CatchLaw Privacy Policy

Effective Date: October 20, 2026

Operator: Lawfit Inc. ("the Company")

Service: CatchLaw (catchlaw.co.kr)

Contact: support@lawget.co.kr

The Company values user privacy and complies with the Personal Information Protection Act (PIPA) and the Act on Promotion of Information and Communications Network Utilization and Information Protection of Korea. This policy explains how CatchLaw ("the Service") collects, uses, stores, and deletes personal information, and the safeguards applied.

1. Personal Information Collected

1-1. Account registration and sign-in

• Email, password, name, phone number
• Social login (Naver, Google): email, display name, profile image

1-2. Business verification (small business members)

• Business registration number, representative name, business start date, trade name
• Verified against the Korean National Tax Service public API; only the verification result is stored.

1-3. Information generated through service use

• YouTube channel, video, and comment data (via OAuth)
• Naver Place store and visitor review data (for stores registered by the user)
• Target public posts (blogs, cafes, communities, news, web search results)
• User-registered damage case records and watchlist customer information
• Evidence screenshots and files uploaded by the user

1-4. Payment information

• Payment data is processed by the payment service provider; the Service only retains order, amount, and billing key information.

1-5. Automatically collected information

• Access IP, browser type, cookies, access timestamp, usage analytics

2. Purpose of Collection and Use

3. Retention and Deletion

3-1. Retention period

• Upon account withdrawal or service termination, user data is marked for deletion in the service database within 7 days.
• Database backups are retained for a maximum of 14 days before automatic expiration.
• Including external processor storage, complete deletion is completed within a maximum of 30 days.
• Deletion requests: support@lawget.co.kr

3-2. Statutory retention exceptions

The following data is retained separately for the periods required by applicable laws.

3-3. Deletion method

• Electronic files: permanently deleted using methods that prevent recovery
• Paper documents: shredded or incinerated

4. Third-Party Sharing and Data Processors

4-1. Scope of entrusted processing

The Company entrusts the following categories of third parties for service delivery.

A detailed list of processors is available upon request at support@lawget.co.kr.

4-2. No sale or marketing use

The Company does not sell or transfer personal information to advertisers, data brokers, or for marketing purposes. User data is not used to train the Company's own AI models or to train generalized AI/ML models of third parties.

4-3. Disclosure under law

Personal information is disclosed only in response to legally binding requests such as warrants or court orders. Unless prohibited by law, the Company will notify the affected user in advance.

5. Special Provisions for Google User Data

5-1. Scope accessed

When connecting via Google OAuth, the Service accesses:

• https://www.googleapis.com/auth/youtube.readonly — read channel, video, and comment data
• https://www.googleapis.com/auth/youtube.force-ssl — perform user-specified moderation actions (report, hide)

5-2. Purpose of use

• Monitor the user's registered YouTube channel for reputational risk (defamation, abusive comments)
• Execute user-selected moderation actions against harmful content

5-3. Token storage and sharing recipients

• YouTube OAuth refresh tokens are encrypted using AES-256-GCM and stored.
• Google user data is shared only with the following categories of third parties:
  • Cloud hosting providers (for encrypted token storage and server-side processing)
  • Google LLC (for YouTube API calls and Gemini AI analysis)
  • Anthropic PBC (for Claude AI analysis — post context classification, etc.)
• OAuth tokens themselves are not transmitted to AI analysis inputs.
• YouTube API response content (comment text, author handle, video title) may be transmitted to the above AI services for analysis purposes.

5-4. Compliance with Google API Services User Data Policy

The Company complies with the Limited Use requirements of the Google API Services User Data Policy. Data collected from YouTube is not used for advertising, sale, or generalized AI/ML model training beyond the purposes to which the user has consented.

5-5. User rights

• Revoke OAuth connection: CatchLaw [Discovered Comments > YouTube Connection Management] or Google Account settings (https://myaccount.google.com/permissions)
• Request data deletion: support@lawget.co.kr

6. Use of AI Analysis Services

The Company uses third-party AI analysis services to deliver the Service.

• Used for review/comment/post classification, reply generation, image recognition, and similar features.
• For certain features such as damage case registration, personal identifiers (trade names, phone numbers, addresses, URLs) are automatically masked before transmission. Users may preview and edit the masked result before submission.
• The Company does not store or collect data to train its own AI models.
• Third-party AI service providers do not use input or output data to train their generalized models under standard commercial API policies.

7. Protection Mechanisms for Sensitive Data

7-1. In-transit and at-rest protection

• All communications use industry-standard encryption (TLS 1.2 or higher)
• YouTube OAuth refresh tokens are encrypted using AES-256-GCM
• Payment card data is encrypted and transmitted directly to the payment processor; the Service retains only minimal information such as billing keys
• Sensitive file storage (evidence, legal documents) is configured as private

7-2. Access control

• Role-based access control and database-level isolation policies restrict user-level data access
• Administrator access is recorded in audit logs
• Passwords are stored as hashes only (plaintext storage prohibited)

7-3. No 2-factor authentication

CatchLaw does not currently support 2-factor authentication (2FA). This policy will be updated and users will be notified when 2FA becomes available.

7-4. Session management

• Login sessions are managed using secure token mechanisms
• Browser storage is cleared on logout

7-5. Breach response

If a personal information breach is identified, the Company will notify affected users and the Personal Information Protection Commission within 72 hours in accordance with applicable law.

8. Cookies

8-1. Cookie purposes

• Login session persistence
• User preference storage
• Service usage analytics

8-2. Opting out of cookies

Users may reject cookie storage through browser settings. Rejecting may limit use of certain services such as login.

9. User Rights

Users may exercise the following rights.

CatchLaw is a service for businesses, small business owners, and content creators, and does not permit accounts for users under the age of 14.

10. Data Protection Officer

• Affiliation: Lawfit Inc.
• Contact: support@lawget.co.kr

11. Changes to This Policy

Changes to this policy will be notified in advance through service announcements or email. Material changes (collection scope, purpose, retention period, third-party sharing changes) will be notified at least 7 days prior to the effective date.

Supplementary Provisions

• Effective date: October 20, 2026
• Previous versions: catchlaw.co.kr/privacy/history