Privacy Policy

Effective date: 19 August 2026

Concerto Labs (the "Company") operates The CEO Staff (the "Service", including the website theceostaff.com and the desktop app for macOS and Windows) in compliance with the Personal Information Protection Act of the Republic of Korea ("PIPA") and other applicable laws. In order to process personal data lawfully and keep it secure, the Company establishes and discloses this Privacy Policy pursuant to Article 30 of PIPA.

The CEO Staff is a desktop app that recognises what the other party says during a video meeting in real time, supplies a script you can read aloud, and produces a summary report once the meeting ends. It is currently available on macOS and Windows, and the features offered may differ by operating system. Because of what the Service does, it handles information that can be sensitive — meeting audio and the content of conversations — so the Company sets out its principles for that material separately in Article 5.

In short

•Meeting content — audio, transcripts, reports, knowledge base and so on — is stored, as a rule, only on your device.

•The exception is where you use the meeting-record sharing feature: the summary, transcript and participant details of that record are then stored on the Company's servers. Recordings are never uploaded to the servers under any circumstances. Revoking a share also deletes what was stored (Article 5(2)).

•The Company does not use your conversations to train AI models.

•The Company does not sell personal data for money. The website does carry a Meta pixel for measuring advertising performance; in regions where prior consent is required it runs only with consent (Article 10). The desktop app contains no advertising or tracking technology.

•Notifying meeting participants about recording and transcription, and obtaining their consent, is your responsibility (Article 5(4)).

•For paid plans, the Company does not store full card numbers or card security codes; withdrawal and refunds follow the Paid Service Withdrawal, Cancellation and Refund Policy.

Article 1 (Scope)

① This Policy applies to all of the following.

1. Visiting the website (theceostaff.com) and registering interest in the beta test
2. Sending and receiving invitations, and signing up and logging in
3. Use of the desktop app (macOS and Windows) (meeting sessions, knowledge base, rehearsal, reports, meeting-record sharing and so on)
4. Viewing the meeting-record web viewer (theceostaff.com/r/)
5. Customer support and notices

② Where the Company enters into a separate agreement with a corporate customer and processes the personal data of that customer's staff on its instructions, the corporate customer is the controller and the Company acts as a processor. In that case the corporate customer's privacy policy takes precedence.

③ This Policy does not apply to external sites and services linked from the Service; please review the policies of those operators.

④ The Service may offer paid subscriptions in three-month or one-year terms, together with additional paid products. Withdrawal of subscription, cancellation and refunds for paid services are governed by the Paid Service Withdrawal, Cancellation and Refund Policy.

Article 2 (Definitions)

The terms used in this Policy have the meanings below; terms not defined here follow PIPA and related legislation.

1. "Personal data" means information about a living individual that identifies that individual — such as a name, email address or voice — including information that identifies the individual when readily combined with other information.
2. "Data subject" means the individual identifiable by the information processed, and in this Policy includes users who access, register interest in, sign up for or use the Service, as well as third parties who take part in a user's meeting.
3. "User" means a person who has entered into a service agreement with the Company and uses the Service.
4. "Meeting content" means audio processed while the user uses the Service, its transcript, translations, summaries and reports, and the knowledge base, FAQ and Memory entries the user has registered — that is, everything the user supplies or the Service generates.
5. "Processor" means a party entrusted by the Company with processing personal data on its behalf.
6. "Overseas transfer" means providing, entrusting or storing personal data outside the Republic of Korea.

Article 3 (Purposes of processing)

The Company processes personal data for the purposes below and does not use it for any other purpose. Where a purpose changes, the Company takes the necessary steps, such as obtaining separate consent under Article 18 of PIPA.

