Privacy Policy

This translation is provided for reference only. If there is any discrepancy, the Korean version prevails.

Humelo Inc. (“Humelo”) complies with the Personal Information Protection Act and the Act on Promotion of Information and Communications Network Utilization and Information Protection, and has established this Privacy Policy as set out below to protect data subjects’ personal information and to handle related complaints promptly. This Policy applies to inquiries, link requests, and demos on humelo.com and on the page for the AI agent Sody (sodyai.com, formerly humelo.com/sody); to consultation requests made through Humelo ads; and to the Sody app and Sody member mobile number verification (in the Sody app and on app.sodyai.com). Other member information for the Console (console.humelo.com, app.sodyai.com) is governed by the Console Privacy Policy.

Contents

1. Personal Information Collected and Purposes of Collection

Humelo collects only the minimum personal information necessary to provide its services.

A. Sales inquiries and requests for service brochures and success stories (humelo.com)

Items collected

Required: name, company name, email address, contact number, inquiry details
Automatically collected: IP address and browser information (for bot-prevention checks), ad referral information (UTM parameters and ad click IDs, if any)

Purposes of collection

Sales consultations and responses to inquiries
Sending success stories and service brochures
Preventing fraudulent submissions and automated entries, and measuring ad performance (the name, email address, contact number, and other information you enter may be converted into hashed values and sent to Google and Meta; see Section 6)
Providing service information and marketing information (if you consent)

B. Voice callbot continue-building link requests and mission demo sign-ups (sodyai.com, formerly humelo.com/sody)

Items collected

Required (link request): mobile number, company name
Required (mission demo sign-up): either a mobile number or an email address
Optional (if entered): name, industry, selected agent voice, company website
Mission demo records: selected industry, browser demo call session ID, number of exchanges, demo steps handled by the agent (order numbers, ticket numbers, etc. in the fictitious data)
Automatically collected: ad referral information (ad click IDs (fbclid, gclid, etc.), Meta cookie identifiers (fbc, fbp), UTM values, landing page URL), browser demo call session ID (if you tried a demo), IP address (stored as a hashed value), browser information

Purposes of collection

Sending the link you requested to continue building on a PC (by text message or Kakao AlimTalk, or by email if you provided only an email address)
Providing mission browser demo calls, preventing abuse, and sending demo summaries
Pre-filling the company name, industry, and voice you provided when you sign up through the link
Preventing fraudulent submissions and automated entries
Measuring ad performance (the name, mobile number, email address, and other information you enter may be converted into hashed values and sent to Meta and Google; see Section 6)
Sending promotional and advertising information (if you have consented to both the use of personal information for promotional purposes and the receipt of advertising information; see Section 8)

C. AI agent browser demo calls and speech synthesis demos (humelo.com, sodyai.com)

Items collected

Browser demo calls: your voice, the text transcribed from it and the conversation you have with the AI agent, and the browser demo call session ID
Speech synthesis demos: the sentences you enter, the voice you select, and the date and time of use
Automatically collected: IP address and browser identifier for usage limits (stored as hashed values), device identifier

Purposes of collection

Providing the demos (speech recognition, answer generation, speech synthesis)
Enforcing usage limits and preventing fraudulent use
Checking errors and improving consultation and voice quality

When trying a demo, you do not need to say or enter real personal information such as actual order numbers or contact details.

D. Consultation requests from Facebook and Instagram ads (Meta Instant Forms)

Items collected

Name, mobile number, company name, industry, monthly volume of consultation calls (fields included in the form), and whether you consent to receive marketing information
Automatically collected: information on the ad and form through which you applied (campaign, ad, and form IDs)

Purposes of collection

Contacting you for the sales consultation you requested and sending related text messages (including the link to continue building on a PC)
Measuring ad performance
Sending advertising information (if you consented to receive marketing information; see Section 8)

E. AI agent demo calls (calls the AI places to your mobile phone and calls you place directly to the demo number; sodyai.com, formerly humelo.com/sody)

Items collected

Required: mobile number (your own number), text-message verification result (the verification code is stored only as a hashed value and deleted after verification)
When you call the demo number directly: the phone number you call from (caller number) and the industry you selected. Instead of text-message verification, we check whether the caller number matches the mobile number you provided at mission demo sign-up (Section 1.B)
During the call: your voice in the call (used for transcription and answer generation, and retained for 1 year for consultation review; the AI agent’s voice is not stored), the transcription of it and the conversation you have with the AI agent, and the call result (whether the call connected, call time and duration, reason the call ended, and your answer as to whether you are the person who requested the call)
Automatically collected: selected voice, industry, and landing page; IP address and device identifier (stored as hashed values); consent text version and date and time of consent

Purposes of collection

Placing the demo call you requested (over a dedicated demo phone line) and confirming that the number is yours (text-message verification)
Connecting calls you place directly to the demo number (checking by caller number that you are the person who signed up for the demo, and connecting you to the demo for the industry you selected)
Limiting repeated requests from the same number, device, or connection environment and preventing fraudulent use
Checking errors and improving consultation and voice quality

The AI places a demo call only when the user has personally requested it and completed number verification, and places one call per request (up to three times a day for the same number). Because the user requested the call directly, it is placed immediately regardless of the time of day. In its opening line, this call tells you that it is a Sody AI demo call. For calls you place directly to the demo number, the opening line tells you that the AI agent Sody will guide you using fictitious demo data.

