PRIVACY

Privacy Policy

Taeyung Information & Communication Co., Ltd. operates the ASTERON service, processes only necessary data, and clearly informs users of the storage location and purpose of use.

Current status Now availableEffective date August 20, 2026Last change October 7, 2026

External Service Data Processing PrinciplesASTERON KMS processes Google Drive·Calendar, Notion, and Microsoft 365 data directly connected by users only to the extent necessary to provide permitted functions. We do not sell or use linked data for advertising or use it as training data for general-purpose artificial intelligence models.

Taeyung Information & Communication Co., Ltd. (hereinafter referred to as the “Company”) operates the software brands ASTERON SYSTEMS and ASTERON KMS and complies with applicable laws and regulations, including the Personal Information Protection Act. The company discloses how personal information and external service data connected to users are accessed, used, stored and shared on the website and ASTERON KMS as follows.

Scope

This policy applies to asteron.io.kr Applies to websites, ASTERON KMS Windows applications, and ASTERON account/license/customer support functions linked thereto. For services deployed for organizations that display separate policies, those policies may take precedence.

This policy also applies to the Universal Shelf Windows application. Signed out, Universal Shelf only checks for updates (sending just the app version); signed in, it processes the Universal Shelf items in the table below. Files on the shelf and Flow processing never leave your PC.

ASTERON KMS operates in a local-first manner. In principle, original work documents, search indexes, mail copies and calendar data are stored on the user's PC and cannot be accessed by the company on a daily basis. If a user executes a cloud function directly, the minimal context required to perform that function may be transmitted externally.

Personal Information and Data We Process

Classification	Processing items	Collection method
Website/Beta Application	Name, email address, applied product, required/optional consent record, application status, administrator memo, IP address, browser/device information, User-Agent, inflow page	Entered directly by the applicant or automatically generated during the connection process
ASTERON ACCOUNT/LICENSE	Account email, authentication token, license status, app version, operating system information, device identification, login/function usage and error records	Login, license confirmation, and service use process
Universal Shelf	App version when checking for updates. When signed in: account email, sign-in tokens (stored on the PC, encrypted per Windows user), a device identifier (a one-way hash of the Windows installation ID), app version, and plan/trial/licence status	Update checks; sign-in, starting a trial and licence checks
KMS local data	Path/name/metadata/extract text/search index of the file selected by the user, project/memo/follow-up/report, mail account information and downloaded mail, local/subscription calendar schedule	Created on the PC when the user connects a folder, mail, or calendar or uses a function.
Google Calendar	Schedule information required to perform the function, such as connection account email, OAuth access/refresh token, permitted range, connection time, selected calendar ID, calendar list and properties, schedule title, description, time, repetition, location, attendee, host, status, meeting link, and event identifier of the selected calendar.	Access via Google Calendar API after user consent to OAuth
Google Drive	File/folder identifier, name, format, modification time, size, parent folder, original link, and extracted text for search of the selected folder. Contents of Google Docs, Sheets, Slides and supporting files saved by users in Drive	Read-only access through Google Drive API after user OAuth consent and folder selection
Notion	Internal integration token entered by the user, workspace name, connection time, title, body, properties, modification time, and original URL of the page, subpage, and database row shared in the integration.	Read-only access through the Notion API when a user shares a page from Notion to the integration and enters the token directly.
Microsoft 365	Linked account email/display name, OAuth token and permission scope, OneDrive file name/path/modification time/original URL/extracted body, OneNote page title/body/notebook/section/original URL, Outlook calendar title/description/time/location/attendees/organizer/status/meeting link	Access via Microsoft Graph API after user consent to OAuth
Customer Support/Feedback	Inquiry/feedback, email, app version, operating system, license status, and error diagnosis information provided by the user	User executes inquiry or feedback submission function

Document content, search terms, or email body are not automatically attached to feedback. Even if the company requests additional data, only the scope confirmed and directly provided by the user will be processed.

Access and Use of Connected Service Data

ASTERON KMS requests the following OAuth scope to integrate Google Calendar and Google Drive. We will not ask you to access your Gmail or Google Contacts data.

OAuth scope	Access level and purpose of use
`calendar.readonly`	Reads the list and properties of connectable calendars and the schedule of the selected calendar, displays them on the ASTERON calendar, and provides notification, project connection, and meeting preparation functions.
`calendar.events`	The creation, modification, and deletion of schedules explicitly confirmed by the user in ASTERON are synchronized with Google Calendar. It is not used to create or delete the calendar itself or change sharing permissions.
`drive.readonly`	The file list and contents of the Google Drive folder selected by the user are read and included in the local integrated search. ASTERON does not create, modify, or delete Drive files or change sharing permissions.