1. Receiving beta registrations and reviewing invitations: verifying applicants, assessing fit, managing the invitation queue, sending invitation emails
2. Sign-up and account management: identity verification (email confirmation), keeping sessions signed in, account security, preventing duplicate and fraudulent registration
3. Operating the invitation programme: issuing, delivering and expiring invitations, granting and reconciling rewards (free usage credits) for inviters and joiners
4. Providing the Service: real-time speech recognition, answer script generation, translation and interpretation, summaries and meeting reports, storing and searching the knowledge base, FAQ and Memory, meeting rehearsal
5. Sharing meeting records: creating the web share link for a record at the user's request, managing access rights, emailing the link to participants, and processing revocation of a share
6. Usage management: granting, consuming and expiring free usage credits
7. Customer support and notices: responding to enquiries, onboarding support, sending essential notices such as incidents and policy changes
8. Service improvement and statistics: statistical analysis such as feature-level usage and error diagnosis (pseudonymised or aggregated as a matter of principle)
9. Preventing misuse and complying with the law: detecting abuse and fraudulent credit acquisition, handling disputes, meeting statutory obligations
10. Marketing messages (with separate consent): information about new features, events and promotions
11. Measuring advertising performance: measuring what users who arrive through an advertisement do — visits to the website, downloads and the like — analysing advertising efficiency and building advertising audiences
12. Paid service payment and refunds: payment for subscriptions and additional products, management of recurring payments, payment confirmation, issuing receipts, processing withdrawal, cancellation and refunds, preventing fraudulent payments and handling payment-related disputes

Article 4 (Categories of personal data processed and how it is collected)

① Beta registration (registering interest)

You can register without providing the optional items, although there may then be less information available for the invitation review.

② Sign-up and invitations

Phone number: stored converted to international format (E.164, without hyphens), and used only for essential account notices and for identity checks and contact during customer support. It is not used for marketing without separate consent.

Note when sending invitations: entering a third party's email address to send an invitation amounts to providing that third party's personal data to the Company. You must obtain that person's consent in advance. The Company uses the address only to send the invitation and confirm the outcome, and destroys it without delay once the invitation has expired or gone unused.

③ Use of the Service (meeting content)

As a rule, meeting content is stored only inside the user's device. The Company's servers and its external AI and speech-recognition providers are involved only as a transient processing path that produces a result and returns it to the user's screen.

By way of exception, where a user uses the meeting-record sharing feature, a snapshot of that record is stored on the Company's servers. The details are set out in Article 5(2).

Recordings are not included in the snapshot that is shared. Times in the transcript are also stored only as elapsed time from the start of the meeting, not as absolute timestamps.

④ Information collected automatically

⑤ Data minimisation

1. The Company collects no unique identifiers whatsoever, such as resident registration numbers or passport numbers.
2. The Company does not set out to collect sensitive data such as political opinions, health, sex life, genetic data or criminal records. Because such material may naturally arise in a user's meeting, the Company applies the enhanced safeguards in Article 5 to meeting content as a whole.
3. The Company does not create or store biometric data such as voiceprints for speaker identification. Speakers are distinguished only by processing separate audio channels (your microphone / the other party's sound).
4. The Company does not keep its own record of website visitors' IP addresses; for country of access it records only the country code in the request header (for example KR).

⑥ Paid service payment and refunds

Details of the payment method — card number, expiry date, card security code and the like — are handled directly by the payment gateway. The Company does not store full card numbers or card security codes.

⑦ App download

The phone number is stored converted to international format (E.164, without hyphens) and is not used for marketing without separate consent.

Article 5 (Special provisions on meeting content)

Meeting content captures conversations between the user and the other party and so needs particular protection. The Company observes the following principles.

① As a rule, meeting content is stored only on the user's device (local-first design)

1. Recordings, transcripts, translations, answer scripts, summaries and reports, Memory items, the knowledge base and FAQ, and information about meeting counterparts are held in the app's own data area on the user's device, encrypted per account. Unless the meeting-record sharing in paragraph 2 is used, none of it is transmitted to or stored on the Company's servers, and the Company can neither hold nor read it.
2. The Company's servers and its external providers are involved only as a transient processing path that generates a result and returns it to the user's screen. The audio stream for real-time speech recognition is sent to the speech-recognition provider only while the session runs and is not stored; text for generating answers and summaries is sent to the AI provider, and processing ends when the result is returned (Article 12). Where live meeting notes are switched on, the speech in each interval is also sent to the AI provider at regular intervals during the meeting so that a summary can be generated. What is sent is processed and finished together with the return of the result, and is not stored.
3. Please note: because meeting content exists only on your device, it cannot be recovered in the following cases.
   • You delete the app together with its app data
   • You reset or replace your device
   • The operating system's credential store (the macOS keychain, the Windows Data Protection API and the like) is damaged or reset and the encryption key can no longer be read
   • You sign in from another device (synchronisation across devices is not supported)
   • You sign in with a different account (data is stored separately per account)

   The encryption key that opens the account's data is tied to the protected area of that device's operating system, so copying the data files alone to another device does not allow them to be decrypted. This is deliberate, so that someone who takes the files cannot read them. The Company holds no backup and therefore cannot help with recovery. Please save important reports and documents separately using the download function in the Service.

