Privacy Policy

The Company processes personal data for the following purposes and does not use it for any other purpose.

• Member authentication and account management — including Google account authentication
• Operating the AI agent and performing tasks — processing conversations, automating connected services, and executing scheduled automations
• Keeping information from the tools you connect (Google, Microsoft, Slack, Notion, GitHub, Linear, Stripe, Vercel, Buffer, Supabase) and using it to show cards, for the agent’s memory, and to suggest, create, and run automated tasks that help you before you ask — Article 6-2
• Messaging-channel integration (KakaoTalk, Slack) and sending/receiving messages and files
• Subscription and billing management — including free trials and promotions
• Service analytics and improvement, error monitoring, security, and abuse prevention
• Responding to customer inquiries
• Marketing and online interest-based advertising (marketing website only — see Article 7)

The Company does not ask for or separately collect sensitive information or unique identifiers (resident registration numbers, etc.) (if a resident registration number appears in information kept from your connected tools, it is kept as part of that information), and does not collect personal data of children under 14.

• Account: name, email address, profile image, and unique user identifier (via Google account authentication)
• Integrations: Google and Microsoft authentication tokens (access/refresh) and granted scopes; account identifiers and access tokens (stored encrypted) for services you connect (ChatGPT, Claude, Grok, Slack, Notion, GitHub, Linear, Stripe, Vercel, Buffer, Supabase); KakaoTalk business-chat user identifier; Slack workspace and user identifiers
• Service usage data: conversation content and attachments exchanged via messengers and the web dashboard, agent task records and outputs, and profile/preference information you enter (job role, keywords of interest, response style, “get to know me” answers, agent notes)
• Information kept from connected tools: events from Google Calendar and Outlook Calendar (title, time, description, attendees, organizer, location, meeting link, response status, etc.); Gmail and Outlook mail (sender, recipients, cc, subject, received time, thread, labels, read status, the full body, and the name, size, and type of each attachment, etc.); Google Drive and OneDrive file metadata (name, type, modified time, owner, link); the name, primary email, primary phone number, company, and job title of Google Contacts and Outlook contacts; the title, status, due date, and list of Google Tasks and Microsoft To Do to-dos; Slack messages that mention you; Notion pages and database items; GitHub and Linear notifications, issues, and pull requests; Stripe payment, refund, and subscription metadata; Vercel projects and deployments; Buffer scheduled and published posts; Supabase organization and project information. Kept information is stored as it is in the tool it came from (values written in mail, messages, or documents, such as passwords, are kept as written), and attachment files themselves, file contents, and source code are never stored (per-tool items in Article 6-2)
• Billing: payment-processor (Stripe) customer and subscription identifiers, subscription status, amounts, promotion codes, and other payment results (card numbers and other payment-method details are not stored and are collected and handled directly by the payment processor)
• Automatically collected: service usage and error logs, IP address, cookies, device/browser information, and (on the marketing site) behavioral information and advertising identifiers