F. Sales consultation requests for the AI agent Sody (sodyai.com)

Items collected

Required: mobile number
Optional: company name
If you have completed a demo (if you submit a request through the consultation link in the demo result text message, or if you completed number verification within 24 hours in the browser you used for the demo and then submit a request): without your re-entering your number, we link to your request the mobile number you provided during the demo and that number’s demo records (selected industry, missions tried and how they were handled, and the date and time, length, and number of exchanges of your last browser demo call). If you arrive through the consultation link, a link value that identifies you as someone who tried the demo is kept in a cookie for 30 minutes and deleted when you submit the request
Automatically collected: IP address (to limit repeated requests), landing page and ad referral information (UTM, if any), consent text version and date and time of the request

Purposes of collection

Contacting you for the sales consultation you requested
Sending text messages confirming receipt
Limiting repeated requests and preventing fraudulent use
Measuring ad performance (your mobile number may be converted into a hashed value and sent to Google and Meta; see Section 6)

G. The Sody app and Sody member mobile number verification (Sody app, app.sodyai.com)

Items collected

Required (member mobile number verification, common to the Sody app and app.sodyai.com): mobile number (one number per account), date and time of verification, text-message verification records (the mobile number and verification code are kept only as hashed values, and the verification code is deleted once it is confirmed or after five incorrect attempts)
When you receive a 30-minute free test number: the date received and the verified mobile number
Automatically collected by the Sody app: app usage records (app launches and usage time, in-app actions such as signing up, creating an agent, publishing an agent, and getting a test number, along with their dates and times, and sign-up method), device information (device model, OS type and version, app version), IP address, a random identifier generated for each app installation, advertising identifiers (Android advertising ID; on iOS, IDFA only if you allow app tracking), app install source information (such as the Google Play install referrer), and app error records (error details, time of occurrence, and device state at the time of the error)
If you allow Sody app notifications: push notification token

Purposes of collection

Verifying members’ identity and preventing multiple accounts from being created with one number (text-message verification)
Sending a text message to let you know when your agent is ready, and verifying membership by the number you call from when you create an agent by phone
Checking that each mobile number receives a 30-minute free test number only once a day
Checking app errors and improving stability
Analyzing app usage statistics and measuring ad performance (app usage records, device information, and advertising identifiers are sent to the companies listed in Section 6)
Personalized advertising for the Sody app (Meta and TikTok use app events and advertising identifiers to show you Sody ads you may be interested in on Facebook, Instagram, TikTok, and elsewhere; see Section 7)
Sending app notifications

The Sody app does not send member information such as names, email addresses, or mobile numbers to app usage statistics, ad performance measurement, or personalized advertising tools. On iOS, the app asks once whether you allow app tracking after you create your first agent, and uses IDFA only if you allow it. You can still use the app even if you do not allow it. The app asks for permission to send notifications after you get a test number.

2. Retention and Use Period of Personal Information

Sales inquiries (Section 1.A) and Sody sales consultation requests (Section 1.F): retained for 3 years after the purposes of responding to inquiries and consultations and providing services have been achieved, and destroyed without delay thereafter.
Voice callbot link requests, mission demo sign-ups, and Instant Form consultation requests (Sections 1.B and 1.D): retained for 1 year from the date of collection. If, before then, you withdraw consent or request deletion, refuse to receive advertising information, or complete Console sign-up through the continue-building link, we destroy without delay the mobile number, email address, company name, name, company website, ad click IDs, cookie identifiers, browser demo call session ID, and hashed IP address. After destruction, we keep only statistical information that cannot identify individuals (request date and time, industry, selected voice, referral source (UTM), landing page, processing status) and records of the dates and times of consent and withdrawal. If you completed sign-up, the link to your Console account is also kept, and this link is removed upon membership withdrawal.
Browser demo calls and speech synthesis demos (Section 1.C): your voice in browser demo calls is retained for 1 year from the date of recording for consultation review and then deleted, and the AI agent’s voice is not stored. The conversation content (text) of browser demo calls is retained for 1 year from the date it is recorded, and the sentences you enter and usage records are retained for 3 years from the date of collection, and they are then destroyed.
AI agent demo calls (Section 1.E): the mobile number to be called, kept in the request record, is deleted without delay when the call ends or the request expires. Your voice in the call is retained for 1 year from the date of recording for consultation review and then deleted, and the AI agent’s voice is not stored (the same applies to calls you place directly to the demo number). The phone number used for the call, the transcribed conversation, and the call summary kept in the call record are retained for 1 year from the date of the call and then destroyed (the same applies to calls you place directly to the demo number). Request and call result records (including the last 4 digits of the mobile number and hashed values of the mobile number, IP address, and device identifier) are retained for 1 year from the date of the request and then destroyed; if the transcribed conversation is also kept in these records, that content is deleted earlier, once 90 days have passed from the date of the request. The selected industry and the demo number usage request records created when you call the demo number directly are destroyed together with your mission demo sign-up information (Section 1.B), and the industry and call time recorded for each call are kept only as statistics that cannot identify individuals once the numbers in the request information and call records have been destroyed. Until the morning of November 2, 2026, if the person who answered a call said they had not requested it, the hashed value of that mobile number was kept on a do-not-call-again list. We no longer add numbers to this list or check it when placing calls, and the remaining records are retained only until their destruction date, which falls 3 years after the date of registration, and then destroyed. If you send a request to privacy@humelo.com, we will delete them without delay even before then.
Sody member mobile number verification and the Sody app (Section 1.G): the mobile number registered to your account, text-message verification records, records of receiving 30-minute free test numbers, and push notification tokens are destroyed without delay upon membership withdrawal. App usage records, device information, advertising identifiers, and app error records are not stored on Humelo’s servers, and the retention periods of the companies that receive them are described in Section 6.
Instant Form information retained by Meta and ad measurement information retained by Meta and Google are subject to each company’s policies (Section 6).
Where retention is required under applicable laws, the information is stored separately from other information for the required period.