② Processing when a meeting record is shared (an exception to local-first)

1. When a user uses the meeting-record sharing feature, the title, structured summary, timeline entries, speaker names, participant email addresses and names, and transcript of that record are stored on the Company's servers as a snapshot. This is so that participants who do not use the app can open the record through a web link. The email sent to participants contains only the title of the record, the viewing link and any note the user has written; it does not contain the record itself.
2. Recordings are not part of what is shared and are never stored on the Company's servers under any circumstances.
3. Times recorded in the transcript are stored only as elapsed time from the start of the meeting, not as absolute timestamps.
4. Users may choose whether the share is open to "anyone with the link" or to "participants only".
5. Users may revoke a share at any time. Revoking deletes the snapshot stored on the server, and links already sent can no longer be used to gain access.
6. Where a user enters participants' email addresses in order to send the link, this amounts to providing a third party's personal data to the Company. The user must tell those participants in advance that the record is being shared and obtain any consent required.
7. The Company uses the participant email addresses it receives only to send the link to the record and to confirm the result.
8. If the sharing feature is not used, the meeting record never leaves the user's device.

③ Not used to train AI models

The Company does not use your audio, transcripts, knowledge base or reports to train or fine-tune artificial intelligence models. The Company's contracts with the external AI providers it uses (Article 12) likewise stipulate that the data is not used for model training.

④ Your responsibility to notify and obtain consent

1. Processing the other party's audio begins with the user's own choice and action, and the Company processes it on the user's instructions.
2. Before any recording or transcription takes place, you are responsible for informing meeting participants and obtaining any consent required by the law that applies to you. Korea's Protection of Communications Secrets Act prohibits recording by someone who is not a party to the conversation, and some countries and states — California in the United States, for example — require the consent of every participant (all-party consent).
3. The Company is not liable for disputes arising from a user's failure to meet this obligation, and may restrict use of the Service where unlawful use is established.

⑤ Access control

1. Because unshared meeting content is stored only on the user's device, Company personnel cannot read it. Even where the Company needs to inspect meeting content for technical support or incident response, access is impossible unless the user supplies the material directly. Snapshots shared under paragraph 2 are, however, stored on the Company's servers and are therefore technically accessible. The Company grants access to the smallest possible number of people, records and manages access history, and does not read them for any purpose other than incident response and compliance with legal obligations.
2. Where a user provides part of their meeting content to the Company in the course of an enquiry or error report, the Company uses it solely to handle that enquiry and destroys it without delay once handling is complete. In such cases the time, reason and identity of access are logged and kept for one year.
3. For information held on the Company's servers, such as account data, access rights are granted to the minimum number of people and access history is logged and managed.

⑥ Deletion controls

1. Users can delete individual sessions (recording, transcript, report), knowledge base documents, Memory items and knowledge base folders themselves at any time within the Service.
2. Deleting the app together with its app data destroys all meeting content immediately.
3. Because unshared meeting content is not held on the Company's servers, no separate deletion request to the Company is required.
4. A shared meeting record is deleted from the server when the share is revoked within the Service. Where revocation is difficult, deletion may be requested through the contact point in Article 14.

⑦ Information about meeting counterparts (third parties)

1. Where a user registers a counterpart's name, organisation or disposition in the knowledge base, or requests public-information research, the Company processes it on the user's instructions. Users must satisfy themselves that collecting and using that information is lawful.
2. Public-information research searches and summarises only information published on the internet; the Company does not build a separate database of individuals.
3. A third party who was a meeting counterpart may request access to or deletion of information about themselves through the contact point in Article 14. The Company will pass the request to the user holding that information and support its handling.