• Account and integration data: until account withdrawal — on withdrawal, the integration tokens stored in the service database are deleted without undue delay, and revocation of access is also requested from Google, GitHub, Linear, and Supabase. If another Dexter account uses the same Google account, GitHub account, or Supabase organization, revocation is not requested from that service so that the other account’s connection is not cut (the tokens are still deleted). If another Dexter account uses the same Slack workspace, the token of the Dexter app installed in that workspace is kept. The AI account (ChatGPT, Claude, Grok) sign-in data and the integration tokens stored on the agent server are deleted with the agent server but remain in the backups described under “Agent usage data” below, so you can disconnect any connection that was not revoked in that service’s settings (basis: consent of the data subject)
• Agent usage data (conversations, memory, files): kept until account withdrawal, and not deleted when a subscription ends (basis: consent of the data subject). When you delete your account, the memory, files, and conversations on your agent server are deleted, and from the service database we delete the text, attachment details, and titles of your conversations, messages queued to be sent through messengers, and messages received while the agent server was asleep. Records such as when messages were sent and in which direction stay, without the text. In someone else’s Dexter that was formerly shared with others, only the text you sent is deleted; the conversation titles, what others wrote, Dexter’s replies, older Slack messages whose sender was not recorded, and the conversations kept on that Dexter’s agent server stay with that Dexter. Agent server data is backed up for recovery: each time a new backup is made, backups older than 7 days are deleted, but the 3 most recent backups are kept regardless of age. When you delete your account, one more backup is made right before the agent server is deleted (if it cannot be made, the server is deleted anyway), and the backups remaining at withdrawal, including that one, are not deleted automatically after withdrawal.
• Information kept from connected tools: kept until account withdrawal. Nothing is deleted just for being old. Items you delete in a tool are deleted from what was kept too when the tool reports the deletion; when it does not, Dexter deletes them only within the recent period it fetches again to check (events deleted in Google Calendar are first marked as cancelled even when reported, and only those within this recent period are then deleted). So older items, and items deleted while the tool is disconnected, may stay here even after you delete them in the tool; they are deleted if you ask us by email or when you delete your account. If you disconnect, what was already kept stays (and is used again if you reconnect); on account withdrawal, all of it is deleted (basis: consent of the data subject)
• Payment and tax records: 5 years (basis: Act on Consumer Protection in Electronic Commerce)
• Access logs: at least 3 months (basis: Protection of Communications Secrets Act)
• Service usage/error logs, behavioral information: up to 2 years from collection or until consent is withdrawn (basis: consent of the data subject)
• Withdrawal record (email, name, phone number, profile photo URL, sign-in method, the account that carried out the withdrawal, withdrawal time) and the identifiers of the messenger accounts you linked: 3 years after withdrawal — abuse prevention and dispute handling (basis: consent of the data subject)

The Company provides personal data to third parties only where Articles 17 and 18 of the Personal Information Protection Act apply, such as the data subject’s consent or special provisions of law. Currently, no personal data is provided to third parties without the data subject’s consent.

When you choose to connect an external service (Google, Microsoft, OpenAI (ChatGPT), Anthropic (Claude), xAI (Grok), KakaoTalk, Slack, Notion, GitHub, Linear, Stripe, Vercel, Buffer, Supabase), the data needed for that feature is transmitted at your request. In particular, if you connect your own AI account (ChatGPT, Claude, or Grok), the conversations and tasks the agent processes, and the analysis for automation suggestions under Article 6-2, run through that account, and each external service’s own terms and privacy policy apply to its processing. You can disconnect any integration at any time from the connections screen.

For smooth operations, the Company outsources personal data processing as listed below. When entering outsourcing agreements, the Company specifies in writing the matters required by Article 26 of the Personal Information Protection Act — prohibition of use beyond purpose, technical and managerial safeguards, restrictions on re-outsourcing, management and supervision, and liability for damages — and supervises the processors.

For the overseas processors below, each outsourced item may be transferred abroad over the network when you use the Service (Article 28-8 of the Personal Information Protection Act). The items, purposes, and retention periods are as listed below and in this policy. Data subjects may refuse the overseas transfer; if refused, the relevant features may be limited. (To refuse: iam@lazydevz.com)

• Supabase, Inc. (U.S. company · data hosted in a Republic of Korea region): member authentication, service database, and backup storage
• Google LLC (USA): account authentication, Google Workspace API integration, and Gmail change notification delivery (Google Cloud Pub/Sub — items transferred: only the Gmail address and a mailbox change number (historyId); data hosted in a Republic of Korea region; kept for at most 1 hour, then deleted)
• Microsoft Corporation (USA): Microsoft account authentication and Microsoft Graph (Outlook mail, calendar, etc.) integration
• Stripe, Inc. (USA): payment processing
• PostHog, Inc. (USA): product/service usage analytics and error monitoring
• OpenRouter, Inc. (USA): default AI model call processing, and the analysis that drafts your profile from your connected mail and calendar when you first start (items transferred: mail senders, recipients, subjects, and bodies, and event titles, times, attendees, descriptions, etc. — Article 6-2)
• Meta Platforms, Inc. (USA): ad performance measurement and interest-based advertising (marketing site only — Article 7)
• NAVER Cloud Corp. (Republic of Korea): service server infrastructure operation
• Infobank Corp. (Republic of Korea): KakaoTalk business-chat message and file delivery
• Kakao Corp. (Republic of Korea): message delivery via the KakaoTalk messenger platform

You may grant granular consent per permission, and the Company accesses data only within the permissions actually granted. Features that need a permission you have not granted are processed only after obtaining additional consent for that permission.

