Privacy Policy

Last Updated: June 17, 2026

Effective Date: June 17, 2026

Thank you for using markepers (the "Service"). This Privacy Policy (the "Policy") explains how Be & Pers Inc. ("Company", "we", "us", or "our") collects, uses, shares, and protects your personal information. This Policy is incorporated into our Terms of Service. By using the Service, you are deemed to have agreed to this Policy.

markepers consists of Account Connections (main service — exploring connections between Instagram accounts based on publicly available information) and Data Board (data analysis solution). This Policy applies to both services. For details on how public information is processed in Account Connections, please refer to Section 13.

1. Personal Information We Collect and Collection Methods

1.1 Information We Collect

We collect the following personal information to provide the Service:

Required Information

Collection Purpose	Information Collected	Retention Period
User registration and identification for service provision	Email, password	Until account deletion
Social login (Google, Apple, etc.)	Third-party platform account information (email, profile information, Open ID, etc.)	Until account deletion
Data analysis service provision	Uploaded data files (Excel, CSV, etc.)	Until account deletion or file deletion
AI data analysis and insights provision	User input prompts, data queries, analysis request content	Until account deletion or conversation deletion
Instagram/Meta integration and insights analysis	Instagram account information (account identifier, username, display name, profile picture, biography, website, followers count, follows count, media count); Facebook Page information (page identifier, page name); Instagram insights data (reach, views, accounts engaged, total interactions, likes, comments, saves, shares, reposts, profile visits, follows, profile activity, average watch time, skip rate, total watch time, day-of-week × hour follower activity, follower demographics — age/gender/country/city); media data (post time, caption, media type, permalink, media URL, thumbnail URL, native like/comment counts, collaborators); tagged media (UGC) where the connected account is tagged; social listening search results when used (public posts returned by hashtag/account search); Facebook user identifier (authentication diagnostics); OAuth tokens (stored encrypted)	Until account deletion, OAuth disconnect, or board deletion
Customer support and inquiry response	Email, inquiry content	Up to 3 years in accordance with applicable laws
Account Connections member features (Saved items)	Saved account list, saved posts, private memos, account collection request records	Until membership withdrawal or deletion of the item

Optional Information

Collection Purpose	Information Collected	Retention Period
Google Sheets integration (optional)	Google account info, data from connected sheets	Until disconnection or account deletion

Automatically Collected Information

The following information is automatically generated and collected during service usage:

• Device information: IP address, device type, operating system, browser type, unique device identifiers
• Usage information: Service usage logs, access time, page views, click records
• Cookies and similar technologies: Cookie ID, session information, Google Analytics and Google Ads tracking cookies (_ga, _gid, _gat, AW_*, etc.), Google Tag Manager
• Location information: Approximate regional information based on IP address

1.2 Collection Methods

• Direct input by users during registration and service usage
• Provided by third-party platforms (Google, Apple, etc.) during social login
• Automatically generated and collected during service usage
• Collected through customer support inquiries, emails, etc.
• Collected through Google API when integrating with Google Sheets

1.3 Children's Personal Information

We do not knowingly collect personal information from children under 14 years of age. If we become aware that a child under 14 has provided us with personal information, we will immediately delete such information and terminate the account. If a parent or guardian believes their child has provided personal information, please contact us at markepers.official@gmail.com.

2. Purpose of Using Personal Information

We use the collected personal information for the following purposes:

2.1 Service Provision and Operation

• User registration, login, and user authentication
• Data file upload, storage, and management
• AI-based data analysis and visualization service provision
• Service functionality provision such as data merging, chart creation, insight generation
• Google Sheets integration and data synchronization
• Personalized service provision

2.2 Service Improvement and Development

• Service usage statistics analysis and usage pattern identification
• Service quality improvement and new feature development
• Service error correction and technical problem resolution

Important: We do not use your personal information (uploaded data, input prompts, queries, etc.) for AI model training.