Connecting your Google·Notion·Microsoft account or workspace is optional; you can still use local calendar and document search functions without connecting.
Schedules found by ASTERON in documents and emails are proposed only as candidates and will not be written or changed on Google Calendar until approved by the user.
Google Drive·Notion·OneDrive·OneNote integration is read-only, and ASTERON does not modify or delete the original content in the range selected or shared by the user.
Google user data will not be used for any purpose other than to provide user-facing functionality for ASTERON KMS.
We do not sell Google user data or use it for personalized advertising, credit scoring, surveillance, data brokerage, or non-user profiling.
Do not use Google user data and derived data as data for training, improving, or evaluating artificial intelligence or machine learning models for general purposes or other users.
Company executives and employees do not view Google user data unless there are permitted exceptions, such as the user's explicit consent, investigation of security incidents, or fulfillment of legal obligations.

Complies with Google API Limited Use

ASTERON KMS uses information received from Google Workspace APIs in accordance with the Google API Services User Data Policy and its Limited Use requirements.

Notion and Microsoft 365

Notion only accesses pages and databases that you explicitly share with internal integrations you create. Microsoft 365 reads OneDrive, Outlook Calendar, and OneNote data within the scope permitted by the user in the OAuth consent screen. Each connection can be turned off in ASTERON KMS settings, and permission can also be revoked in the originating service's account settings.

Purposes of Processing

Product beta application reception, participant selection, installation/update/product-related information
ASTERON account authentication, license issuance and confirmation, available functions and usage management
Local search of documents, emails, and schedules, project connection, follow-up, notifications, and reports
Google Calendar calendar display and user-approved two-way synchronization
Local comprehensive search and original opening of Google Drive·Notion·OneDrive·OneNote materials
Display KMS calendar in Outlook calendar, connect projects and prepare for meetings
User-requested search, summary, comparison, meeting briefing, report, and decision support
Process inquiries and feedback, diagnose issues, prevent abuse, and protect the service
Fulfilling legal obligations and responding to disputes

Local Storage and Cloud Processing

Information stored on your PC

Original work documents stay where you keep them, and connected cloud files remain in Google, Notion, or Microsoft. Extracted text, search indexes, project data, local mail copies, schedules, connection state, and incremental sync data are stored in ASTERON KMS's local database and search-data folder. OAuth tokens, Notion integration tokens, and mail or calendar credentials are protected with Windows per-user encryption.

When using cloud AI

Cloud AI is only used when the user selects the corresponding function and executes questions, summaries, briefings, and report generation. In this case, the request sentence and the minimum excerpts of documents, emails, and schedules required for the response may be delivered in encrypted communication to ASTERON's AI relay service and the designated cloud AI provider. There is no automatic upload of the entire original file, and if you select search-only or local AI mode, no corresponding AI processing is transferred to the external model.

Even if Google·Notion·Microsoft connection data is required for a cloud AI feature, relevant minimum excerpts are included only to the extent that the user has invoked the question, brief, analyze, or report feature.

Retention and Deletion

Item	Retention period	Destruction method
Beta application information	One year after the end of the beta program or until the consent withdrawal/deletion request is processed	Permanently deleted from the database
Account/license information	Until account cancellation or service termination. If there is a preservation obligation under relevant laws, the relevant period	Deletion or de-identification of server data, destruction of authentication tokens
Google OAuth token/connection information	Until the user disconnects all Google Calendar·Drive	Delete local account linked records and sync status after revoking Google permissions
Notion·Microsoft connection information	Until the user disconnects the connection or resets the app data.	Delete local token/connection record and synchronization state. Microsoft permissions can also be revoked in your account settings
Search data extracted from connection service	While the source is connected or until the item/index is deleted by the user.	Clear local search index/extract body/cache. The original remains intact in each external service
Documents, mail, schedule, and project data saved on the PC	Until the user deletes the item or resets the app data.	Delete/reset app function or delete local data folder
Access/Security Records	Minimum period required to prevent fraudulent use and for security purposes. If there is a separate preservation obligation under the law, the relevant period	Sequential deletion or de-identification after expiration of period
Inquiry/Dispute Records	3 years after completion of processing or the period specified in relevant laws and regulations	Deletion of Electronic Records

Because local data resides on the user's PC, not on the company's server, the company cannot directly delete it remotely. Users can disconnect/reset data in the ASTERON KMS settings or close the app. %LOCALAPPDATA%\ASTERON\KMS to delete its local data folder. Back up anything you need first.

Third-Party Disclosure and Processing

The company does not sell users' personal information and connection service data, and in principle does not provide it to third parties. However, if it is necessary to provide a function explicitly requested by the user, if there is a basis for it in the law, or if it is urgently needed to protect life and safety, it can be processed to the extent permitted.