Dexter’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.

Specifically, the Company (1) uses Google user data only to provide and improve the features offered to you, (2) does not use it for advertising, (3) does not use it to train or improve AI/machine-learning models, (4) does not allow humans to read it except for limited exceptions such as security, legal requirements, your explicit consent, or incident response, and (5) does not transfer it to third parties except as necessary for the above purposes.

Keeping and using Google user data under Article 6-2 follows (1)–(5) above as well, and the kept data is used only for features you can see — calendar, mail, file, and to-do cards, the tasks (automations) and cards (widgets) you create yourself that read or show that data, automation suggestions and automations Dexter turns on, and Dexter’s memory.

Disconnecting — you may revoke access at any time from the in-app connections screen or your Google account permissions page (https://myaccount.google.com/permissions); on revocation, tokens are erased without undue delay and no new information is fetched. Information already kept is deleted when you delete your account (Article 6-2).

The Google scopes the Company requests and their purposes are as follows.

• openid · userinfo.email · userinfo.profile email, name, profile — member authentication and account identification
• calendar calendar events — automating viewing, creating, and managing events
• gmail.modify reading, composing, sending, and labeling email (no permanent deletion) — summarizing, searching, replying to, and organizing mail at your request
• drive viewing and editing Drive files — accessing files you specify for document/sheet work, and regularly keeping file metadata (Article 6-2; never file contents)
• documents Google Docs — automating document creation and editing
• spreadsheets Google Sheets — automating sheet creation and editing
• presentations Google Slides — automating presentation creation and editing
• tasks Google Tasks — viewing, creating, and managing to-dos, and regularly keeping your to-dos (Article 6-2)
• contacts Google Contacts — referencing and managing contacts for calendar and email tasks, and regularly keeping contacts’ names, primary emails, primary phone numbers, companies, and job titles (Article 6-2)
• forms.body Google Forms — creating and editing forms
• meetings.space.created Google Meet — managing meeting spaces the agent creates (generating meeting links)

By signing up, you are deemed to agree to this policy, including keeping and using information from the tools you connect (Terms of Service, Article 1). The Company periodically receives the information below from the accounts of the tools you connect, and keeps it in the service database. The tools are Google (Gmail, Google Calendar, Google Drive, Google Contacts, Google Tasks), Microsoft (Outlook mail, Outlook Calendar, OneDrive, Outlook contacts, Microsoft To Do), Slack, Notion, GitHub, Linear, Stripe, Vercel, Buffer, and Supabase, and information is kept only from the tools you connect.

What is kept is shown to you and used so Dexter knows you and can help before you ask; the per-tool items are below. Mail bodies and message text are kept in full, and for mail attachments only the name, size, and type are kept. Attachment files themselves, the contents of Drive files, Notion page content, and source code are never stored. Kept information is stored and shown as it is in the tool it came from — values written in mail, messages, or documents, such as passwords or API keys, are kept as written, not masked or altered.

Purposes — (1) showing you the kept items as cards and letting the tasks and cards you create read them, (2) letting the agent remember summarized facts (e.g., the number of external meetings this week) so it can help you better, and (3) looking at the kept information together with the requests (conversations) you sent Dexter in the last 30 days to suggest, or create and turn on, automated tasks that help you before you ask (reminders, summary reports, etc.). The analysis in (3) runs through the AI account you connected (ChatGPT, Claude, or Grok) (Article 4).

Profile when you first start — when you first start using the Service, Dexter reads the sender, recipients, subject, and body of mail and the title, time, attendees, description, etc. of events from your connected mail (the last 30 days of Gmail or Outlook mail) and calendar (the last 60 days and next 30 days of Google Calendar or Outlook Calendar) to draft your profile. This analysis is processed not through the AI account you connected but by an AI model the Company calls through OpenRouter (Article 5), and is sent only to model providers that do not use the input for training and do not retain it. The input used for the analysis is not kept separately; the profile draft and its evidence (the subjects and titles of the mail and events, with short excerpts) are stored encrypted, and only what you confirm and keep is written into Dexter’s memory. The profile draft is deleted when you delete your account.