Article 6 (Processing and retention periods)

① The Company processes and retains personal data within the period required by law or the period consented to by the data subject.

② The Company may, after prior notice, make dormant or destroy the account of a user who has not used the Service for a year or more.

Article 7 (Destruction of personal data)

① Where personal data becomes unnecessary — because the retention period has passed or the purpose has been achieved — the Company destroys it without delay.

② Personal data stored electronically is permanently deleted by a method that prevents recovery or reconstruction; paper documents are shredded or incinerated.

③ Personal data that must be retained under other legislation is stored and managed in a separate database or a different storage location.

Article 8 (Provision to third parties)

① The Company processes personal data only within the purposes set out in Article 3, and provides it to third parties only with the data subject's consent or where Articles 17 and 18 of PIPA otherwise apply, such as under a specific provision of law.

② The Company currently does not provide personal data to third parties. The following are exceptions.

1. Where a state authority, such as an investigative agency, makes a lawful request following statutory procedure
2. Where personal data must be transferred as part of a merger or business transfer (in which case the fact and the user's rights are notified in advance)

③ The Company does not sell personal data for money. However, information passed to Meta through the advertising pixel in Article 10 may count as a "sale" or "share" of personal data under some US state privacy laws. You can refuse this at any time from "Cookie settings" at the bottom of the website (Article 18(2)).

④ The Company reviews the statutory requirements and procedure for any request for information from an investigative agency, and notifies the affected user unless prohibited by law.

Article 9 (Entrustment of processing)

① To provide the Service smoothly, the Company entrusts part of its personal data processing to external providers.

② Of the processors above, Supabase, Inc. stores personal data in a region inside Korea, but as the company is headquartered abroad, access from outside Korea may occur during technical support and incident response. The Company sets out this and other overseas transfers in Article 12.

③ Other overseas processors are listed in Article 12.

④ When concluding an entrustment agreement, the Company sets out in writing — as required by Article 26 of PIPA — the prohibition on processing beyond the stated purpose, security measures, restrictions on sub-processing, management and supervision and liability for damages, and supervises whether the processor handles personal data securely.

⑤ Any change to the entrusted work or the processor is disclosed through this Policy without delay.

Article 10 (Automatic collection devices and how to refuse them)

① The Company uses the following cookies and similar technologies.

② For users in regions where prior consent is required (the EU, EEA, the United Kingdom, Switzerland and Brazil), cookies other than essential cookies are stored only with consent. Marketing scripts are not even downloaded before consent is given. You can change your choice at any time from "Cookie settings" at the bottom of the website.

③ You can refuse or delete cookies through your web browser settings.

④ The Company does not use web analytics tools. To measure advertising performance it uses the Meta pixel (Meta Platforms, Inc.) on the website only, in order to see whether someone who saw an advertisement visited the website or went on to download, and to build advertising audiences. Meeting content, meeting records and account information are never passed to the advertising provider.

⑤ The desktop app contains no cookies or tracking technologies for advertising or analytics whatsoever. The pixel in paragraph 4 exists only on the website. It stores only the app settings the user has chosen — display language, session presets, prompter scripts and the like — inside the device, and this information is not transmitted to the Company's servers.

Article 11 (Automated decisions and AI processing)

① The Service analyses conversations with artificial intelligence to generate answer scripts, summaries and reports. These are reference material that assists the user; the Company does not use them to make automated decisions with legal or similarly significant effects on the user.

② Generated output may be inaccurate, so the user must make the final check and judgement.

③ The Company does not carry out automated decision-making through profiling.

Article 12 (Overseas transfer of personal data)

① To the extent necessary to provide the Service, and pursuant to Article 28-8(1)3 of PIPA (entrustment or storage of personal data for the conclusion and performance of a contract with the data subject), the Company transfers personal data overseas (entrustment and storage) as follows.

② Session recordings are not transferred to any of the providers above.

③ Meeting content is only transmitted and processed transiently in order to generate a result and is not stored by overseas providers. Snapshots of meeting records shared by the user are the exception: they are stored in the Seoul region of the Republic of Korea, and access from outside Korea may occur in the course of the provider's technical support (Article 5(2)).

④ Payment data is not transferred overseas. Payments are processed through a payment gateway inside Korea (Article 9).