2.3 Customer Support

• Customer inquiry response and complaint handling
• Notification delivery and service-related guidance

2.4 Security and Fraud Prevention

• Service security maintenance and fraud prevention
• Detection and prevention of illegal activities
• Legal obligation fulfillment

3. Sharing Personal Information with Third Parties

In principle, we do not provide your personal information to third parties. However, the following are exceptions:

3.1 With Prior Consent

We may provide personal information to third parties with your prior consent.

3.2 Legal Requirements

• When required by law or by request of investigative agencies according to procedures and methods defined by law for investigation purposes
• When there are special provisions in other laws

3.3 Sharing with Third Parties for Service Provision

We may share personal information with third parties in the following cases:

Recipient	Purpose	Information Shared	Retention Period
Google LLC	Google Sheets integration service provision	Google account information, Sheets data	Until integration is disconnected

4. Personal Information Processing Entrustment

We entrust personal information processing tasks to the following external specialized companies for smooth service provision:

Entrusted Company	Entrusted Tasks	Personal Information Retention and Usage Period
AWS (Amazon Web Services)	Server hosting	Until account deletion or entrustment contract termination
Firebase (Google LLC)	User authentication, data storage and database management (Firestore, Storage)	Until account deletion or entrustment contract termination
Meta Platforms, Inc. (Facebook, Instagram)	OAuth authentication and Instagram Graph API insights data delivery	Until OAuth disconnect or account deletion
Google LLC (Gemini API)	AI-based analysis and summary generation (processes user-requested analytics features)	Deleted immediately after request processing (temporarily retained up to 30 days for abuse monitoring only; never used for training or any other purpose)
OpenAI, L.L.C.	AI chatbot response generation (guide/help chatbot processing)	Deleted immediately after request processing (temporarily retained up to 30 days for abuse monitoring only; never used for training or any other purpose)
Google LLC (Google Analytics, Google Tag Manager, Google Ads)	Service usage analytics, ad performance measurement, conversion tracking	26 months after collection (Google Analytics default retention)

We manage and supervise entrusted companies to ensure they handle personal information safely in accordance with personal information protection laws when entering into entrustment contracts.

Important: AI service providers (Gemini, OpenAI) do not use the provided data for AI model training under their paid API terms.

5. Cross-Border Transfer of Personal Information

We transfer personal information overseas for service provision as follows:

5.1 Cross-Border Transfer Status

Transferee	Country	Transfer Purpose	Information Transferred	Transfer Method	Retention and Usage Period
AWS (Amazon Web Services)	United States	Server hosting	Service usage logs	Encrypted network transmission	Until account deletion
Firebase (Google LLC)	United States	User authentication and database storage (Firestore, Storage)	Email, user ID, profile information, uploaded data files	Encrypted network transmission (HTTPS/TLS)	Until account deletion
Meta Platforms, Inc.	United States	OAuth authentication and Instagram Graph API insights data delivery	Facebook/Instagram user ID, OAuth access token, Instagram insights data	Encrypted API transmission (HTTPS/TLS)	Until OAuth disconnect or account deletion
OpenAI, L.L.C.	United States	AI chatbot response generation (guide/help chatbot)	Data analysis request content, input prompts	Encrypted API transmission (HTTPS/TLS)	Deleted immediately after request processing (temporarily retained up to 30 days for abuse monitoring only; never used for training or any other purpose)
Google LLC (Gemini API)	United States	AI-based analysis and summary generation (captions, engagement metrics, post timestamps, media types, monthly aggregates, sheet column metadata as needed for the requested feature)	Analysis request content, input prompts	Encrypted API transmission (HTTPS/TLS)	Deleted immediately after request processing (temporarily retained up to 30 days for abuse monitoring only; never used for training or any other purpose)
Google LLC (Google Analytics, Tag Manager, Ads)	United States	Service usage analytics, ad performance measurement	IP address, service usage logs, cookie ID, page views	Encrypted network transmission (HTTPS/TLS)	26 months after collection

6. Retention and Usage Period of Personal Information

6.1 General Principle

We process and retain personal information within the retention and usage period according to laws or the retention and usage period agreed upon when collecting personal information from the data subject.

