Privacy policy
Last updated November 1, 2026
Article 1 (Purposes of processing personal data)
Mindlogic (the "Company"), which operates DUETA, collects, records, stores and uses ("processes") users' personal data for the purposes below. The Company does not process personal data for purposes other than these, and where a purpose changes it takes the measures the law requires, including obtaining separate consent under Article 18 of the Personal Information Protection Act.
- Confirming an intention to register, identifying a user, and confirming an intention to withdraw.
- Protecting users and operating the service: preventing and sanctioning conduct that impedes the smooth operation of the service, including breaches of the terms; preventing account theft; delivering notices such as amendments to the terms; preserving records for dispute resolution; and handling complaints.
- Running the jobs a user submits, metering the audio processed, charging credit for it, and showing the user their own usage and payment history.
- Analyzing usage records and access frequency, producing statistics on use of the service, and improving the service on the basis of that analysis.
- Building an environment users can rely on in terms of security, privacy and safety.
- Handling other service-related work under individual agreements.
This policy is written to the Korean Personal Information Protection Act, which is the law the Company is subject to, and is offered in Korean and English. Where the two differ, the Korean text governs. It covers the website, the console and the API: everything at this domain.
The Service is for adults. The Company does not knowingly collect the personal data of children under 14, and deletes an account it finds to belong to one.
The Company does not sell personal data, does not use it for advertising, and installs no advertising tracker on this site. The one analytics tool it uses, Microsoft Clarity, is described in Articles 5, 6 and 12.
Article 2 (Items of personal data processed)
The personal data the Company may collect from a user in the course of registration and provision of the service is as follows.
- Registration and management
- Your email address and, for a password account, a hash of your password, never the password itself. Name (optional): the name you enter at sign-up or in the console, where you choose to give one. If you sign in with Google we store the account identifier Google gives us and the email address on it, and, while the account has no name, the name on the Google profile; we never see your Google password. We also record when the account was created and when its address was verified. Telephone number, where you verify one: the mobile number you verify by SMS code in the console (My page, Phone), stored with the time of verification; verification is optional and is not required to download results. One number is registered to one account. We keep a record of each code sent and verified, never the code itself. We do not ask for your postal address.
- Audio
- The files you submit and the stems we produce from them. For Target Speaker Extraction this includes the sample of the target voice you provide. The retention period is in Article 3.
- Jobs and payment records
- For each job: its type, its status, its timings, the length and file name of each input, the seconds billed and the amount charged, and any error. Plus your credit ledger, and for each purchase the order, its amount and currency, the payment provider's reference, and, where you keep a card on file, the card brand and its last four digits.
- API keys
- The name you give a key, a short non-secret prefix, and a hash of the key itself. The key is shown to you once, at creation, and is never recoverable from us afterwards.
- Organizations
- For an organization you create or join: its name, logo and address (URL), your role in it, and, for a purchase, which member bought it. For a person you invite: their email address, as Article 4 describes.
- Inquiries
- The name and email address you give, your company and telephone number where you enter them, the content of the inquiry, and a job reference where you attach one.
- Automatically collected
- IP address, time, request path, response code and comparable ordinary server logs. Rate limiting also operates from these records.
Article 3 (Processing and retention period)
The Company retains and processes collected personal data within the period consented to by the user or the period provided by statute. The period may differ where the law permits or requires it, as in the cases below, and expires immediately where a user withdraws consent to the collection and use of their personal data.
Audio. For an account that has not bought credit, a cleanup runs daily and removes jobs older than 7 days, so a file's real lifetime is that window plus up to about a day until the next run. Deletion removes the uploaded file and the returned stems together, so download anything you want to keep before then. An upload that never becomes a job is deleted after 24 hours, and a rejected upload is discarded without being stored.