⑤ Data subjects may refuse the overseas transfer of their personal data through the contact point in Article 14. However, these transfers are essential to core functions of the Service (speech recognition, AI generation, authentication, data storage), so refusing them may limit or prevent use of the Service.

⑥ Automatic transfers relating to web fonts and CDNs can be blocked through your browser's content-blocking settings, although this may affect how pages are displayed.

⑦ When contracting with overseas processors, the Company applies appropriate safeguards recognised by applicable law, such as standard contractual clauses (SCCs), and secures by contract the prohibition on model training and on use beyond the stated purpose.

Article 13 (Rights of data subjects and legal representatives, and how to exercise them)

① Data subjects may exercise the following rights against the Company at any time.

1. Access to how their personal data is processed
2. Correction where there is an error
3. Deletion
4. Suspension of processing
5. Withdrawal of consent
6. Portability (download) — meeting reports, transcripts and knowledge base entries are stored on your device and can be downloaded directly within the Service.
7. Revocation of a shared meeting record — you may revoke it yourself from the sharing management screen in the Service, or request revocation through the contact point in Article 14.

② You may exercise these rights from the settings screen in the Service, or by writing or emailing the contact point in Article 14, and the Company acts within 10 days of receiving the request. As the Company does not hold unshared meeting content, however, access, correction and deletion must be carried out by the user within the Service. Rights may also be exercised through a representative, in which case a power of attorney confirming the delegation must be submitted.

③ You are free to refuse consent to the collection and use of personal data. Refusing consent for required items will limit sign-up and use of the Service. Refusing optional items (such as marketing messages) carries no disadvantage in using the Service.

④ The Company verifies that a person exercising these rights is the data subject or a duly authorised representative.

⑤ Data subjects must exercise their rights without breaching applicable law and must not infringe others' personal data.

⑥ Information that the Act on the Consumer Protection in Electronic Commerce requires to be retained, such as payment and refund records, may fall outside the scope of a deletion or suspension request; where that is the case, the Company will explain the reason.

Article 14 (Privacy officer and access requests)

① The Company has designated the privacy officer below to oversee personal data processing and to handle complaints and remedies for data subjects.

• Privacy officer: Jemin You (COO)
• Contact: hello@theceostaff.com
• Payment and refund enquiries: hello@theceostaff.com

② Data subjects may use the contact above for any enquiry, complaint or request for remedy relating to personal data processing, including requests for access under Article 35 of PIPA. The Company will respond and act in good faith without delay.

Article 15 (Children under 14)

① The Service is not directed at children under 14, and the Company does not collect the personal data of children under 14.

② Where it is established that the personal data of a child under 14 has been collected, the Company destroys it without delay.

Article 16 (Security measures)

Pursuant to Article 29 of PIPA, the Company takes the following measures.

1. Administrative measures: establishing and implementing an internal management plan, limiting those who handle personal data to the minimum required to operate the Service, regular training for them, and managing the history of granting, changing and revoking access rights
2. Technical measures
   • End-to-end encryption in transit (TLS 1.2 or above)
   • Encryption of stored data (passwords are one-way hashed; meeting content is encrypted with a per-account AES-256 key, and that key is envelope-encrypted into the operating system's credential store)
   • Per-account data isolation and row level security
   • Structural removal of leakage risk through a local-first design that keeps unshared meeting content off the servers
   • A structure in which payment method details are handled directly by the payment gateway and never stored on the Company's servers
   • Retention of access records and protection against tampering
   • Intrusion prevention and detection, and regular vulnerability assessments
3. Physical measures: personal data is held in domestic facilities of cloud providers with physical security certifications (ISO 27001 / SOC 2 and the like)
4. Incident response: in the event of a breach, notifying data subjects and reporting to the authorities within the periods set by law

Article 17 (Remedies for infringement of rights)

To seek redress for infringement of personal data rights, data subjects may apply to the bodies below for dispute resolution or advice. These bodies are separate from the Company; please contact them if you are not satisfied with the Company's own handling of a complaint or remedy, or if you need more detailed help.