6.2 Upon Account Deletion

When you delete your account, your personal information will be immediately deleted. However, the following information will be retained for the period specified by applicable laws:

Protection of Communications Secrets Act

• Access log records: 3 months

Fraud Prevention

• Fraudulent use records: 30 days after account deletion

6.3 Data Deletion

• Uploaded data files: Immediately deleted when the user deletes them from the service
• AI conversation logs: Immediately deleted when the user deletes conversations

7. Procedures and Methods for Destroying Personal Information

7.1 Destruction Procedures

• Information entered by users for registration purposes will be stored for a certain period according to internal policies and information protection reasons under other applicable laws (see retention and usage period) after the purpose is achieved, and then destroyed.
• Such personal information will not be used for any purpose other than retention unless required by law.

7.2 Destruction Methods

• Electronic file format information is destroyed using technical methods that cannot reproduce the records.
• Personal information printed on paper is destroyed by shredding or incineration.

8. Rights and Obligations of Data Subjects and How to Exercise Them

8.1 Request for Access to Personal Information

You may request access to your personal information that we process.

8.2 Request for Correction or Deletion of Personal Information

You may request correction or deletion of your personal information that we process. However, if the personal information is specified as a collection target in other laws, you cannot request its deletion.

8.3 Request for Suspension of Personal Information Processing

You may request suspension of processing of your personal information that we process.

8.4 Methods of Exercising Rights

• Email: markepers.official@gmail.com
• Direct modification and deletion through the settings page within the service
• Complete deletion of personal information through account deletion

8.5 Response Deadline

We will take action on your request without delay. However, if there are legitimate reasons, the action may be postponed, in which case we will notify you of the reason and postponement period.

9. Installation, Operation, and Rejection of Automatic Personal Information Collection Devices

9.1 Purpose of Using Cookies

We use cookies for the following purposes: - Maintaining user login status - Providing personalized services - Service usage statistics analysis - Website performance improvement

9.2 Cookie Installation, Operation, and Rejection

• You have the right to choose whether to install cookies.
• You can allow all cookies, check each time a cookie is stored, or refuse to store all cookies by setting options in your web browser.
• However, refusing to install cookies may cause difficulties in using the service.

9.3 Methods for Rejecting Cookies

• Chrome: Settings > Privacy and security > Cookies and other site data
• Safari: Preferences > Privacy > Cookies and website data
• Firefox: Settings > Privacy & Security > Cookies and Site Data
• Edge: Settings > Cookies and site permissions

10. Measures to Ensure the Safety of Personal Information

We take the following measures to ensure the safety of personal information:

10.1 Administrative Measures

• Establishment and implementation of internal management plans
• Regular employee training
• Minimization of personal information processing staff and training

10.2 Technical Measures

• Encryption of personal information
• Technical measures against hacking, etc.
• Access authority management
• Storage of access logs and prevention of forgery and alteration
• Installation and update of security programs
• Encryption during personal information transmission (TLS 1.2 or higher)
• Encrypted database storage

10.3 Physical Measures

• Access control to computer rooms, data storage rooms, etc.

10.4 Security Infrastructure

• Data storage: Data storage through Firebase Storage and Firestore
• Authentication credential handling: Passwords are never stored in plain text. We rely on Firebase Authentication's secure authentication system or industry-standard hashing algorithms (e.g., PBKDF2). OAuth access tokens are stored encrypted and used solely for API calls
• Data transmission: All data is transmitted through encrypted networks (HTTPS/TLS 1.2 or higher)
• Backup: Establishment of periodic data backup and recovery plans
• Authentication: Secure user authentication through Firebase Auth

Important: We do our best to protect your personal information, but information transmission over the Internet may not be completely secure. Please keep your account password and other login information safe.

11. Personal Information Protection Officer

We have designated a Personal Information Protection Officer as follows to be in charge of overall personal information processing and to handle complaints and remedy damages related to personal information processing by data subjects.

Personal Information Protection Officer - Company: Be & Pers Inc. - Email: markepers.official@gmail.com

You may contact the Personal Information Protection Officer regarding any personal information protection-related inquiries, complaint handling, damage relief, etc. that arise while using our service. We will respond to and handle your inquiries without delay.

