Privacy Policy

Effective date: November 10, 2026 · This English version is provided for convenience; if it conflicts with the Korean version, the Korean version prevails.

주식회사 윗유 (witU) ("we", "us") operates Drop Post (the "Service"), a tool that helps creators publish their videos to the YouTube, Instagram, and TikTok accounts they connect. We comply with the Personal Information Protection Act of Korea and other applicable laws. This policy explains what personal information we process, why, and the rights you have.

1. Information we process
2. Why we process it
3. Staff access and manager sharing
4. Statistics and anonymization
5. How long we keep it
6. Sharing with third parties
7. Service providers
8. International transfers
9. How we delete data
10. Your rights
11. Data deletion requests
12. Security measures
13. Cookies
14. Children
15. Privacy officer
16. Remedies
17. Changes to this policy

1. Information we process

2. Why we process it

• Sign-up, sign-in, identity verification, and password reset emails
• Account approval: confirming that you are a WITU creator (using your name, creator name and social account)
• Publishing and scheduling videos to the platform accounts you connect
• Applying the edits you request (trim, aspect ratio, text)
• Showing your upload history and post performance
• Preventing abuse (including request rate limits), keeping the Service secure, fixing errors, and answering inquiries
• Operating the Service: account approval by administrators, finding the cause of upload errors, and fixing connection problems (Section 3)
• Sharing a platform account with a company manager who posts on a creator's behalf, and notifying the users who already connected it (Section 3)
• Improving the Service and internal statistical analysis, after anonymization (see Section 4)
• Service notices: important emails about your account, such as policy changes, maintenance, and outages
• Sending news about features and events, only if you opted in to marketing messages (each such email includes an unsubscribe link)

3. Staff access and manager sharing

Access by administrators

A small number of staff we designate as administrators can view the following in an admin screen, to approve accounts, find the cause of upload errors, answer inquiries, and respond to abuse:

• Account information: email address, name, creator name and main social account, sign-up method, approval and email verification status, country, last visit and sign-in time, company role
• Names of connected platform accounts and when they were connected (tokens cannot be viewed)
• Upload records kept by the Service: title, description, hashtags, success or failure per platform and the reason, post links, scheduled posts
• Upload error records and the number of recent failed sign-ins
• View, like, and comment counts of Instagram posts

In line with each platform's policies, performance data obtained from YouTube and TikTok (views, likes, etc.) is not shown in the admin screen; it is shown only to you. Administrators can disconnect a user's platform connection or change a user's company role when needed. Whenever an administrator views or changes a user's information, we record who did what, to which user, and when (staff activity records), and keep these records for 1 year.

Manager sharing

witU employees we designate as managers can connect a YouTube, Instagram, or TikTok account that a creator has already connected to their own Drop Post account, by signing in and granting permission on that platform, and post to it on the creator's behalf. In that case:

• The users who already connected that account are told, by an in-service notification and email, which account was shared and the manager's name and email address.
• Managers see only the records of the posts they make themselves. They cannot see the creator's upload history, performance data, or notifications.
• If you don't want an account shared, email the privacy officer below and we'll remove the manager's connection. You can also revoke Drop Post's access in that platform's connected-apps settings.

Administrators and managers are all employees of our company; this is internal processing, not sharing with third parties.

4. Statistics and anonymization

To improve the Service, we may analyze upload times, video length and format, hashtags, posting options, edit settings, and performance data. We use this data only as aggregated statistics across many users, with information that could identify you removed — such as email addresses, account identifiers, channel/account names, and post identifiers or links.

• Anonymized statistics are used only within our company. We don't sell them or share them externally.
• We don't try to re-identify individuals by combining anonymized data with other information.
• In line with the YouTube API Services policies, data obtained through the YouTube API is never used in statistics that combine multiple users, and is shown only to the user it belongs to.
• Anonymized statistics that can no longer identify anyone are not personal information and may remain after you delete your account.