Audio of a paying customer. Once an account has bought credit, in a purchase that has not been refunded in full, its finished jobs that still exist and their audio are kept until you delete them or close the account. Jobs billed to an organization are kept in the same way while the organization has such a purchase or a contract with the Company says so, and for 30 days after the organization is closed; otherwise the 7-day window applies to them. Jobs already deleted before the purchase are not restored. Where the purchase is refunded in full or the account is closed, the 7-day window applies again to the account's own jobs.
Deleting a job. Any account may delete one of its jobs at any time, in the console or with the API; the organization's owner, or the member who ran it, may delete an organization job. Deleting a job moves it to the trash, where it can be restored for 30 days, After 30 days the job's audio and results (uploaded files, returned stems and archives) are deleted. The job's record (its id, status and amounts) is kept for billing and receipts.
Recovery copy. Stored audio is also copied daily to storage in the same Seoul region, so that it can be restored after a failure. When a file is deleted, its copy is deleted within a day.
Telephone number. Held until you replace it with another verified number or close the account. The record of codes sent and verified is kept with the job and payment records, under Article 3 above.
Account data. Held until the account is closed. 30 days after closing, the email address, name, Google identifier and telephone number are replaced, the telephone number in the verification log and the inbox kept for the sign-up credit are kept only as keyed one-way values, and sign-in records are deleted; credit, payment and order records stay under the statute below. You may ask at any time for the account and everything belonging to it to be deleted.
Sign-in and sign-up records. Time, country, browser family and a one-way hash of the network address, never the address itself, kept for 365 days.
Records retained under statute. Job and payment records are kept longer than the audio, for accounting and under the following provisions.
- Records on contracts or withdrawal of subscription: 5 years, under Article 6 of the Act on Consumer Protection in Electronic Commerce and Article 6 of its Enforcement Decree, retained for that period even where the user withdraws consent to the use of their personal data.
- Records on payment and the supply of goods: 5 years, under the same Article 6 and Enforcement Decree Article 6, on the same basis.
- Records on consumer complaints or dispute resolution: 3 years, under the same Article 6 and Enforcement Decree Article 6, on the same basis.
- Server and access logs (IP address, time, path, response code and user agent), which are also records for confirming communication facts: kept for 1 year from the time the record is created, in Amazon CloudWatch in Seoul, for security and incident investigation. This covers the at least 3 months required by Article 15-2 of the Protection of Communications Secrets Act and Article 41 of its Enforcement Decree.
Article 4 (Use and provision to third parties)
The Company uses users' personal data within the scope of the purposes notified to them at collection, and does not use it beyond that scope or disclose or provide it to a third party without the user's prior consent. The following are exceptions.
- Where the user has consented in advance to provision to a third party.
- Where a statute so provides, or an investigative authority so requires under the procedure and by the method prescribed by statute.
- Where it is strictly necessary for performance of the service agreement and obtaining ordinary consent is markedly difficult for economic or technical reasons.
- Where the personal data is processed into a state in which the data subject cannot be specified or identified.
This is distinct from the entrustment in the next article: a processor handles personal data only for the Company and on the Company's instructions.
Inside an organization. When you join an organization, every member of it can see your email address and your role, and your name where you have given one. Its Owners and Admins, and any member given the same permission, can also see the jobs you run on the organization's credit and the names of the organization API keys you create. Its Owners, Admins and Billing members can see how much credit your jobs used, and which member made each purchase. The Owner's own console work and purchases are not shown to members. Organization jobs are not shown in your own console, and they belong to the organization: they stay with it when you leave it or close your account, until the organization deletes them or its retention ends. When you invite someone, we use their email address only to send the invitation and to match it when they accept. We delete it from the invitation once the invitation is accepted or withdrawn. An invitation expires after 7 days; an expired one keeps the address, so that it can be sent again, until it is withdrawn. The organization's activity log keeps a record of each invitation, address included, which its Owners and Admins can read.
Article 5 (Entrustment of personal data processing)
For the effective performance of the service the Company entrusts the processing of personal data as follows, and a company entrusted with it processes personal data only within the minimum scope necessary to perform the entrusted work.
- Payple Co., Ltd.
- Card payment and refund processing, and card registration where you keep one on file. Republic of Korea.