12. Meta Platform Data Processing (Instagram/Facebook Integration)

We offer features that analyze your Instagram Business account insights through the Meta Platforms, Inc. (Facebook, Instagram) Graph API. This section is provided to comply with the Meta Platform Terms and Meta Developer Policies.

12.1 Data Collected from Meta

When you authorize Instagram integration, we receive the following data via the Meta Graph API:

Data Type	Items
Account identifiers	Instagram account identifier, username, display name, profile picture, followers count, follows count, media count, biography, website
Facebook Page info	Page identifier, page name (used to identify the page linked to your Instagram Business account)
Media insights	Reach, views, likes, comments, saves, shares, reposts, total interactions, profile visits, follows, profile activity, average watch time, skip rate, total watch time
Account insights	Reach, views, accounts engaged, total interactions, likes, comments, saves, shares, reposts, follower count, follow/unfollow events
Follower activity by time	Day-of-week × hour follower online activity (last 30 days, Pacific Time → converted to your timezone)
Demographics	Aggregated follower distributions by age, gender, country, and city — individuals are not identifiable
Media metadata	Post time, caption, media type, permalink, media URL, thumbnail URL, native like/comment counts, collaborators
Tagged media (UGC)	External posts in which your connected account is tagged — post time, caption, media info, like/comment/share/repost counts, author username
Social listening results	When the social listening feature is used: public posts returned by Meta from hashtag/account search
Facebook user identifier	For authentication diagnostics — Facebook user ID, display name
OAuth tokens	Authentication tokens (access_token, user_access_token) — stored encrypted, used solely for Meta API calls

12.2 Permissions (OAuth Scopes)

We request the following permissions. The purpose of each is:

Permission	Purpose
instagram_basic	Identify your Instagram account (username, profile picture, followers count, etc.)
instagram_manage_insights	Receive your account insights (reach, engagement, demographics, etc.)
instagram_manage_comments	Read external posts where your account is tagged (UGC)
pages_show_list	Identify Instagram Business accounts linked to your Facebook Pages
pages_read_engagement	Enrich Page-level info linked to your Instagram Business account

12.3 Purpose of Use

Data received from Meta is used solely to provide insights to you, the account owner:

• Visualizing your Instagram account performance (monthly charts, post analysis, demographics, etc.)
• Generating AI-based insights (post recommendations, trend analysis)
• Enabling data downloads and report generation

12.4 Meta Data Is NEVER Used For

• ❌ Training AI models — when AI providers such as Google Gemini and OpenAI are called for analysis, we send captions, engagement metrics, post timestamps, media types, monthly aggregates, and sheet column metadata as needed for the requested feature. Under these providers' paid API terms, they are contractually bound NOT to use the data for training.
• ❌ Ad targeting, marketing profile creation, behavioral tracking
• ❌ Sale or sharing with any third party
• ❌ Automated decision-making such as credit scoring or employment screening

12.5 Retention and Deletion

• OAuth access tokens: Stored encrypted. Immediately deleted when you disconnect the OAuth integration or delete your account
• Instagram insights data: Deleted immediately upon account deletion or board deletion
• Social Listening search results (hashtag / account discovery): Retained per board for up to 30 days for user convenience. Automatically deleted after 30 days. Users can manually delete individual saved searches at any time
• Meta API retention limits: The Meta Graph API has metric-specific retention limits (typically up to 2 years). Historical data beyond those limits is unavailable from Meta and is not retained by us
• Disconnecting OAuth: Removing app permissions in Facebook settings immediately revokes our access to your Meta data

12.6 How to Delete Your Data (User Data Deletion)

You can delete Meta data and the entire account using one of the following methods:

1. In-service account deletion: Sign in → top-right menu → "Account Settings" → "Delete Account". All data is permanently erased
2. Revoke from Facebook: Facebook settings → Business Integrations → revoke markepers. Our Meta data access is terminated immediately and our stored Meta data is purged

12.7 Compliance with Meta Platform Policies

We comply with the Meta Platform Terms and Meta Developer Policies and only use data received from Meta within the scope described above.