The following external services may have limited involvement for website delivery and protection and optional cloud AI features:

Trustee/External Service	Processing tasks	Processing information
Cloudflare, Inc.	Website traffic forwarding, TLS, security and fraud prevention	IP address, request URL, access time, browser/device, and security log
Google LLC / Google Cloud	Provides Google OAuth·Calendar·Drive API, processes cloud AI requests selected by users	OAuth request/token exchange information, user-connected Calendar/Drive data, minimum context required for AI request
Notion Labs, Inc.	Reading shared pages and databases through Notion API	Contents and connection request information of pages, subpages, and databases shared by users for integration
Microsoft Corporation	OneDrive·OneNote·Outlook calendar connection through Microsoft OAuth·Graph API	OAuth request/token exchange information and Microsoft 365 data permitted by the user
Paddle.com Market Limited	Processing payments for paid licences and subscriptions, issuing receipts, and handling tax as Merchant of Record	Email, country, payment method details (collected directly by Paddle), purchase and refund history
ASTERON AI relay service	Verify account/license, forward AI request, aggregate usage, and return response	Account/license identification information, feature code, request statement and minimum required context, usage amount

If the addition or change of a trustee or cloud provider has a significant impact on the processing of personal information, we will notify you through this policy. External providers must limit use for purposes other than those for which they were entrusted and protect data in accordance with applicable agreements and policies.

International Data Processing

In the process of using Cloudflare's global network, Google·Notion·Microsoft's APIs, and optional cloud AI services, some information may be transmitted and processed on servers outside of Korea. The transmission occurs over an encrypted network when the user accesses the website, connects to an external service, or executes a cloud AI function.

Items transferred: Access/security information, authentication/connection information of external services, documents and schedule data selected, shared, or permitted by the user, minimum context required for cloud AI request
Previous purpose: Website provision and security, integration with Google Drive·Calendar·Notion·Microsoft 365, generation of AI results requested by users
Retention period: The period required to provide each function and the period according to the data processing terms and conditions of the relevant provider.
How to refuse: Do not connect to external services or disconnect them, and use search-only/local AI mode instead of cloud AI. If you object to processing that is essential for the delivery of the website, your use of the website may be restricted.

When selecting an external service, the company checks data protection conditions and applies transmission section encryption and minimum data principles.

Your Rights and How to Exercise Them

Users may request to view, correct, delete, suspend processing, withdraw consent, and cancel their account regarding their personal information. After verifying your identity, the company processes it in accordance with the procedures established by applicable laws.

Disconnecting Google Calendar: from ASTERON KMS Settings → Calendar → Google Calendar → Disconnect
Disconnect from Google Drive·Notion·Microsoft 365: ASTERON KMS Settings → External Source, then disconnect the relevant service
Revoke permissions from your Google Account: Manage third-party connections for your Google Account
Withdraw permission from Notion/Microsoft account: Connection/integration of each service or app permission management screen
Delete local data: Wipe data in ASTERON KMS settings or delete local data folder
Request for deletion of application/account/inquiry data from company server: [email protected]

If you revoke your permission to an external service, ASTERON will no longer be able to access or sync new material from that service. Search indexes and local copies already stored on your PC may need to be deleted separately by removing their source or performing a data reset.

Cookies and access history

Currently, public websites do not use cookies for personalized advertising or ad tracking. Functions that require security, such as administrator login, may use essential cookies to maintain the session. To provide a stable website and prevent unauthorized use, IP address, request time, request URL, response status, and browser/device information may be recorded in server or security service logs.

If an analysis or marketing tool is introduced in the future, the name of the tool, processing items, purpose of use and method of refusal will be notified in this policy or in a separate consent screen.

Measures to ensure the safety of personal information

HTTPS encryption between website and external API communication section
Google·Microsoft OAuth PKCE, state verification and application of minimum authority scope
Windows per-user encryption of OAuth tokens, Notion integration tokens, mail credentials, and private calendar addresses
Restrict the local API to the PC's loopback address and protect it with a session token
Minimize and control access to personal information and administrator screens
Operation of security updates, log inspection, backup and incident response procedures
Transmit only the minimum data required for processing purposes and limit automatic upload of original files

Personal information of children under 14 years of age

The company's products and beta programs are intended for users aged 14 or older who use business software. The company does not intentionally collect personal information from children under 14 years of age. If we confirm that the child's information has been processed without the consent of the legal representative, it will be deleted without delay after necessary confirmation.

Privacy Contact

For inquiries regarding personal information, Google·Notion·Microsoft linked data, permission withdrawal or deletion, please send them to the contact information below.

Personal Information Protection ManagerSeongjun Moon, CEO of Taeyung Information & Communications Co., Ltd.

Email[email protected]

Telephone02-861-0305

websitehttps://asteron.io.kr

If you need to report or consult about a personal information infringement, you can use the Personal Information Infringement Reporting Center (118 without area code), the Personal Information Dispute Mediation Committee, or related organizations.

Changes to This Policy

If the company changes the processing items, purpose of use, or method of processing connected service data, this policy will be updated to the latest date. General changes will be notified at least 7 days prior to the effective date, and changes that significantly affect user rights will be notified through a notice on the website or in the product at least 30 days prior to the effective date. If we need to process your Connected Services data for new purposes or new types, we will not start processing that until we update our policy and obtain the necessary consent again.