Privacy Policy
The Korean text governs. This page is an English rendering of the 개인정보 처리방침 provided for convenience. Where the two differ, the Korean original is the one in force. Both describe the same processing and carry the same effective date, version, and policy ID.
“The Company” means 주식회사 바이버스, a corporation registered in the Republic of Korea under business registration number 479-86-03624. That registered Korean name is the legal identity; Vibers is the name it trades under, and tempo is the service described here.
Advance notice — version 1.3 takes effect on 2 November 2026. This notice is posted on 1 October 2026. The policy in force today is version 1.2 named above, and everything except the five items below is unchanged from version 1.2.
- A row for TikTok Shop messages exchanged added to the creator table of Article 2.
- Receiving messages added to the TikTok Shop row of Article 5.
- Message and creator discovery items, and a paragraph on receiving and keeping messages, added to Article 5-3 — that the Company receives every conversation in a connected Shop’s inbox, not only replies to proposals it sent, and that message bodies may reach the advertiser organization’s screens, the Company’s operators, and the AI development tools those operators use. The sending paragraph is widened from ‘collaboration proposals to affiliated creators’ to ‘collaboration proposals and replies to creators’, and message bodies are added to the erasure paragraph.
- The transferred items of the TikTok Shop row (reading and receiving messages, and searching for creators) and of the Anthropic PBC · OpenAI, L.L.C. row (TikTok Shop message bodies and creator discovery results) of Article 6 widened.
- TikTok Shop message bodies received and kept under Article 5-3 added to the field-level encryption of Article 10.
This amendment starts receiving and keeping messages exchanged with creators, lets their bodies reach the advertiser organization, the Company’s operators, and the AI development tools those operators use, and starts finding new creators in the TikTok Shop Creator Marketplace. Because it may materially affect the rights of data subjects, it follows the 30 days before the effective date branch of Article 12. Before the effective date, no messages are received and no creators are found this way.
Article 1 (General)
주식회사 바이버스 (the “Company”) complies with the Personal Information Protection Act of the Republic of Korea and related laws in processing personal data while operating the tempo service, and uses this policy to explain what information it processes, for what purpose, how long it keeps that information, and how it protects it.
This policy applies to the following surfaces and to the processing they produce.
- tempo marketing pages — tempo.vibers-ai.com, its sub-pages, and the service inquiry form
- Advertiser Portal — the screens where members of an advertiser organization sign in to follow project progress and submit materials
- Public forms — the screens creators and partner clinics reach through a link, without an account, to book a visit, give a shipping address, or report a post
For personal data that creators provide through a public form, the Company is the personal information controller. An advertiser is a recipient of that information, and Article 4 governs when and what an advertiser receives.
The Company has a subsidiary in the State of Delaware, United States — Vibers Global, Inc. (entity number 10534878) — and that subsidiary holds the Company’s platform partner registrations for the United States market, including the TikTok Shop Partner Center registration. The tempo service is operated, and all processing described in this policy is carried out, by the Company. Vibers Global, Inc. is not provided with personal data collected through the service.
Article 2 (Categories, purposes, and retention periods)
The Company processes the information below, by category of data subject. It does not process items absent from these tables, and when an item is added this policy is amended with it.
1. Members of an advertiser organization
| Category | Items | Purpose | Retention |
|---|---|---|---|
| Account | Email, name, organization, last sign-in time | Portal sign-in, identifying the contact, managing permissions | Until the service agreement ends or the account is deleted |
| Organization | Organization name, business registration number, logo image | Confirming the contracting party, preparing contract and settlement documents | For the period required by law after the service agreement ends |
| Access | Sign-in token issue time, access IP, browser information | Detecting unauthorized access, responding to security incidents | While the account exists |
| Submitted materials | Documents the advertiser uploads in response to a request, and the information they contain | Concluding contracts, performing onboarding and settlement procedures on the advertiser’s behalf | Articles 3 and 8 |
| Account records | The body of notes recording meetings and calls | Handing work over, confirming what was agreed | Until the Company deletes that record |
2. Creators and public form participants
| Category | Items | Purpose | Retention |
|---|---|---|---|
| Public profile | Platform, account handle, display name, profile image URL, post body and public metrics | Finding and comparing collaboration candidates | Until the Company removes them from the list |
| Analysis results | Summaries, classifications, and inferences derived from the public information above | Selecting candidates that fit a project | Same as above |
| Contact | Collaboration proposals and correspondence | Same as above | |
| Email exchanged | Sender and recipient addresses, subject, body, attachment information | Following the progress of a collaboration | Until the Company deletes that conversation |
| TikTok Shop messages exchanged (effective 2 November 2026) | The partner creator’s identifier within the Shop and account handle, message body and type, which side sent it, and when it was sent | Following the progress of a collaboration | Until the advertiser organization requests erasure or the agreement ends (Article 5-3) |
| Visit booking | Name, contact details, date of birth (optional), nationality (optional), desired treatment, preferred time, notes | Booking and running clinic visits | Up to 6 months after the project ends |
| Shipping address | Recipient name, email, mobile number, country, postal code, address, city, state, delivery instructions | Sending collaboration samples and confirming delivery | Up to 6 months after the project ends |
| Skin sensitivity | Skin sensitivity and allergy information the person chooses to write | Choosing products suited to that person | Up to 6 months after the project ends |
| Post submission | Post URL, time of posting, notes | Confirming the result of a collaboration | While the project record is kept |
| MCN and agency contacts | Name, email, phone number, work notes | Discussing collaborations for affiliated creators | Until the Company deletes them |
Creators do not create a tempo account. A public form is reached through a link issued to one person, and that link expires 45 days after it is issued.