5. How long we keep it

6. Sharing with third parties

We don't sell your personal information or share it with third parties for advertising or marketing. When you connect a platform and ask us to post, we send that platform only what's needed to publish. After that, the platform's own privacy policy applies.

Retention follows each platform's policy, and you can delete your posts directly on each platform.

7. Service providers

8. International transfers

To provide the Service, personal information may be transferred outside Korea as follows.

You can refuse these transfers by deleting your account or disconnecting a platform. Transfers through Cloudflare are required to access the Service, so refusing them means you can't use the Service; refusing transfers through Resend means you won't receive password reset emails.

9. How we delete data

When the retention period ends or the purpose is fulfilled, we delete personal information without delay. Electronic files are deleted so they can't be recovered, and database backups are deleted automatically on a 7-day cycle.

10. Your rights

You can ask to access, correct, or delete your personal information, ask us to stop processing it, or withdraw consent at any time.

• View account details, withdraw marketing consent, or delete your account: Settings → Account
• Disconnect a platform (deletes its tokens and the performance data obtained from it): Settings → Platform connections
• Other requests: email the privacy officer below. We'll act without delay (within 10 days) and let you know the result.

You may also exercise these rights through a legal representative or an authorized agent; we may ask for proof of authorization.

11. Data deletion requests

If you delete your account in Settings, your sign-in information, platform tokens, upload history, performance data, and any video files still on our server are deleted immediately. If you can't delete your account in the Service, or you're requesting deletion through a platform such as Meta (Instagram, Facebook) or TikTok, email us and we'll delete your data within 7 business days.

Email: [email protected]

12. Security measures

• Passwords are stored with one-way encryption (bcrypt).
• Platform access and refresh tokens are encrypted in the database (AES-256-GCM).
• Traffic between your browser and the Service is encrypted with HTTPS, and sign-in sessions use signed, secure cookies.
• Access to server configuration and database files is restricted to the minimum, and administrator access requires key-based authentication.
• Rapid repeated sign-in and upload requests are limited to prevent abuse.
• We email you when your account is signed in from a device (browser) we haven't seen before, and you can sign out all other devices at once in Settings.
• Only administrator accounts we designate can use the admin screen, and every view or change of user information is recorded and kept for 1 year.

13. Cookies

We use a cookie to keep you signed in. To tell you about sign-ins from new devices, we also keep the account numbers that signed in on a browser in a signed cookie (kept 1 year). This cookie is stored only in your browser; we don't store device information on our servers. You can block cookies in your browser, but features that require sign-in won't work. Display preferences such as language and library sort/view are stored only in your browser and aren't sent to our servers. We don't use advertising cookies or third-party tracking tools.

14. Children

The Service doesn't allow children under 14 to sign up. If we learn that we've collected personal information from a child under 14, we'll delete it immediately.

15. Privacy officer

16. Remedies

For advice or dispute resolution about a privacy issue, you can contact the following Korean agencies.

• Personal Information Infringement Report Center: privacy.kisa.or.kr / 118 (in Korea)
• Personal Information Dispute Mediation Committee: www.kopico.go.kr / +82-1833-6972
• Supreme Prosecutors' Office: www.spo.go.kr / 1301 (in Korea)
• Korean National Police Agency: ecrm.police.go.kr / 182 (in Korea)

17. Changes to this policy

We'll announce changes in the Service at least 7 days before they take effect, or at least 30 days before for changes that materially affect your rights. Previous privacy policies: effective October 26, 2026, effective October 14, 2026, effective October 13, 2026, effective August 21, 2026 (Korean)
Changes effective November 10, 2026: added what administrators can view and staff activity records (kept 1 year), and platform account sharing with company managers (Section 3); added upload error records (kept 90 days), notifications, last visit time, and failed sign-in records, with their retention periods; a device-recognition cookie for new sign-in alerts (Section 13)