Privacy Policy

1. Introduction

UDID Inc. ("Company," "we," "us," or "our") operates the FanTalk platform (accessible at fantalk.im), an AI-powered fan management and customer support service for creators and businesses. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our service.

By accessing or using FanTalk, you agree to the terms of this Privacy Policy. If you do not agree with the terms of this Privacy Policy, please do not access or use our service.

2. Information We Collect

2.1 Information You Provide Directly

• Account Information: Email address, password, display name when you create an account.
• Social Login Data: If you sign in via Google or other social providers, we receive your unique account identifier, profile image, and name as authorized by you.
• Profile Information: Any additional profile details you choose to provide.
• Communications: Information you provide when contacting our support team.

2.2 Instagram Data (via Meta APIs)

When you connect your Instagram Business or Creator account, we collect:

• Basic Profile: Instagram user ID, username, display name, profile picture URL, follower/following counts, media count, biography.
• Comments: Comments on your Instagram posts, including commenter's username, comment text, and timestamp, for AI-powered analysis and auto-response.
• Direct Messages: Messages received in your Instagram inbox (with your explicit authorization) for AI-powered auto-response and fan management.
• Content Data: Your Instagram posts and media metadata for content publishing features.
• Access Tokens: OAuth tokens issued by Meta to access Instagram APIs on your behalf.

2.3 Automatically Collected Information

• Device & Browser Info: IP address, browser type and version, operating system.
• Usage Data: Pages viewed, features used, timestamps, referring URLs.
• Cookies: Session cookies for authentication, locale preference cookies, and analytics cookies.

2.4 Customer Support Chat (Web Chat) Information

Members install the customer support chat on their own websites and applications. The items actually collected vary according to the pre-chat form each Member configures for their own channel; required and optional items are indicated separately on the input screen. In general we collect:

• Required: The content of the inquiry, and the required fields of the Member's pre-chat form (for example, name and contact number (mobile phone number)).
• Optional: Email address, inquiry type, order number, service account ID, company name, business registration number, address and other fields configured by the Member for handling inquiries, together with files attached by the person making the inquiry.
• Automatically collected: IP address, browser information (User-Agent), the address of the page from which the chat was opened, session identification cookies, and conversation and access records.
• Received from the connected site: Where an inquiry is made while signed in to a website or application operated by a Member, the name, email address, contact number and that site's user identifier that the site transmits with a digital signature.

3. How We Use Your Information

We use the collected information for the following purposes:

• Service Delivery: To provide Instagram account integration, AI-based comment analysis, DM auto-response, and fan management features.
• AI Processing: To train and operate AI models that respond to fan messages and comments in your communication style. Your data is used solely for your account and is not shared across accounts.
• Account Management: To create and manage your account, verify your identity, and prevent unauthorized access.
• Customer Inquiry Handling: To receive inquiries submitted through customer support chat (web chat) and messenger channels, verify the person making the inquiry, conduct support conversations, notify the outcome and progress of processing, and retain support records.
• Communication: To send informational and transactional notifications related to the Service, respond to inquiries, and provide customer support. See Section 8 for the distinction between these notifications and advertising messages.
• Analytics & Improvements: To analyze usage patterns, review and improve support quality, maintain the knowledge materials used for automated responses, improve our service, and develop new features.
• Marketing (separate consent only): To send advertising information such as event announcements. Processing for this purpose and the transmission of advertising information take place only where you have given separate, explicit prior consent; such consent is not replaced by your agreement to the Terms of Service or to this Policy.
• Legal Compliance: To comply with applicable laws, regulations, and legal processes.

4. Sharing of Information

We do not sell your personal information. We may share your information only in the following circumstances:

• Meta (Instagram/Facebook): We exchange data with Meta's APIs to provide Instagram integration features. This includes sending API requests using your authorized access tokens to read comments, messages, and post content on your behalf.
• AI Service Providers: We use third-party AI providers (Google, OpenAI, Cohere, OpenRouter, Anthropic) to analyze comments and messages, and the inquiry content and support conversations from customer support chat (web chat), and to generate AI replies. The data is used only within the scope of that purpose. Each provider may process the data at its own facilities located outside Korea.
• Payment Processors: If you use paid features, minimal information required for payment processing is shared with our payment service providers.
• Messaging Providers: SMS and KakaoTalk notification message providers receive the recipient's contact details and the message content in order to deliver notifications such as reply-arrival notices.
• Cloud Infrastructure Providers: Google Cloud (Seoul region) and Cloudflare provide the servers, databases and attachment storage required to operate the Service.
• Email Delivery Provider: Resend receives recipient email addresses and message content in order to send notification and verification emails.
• Legal Requirements: We may disclose information if required by law, court order, or governmental regulation.

