Privacy policy

Checking (hereinafter the “service operator”) complies with the Personal Information Protection Act and other applicable laws, GI-JUN 기준and establishes and publishes this policy to protect the personal information of data subjects who use (hereinafter the “service”).

The service is a business HR management service, and the parties responsible for processing personal information are divided into two categories.

1. Information processed directly by the service operator — Account information entered by an administrator during sign-up, service inquiries, access logs, etc. The service operator is the personal information controller.
2. Information processed on behalf of customer companies — Employee information and attendance, leave, payroll, and contract records entered by a customer company administrator for HR management of its employees. The customer company is the personal information controller, and the service operator processes the information as an entrusted processor only within the scope of the customer company's instructions. Requests to access, correct, or delete this information must be made to the administrator of your customer company, and the service operator provides technical support for fulfilling the customer company's requests.

The service does not collect location information, resident registration numbers, health information, or other unique identifying information or sensitive information under applicable laws. Information voluntarily included in attachments by a customer company is processed under the customer company's responsibility.

1. Account information processed directly by the service operator (login account, personal email, profile photo, push token, notifications) is destroyed immediately upon membership withdrawal.
2. Information entrusted by the customer company is retained until the customer company deletes it or the service agreement with the customer company ends. After the agreement ends (expiration, termination, or suspension of use), it is retained for a 90-day preservation period so it can be restored if service resumes, and is permanently deleted after the preservation period. If the customer company directly requests company deletion, it is deleted 30 days after the request date.
3. HR records of employees whose resignation has been processed by the customer company are retained until the customer company deletes them, so the customer company can fulfill its legal retention obligations under the Labor Standards Act and other laws (e.g., wage ledgers and employment contracts for 3 years).
4. In-app notifications are retained for 90 days, and service error logs are retained for up to 30 days before being automatically deleted.
5. If retention is required under applicable laws (e.g., contract and payment records under the E-Commerce Act for 5 years, consumer complaint and dispute handling records for 3 years, and access logs under the Protection of Communications Secrets Act for 3 months), the information is stored separately for the applicable period.

The service operator does not provide a data subject's personal information to third parties beyond the purposes set forth in Article 2. Exceptions apply when the data subject has given prior consent, when there are special provisions under law, or when an investigative agency requests it through lawful procedures.

Displaying the organization chart, leave schedule, and approval information to employees and administrators of the same customer company (and member companies connected as a group by the customer company) constitutes the performance of the customer company's HR management work, and the display scope is controlled by permission settings configured by the customer company administrator.

The service operator outsources the following tasks to provide stable service.

When entering into outsourcing agreements, the service operator manages and supervises processors in accordance with Article 26 of the Personal Information Protection Act by specifying prohibition of processing outside the intended purpose, technical and administrative safeguards, restrictions on re-outsourcing, damages, and other matters.

Data subjects may refuse overseas transfers; however, in that case, use of the relevant features (AI assistance, push notifications, and email notifications) may be restricted. To refuse, please contact customer support by email.

1. Personal information is destroyed without delay when the retention period expires or the purpose of processing is achieved.
2. Electronic files are permanently deleted using methods that cannot be restored, and backups are also destroyed after the backup retention cycle (up to 7 days).
3. Information that must be retained under laws is stored separately and destroyed after the retention period expires.

1. Data subjects may request access to, correction or deletion of, suspension of processing of, or withdrawal of consent for their personal information at any time.
2. Account information processed directly by the service operator can be viewed, edited, and deleted directly from the profile screen in the service. Upon account deletion, HR records remaining with the customer company are only disconnected from the login, and the customer company manages them according to its retention obligations.
3. To exercise rights over information entrusted by the customer company (HR records), you must submit a request to your customer company, which is the personal information controller. The service operator provides admin features (edit, delete, export) so the customer company can fulfill the request.
4. Children under 14 years of age cannot sign up for the service.
5. Requests to exercise rights are processed within 10 days after identity verification. If a request is made by an agent, a power of attorney must be submitted.

1. The service uses only authentication cookies (session tokens) to maintain login status and does not use third-party cookies for advertising or tracking purposes.
2. Screen settings and temporary draft content may be stored in browser storage (such as localStorage), and are stored only on the user’s device.
3. To measure service performance, page loading metrics (Web Vitals) are collected anonymously. They do not include information that identifies individuals.
4. On public pages that do not require login (landing, documentation, signup), the service collects a browser session identifier (deleted when the tab is closed), visit path, traffic source (referrer and UTM parameters), device type (mobile/desktop), and country of access for service improvement and traffic analysis. It does not store personally identifying information such as IP addresses or names. This information is deleted after 180 days.
5. You can block cookie storage in your browser settings. However, in this case, login cannot be maintained, which may make the service difficult to use.

1. Sensitive items (address, salary, account) are encrypted and stored using server-side encryption keys, and decryption and calculation are performed only on the server.
2. Database row-level security (RLS) blocks access outside the scope of company, role, and self, and access to salary and account information is limited to users with detailed permissions designated by the customer company administrator.
3. All communications are encrypted with TLS, and passwords are stored as one-way hashes. Two-factor authentication (TOTP) is provided for admin accounts, and customer companies can enforce it.
4. Sensitive personal information such as salary, account, and address is encrypted for storage and displayed with masking on screens. If an admin views, exports, or edits another person’s contact information, salary, account, or similar information in plain text, the viewer, subject, item, time, and IP are recorded and retained for 3 years, and used as evidence in investigations of personal information breaches and in response to data subject access requests.
5. Changes to personal information access permissions are recorded, and server errors and abnormal access are monitored in real time.
6. The service operator minimizes the number of personnel who can access personal information internally and regularly reviews access permissions.

The service operator designates a Chief Privacy Officer as follows to oversee personal information processing and handle data subject complaints and remedies.

You may contact the following organizations to report or consult on personal information infringements.

1. Personal Information Infringement Report Center (privacy.kisa.or.kr / 118 without area code)
2. Personal Information Dispute Mediation Committee (www.kopico.go.kr / 1833-6972)
3. Cyber Investigation Department, Supreme Prosecutors’ Office (www.spo.go.kr / 1301 without area code)
4. Cyber Investigation Bureau, Korean National Police Agency (ecrm.police.go.kr / 182 without area code)

This policy applies from 2026-09-25. If the content changes due to changes in laws or the service, we will notify you through an in-service notice at least 7 days before the effective date (30 days before for material changes to data subject rights).View full Terms of Service