3. Procedures and Methods for Destroying Personal Information

Destruction procedure: when the retention period ends or the purpose of processing has been achieved, the information is destroyed without delay. Information that must be retained longer under other laws is stored separately from other information only for that period and then destroyed.
Destruction method: information in electronic files is deleted in a way that makes it impossible to recover or view again, and information printed on paper is shredded or incinerated.

4. Provision of Personal Information to Third Parties

As a rule, Humelo does not provide your personal information to third parties. However, the following cases are exceptions:

Where you have given prior consent
Where required under the provisions of laws or regulations, or where requested by an investigative agency

Information sent to Meta and Google (and, for the Sody app, also to Adjust and TikTok) for ad performance measurement is described separately in Sections 6 (overseas transfer) and 7 (behavioral information). When information you enter, such as your name, email address, or mobile number, is used for ad performance measurement, we do not send the original values; we send only hashed (SHA-256) values. Where separate consent is required under applicable laws, we obtain separate consent.

5. Outsourcing of Personal Information Processing

Humelo outsources personal information processing tasks as follows to provide its services. The outsourcing contracts (including each company’s terms of service and data processing terms) set out the matters necessary to protect personal information, and Humelo supervises whether the outsourcees process personal information securely. If an outsourcee or an outsourced task changes, we will give notice through this Policy.

Supabase, Inc.

Outsourced tasks: storage of voice callbot link request information and sending records, browser demo call records, demo call request and call records, sales consultation request records, and Sody member mobile number verification records (database and file storage)
Storage location: Seoul, Republic of Korea (AWS Seoul Region)

Vercel Inc.

Outsourced tasks: hosting of the websites (humelo.com, sodyai.com) and the Console (console.humelo.com, app.sodyai.com), and running the servers that process inquiries, link requests, and member mobile number verification
Server location: Seoul, Republic of Korea

Neon, Inc.

Outsourced tasks: storage of speech synthesis demo usage records (database)

Cloudflare, Inc.

Outsourced tasks: bot-prevention checks (Turnstile) for inquiries and link requests

Google LLC (Google Workspace)

Outsourced tasks: sending and receiving business email (receiving inquiries, notification emails for new link requests, and continue-building emails sent to those who signed up by email)

Google LLC (Firebase)

Outsourced tasks: collecting Sody app error records (Firebase Crashlytics), app usage statistics (Firebase Analytics), and sending app notifications (Firebase Cloud Messaging)

Slack Technologies, LLC

Outsourced tasks: internal notifications of new link requests, people to contact for consultations, and sales consultation requests

Meta Platforms, Inc.

Outsourced tasks: receiving consultation requests submitted through Instant Forms in Facebook and Instagram ads

Adjust GmbH

Outsourced tasks: measuring ad performance for Sody app installs and in-app actions

650 Industries, Inc. (Expo)

Outsourced tasks: distributing Sody app updates and issuing app notification tokens

SOLAPI Inc.

Outsourced tasks: sending text messages with continue-building link information and advertising information

Sendon

Outsourced tasks: sending demo call verification code text messages, sending demo summary text messages, sending Kakao AlimTalk messages on our behalf, sending text messages confirming receipt of sales consultation requests, sending Sody member mobile number verification code text messages, and sending text messages notifying that an agent is ready

Kakao Corp.

Outsourced tasks: delivering Kakao AlimTalk messages (when notices are sent via AlimTalk)

AIEEV Inc.

Outsourced tasks: operating the GPU servers that handle speech recognition, answer generation, and speech synthesis for browser demo calls and demo calls

KT Corporation

Outsourced tasks: placing AI agent demo calls and connecting calls (providing dedicated internet phone lines for demos)

Gabia Inc.

Outsourced tasks: operating the data center (IDC) that houses the Humelo servers relaying browser demo calls

6. Overseas Transfer of Personal Information

Humelo transfers personal information overseas as follows for ad performance measurement, business email, internal notifications, bot prevention, service operation, and Sody app error checking, updates, and notifications. Overseas transfers take place by transmission over information and communications networks or by storage on each company’s servers.

Meta Platforms, Inc. · Meta Platforms Ireland Ltd.