Tasks created automatically — Dexter may create automated tasks on its own based on the kept information (for example, a task that tells you about new failed payments, or a digest of Slack messages that mention you). Tasks Dexter turns on by itself are limited to ones that only notify you (reminders, summaries, organizing, etc.); Dexter tells you each time it turns one on, and you can turn it off or delete it with one tap. Actions that affect others or outside services — sending email, changing events, messaging other people, or writing to or changing anything in a connected tool — run only if you turn them on yourself.

Disconnecting and deletion — if you disconnect a tool on the connections screen, Dexter stops fetching new information from it. What was already kept stays, so Dexter picks up where it left off if you connect the same tool again. Kept information stays until you delete your account and is never deleted just for being old. When you delete your account, all of your data is deleted — the kept information, the summarized facts about it written into Dexter’s memory, the text of automation suggestions and their notices, your tasks and cards and their run history, and your conversation history (tasks and cards you created in someone else’s Dexter that was formerly shared with others, and their run history, stay with that Dexter; how far conversation history is deleted, backups, and records the law requires us to keep follow Article 3). You can also ask us by email to delete kept information without deleting your account.

Safeguards — the Company does not use the kept information to train or improve AI/machine-learning models, does not use it for advertising, and does not let humans read it except for the exceptions in Article 6 (4). Operational alerts and logs contain only identifiers and counts, never subjects, bodies, event titles, or message content. Information from Google follows the Limited Use requirements in Article 6, and information from Microsoft follows Article 6-3. Under the Slack API Terms of Service, the Company never uses information from Slack to train AI/machine-learning models. Of the information received from Stripe, only payment, refund, and subscription metadata is stored — customers’ card details and names, emails, and other contact details are never stored.

What is kept from each tool is listed below.

• Google (Gmail, Google Calendar) and Microsoft (Outlook mail, Outlook Calendar): event title, start and end time, whether it is all-day, description, attendees (names and addresses, attendee count, external attendee count, and domains), organizer, location, meeting link, whether it is part of a recurring series, your response status, and event and account identifiers; mail sender (name, address, and domain), recipients, cc, subject, received time, whether it was received or sent, thread, labels, read status, the full body, the name, size, and type of each attachment, and mail and account identifiers. Attachment files themselves are never stored.
• Google (Google Drive, Google Contacts, Google Tasks) and Microsoft (OneDrive, Outlook contacts, Microsoft To Do): file name, type (file format), last modified time, owner (name and email), link, whether it is your own file or shared with you, and file and account identifiers; contact name, primary email, primary phone number, company, job title, and contact and account identifiers; to-do title, status (whether it is done), due date, list name, completed time, last modified time, and to-do and account identifiers. File contents, folders, other contact details such as addresses, birthdays, notes, and photos, and to-do notes are never stored.
• Slack: sender, channel, time, thread, link, and the full text of messages that mention you in channels Dexter is in. DMs between people (including group DMs Dexter is in), messages in channels Dexter is not in, and attached files are never stored. Messages Dexter receives as conversation, such as DMs you send Dexter, separately become conversation records (service usage data in Article 2) and are kept under Article 3.
• Notion: title, parent location, last-edited time, property values (status, assignee, dates, etc.), and link of the pages and database items you share with Dexter (the ones you pick when connecting and any you share later in Notion). Full page content and attachments are never stored.
• GitHub: repository name, number, title, status, author, labels, and update time of notifications, issues, pull requests, and review requests that involve you, why each notification came (assigned, mentioned, review requested, etc.) and what it is about (CI, release, discussion, etc.), and links (the issue or pull request page, or the repository page for other notifications). Source code and full descriptions and comments are never stored.
• Linear: team, identifier, title, status, priority, assignee, due date, and update time of issues assigned to, created by, or followed by you. Full descriptions and comments are never stored.
• Stripe: payment, refund, and subscription metadata from your connected Stripe account (amount, currency, status, failure reason, time, and the identifiers of those payments, refunds, and subscriptions). Card numbers and other payment-method details, and customers’ names, emails, and other contact details, are never stored.
• Vercel: project names and each deployment’s status, environment (production or preview), branch, full commit message, and time. Environment variables, source code, and build logs are never stored.
• Buffer: each scheduled or published post’s channel (name and social network), scheduled time, status, full text, and public engagement counts. Attached images and videos are never stored.
• Supabase: organization and project names, regions, and status. The data inside your databases and your projects’ API keys and passwords are never fetched.