3. Service inquirers and sign-up applicants
| Category | Items | Purpose | Retention |
|---|---|---|---|
| Service inquiry | Inquiry content, brand name, contact person’s name, contact details | Answering and following up on the inquiry | Until the Company erases the contact details |
| Attribution | Referral path and campaign values (UTM), referring page URL, device type, advertising identifiers (_fbp and _fbc), browser information | Measuring advertising performance | Same as above |
| Follow-up records | Contact method, outcome, notes | Managing the progress of an inquiry | Same as above |
| Portal sign-up application | Email, name, company name | Reviewing whether to open a Portal account | Deleted at the moment of approval or rejection |
Article 3 (Sensitive data and unique identifying information)
The Company does not collect sensitive data or unique identifying information without a purpose. It processes the two categories below only after obtaining separate consent, taken apart from every other item.
- Health-related information — skin sensitivity and allergies, and the treatment a person selects for a clinic visit. It is used only to decide which products and treatments suit that person, and for no other purpose. Skin sensitivity may be left blank and the form can still be submitted.
- Identity verification materials — for North American TikTok Shop onboarding, the copy of a passport, driver’s licence, or state-issued identification that TikTok Shop requires for seller review, together with the legal name, date of birth, nationality, and residential address it contains. It is used only for onboarding review, and only staff with the corresponding permission can open it.
The Company does not engage anyone under 18 as a collaboration partner, and public forms accept a submission only after confirming that the person is 18 or older.
Article 4 (Provision of personal data to third parties)
The Company does not provide a data subject’s personal data to third parties. The exceptions below are provided only after the data subject has been informed in advance and has given separate consent, and that consent is taken only in the project concerned.
| Recipient | Purpose | Items | Retention and use period |
|---|---|---|---|
| The partner clinic performing the treatment | Accepting the booking and running the visit on the day | Name, contact details, desired treatment, confirmed visit time | Until the purpose of running the visit is achieved |
| The advertiser (only for projects where the brand ships directly) | Sending collaboration samples | Recipient name, email, mobile number, shipping address, delivery instructions | Until the purpose of shipping is achieved |
| TikTok Shop (only for North American TikTok Shop onboarding) | Opening and reviewing a seller account | Information about the representative, the operating officer, and the ultimate beneficial owners contained in the application documents | Until TikTok Shop’s review procedure ends |
In projects where the Company ships samples itself, shipping addresses are not provided to the advertiser. That consent is taken only in projects where the brand ships directly.
Article 5 (Outsourcing of personal data processing)
The Company outsources the processing work below in order to operate the service. Each outsourcing agreement covers the prohibition on processing beyond the stated purpose, restrictions on sub-processing, measures to ensure safety, and the return or destruction of data when the outsourcing ends.
| Processor | Outsourced work |
|---|---|
| Google Cloud Platform | Running the application servers and database (Seoul region, Republic of Korea) |
| Cloudflare, Inc. | Storing uploaded files and submitted documents |
| Google LLC (Gmail) | Sending collaboration proposal email and receiving replies |
| Resend, Inc. | Sending notification and invitation email |
| Aligo Co., Ltd. | Sending domestic mobile text messages |
| Twilio Inc. | Sending international mobile text messages |
| TikTok Shop | Sending messages exchanged with creators (effective 18 September 2026) and receiving them (effective 2 November 2026) |
| Apify Technologies s.r.o. | Collecting public social profiles and posts |
| OpenAI, L.L.C. | Analysing public profiles and drafting proposal copy |
| Slack Technologies, LLC | Delivering notifications of incoming service inquiries |
| Google LLC (Apps Script and Sheets) | Storing the content of service inquiries |
| Meta Platforms, Inc. | Measuring advertising performance on the marketing pages |
| Microsoft Corporation | Analysing usage behaviour on the marketing pages |
| Google LLC (Google Analytics) | Measuring visit and conversion statistics on the marketing pages |
| Anthropic PBC · OpenAI, L.L.C. | Handling requests when an internal operator uses tempo operations features through an AI development tool |
When a processor changes, this policy is amended to say so.