Contact: the contact channels provided in Meta’s Privacy Policy (facebook.com/privacy/policy)
Destination countries: the United States, Ireland, and other countries where Meta’s data centers are located
Timing and method of transfer: sent from your browser via Meta Pixel while you visit humelo.com and sodyai.com (when you enter your name, mobile number, email address, or other information on sodyai.com (formerly humelo.com/sody) or elsewhere, Meta Pixel’s Automatic Advanced Matching hashes those values on your device (SHA-256, one-way encryption) and includes them in subsequent transmissions such as demo sign-ups); sent from the Console server via the Conversions API (CAPI) immediately after a link request or demo sign-up, when you enter a mobile number during a demo, request a demo call, end a browser demo call, or submit a sales inquiry, and when you complete sign-up through the continue-building link; entered on Meta’s servers when you submit an Instant Form
Items transferred: pages visited and actions taken on those pages, Meta cookie identifiers (fbp, fbc), ad click ID (fbclid), IP address, browser information, hashed link request ID, device identifier for ad measurement (hashed), and hashed values of information you enter such as your name, email address, and mobile number (via Pixel Automatic Advanced Matching and the Conversions API; original values are not sent). If you enter your mobile number in the demo card on sodyai.com to try a demo, the Console server converts that mobile number and the device identifier for ad measurement (a random value stored in this browser) into hashed values and sends them via the Conversions API for ad performance measurement, even before you sign up for the demo. For Instant Forms, Meta receives your name, mobile number, company name, industry, and monthly volume of consultation calls and passes them to Humelo.
Purpose of use: ad performance measurement (Meta uses the hashed values to match users who saw an ad with requests), receiving Instant Form submissions
Retention and use period: in accordance with Meta’s policies
How to refuse: you can block Meta Pixel transmissions using the methods in Section 7, and you can still use the demos and link requests even if you block them.

Google LLC

Contact: the contact channels provided in Google’s Privacy Policy (policies.google.com/privacy)
Destination countries: the United States and other countries where Google’s data centers are located
Timing and method of transfer: sent from your browser via Google tags (Google Analytics 4 and Google Ads) during your visit (the name, email address, mobile number, and other information you enter when making an inquiry, link request, or demo sign-up are hashed on your device by the Google tag (SHA-256, one-way encryption) and sent along with conversions; enhanced conversions); stored on Google Workspace servers when business emails are sent and received
Items transferred: pages visited and actions taken on those pages, Google cookie identifiers, ad click IDs (such as gclid), IP address, browser and device information, hashed values of the name, email address, mobile number, and other information you enter in inquiries, link requests, and demo sign-ups (Google Ads enhanced conversions and Google Analytics 4 user-provided data; original values are not sent via the Google tag), and business email content (inquiry details, and link request notifications including company name, industry, and partially masked mobile number).
Purpose of use: visit statistics analysis, ad performance measurement (Google uses the hashed values to match users who saw an ad with requests), business email
Retention and use period: Google Analytics 4 follows the data retention setting (up to 14 months), Google Ads information follows Google’s policies, and business emails are retained by Humelo for the periods in Section 2
How to refuse: you can block Google tag transmissions using the methods in Section 7, and you can still use inquiries, link requests, and demos even if you block them.

Slack Technologies, LLC

Contact: the contact channels provided in Slack’s Privacy Policy (slack.com/trust/privacy/privacy-policy)
Destination countries: the United States and other countries where Slack’s data centers are located
Timing and method of transfer: sent over the network when internal notifications are sent immediately after a link request and 3 days later, and immediately after a sales consultation request
Items transferred: company name, industry, selected agent voice, partially masked mobile number, whether marketing consent was given, ad referral information, landing page. For sales consultation requests, so that a representative can contact you right away: the full mobile number, the company name (if entered), the demo records described in Section 1.F, and the request number
Purpose of use: internal notifications of new link requests, people to contact for consultations, and sales consultation requests
Retention and use period: in accordance with Humelo’s Slack message retention settings

Cloudflare, Inc.

Contact: the contact channels provided in Cloudflare’s Privacy Policy (cloudflare.com/privacypolicy)
Destination countries: the United States and other countries where Cloudflare’s data centers are located (processed at the data center closest to where you connect from)
Timing and method of transfer: sent when your browser performs the bot-prevention check (Turnstile) on the inquiry and link request screens
Items transferred: connection information that Cloudflare uses to determine whether an entry is automated, such as IP address and browser and device information
Purpose of use: bot prevention
Retention and use period: in accordance with Cloudflare’s policies

Supabase, Inc. · Vercel Inc. · Neon, Inc.

Contact: the contact channels provided in each company’s privacy policy (supabase.com/privacy, vercel.com/legal/privacy-policy, neon.com/privacy-policy)
Destination countries: the United States and other countries where each company and its data centers are located
Timing and method of transfer: information entrusted to Supabase and Vercel is stored in the Seoul Region and processed on servers in the Seoul Region. However, each company may access or store it from overseas in the course of backup and log retention, incident response, and technical support. Information entrusted to Neon is stored on Neon’s database servers.
Items transferred: the information entrusted to each company as described in Section 5
Purpose of use: database and server operation, backup, incident response
Retention and use period: the periods in Section 2 (including each company’s backup and log retention periods)

Google LLC (Firebase, Sody app)

Contact: the contact channels provided in Google’s Privacy Policy (policies.google.com/privacy)
Destination countries: the United States and other countries where Google’s data centers are located
Timing and method of transfer: sent over the network by the Firebase SDK in the Sody app (Firebase Crashlytics when an error occurs in the app, Firebase Analytics while you use the app, and Firebase Cloud Messaging when you allow app notifications). In the iOS app, Google’s on-device conversion measurement module included in Adjust (below) also exchanges information with Google for ad performance measurement.
Items transferred: app error records (error details, time of occurrence, and device state at the time of the error), app usage records (app launches and usage time, in-app actions such as signing up, creating an agent, publishing an agent, and getting a test number, along with their dates and times, and sign-up method), device information (device model, OS type and version, app version), IP address, a random identifier generated for each app installation, and push notification token (if you allow notifications). Advertising identifiers (Android advertising ID, IDFA) and member information (name, email address, mobile number) are not sent to Firebase.
Purpose of use: checking app errors and improving stability, analyzing app usage statistics and measuring ad performance (Google Analytics 4), sending app notifications
Retention and use period: Firebase Analytics (Google Analytics 4) follows the data retention setting (up to 14 months), and app error records and push notification tokens follow Google’s policies
How to refuse: app notifications can be turned off using the methods in Section 7. Because there is no in-app setting to turn off app error records and app usage statistics, if you do not want them, you can use the web version (app.sodyai.com) instead of the app.