You can choose which Microsoft services (mail, calendar, files, contacts, to-dos) to turn on or off on the connections screen, and the Company accesses data only within the permissions you turned on.

The Company applies the same principles as Article 6 (1)–(5) to user data received through Microsoft Graph — it uses the data only to provide and improve the features offered to you, does not use it for advertising, does not use it to train or improve AI/machine-learning models, does not allow humans to read it except for limited exceptions, and does not transfer it to third parties except as necessary.

Disconnecting — you may revoke access at any time from the in-app connections screen or your Microsoft account’s app permissions page (personal accounts https://account.live.com/consent/Manage, work or school accounts https://myapps.microsoft.com); on revocation, tokens are erased without undue delay and no new information is fetched. Information already kept is deleted when you delete your account (Article 6-2).

The Microsoft permissions the Company requests and their purposes are as follows.

• openid · profile · email · User.Read email and name — account identification
• offline_access keeping the connection without signing in again (token refresh)
• Mail.ReadWrite · Mail.Send reading, composing, sending, and organizing mail — summarizing, searching, replying to, and organizing mail at your request
• Calendars.ReadWrite calendar events — automating viewing, creating, and managing events
• Files.ReadWrite.All viewing and editing OneDrive files — working on files you specify, and regularly keeping file metadata (Article 6-2; never file contents)
• Contacts.ReadWrite contacts — referencing and managing contacts for calendar and email tasks, and regularly keeping contacts’ names, primary emails, primary phone numbers, companies, and job titles (Article 6-2)
• Tasks.ReadWrite Microsoft To Do — viewing, creating, and managing to-dos, and regularly keeping your to-dos (Article 6-2)

This behavioral information processing applies only to visits to the marketing website (dexter.tools) and does not apply to the product service (app.dexter.tools) or to the Google user data in Article 6.

You may opt out via your browser’s cookie-blocking settings and Meta’s ad preferences (https://www.facebook.com/ads/preferences).

• Meta Platforms, Inc. (Meta Pixel, USA): online interest-based advertising and ad performance measurement — cookies (_fbp, _fbc), advertising identifiers, and visit records. Retention: up to 2 years from collection or until consent is withdrawn
• Campaign attribution (first-party cookie): stores the first-touch ad/campaign source (UTM parameters, etc.) for 90 days — ad performance analysis

When personal data becomes unnecessary due to the expiry of the retention period or fulfillment of the purpose, the Company destroys it without undue delay. Electronic files are permanently deleted in an unrecoverable manner, and data contained in backups is handled as set out in Article 3. Where retention is required by law, the data is stored separately.

Data subjects may at any time request access to, correction or deletion of, suspension of processing of, portability of, and withdrawal of consent for their personal data. Rights may be exercised by email (iam@lazydevz.com) or through in-app settings, and the Company acts without undue delay.

You can disconnect external services such as Google and Microsoft directly from the in-app connections screen, or revoke access from the service itself (e.g., your Google account permissions page).

Users outside the Republic of Korea may have additional rights under applicable laws such as the GDPR or CCPA. The Service is not directed at children under 14; if we learn that a child’s personal data has been collected, we destroy it without undue delay.

The product service (app.dexter.tools) uses essential cookies to maintain sign-in sessions and analytics/error-monitoring cookies (PostHog). The marketing website (dexter.tools) uses cookies for usage analytics (PostHog), advertising (Meta Pixel), and campaign attribution.

You can refuse cookies in your browser settings (Chrome, Safari, Edge, Firefox); however, refusing essential cookies may limit features such as sign-in.

Through the AI agent, the Company automatically performs calendar, email, and document tasks and scheduled automations within the scope of your instructions and approval. AI outputs may be inaccurate and are premised on your review; important actions are executed only after your approval.

The AI agent may suggest, or create and turn on, automated tasks based on the information kept from your connected tools (Article 6-2) and the requests you sent in the last 30 days. Automations it turns on by itself are limited to tasks that only notify you; it tells you each time, and you can turn them off or delete them with one tap.