13. Processing of Public Information in the Account Connections Service

Our main service, Account Connections, collects and analyzes publicly available information on the internet to provide connections between Instagram accounts. In the course of this, public information of account owners who are not markepers members may be processed, and this section transparently describes that processing.

13.1 Items of Information Processed

Category	Items
Public profile information	Account name (username), display name, profile picture, follower count, bio, website, account classification (category and account type — classified by us based on public information)
Public post information	Posting time, post description (caption), post URL, like/comment counts, media display (via official embeds)
Connection information	Sponsorship, collaboration, tag, mention, and similar-account relationships between accounts and their supporting posts — estimated information generated by us through automated analysis of public posts

13.2 Source of Collection and Legal Basis

• Source: Information publicly available on the internet
• Legal basis: Article 15(1)6 of the Personal Information Protection Act of Korea (legitimate interests of the personal information controller). We process information that data subjects have made public themselves, within the purpose and scope of such disclosure and within a scope reasonably recognized by social norms. We process only the minimum public information necessary for the service purpose of exploring and browsing marketing collaboration relationships.
• Data subjects may request that we disclose the source of collection, the purpose of processing, and their right to request suspension of processing, in accordance with Article 20 of the Personal Information Protection Act.

13.3 Purpose of Processing and Retention Period

• Purpose: Providing the account connection exploration service, and per-account connection statistics and comparison features
• Retention period: Retained for the duration of service provision; connection information is periodically refreshed to stay current. Upon a deletion request from the data subject, we delete the information without delay.

13.4 Self-Hosting and Deletion of Public Profile Images

• The original URLs of public profile images provided by Instagram are signed and expire after a period of time, becoming inaccessible. To display profile pictures reliably in the service, we may therefore store a copy of a public account's profile image in our storage (Google Cloud / Firebase Storage).
• Such storage is limited to public accounts' profile images, used solely to display avatars within the service, and is not redistributed for any other purpose.
• Retention period: Kept only for as long as necessary to provide the service, and refreshed when the source updates. When the account is no longer shown in the service, or upon a deletion request from the data subject, we delete the copy without delay.
• We do not separately store post images; post media is displayed only via Instagram's official embeds. AI insight analysis is performed on the text (captions) of posts, without images.
• Data subjects may request deletion of the copy of their profile image via the request method in Section 13.6 (Rights of Data Subjects); after identity verification, we delete it without delay.

13.5 Notice on Connection Information (Automated Analysis)

Connection labels (sponsorship, collaboration, etc.) are estimates generated by automated analysis of public posts and do not confirm any actual contractual relationship. We do not use this information for automated decision-making that has legal effect or similarly significant impact on data subjects, such as credit evaluation or hiring.

13.6 Rights of Data Subjects (Account Owners) — Regardless of Membership

Account owners whose accounts or posts appear in Account Connections may request the following regardless of whether they are markepers members:

• Access to processed information related to their account
• Correction of incorrectly displayed information (account classification, connections, etc.)
• Deletion and suspension of processing of their account/post information (exclusion from service display)
• Disclosure of the source of collection of their personal information

How to request: Please contact markepers.official@gmail.com with information verifying that you are the owner of the account. After identity verification, we will act without delay and inform you of the result.

14. Changes to the Privacy Policy

14.1 Notice of Changes

If we change the Privacy Policy, we will notify you through website announcements (or individual notices).

14.2 Advance Notice for Important Changes

We will make efforts to provide notice at least 30 days in advance for important changes to the Privacy Policy.

14.3 Continued Use of Service

If you continue to use the service after notification of changes to this Policy, you are deemed to have agreed to the changed Policy.

15. Supplementary Provisions

15.1 Effective Date

This Privacy Policy will take effect on June 17, 2026.

---

Contact Information - Company: Be & Pers Inc. - Email: markepers.official@gmail.com

By using this Service, you acknowledge that you have read, understood, and agreed to this Privacy Policy.