Meta Platforms, Inc. · Meta Platforms Ireland Ltd. (Sody app)

Contact: the contact channels provided in Meta’s Privacy Policy (facebook.com/privacy/policy)
Destination countries: the United States, Ireland, and other countries where Meta’s data centers are located
Timing and method of transfer: sent over the network by the Meta SDK in the app when you sign up, create an agent, publish an agent, or get a test number in the Sody app
Items transferred: app events (event name and date and time, sign-up method, OS type, app version), device information, IP address, a random identifier generated by the Meta SDK for each app installation, and advertising identifiers (Android advertising ID; on iOS, IDFA only if you allow app tracking). Member information (name, email address, mobile number) is not sent.
Purpose of use: ad performance measurement, personalized advertising for the Sody app (Meta uses this to match users who saw an ad with app sign-ups and other actions, and to show ads you may be interested in on Facebook, Instagram, and elsewhere)
Retention and use period: in accordance with Meta’s policies
How to refuse: you can block this using the methods in Section 7 (not allowing app tracking on iOS, deleting the Android advertising ID or opting out of ads personalization, and Meta ad preferences), and you can still use the app even if you block it.

Adjust GmbH

Contact: the contact channels provided in Adjust’s Privacy Policy (adjust.com/terms/privacy-policy) (privacy@adjust.com)
Destination countries: Germany (Adjust GmbH, Berlin), the United States (affiliate Adjust Inc.), and other countries where Adjust, its affiliates, and its hosting providers are located (standard contractual clauses or similar safeguards are used for transfers outside the European Union)
Timing and method of transfer: sent over the network by the Adjust SDK in the app when you first open the Sody app, while you use the app, and when you sign up, create an agent, publish an agent, or get a test number
Items transferred: advertising identifiers (Android advertising ID; on iOS, IDFA only if you allow app tracking), an identifier generated by Adjust for each app installation, device information (device model, OS type and version, app version), IP address, app install source information (Google Play install referrer, Apple ad attribution information), and app events (event name and date and time, sign-up method, OS type, app version). Member information (name, email address, mobile number) is not sent.
Purpose of use: ad performance measurement (measuring which ads app installs and in-app actions came from)
Retention and use period: retained while Humelo uses Adjust for the Sody app; if Humelo removes the app from Adjust or requests deletion, Adjust deletes or anonymizes the data (under Adjust’s policies)
How to refuse: you can block the transmission of advertising identifiers using the methods in Section 7, and you can still use the app even if you block it.

TikTok Pte. Ltd.

Contact: the contact channels provided in TikTok’s Privacy Policy (tiktok.com/legal/page/row/privacy-policy/en)
Destination countries: Singapore (where TikTok Pte. Ltd. is located), Malaysia, Ireland, the United States, and other countries where TikTok’s servers are located
Timing and method of transfer: sent over the network by the TikTok Business SDK in the app when you first open the Sody app and when you launch it, and when you sign up, create an agent, publish an agent, or get a test number
Items transferred: app events (app install and launch, event name and date and time, sign-up method, OS type, app version), device information, IP address, advertising identifiers (Android advertising ID; on iOS, IDFA only if you allow app tracking), and app install source information (Google Play install referrer). Member information (name, email address, mobile number) is not sent.
Purpose of use: ad performance measurement, personalized advertising for the Sody app (TikTok uses this to match users who saw an ad with app installs, sign-ups, and other actions, and to show ads you may be interested in on TikTok and elsewhere)
Retention and use period: in accordance with TikTok’s policies
How to refuse: you can block this using the methods in Section 7 (not allowing app tracking on iOS, deleting the Android advertising ID or opting out of ads personalization, and TikTok ad settings), and you can still use the app even if you block it.

650 Industries, Inc. (Expo)

Contact: the contact channels provided in Expo’s Privacy Policy (expo.dev/privacy)
Destination countries: the United States and other countries where Expo’s data centers are located
Timing and method of transfer: requests to check for new app updates when you open the Sody app, and requests to obtain a notification token when you allow app notifications, are sent over the network
Items transferred: IP address, OS type, app version, a random identifier generated for each app installation, and the device’s push notification token (if you allow notifications)
Purpose of use: distributing app updates, sending app notifications
Retention and use period: in accordance with Expo’s policies

If you do not want your information transferred overseas, you can refuse the collection of behavioral information and the transmission of hashed values of entered information using the methods in Section 7, or let us know at privacy@humelo.com. You can still make link requests and use the demos even if you refuse. However, transfers for bot prevention (Cloudflare), business email (Google Workspace), internal notifications (Slack), and data storage (Supabase, Vercel, Neon) are necessary to process your requests, so if you refuse them, we cannot process inquiries, link requests, or demos. Because there is no in-app setting to turn off the Sody app’s error records (Firebase Crashlytics) and app update checks (Expo), if you do not want them, you can use the web version (app.sodyai.com) instead of the app.