Article 5-2 (Google account data)
When an operator connects a mailbox, tempo by Vibers uses the Gmail API to process that Google account’s mail address and the sender and recipient addresses, subject, body, and attachments of its mail. This data is used only to send collaboration proposal email, receive replies, carry out operational work, and follow the progress of a collaboration.
The Company does not use Google account data for advertising, profiling, or model training. It does not share that data with third parties except where required by law or necessary to send or receive the mail the user requested. On disconnecting the mailbox, or on request through the contact below, a user may ask the Company to delete the Gmail data it holds.
The use of Google account data follows the Limited Use requirements of the Google API Services User Data Policy.
Article 5-3 (TikTok Shop integration data)
This article has been in force since 18 September 2026; the ‘Messages’ and ‘Creator discovery’ rows of the table below and the parts about receiving and replying to messages take effect on 2 November 2026. When an advertiser organization connects its own United States TikTok Shop to tempo, the Company receives the items below from TikTok Shop, within the scope that Shop’s seller account has authorized. The advertiser organization makes the connection itself and may disconnect it at any time.
| Category | Items received | Purpose |
|---|---|---|
| Connection | Shop identifier and name, the seller account’s TikTok identifier, access and refresh tokens | Maintaining the connection and confirming read permission |
| Creator identity | Affiliated creators’ TikTok identifiers, account handles, display names, profile image URLs | Gathering one person’s results onto a single row |
| Performance | Sales, view, and settlement figures at Shop, product, creator, video, and LIVE level | Reporting results to the advertiser organization |
| Raw records | The bodies of the requests and responses exchanged in order to receive the items above | Finding the cause when figures disagree |
| Messages | Conversations with creators in the connected Shop’s inbox: conversation identifier, the other creator’s identifier within the Shop, account handle, and profile image URL, message body and type (text, product card, collaboration invitation card, free sample card), which side sent it, and when it was sent | Letting the advertiser organization and the Company’s operators read and answer creators’ replies |
| Creator discovery | Account handles, display names, profile image URLs, marketplace identifiers, operating regions, follower counts, categories, content performance, sales amounts or sales and units-sold ranges, followers’ top age ranges and gender split, affiliated MCN names, creator levels and performance scores, marketplace badges such as recommended or fast-growing, and whether the Shop has collaborated with, invited, or blocked them, of creators registered in the TikTok Shop Creator Marketplace who match conditions an operator requested for the advertiser organization’s campaigns | Finding collaboration candidates for that advertiser organization |
The items above are kept until the Company erases them, and the final paragraph of this article decides what is erased and when. A message partner’s profile image URL, however, is received but not kept, and creator discovery items are returned to the operator who asked and are not kept.
So that a creator’s profile image does not vanish from the screen when its original URL expires, the Company keeps a copy in its own storage. That storage is in the United States, and the Cloudflare row of Article 6 records the transfer.
With the advertiser organization’s approval, the Company sends collaboration proposals and replies to creators as TikTok Shop messages. The message body and the recipient’s identifier within the Shop are transmitted to TikTok Shop at that point, and the TikTok Shop row of Article 6 records the transfer.
From 2 November 2026, the Company receives and keeps the messages exchanged with creators in a connected Shop’s inbox. This covers not only replies to proposals the Company sent but also messages a creator sent first and messages the advertiser organization exchanged directly on TikTok Shop, and on the first receipt conversations from the preceding 90 days are received as well. Received messages are visible on that advertiser organization’s tempo screens and to the Company’s operators, and may be passed to an AI development tool when an operator uses one to carry out their work (the Anthropic PBC · OpenAI, L.L.C. row of Article 6). Message bodies are encrypted field by field when stored.
The Company does not use TikTok Shop integration data for advertising, profiling, or model training. It does not share that data with third parties except where required by law or necessary for a delivery the advertiser organization requested.
Disconnecting and erasure are two different events. Disconnecting stops the Company from receiving anything further, but what was already received remains. When the advertiser organization requests erasure or the agreement ends, the Company irreversibly overwrites every value among the items above that points to a person, and every message body, and deletes the profile image copies it kept in storage. The record of what was received, when, how many, and what was skipped remains, and that record does not point to a person.