1. Personal Information Dispute Mediation Committee: 1833-6972 (www.kopico.go.kr)
2. Privacy Infringement Report Centre (Korea Internet & Security Agency): 118 (privacy.kisa.or.kr)
3. Supreme Prosecutors' Office: 1301 (www.spo.go.kr)
4. National Police Agency: 182 (ecrm.police.go.kr)

Article 18 (Additional provisions for the EU, EEA, UK and other jurisdictions)

① The following applies additionally to data subjects in regions where the GDPR or equivalent law applies.

1. Controller: Concerto Labs. Enquiries may be addressed to Jemin You (COO) / hello@theceostaff.com.
2. Legal bases for processing
   • Sign-up and provision of the Service: performance of a contract (GDPR Article 6(1)(b))
   • Processing meeting audio and transcripts: consent (Article 6(1)(a)) and performance of a contract (Article 6(1)(b))
   • Payment and refund processing: performance of a contract (Article 6(1)(b)) and compliance with a legal obligation (Article 6(1)(c))
   • Security, prevention of misuse and service improvement: the Company's legitimate interests (Article 6(1)(f))
   • Marketing messages: consent (Article 6(1)(a))
   • Statutory obligations: Article 6(1)(c)
3. Additional rights: in addition to the rights in Article 13, you have the rights to restriction, to object and to data portability, and the right to lodge a complaint with the supervisory authority where you live.
4. Transfers outside the EEA: appropriate safeguards such as adequacy decisions and standard contractual clauses (SCCs) are applied. The Republic of Korea received an adequacy decision from the European Commission in December 2021.
5. Automated decision-making: the Company does not carry out automated decision-making within the meaning of Article 22 of the GDPR.

② For data subjects in regions where US state privacy laws apply, such as California, the Company does not sell personal data for monetary consideration. However, the transfer of information through the Meta pixel in Article 10 may amount to a "sale" of personal data or a "share" for targeted advertising under those laws, and data subjects may opt out from "Cookie settings" at the bottom of the website. The Company also honours a browser's GPC (Global Privacy Control) signal as an opt-out. The rights to access, delete and correct, and not to be discriminated against, are guaranteed as set out in Article 13.

③ This Policy was drawn up with the Korean text as the authoritative version; where a translation differs, the Korean text prevails to the extent that this does not conflict with mandatory local law.

Article 19 (Changes to this Policy)

① Where this Policy is added to, amended or partly removed, the Company gives notice through the website notices or this page at least 7 days before it takes effect (30 days for changes materially affecting data subjects' rights).

② This revision made the following changes.

1. Stated that where a user uses the meeting-record sharing feature, the summary, transcript and participant details of that record are stored on the Company's servers (Key points, Articles 3 and 4, Article 5(2))
2. Added the retention period for shared meeting records and the way to delete them by revoking the share (Article 6, Article 5(6), Article 13)
3. Added the entrustment and overseas transfer arrangements relating to sharing (Articles 9 and 12)
4. Restated the Service as a desktop app (macOS and Windows) and aligned storage locations and non-recovery cases with the operating system's credential store (Articles 1, 4, 5(1), 10 and 16)
5. Corrected the generative AI provider to match actual use and stated the transfer of interval summaries for live meeting notes (Article 12)
6. (Amended 15 August 2026) Added the phone number to the required items collected at sign-up and updated the related overseas-transfer entry (Articles 4 and 12)
7. (Amended 15 August 2026) Stated that the phone number is collected when downloading the app (Articles 4 and 6)
8. (Amended 19 August 2026) Reflected the introduction of the Meta pixel for measuring advertising performance (Key points, Articles 3, 4, 6, 8, 10, 12 and 18). In regions where prior consent is required the script is not downloaded before consent, and elsewhere it can be refused at any time from "Cookie settings"

As before, recordings are never stored on the Company's servers, and if you do not use the sharing feature your meeting record never leaves your device.

③ Earlier versions of this Policy are available below.

1. In force 29 July 2026 – 31 July 2026 (v1, beta registration only): view earlier version
2. In force 1 August 2026 – 5 August 2026 (v2, before paid plans): view earlier version

Addendum

This Policy takes effect on 11 August 2026.

This amended Policy (adding the phone number to the items collected) takes effect on 15 August 2026.

This amendment (introduction of the advertising pixel) takes effect on 19 August 2026.