7. Collection, Use, and Refusal of Behavioral Information

Humelo collects and uses behavioral information as follows for ad performance measurement and visit analysis.

In the Sody app, the behavioral information listed in the “Sody app” items below is used for personalized advertising in addition to ad performance measurement and app usage statistics analysis. On the websites (humelo.com, sodyai.com), it is used only for ad performance measurement and visit statistics analysis.

Collection tools

Meta Pixel (humelo.com, sodyai.com), Meta Conversions API (console.humelo.com server)
Google Analytics 4 (humelo.com, sodyai.com, console.humelo.com), Google Ads conversion tags and enhanced conversions (humelo.com, sodyai.com)
Sody app: Firebase Analytics (Google Analytics 4), Adjust, Meta SDK (app events), TikTok Business SDK

Items collected

Pages visited and dates and times of visits
Actions taken on pages (previewing voices, starting a browser demo call, link requests, button and link clicks)
Ad click IDs (fbclid, gclid, gbraid, wbraid) and ad campaign information (UTM)
Cookie identifiers, IP address, browser and device information
Hashed values for ad performance measurement: values obtained by hashing (SHA-256) on your device the name, email address, mobile number, and other information you enter in inquiries, link requests, and demo sign-ups (Meta Pixel Automatic Advanced Matching, Google Ads enhanced conversions, and Google Analytics 4 user-provided data; original values are not sent)
Sody app: app usage records (app launches and usage time, in-app actions and their dates and times), device information (device model, OS type and version, app version), advertising identifiers (Android advertising ID; on iOS, IDFA only if you allow app tracking), app install source information

Collection methods and purposes of use

Collection method: collected automatically through cookies and scripts when you visit the websites, and sent by the Console server via the Conversions API upon link requests, demos (number entry, call requests, call end), sales inquiries, and sign-up
When you move between sodyai.com or humelo.com and the Console (console.humelo.com), the Google cookie identifier is appended to the destination URL (the _gl value) so that you are counted as the same visitor. The recipient (Google) and the purpose of use are the same as above.
Purpose of use: ad performance measurement, visit statistics analysis
Sody app: the SDKs in the app collect this information automatically and send it to each company (Section 6). On iOS, the app asks once whether you allow app tracking after you create your first agent, and uses IDFA only if you allow it. The purposes of use are ad performance measurement, app usage statistics analysis, and personalized advertising (Meta, TikTok). You can still use the app even if you do not allow app tracking.

Who collects behavioral information in the Sody app

Meta Platforms, Inc. (Meta SDK in the Sody app): ad performance measurement, personalized advertising
TikTok Pte. Ltd. (TikTok Business SDK in the Sody app): ad performance measurement, personalized advertising
Adjust GmbH (Adjust SDK in the Sody app): ad performance measurement
Google LLC (Firebase Analytics in the Sody app): app usage statistics analysis, ad performance measurement

Retention period

humelo.com and sodyai.com store ad referral information (UTM and ad click IDs) in cookies (which expire after 90 days) and in browser storage. Values in browser storage are deleted when you clear site data in your browser.
Google Analytics 4 follows the data retention setting (up to 14 months). The retention periods for Meta and Google cookies and ad data follow each company’s policies and settings.
Information sent from the Sody app to Google, Meta, Adjust, and TikTok is subject to each company’s retention period described in Section 6.

How to refuse

You can refuse to store cookies or delete stored cookies in your browser settings. For example: Chrome “Settings > Privacy and security > Third-party cookies”; Safari “Settings > Safari > Prevent Cross-Site Tracking” (menu names may vary by version)
Transmission of hashed values of entered information (Meta Pixel Automatic Advanced Matching, Google enhanced conversions): if you block Meta Pixel (connect.facebook.net) and the Google tag (googletagmanager.com) using your browser’s tracking protection or an ad- or tracker-blocking extension before entering information, browser transmissions including hashed values will not occur. Refusing or deleting cookies alone may not block these transmissions.
Meta ad preferences: accountscenter.facebook.com/ad_preferences. If you have a Meta account, you can disconnect your activity on other sites from your account under “Your activity off Meta technologies” in Accounts Center (menu names may change).
Google My Ad Center: myadcenter.google.com
Google Analytics Opt-out Browser Add-on: tools.google.com/dlpage/gaoptout
Conversion information sent by the Console server (Conversions API) upon link requests, demos, sales inquiries, and sign-up is not blocked by browser settings. If you do not want it sent, please let us know at privacy@humelo.com.
Advertising identifiers and personalized ads in the Sody app: on iOS, you can select “Ask App Not to Track” when the app asks for tracking permission, or turn off Sody under “Settings > Privacy & Security > Tracking.” On Android, you can delete or reset the advertising ID and opt out of ads personalization under the device’s “Settings > Privacy > Ads” (menu names may vary by device and version). You can still use the app even if you do not allow or block this. If you block it, advertising identifiers are not sent, but app usage records without advertising identifiers may still be sent; if you do not want those sent either, you can use the web version (app.sodyai.com) instead of the app.
Meta personalized ads in the Sody app: if you have a Meta account, you can disconnect app activity from your account at accountscenter.facebook.com/ad_preferences and under “Your activity off Meta technologies” in Accounts Center (menu names may change).
TikTok personalized ads in the Sody app: if you have a TikTok account, you can disconnect advertisers or clear your off-TikTok activity history in TikTok’s ad settings (TikTok guide to controlling off-TikTok data).
Sody app notifications: you can decline when the app asks for permission to send notifications, or turn off Sody notifications under the device’s “Settings > Notifications.”
Even if you refuse the collection of behavioral information or the transmission of hashed values of entered information, you can still use services such as link requests and demos.

