Privacy Policy

1. Information we collect and why

We collect only what the Service needs. Platform data is received through official APIs and only for accounts you connect yourself. We never ask for your platform passwords.

2. Connecting platforms and permissions

• Threads and Instagram are connected through Meta's official APIs. We read only the connected account's data and the comments and mentions on that account's content.
• Inbox replies, hiding and deletion run when you press the corresponding button. Synex does not automatically engage with unrelated accounts' posts.
• For a keyword campaign you enable, a matching comment on the designated post of your own connected Instagram professional account can automatically trigger each selected action: a public reply, a resource DM, or both. If the follow check is selected, the first instruction DM has no resource. A reply with the confirmation code triggers an actual follow lookup and a resource DM for followers. Non-followers are asked to follow and reply with the same code again. Processing stays within 24 hours of the reply. These confirmation replies are processed, but this is not a general conversational chatbot. AI public replies require the same recorded, unrevoked consent for the current AI provider used by inbox AI drafts; enabling a campaign is a separate action.
• YouTube uses read-only scopes (youtube.readonly, yt-analytics.readonly). Synex never writes to YouTube; you reply to YouTube comments in YouTube Studio through a link.
• We record the permissions each channel actually granted. You can review them or disconnect in Settings › Channels.

3. YouTube API Services

Synex uses YouTube API Services. By connecting a YouTube channel you agree to be bound by the YouTube Terms of Service, and the Google Privacy Policy also applies.

• YouTube Terms of Servicehttps://www.youtube.com/t/terms
• Google Privacy Policyhttps://policies.google.com/privacy
• Google security settings (revoke access)https://security.google.com/settings/security/permissions

• What we collect: your connected channel's information, video list and metadata, public comments on your videos, and YouTube Analytics reports.
• How we use it: we show it to you in your dashboard, archive and inbox, labeled "Provided by YouTube". We never sum it with other platforms' metrics or turn it into scores, multiples or rankings.
• Sharing: we do not sell or share YouTube data with third parties and we never send it to AI services. Only you and team members you invite can see it.
• Storage and refresh: tokens are stored encrypted. Video titles, descriptions and comments are refreshed within 30 days and deleted comments are removed. Access to analytics data is re-verified every 30 days.
• Revoking access: disconnect YouTube in Settings › Channels, or remove Synex's access in your Google security settings. When you disconnect we revoke the token and delete the data within 24 hours; if you revoke access at Google we delete it within 7 days after detecting the revocation.

Synex's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

• Google API Services User Data Policyhttps://developers.google.com/terms/api-services-user-data-policy

4. AI processing

"Draft with AI" in the inbox runs only when you press it, and you review, edit and send the draft yourself. The first time you use it we tell you the AI provider and what is sent, and record your consent with a timestamp.

An enabled Instagram keyword campaign can generate and post an AI public reply automatically after a matching comment, subject to the account, post and campaign conditions above. It uses the same recorded consent for the current AI provider as inbox AI drafts; this consent must not have been revoked. Campaign activation is separate from AI consent. Only replies that pass safety checks are posted; if no reply passes, nothing is posted and no fixed fallback reply is substituted.

• Microsoft hosts Azure OpenAI; this route does not use the direct OpenAI, Anthropic or Google AI APIs. Microsoft says prompts and responses are not used to train foundation models without permission or instruction.
• YouTube data is never sent to AI.
• AI never produces the numbers you see. Every figure is a platform-provided value or a calculation from it.

The current gpt-5-mini deployment is Global Standard. Its East US 2 resource location does not restrict inference to the United States. Prompts and responses may be processed in any geography where the model is deployed. Exact transfer countries, contracting entity and applicable retention terms remain under review.

Default Azure abuse monitoring applies: flagged prompts and responses can undergo automated review and, in some cases, storage and review by authorized Microsoft staff. We do not promise zero data retention or deletion of all AI-provider records within 30 days. See Microsoft's current terms below.

• Microsoft Azure OpenAI — data privacyhttps://learn.microsoft.com/en-us/azure/foundry/responsible-ai/openai/data-privacy
• Microsoft Azure OpenAI — abuse monitoringhttps://learn.microsoft.com/en-us/azure/foundry/openai/concepts/abuse-monitoring

5. Retention

6. Deletion

The deletion deadlines above apply to primary service data. PostgreSQL backups use Azure Korea South GRS storage. Base blobs become lifecycle deletion targets more than 28 days after modification; previous versions become targets more than 28 days after creation. Blob/container soft-delete retention is configured to 7 days. Lifecycle processing is asynchronous, so this is not a guarantee of complete deletion within 35 days.

• Data deletion instructions and status check

7. Push notifications and promotional messages

• We process your device push token and delivery records to send notifications. When you sign out, delete your account or turn notifications off, we immediately unregister and delete that device's token.
• Expo relays notifications to Apple APNs for iOS or Google FCM for Android for delivery to your device. Along this route, notification payloads can include connected-channel identifiers, commenter usernames, post/comment excerpts and notification action data, as well as device delivery identifiers and title/body. You can turn app notifications off in Settings.
• Promotional messages (new features, offers, trial-ending notices, etc.) are sent only if you separately turn on "Consent to promotional messages (push and email)". Allowing notifications on your device is not this consent.
• Promotional push messages between 9 p.m. and 8 a.m. are sent only with a separate night-time consent.
• Promotional messages start with (광고) [Ad] in the title and body and include how to opt out. We confirm every consent, refusal and withdrawal right away and remind you of your consent every two years.
• You can withdraw consent at any time in Settings › Notifications.

8. Sharing with third parties

We do not sell your personal information. To carry out your requests, including the Instagram keyword campaigns you enable, we send the relevant reply or material message to Meta. Service providers process data for the purposes described below. We may disclose information when required by law, following the applicable procedure.

9. Processors (PIPA Article 26)Legal review required

The table describes the currently observed service routes. The complete processor list and contracting entities remain under legal review; it is not a finalized contractual list.

10. Transfers outside Korea (PIPA Article 28-8)Legal review required

The table describes observed infrastructure and AI data flows. Transfers use encrypted connections (TLS). The complete recipient list, contracting entities, transfer countries and retention terms remain under legal review.

• Vercel — regionshttps://vercel.com/docs/regions
• Vercel — data processing addendumhttps://vercel.com/legal/dpa
• Expo — push service processinghttps://docs.expo.dev/push-notifications/sending-notifications/

11. Security

• Platform access tokens are encrypted at rest; data in transit is encrypted (TLS)
• Least-privilege access with access logging
• Regular security reviews and vulnerability fixes

12. Your rights

• You may request access to, correction or deletion of your personal information, ask us to stop processing it, and withdraw consent at any time.
• You can disconnect channels in Settings › Channels and delete your account in Settings yourself.
• You can also revoke access on each platform: the website permissions / apps and websites settings in Threads and Instagram, and your Google security settings.
• Send requests to info@quantus.kr and we will handle them without delay.

13. Cookies and device storage

We use secure httpOnly cookies to keep you signed in and a language cookie for your language setting. Display settings such as the color theme are kept in your device storage. We collect error and performance data to keep the Service reliable (Azure Application Insights). We do not use advertising tracking cookies.

14. Contact and remedies

• Privacy inquiries: info@quantus.kr
• Korea Internet & Security Agency privacy report center: privacy.kisa.or.kr / 118 (in Korea)
• Personal Information Dispute Mediation Committee: www.kopico.go.kr / 1833-6972

15. Changes to this policy

We announce changes in the Service 7 days before they take effect (30 days for changes that are unfavorable to you).