and remedies: • Data Controller (Business) - Company: Anvel - Representative: Avah Kim - Business Registration No.: 575-02-03830 - Address: 402-292A, 4F, 16, Sure-ro 116beon-gil, Wabu-eup, Namyangju-si, Gyeonggi-do, Republic of Korea - Tel: 010-3084-3501 - Email: contact@caleup.ai • Privacy Officer - Name: Avah Kim - Title: Representative - Email: privacy@caleup.ai - Tel: 010-3084-3501 Users can contact the Privacy Officer regarding any privacy-related inquiries, complaints, or remedies arising from the use of the Company's services.
The Company uses the following web analytics tools on the website and in the desktop app to improve services and enhance user experience. The mobile app (iOS/Android) does not load these analytics tools. • Google Analytics (GA4) - Uses cookies (_ga, _ga_*, etc.) to analyze how users interact with the website. - Information collected: Page views, visit duration, scroll depth, click events, traffic sources, etc. • Microsoft Clarity - Analyzes website usage patterns through session recordings and heatmaps (cookies: _clck, _clsk, etc.). - Information collected: Mouse movements, clicks, scrolls, page navigation history, etc. - Clarity automatically masks sensitive input fields such as passwords and financial information. • How to opt out - You can refuse analytics cookies at any time via "Cookie preferences" in the website footer. When refused, analytics cookies are deleted and collection stops. - You can also block cookies in your browser settings, or install the Google Analytics opt-out browser add-on (https://tools.google.com/dlpage/gaoptout). - Some third-party domain cookies (e.g., Clarity's CLID) can only be removed through your browser settings. • Local storage - For service operation, we store your login session, language/theme preferences, and first-visit traffic source (firstTouchUtm) in your browser's local storage. The mobile app also keeps the push token in app storage so it can unregister the device when you sign out. Collected information is processed anonymously and is not used to directly identify individuals.
The CALEUP mobile app (iOS/Android) uses the permissions below. All of them are optional. If you do not allow one, you can still use the parts of the Service that do not need it. • Notifications (optional) - Purpose: Receiving push notifications such as new messages and alerts - If allowed, the device push token is registered with our server (Sections 1, 5, and 7). • Camera and photos (optional) - Purpose: Used only when you attach a photo or file to a message or your profile. Only the files you choose are uploaded. • The mobile app does not request location or microphone access. • Changing permissions: You can allow or turn off CALEUP's permissions at any time in your device's Settings app.
This Privacy Policy is effective from October 27, 2026 (the previous policy applied from October 14, 2026 to October 26, 2026). Any additions, deletions, or corrections to the policy will be announced through notices at least 7 days prior to the implementation of changes.
For privacy-related inquiries, please contact privacy@caleup.ai.