You may direct inquiries and damage reports concerning behavioral information to the Chief Privacy Officer described in Section 11.

8. Sending Advertising Information

Humelo sends advertising information or makes sales consultation calls only to those who have consented to receive advertising information. For mission demo sign-ups (Section 1.B), we send it only if you have also consented to the use of personal information for promotional purposes.

How we send it: only by the methods stated in the consent form among text message, KakaoTalk, phone call, and email (if you provided an email address). We do not send advertising information via Kakao AlimTalk.
What we send: new features of the AI agent Sody (voice callbot), information on promotions and discounts, industry-specific use cases, events and adoption benefits, sales consultation calls from our representatives, and continue-building reminders for those who have not completed sign-up
Advertising information is marked “(Ad)” and includes the sender’s name and contact information and how to unsubscribe. When we contact you by phone, we state the company name and the purpose of the call at the beginning.
We do not send advertising information or make calls between 9:00 p.m. and 8:00 a.m. the next day.
Withdrawing consent to receive advertising information and consent to use for promotional purposes: via the unsubscribe link in the text message you received, the unsubscribe instructions at the bottom of emails, privacy@humelo.com, or a toll-free unsubscribe number (if an 080 number is used, it is stated in the advertising text message). Withdrawal is free of charge, and we will notify you of the result within 14 days. Link request information is destroyed upon unsubscription (Section 2).
If we come to retain your consent information for more than 2 years, we will notify you every 2 years that you have consented to receive advertising information and confirm whether you wish to continue receiving it.
Information you have requested, such as the continue-building link you requested, the demo call you requested (including verification code text messages), and contact regarding the sales consultation you requested and the confirmation text message, is not advertising information, so we send it regardless of your consent to receive advertising information, and it contains no advertising content.

9. Measures to Ensure the Security of Personal Information

Humelo implements the following measures to manage your personal information securely:

Encrypted storage and transmission of personal information
Restriction of access rights to personal information and management of access records
Partially masking mobile numbers in internal notifications (only sales consultation request notifications include the full number so that a representative can contact you right away); full numbers can be viewed only by authorized staff, and each viewing is logged
Regular security inspections and improvements

10. Rights of Data Subjects and How to Exercise Them

You may exercise the following rights regarding your personal information at any time:

Request access to your personal information
Request correction or deletion of your personal information
Request suspension of processing of your personal information, and withdraw consent
Withdraw consent to receive advertising information and consent to the use of personal information for promotional purposes (see Section 8 for how)

You may exercise these rights via privacy@humelo.com or the contact information in Section 11, and you may also do so through a legal representative or a person you have authorized. Humelo will take action without delay upon receiving a request, and will process requests for access within 10 days.

You can delete your Sody member account yourself in the Sody app under “Settings → Account settings → Delete account” or on the web at app.sodyai.com/account/delete. When you delete your account, your login information (email, name, phone number, profile picture, linked social logins) and mobile number verification records are deleted, and organizations that you used alone are suspended together with their AI agents and their connected phone numbers are returned. Organizations shared with others are left as they are and only your membership in them is removed, and payment and refund records are retained for the periods required under applicable laws.

11. Chief Privacy Officer and Responsible Department

For inquiries, complaint handling, and remedies for damage related to the processing of personal information, please contact us below.

Department Responsible for Privacy Protection
Department: Privacy Protection Team
Email: privacy@humelo.com

12. Remedies for Infringement of Rights

To seek remedies for infringement of your personal information, you may apply for dispute resolution or consultation to the organizations below.

Personal Information Dispute Mediation Committee: 1833-6972 (no area code), www.kopico.go.kr
Personal Information Infringement Report Center (Korea Internet & Security Agency, KISA): 118 (no area code), privacy.kisa.or.kr
Supreme Prosecutors’ Office: 1301 (no area code), www.spo.go.kr
Korean National Police Agency: 182 (no area code), ecrm.police.go.kr