Where applicable, data subjects may request an explanation of the criteria and procedures of an automated decision, or object to such processing.

The Company applies managerial, technical, and physical safeguards including encryption in transit (HTTPS/TLS), encrypted storage of key personal data, per-user isolated processing environments, access control and access-log retention for the personal-information processing system, and the establishment and implementation of an internal management plan.

• Name: 이상엽
• Title: 대표
• Phone: 010-5011-3411
• Email: iam@lazydevz.com

• Personal Information Dispute Mediation Committee: 1833-6972 (www.kopico.go.kr)
• Privacy Infringement Report Center (KISA): 118 (privacy.kisa.or.kr)
• Supreme Prosecutors’ Office: 1301 (www.spo.go.kr)
• National Police Agency: 182 (ecrm.police.go.kr)

This policy may be amended as laws or the Service change. We post the changes and the reasons on this page (and may also announce them in the Service), and the amended policy applies from the time it is posted.

October 2, 2026 — Amended. Removed from Article 6-2 the sentence that, in an agent space shared with others, every member can see and use the information kept from the tools members connect, since agent spaces shared with others are no longer offered. Stated in Article 3 that agent usage data is not deleted when a subscription ends and is deleted from the agent server and the service database on account withdrawal (including what stays in someone else’s Dexter that was formerly shared with others), and how backups are kept (backups older than 7 days are deleted when a new backup is made, the 3 most recent are kept, and the backups remaining at withdrawal are not deleted automatically after withdrawal), named the services from which revocation of access is requested along with deleting integration tokens on withdrawal (not requested while another Dexter account uses the same external account) and stated that AI account sign-in data on the agent server remains in backups, listed what the withdrawal record actually keeps, and corrected how far items deleted in a tool are followed (those the tool reports, those within the recent period fetched again to check, and cancelled Google Calendar events). Added to Articles 5 and 6-2 the analysis that drafts your profile from your connected mail and calendar when you first start (AI model calls through OpenRouter). Aligned the backup wording in Articles 6-2 and 8 with Article 3, and corrected what Article 6-2 deletes on withdrawal from the tasks and cards Dexter created to your tasks and cards and their run history. The previous policy (effective September 28, 2026) applied until October 1, 2026.

September 28, 2026 — Amended. Added why each notification came, what it is about, and links to what is kept from GitHub under Article 6-2, links to what is kept from Notion, and that in an agent space shared with others every member can see and use the information kept from the tools members connect. Changed what is kept to include full mail bodies and the name, size, and type of attachments, event descriptions and attendees, contacts’ primary phone numbers, and the full text of Slack messages, Vercel commit messages, Buffer posts, and Notion property values, and removed per-tool retention periods so kept information stays until account withdrawal (Articles 3 and 6-2). Changed secrets (passwords, API keys, tokens, environment variables, etc.), card numbers, and resident registration numbers found in kept information from not being stored to keeping kept information as it is in the tool it came from (Articles 2 and 6-2). The previous policy (effective September 27, 2026) applied until September 27, 2026.

September 27, 2026 — Amended. Added keeping information from connected tools (Google, Microsoft, Slack, Notion, GitHub, Linear, Stripe, Vercel, Buffer, Supabase) and automation suggestions and automatic creation (agreed to at sign-up), use of the last 30 days of requests for automation suggestions, what is kept from each tool and for how long (including files, contacts, and to-dos from Google Drive, Google Contacts, Google Tasks, OneDrive, Outlook contacts, and Microsoft To Do, and additional limits for Slack and Stripe information), deletion on account withdrawal, the Microsoft integration, processor, and permission descriptions, the AI accounts you can connect (Claude, Grok), and Gmail change notification delivery (Google Cloud Pub/Sub) among Google LLC’s outsourced tasks in Article 5 (Pub/Sub receives only the Gmail address and a mailbox change number (historyId), never subjects or bodies, and keeps them in a Republic of Korea region for at most 1 hour before deleting them). The previous policy (effective July 17, 2026) applied until September 26, 2026.

July 17, 2026 — Amended to bring data items, connected services, processors, and Google scope descriptions up to date.

June 23, 2026 — Privacy Policy established.

For questions about how we handle personal data, contact our Data Protection Officer (이상엽) or iam@lazydevz.com.