Article 6 (Cross-border transfer of personal data)
The Company’s application servers and database are located in the Republic of Korea (Seoul) region. The work below, however, transfers personal data outside Korea. A data subject may refuse a cross-border transfer using the methods in Article 9; refusing may limit the use of the corresponding feature.
The TikTok Shop row of the table below, and the words “copies of the profile images of creators affiliated with a connected Shop” in the Cloudflare row, have been in force since 18 September 2026. The items concerning messages and creator discovery added to the TikTok Shop row and the Anthropic PBC · OpenAI, L.L.C. row take effect on 2 November 2026.
| Recipient | Country | Items transferred | When and how | Purpose | Retention |
|---|---|---|---|---|---|
| Cloudflare, Inc. | United States and others (global network) | All uploaded files and submitted documents, copies of the profile images of creators affiliated with a connected Shop | Sent over the network at upload time | File storage | Until the Company erases them |
| Google LLC | United States | Sender and recipient addresses, subject, body, and attachments of collaboration email | Sent through the API when mail is sent or received | Sending mail and receiving replies | Until the Company deletes the conversation |
| Google LLC | United States | Brand name, contact person’s name, contact details, attribution information, and browser information from a service inquiry | Sent when the inquiry form is submitted | Storing the inquiry | Until the Company erases it |
| Slack Technologies, LLC | United States | Brand name, contact person’s name, and contact details from a service inquiry | Sent when the inquiry form is submitted | Notifying the responsible staff member | Per Slack’s retention policy |
| Meta Platforms, Inc. | United States and Ireland | Marketing page visit and behaviour records, advertising identifiers (_fbp and _fbc), IP, browser information | Sent automatically when a page is viewed | Measuring and optimizing advertising performance | Per Meta’s retention policy |
| Microsoft Corporation | United States | Navigation, clicks, scrolling and other usage behaviour on the marketing pages, IP, browser information | Sent automatically when a page is viewed | Analysing usage behaviour | Per Microsoft’s retention policy |
| Google LLC (Google Analytics) | United States | Marketing page visit and event records, IP, browser and device information, measurement identifiers | Sent automatically when a page is viewed | Measuring visit and conversion statistics | Per Google’s retention policy |
| OpenAI, L.L.C. | United States | Public account handles, display names, bios, post bodies, draft proposal email | Sent through the API when analysis or a draft is requested | Analysing candidates and drafting copy | For as long as the request needs (requested not to be used for training) |
| Apify Technologies s.r.o. | Czechia | The account handles to be collected | Sent through the API when collection runs | Collecting public profiles and posts | Until the collection job finishes |
| Twilio Inc. | United States | Recipient mobile number, message body | Sent through the API when the message is sent | Sending text messages to international recipients | Per Twilio’s retention policy |
| Resend, Inc. | United States | Recipient email address, subject, body | Sent through the API when the mail is sent | Sending notification and invitation email | Per Resend’s retention policy |
| TikTok Shop | United States | Connected Shop identifier and access token, the identifier of a conversation being read and creator search conditions, the body of a message to a creator and the recipient’s identifier within the Shop | Sent through the API when results or messages are read, when creators are searched, and when a message is sent | Maintaining the connection, sending and receiving messages, and finding creators | Per TikTok’s retention policy |
| Anthropic PBC · OpenAI, L.L.C. | United States | Operational data within the scope an internal operator queried (may include contact details, identity verification information, the bodies of TikTok Shop messages exchanged with creators, and TikTok Shop creator discovery results) | Sent when an operator makes a request through an AI development tool | Carrying out operational work | For as long as the request needs |
Article 7 (Cookies and behavioural information)
1. Marketing pages
The tempo marketing pages use the tools below to measure advertising performance and improve the pages, and those tools use cookies and browser storage.
- Meta Pixel — records page views, scroll depth, button clicks, and inquiry submissions, and uses the
_fbpand_fbccookies. Opt out: Meta ad settings - Microsoft Clarity — records movement, clicks, and scrolling within a page, and is used to improve the screens. Opt out: Microsoft Clarity opt-out
- Google Analytics — records page views, scroll depth, button clicks, and inquiry submissions to produce visit and conversion statistics. Opt out: Google Analytics opt-out browser add-on
- Browser storage — the access key in a public form link is removed from the address bar and kept in the current tab’s
sessionStorageand inlocalStorageuntil the link expires. This exists so the form can be reopened in a new tab of the same browser, and it is not reused after the link expires.
Refusing cookies in browser settings stops the collection above. Refusing does not limit the use of the marketing pages.