5. Data Retention

• Account Data: Retained until you delete your account. Upon account deletion, data is permanently removed within 30 days.
• Instagram Integration Data: Deleted immediately when you disconnect your Instagram account from FanTalk.
• Access Tokens: Invalidated and deleted immediately upon disconnection or when they expire.
• Service Usage Records: Retained for 3 years as required by the Act on Consumer Protection in Electronic Commerce (Republic of Korea).
• Access Records (login records and web server access logs): Retained for 3 months as required by the Protection of Communications Secrets Act (Republic of Korea).
• Customer Support Chat Records (inquiry content, support conversations, attached files): Retained for as long as the business customer uses the Service, and destroyed within 30 days of the end date once the service agreement ends. Backup copies are deleted automatically according to the backup retention cycle, and all of them are deleted within 37 days of the end date at the latest. Where applicable law requires retention, the records are kept for the period prescribed by that law.
• Customer Support Chat Access and Session Records (IP address, browser information, page address): Plain access records with no conversation are deleted after 30 days, and the access information (IP address, browser information) contained in inquiry records is deleted after 90 days.
• Records of Consent to, and Opt-out from, Advertising Information: Retained for the period prescribed by applicable law, so that the fact of consent and of opt-out can be verified.
• Backup Copies: Deleted automatically when the backup retention cycle ends.

6. Data Deletion

You may request deletion of your data at any time through the following methods:

• In-App: Navigate to Settings > Account > Delete Account to delete all your data.
• Instagram Disconnection: Disconnect your Instagram account to immediately delete all Instagram-related data.
• Meta Data Deletion Callback: When you remove FanTalk from your Meta account settings, we automatically receive and process the deletion request via our data deletion callback endpoint. You will receive a confirmation code to track the deletion status at fantalk.im/data-deletion-status.
• Email Request: Send a deletion request to privacy@fantalk.im with your registered email address.

Upon receiving a deletion request, we will delete or anonymize all associated data, including: Instagram account integration data, access tokens, linked comments and DM data, AI response history, and fan analytics data.

7. Your Rights

You have the following rights regarding your personal information:

• Right to Access: Request a copy of the personal information we hold about you.
• Right to Correction: Request correction of inaccurate or incomplete information.
• Right to Deletion: Request deletion of your personal information (see Section 6).
• Right to Restrict Processing: Request that we limit how we use your data.
• Right to Withdraw Consent: Withdraw your consent for data processing at any time by disconnecting your Instagram account or deleting your FanTalk account.
• Right to Opt Out of Advertising Messages: Withdraw your consent to receive advertising information, or opt out of receiving it, at any time and free of charge.

To exercise any of these rights, please contact us at privacy@fantalk.im. We will respond to your request within 30 days.

Opt-outs are processed free of charge by the following methods:

• Advertising SMS: Use the free opt-out method shown in the advertising message (an opt-out page link or a toll-free opt-out phone number). For the link, open it and press the confirmation button; the opt-out takes effect immediately. Informational and transactional notifications, such as reply-arrival notices, may still be sent after the opt-out.
• Reply-notification emails: Open the opt-out link shown in the email and press the confirmation button; the opt-out takes effect immediately.

8. Notifications and Advertising Messages

We send two kinds of messages, and they are governed by different rules.

• Informational and transactional notifications: Messages that accompany the Service or the handling of your inquiry — confirmation that an inquiry has been received, notice that a reply has arrived, notice of the outcome of processing, notices related to contracts and payments, and operational notices. These are sent by email, SMS, KakaoTalk notification message, or in-app notification. They do not constitute advertising information and do not contain advertising content.
• Advertising information: Sent only where you have given explicit prior consent, in accordance with Article 50 of the Act on Promotion of Information and Communications Network Utilization and Information Protection (Republic of Korea). That consent is not replaced by your agreement to the Terms of Service or to this Policy — it is obtained separately. Advertising messages carry the label required by law, the sender's name and contact details, and the opt-out method. Separate prior consent is obtained for transmission between 9:00 p.m. and 8:00 a.m. of the following day.

You may opt out of advertising information at any time, free of charge; see Section 7 for the methods. Opting out of advertising information does not stop informational and transactional notifications, although certain notifications, such as reply-arrival notices, can be stopped individually through the opt-out link contained in that notification.

9. Security Measures

We implement appropriate technical and organizational measures to protect your personal information:

• Encryption: All data in transit is encrypted using TLS/SSL. Passwords and sensitive data are encrypted at rest.
• Access Control: Strict access controls limit personnel who can access personal information.
• Token Security: Instagram access tokens are stored encrypted and are never exposed to client-side code.
• Regular Audits: We conduct regular security audits and vulnerability assessments.
• Infrastructure: Our service is hosted on Google Cloud Platform with enterprise-grade security.

10. Cookies

We use the following types of cookies:

• Essential Cookies: Required for authentication and core service functionality (session cookies, CSRF tokens).
• Preference Cookies: Store your language and display preferences.

You can control cookies through your browser settings. Disabling essential cookies may prevent you from using certain features of our service.

11. Children's Privacy

FanTalk is not intended for use by individuals under the age of 14 (or the minimum age required in your jurisdiction). We do not knowingly collect personal information from children. If we become aware that we have collected personal information from a child, we will take steps to delete that information promptly.

12. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence, including the Republic of Korea where our servers are located and the United States where our AI service providers operate. We ensure appropriate safeguards are in place to protect your information in accordance with applicable data protection laws.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the updated Privacy Policy on this page and updating the "Last Updated" date. Your continued use of FanTalk after any changes constitutes your acceptance of the updated Privacy Policy.

14. Contact Us