13. Changes to This Privacy Policy

This Privacy Policy takes effect on November 2, 2026.
Additional amendment of November 2, 2026: We added the information processed in the Sody app and in Sody member mobile number verification (common to the Sody app and app.sodyai.com). We added the Sody app and member mobile number verification to the scope of this Policy (introduction), and described members’ mobile numbers and text-message verification records, records of receiving 30-minute free test numbers, app usage records, device information, advertising identifiers, app error records, and push notification tokens (Section 1.G) and their retention periods (Section 2); outsourcing and overseas transfers for the app (Google Firebase, Adjust, Expo, the app’s transmissions to Meta and TikTok, and sending of mobile number verification text messages; Sections 4, 5, and 6); personalized advertising (Meta, TikTok), added to the purposes of use of Sody app behavioral information, and how to refuse advertising identifiers, personalized ads, and notifications in the app (Section 7); and the account deletion path (Section 10). We are giving this notice before the data collection features of app version 1.0.2 and member mobile number verification begin, and because it applies only to those who install and use the Sody app and those who complete member mobile number verification, it takes effect immediately on November 2, 2026. The items collected and purposes of use on the websites (humelo.com, sodyai.com) do not change.
Amendment of November 2, 2026 (effective the same day): If you enter your mobile number in the demo card on sodyai.com to try a demo, the Console server converts that mobile number and the device identifier for ad measurement into hashed values and sends them via the Meta Conversions API for ad performance measurement, even before you sign up for the demo (Section 6; original values are not sent). This changes the statement made in the October 30, 2026 amendment that mobile numbers are not sent when a mobile number is entered during a demo, and takes effect on November 2, 2026. On the same day, we also corrected two statements that did not match actual practice. We had stated that the audio of demo calls is not stored, but in fact your voice is retained for 1 year from the date of recording for consultation review and then deleted, so we corrected this to reflect the facts (the same applies to calls you place directly to the demo number; Sections 1.E and 2). We also stated that, for browser demo calls as well, the only audio retained is your voice (Sections 1.C and 2). In addition, since the morning of November 2, 2026, we no longer add numbers whose holders said they had not requested a call to the do-not-call-again list, so we removed this purpose and stated that records already remaining are retained only until their scheduled destruction date (Sections 1.E and 2). We then corrected three more statements that did not match actual practice. We had stated that the opening line of a demo call announces that it is a demo call from an AI agent and that the conversation is recorded, but in fact the opening line announces only that it is a Sody demo call (for calls placed by the AI) or that the AI agent Sody will guide you using fictitious demo data (for calls you place directly to the demo number), so we corrected this to reflect the facts (Section 1.E). We had stated that the conversation content (text) of browser demo calls is retained for 3 years from the date of collection, but in fact it is destroyed once 1 year has passed from the date it is recorded, so we corrected this to 1 year (Section 2). The caller number and selected industry collected for calls placed directly to the demo number, and their purposes of use, were missing from Section 1, so we added them (Section 1.E). We also corrected two demo call retention periods in Section 2 to match actual practice. We had stated that the transcribed conversation is retained for 90 days from the date of the request, but in fact, for both calls placed by the AI and calls placed directly to the demo number, the phone number used for the call, the transcribed conversation, and the call summary are kept in the call record and destroyed once 1 year has passed from the date of the call; we described this and corrected the statement so that the 90-day period applies only where the transcribed conversation is also kept in the request record. In addition, where we had described only the retention period for audio for calls placed directly to the demo number, we now also describe the retention periods for the call records and for the selected industry and demo number usage request records (Section 2).
Additional amendment of November 1, 2026: Sales consultation requests on sodyai.com once again accept a company name as an optional item (Section 1.F). You can submit a request without entering it, and because this applies only to those who agree to the new consent text and enter it, it takes effect immediately.
Amendment of November 1, 2026: We changed sales consultation requests on sodyai.com so that they no longer collect name, company name, email address, or inquiry details and collect only a mobile number (Section 1.F; Section 1.A applies only to inquiries on humelo.com). For those who have completed a demo, we link the number provided during the demo and the demo records to the request; when you submit a request, we send a text message confirming receipt; and so that a representative can contact you right away, we receive request notifications (including the mobile number) via Slack (Sections 5, 6, and 9). This applies only to those who agree to the new consent text and submit a request, and the use of information already collected does not change, so it takes effect immediately. We also corrected the text message outsourcees in Section 5 (outsourcing) to match actual practice (demo call verification code text messages, demo summary text messages, and Kakao AlimTalk are handled by Sendon, and continue-building link messages and advertising text messages are handled by SOLAPI).
Amendment of October 30, 2026: We added entering a mobile number during a demo, requesting a demo call, ending a browser demo call, and submitting a sales inquiry to the points at which the Console server sends data via the Meta Conversions API (the items sent and the purposes are the same, and mobile numbers are not sent). Demo calls, which previously were not placed between 9:00 p.m. and 8:00 a.m. the next day, are now placed immediately regardless of the time when the user requests them directly. The number of demo calls that can be received at the same number was increased from once a day to three times a day. Inquiry details for sales inquiries, which were already required on the input screen, are now listed as a required item. This applies only to calls the user requests directly, the nighttime restriction on advertising information remains unchanged, and no new items are collected, so it takes effect immediately.
Amendment of October 29, 2026: We reflected the change of the address of the AI agent Sody page to sodyai.com (the previous address humelo.com/sody redirects to sodyai.com). In the collection methods in Section 7, we described how the Google cookie identifier is passed in the URL when you move between the site and the Console. The operator, items collected, purposes of use, and retention periods do not change, so it takes effect immediately.
Amendment of October 28, 2026: We removed “ad delivery optimization” and “personalized advertising” from the purposes of use for transmissions to Meta and Google and of behavioral information (leaving only ad performance measurement and visit statistics analysis). Because this change narrows the purposes of use and is not unfavorable to users, it takes effect immediately.
The previous policy applied from July 13, 2025 to October 26, 2026; the policies of October 27, October 28, and October 29, 2026 each applied on that day only; the policy of October 30, 2026 applied from October 30 to October 31; and the policy of November 1, 2026 applied on that day only. If you need a previous policy, please request it at privacy@humelo.com.
Going forward, when we change this Policy, we will give notice on this page starting 7 days before the effective date, and if there are changes important to data subjects’ rights, such as changes to the items collected, purposes of use, or provision to third parties, we will give notice starting 30 days before the effective date. However, changes that are not unfavorable to users, such as reducing the items collected or the purposes of use, may be announced on this page and take effect immediately.

Effective date: November 2, 2026 · Previous policies effective: November 1, 2026; October 30, 2026; October 29, 2026; October 28, 2026; October 27, 2026; July 13, 2025