This page and the Terms of Service page do not load any of the tools above. While you read this policy, the collection it describes does not happen.
2. Advertiser Portal and public forms
The Portal and the public forms carry no advertising or analytics tools and set no cookies of the Company’s own. To keep you signed in, an access token is stored in the browser’s localStorage; a public form removes the access key carried in the link from the address bar and keeps it in browser storage so the form can be reopened in the same browser until the link expires. Clearing browser storage removes these values.
Article 8 (Destruction of personal data)
The Company destroys personal data without delay once the retention period has passed or the purpose of processing has been achieved.
- Procedure — information whose retention period has passed and information whose purpose has been achieved are identified and destroyed. Information that must be preserved under other laws is kept separately for that period and then destroyed.
- Electronic files — deleted by a method that cannot be recovered. Information stored encrypted at the field level has that field emptied, and stored files are deleted from storage along with it.
- Paper documents — shredded or incinerated.
A Portal sign-up application is deleted at the moment of approval or rejection, and no application history remains. When identity verification materials are destroyed, the file itself is deleted from storage, and after that the material can neither be opened again nor restored.
Article 9 (Rights of data subjects and how to exercise them)
A data subject may at any time request access to, correction of, deletion of, or suspension of the processing of their personal data, and may withdraw consent.
- Members using the Advertiser Portal can view and correct their own information on the Portal’s account screen; any other request may be made through the contact below.
- Creators and other public form participants do not have a tempo account. Make the request through the contact below and the Company will handle it after verifying identity.
- Requests may be made in writing or by email. When a request is made through an agent, a letter of authority must be sent with it.
- The Company acts on a request within 10 days of receiving it and informs the requester of the result. Where access is restricted or refused, the reason is given with it.
A data subject may apply to the bodies below for advice and dispute mediation regarding personal data infringement.
- Personal Information Dispute Mediation Committee — +82-1833-6972 · kopico.go.kr
- Privacy Infringement Report Center — +82-118 · privacy.kisa.or.kr
- Supreme Prosecutors’ Office Cyber Investigation Division — +82-1301 · National Police Agency Cyber Bureau — +82-182
Article 10 (Measures to ensure safety)
- Field-level encryption — names, contact details, email addresses, addresses, dates of birth, nationality, health-related information, identity verification information, and the TikTok Shop message bodies received and kept under Article 5-3 are encrypted field by field (AES-256-GCM) when stored in the database, and the encryption keys are managed outside the database. Passwords are stored in a form that cannot be decrypted.
- Access control — the number of staff who can reach personal data is kept to a minimum, and access scope is separated by organization. Internal operator accounts have no password and sign in only with a company-domain Google account.
- File access restriction — submitted documents have no directly downloadable URL; after permission is verified, a single-use URL that expires within two minutes is issued and delivered.
- Public form access restriction — the access key in a public form link is converted to an irreversible value before it is stored, and the link address alone cannot reach another person’s information.
- Transport protection — all communication is encrypted with HTTPS.
Article 11 (Personal information protection officer)
The Company has designated the team below to oversee personal data processing and to handle inquiries and remedies for data subjects.
- Privacy team — 주식회사 바이버스 privacy team
- Contact — contact@vibers-ai.dev
- Address — 3F, 134 Sillim-ro, Gwanak-gu, Seoul, Republic of Korea
Article 12 (Changes to this policy)
When the content of this policy changes, the effective date and the changes are posted on this page. A change that materially affects the rights of data subjects is announced 30 days before it takes effect; any other change is announced 7 days before it takes effect.
Addendum
This privacy policy takes effect on 27 August 2026.
Version 1.2 (one processor added to Article 5, Article 5-3 added, a TikTok Shop row added to Article 6, the Cloudflare row widened, and a paragraph about the Company’s United States subsidiary added to Article 1) was announced on 11 September 2026 and took effect on 18 September 2026. Because it announced processing that had not yet started and disclosed how the Company is constituted, it followed the seven-days-before notice in Article 12.
Version 1.3 (a TikTok Shop messages row added to Article 2, receiving added to the TikTok Shop row of Article 5, message and creator discovery items and a receiving paragraph added to Article 5-3 with its sending and erasure paragraphs widened, the transferred items of the TikTok Shop row and the Anthropic PBC · OpenAI, L.L.C. row of Article 6 widened, and TikTok Shop message bodies added to the encryption of Article 10) was announced on 1 October 2026 and takes effect on 2 November 2026. Because it starts receiving and keeping messages exchanged with creators, lets their bodies reach AI development tools, and starts finding new creators in the Creator Marketplace, it follows the 30-days-before notice in Article 12.