- Amazon Web Services, Inc.
- Cloud infrastructure for the service: the API servers, the GPU servers on which audio is processed, the database, storage and backup of audio files, and delivery of the mail the service sends, such as verification and password-reset links. Republic of Korea (the AWS Seoul region).
- Vercel Inc.
- Hosting and delivery of the website and console, and passing the console's requests on to the Company's API servers. United States; the site's server functions run in the Seoul region.
- gpuhub
- A relay for fetching the web address you submit as the source of a job: the Company's servers reach that address through a rented server in Singapore that the Company operates. The provider supplies the hardware and the data center. Audio you upload is not processed there.
- Google LLC
- Google account sign-in authentication, where you choose it. United States.
- Cloudflare, Inc.
- Name resolution (DNS) for this domain, and redirecting requests made to its www address. United States.
- Slack
- Delivery of inquiries received through the contact form, and of payment notices, to the Company's staff. United States.
- Aligo (smartsms.aligo.in)
- Delivery of the SMS verification code to a Korean mobile number. Republic of Korea.
- Twilio Inc.
- Delivery of the SMS verification code to a mobile number outside Korea. United States.
- Functional Software, Inc. (Sentry)
- Error and performance monitoring for the website, console and API: a report of each error, and of a sample of page loads and requests, so that the Company can find and fix faults. Reports carry no audio, request content, cookies or sign-in details, and email addresses and keys are removed before sending. United States.
- Microsoft Corporation (Microsoft Clarity)
- Usage analytics on the website's public pages and the console: how pages are viewed, clicked and scrolled, so that the Company can improve the site. Text on the console and contact pages and anything typed into a field are masked before sending. The billing, account, settings and API key pages, the sign-in pages and shared results are not recorded. United States.
The Company supervises its processors under the Personal Information Protection Act and discloses any change to the entrusted work through this policy.
Article 6 (Transfer of personal data abroad)
Seven of the processors above are located outside Korea. For the entrustment and storage needed to conclude and perform the contract with the user, the Company transfers personal data abroad as follows, under Article 28-8(1)(iii) of the Personal Information Protection Act. What is entrusted to Amazon Web Services, Inc. is stored in its Seoul region and is not transferred abroad.
- Recipient
- gpuhub
- Country
- Singapore
- When and how
- Each time you submit a web address as the source of a job (see Article 5), over an encrypted connection (SSH) between the Company's servers in Korea and the relay. The connection from the relay to the linked website is itself encrypted (HTTPS).
- Items transferred
- The host name of the web address you submitted and what the linked website returns for the request. Account data such as the email address, and audio you uploaded, are not transferred.
- Purpose
- Fetching the content at the web address you submitted, so that it can be used as the input of your job.
- Retention and use period
- The relay passes the connection through and does not keep the content.
- How to refuse, and its effect
- Tell us at the contact details at the end of this article. Do not submit a web address as the source of a job; uploading a file does not use the relay.
- Recipient
- Vercel Inc.
- Country
- United States. The site's server functions run in the Seoul region.
- When and how
- Continuously while you use the website or console, encrypted over the network (HTTPS).
- Items transferred
- IP address and request metadata, and the requests the website and console send to the Company's API with their responses, including sign-in details and uploaded audio.
- Purpose
- Hosting and delivery of the website and console, and passing their requests on to the Company's API servers.
- Retention and use period
- Requests and responses are handled only to pass them on. Access records are kept for the processor's operational log retention period.
- How to refuse, and its effect
- The site is delivered through this provider, so refusing this transfer means not using the website or console. A request made with an API key directly to api.dueta.ai does not pass through it.
- Recipient
- Google LLC
- Country
- United States
- When and how
- At the moment you press "Continue with Google", encrypted over the network.
- Items transferred
- Email address, Google account identifier.
- Purpose
- Sign-in authentication.
- Retention and use period
- Until you disconnect the link.
- How to refuse, and its effect
- Use a password account instead. This transfer occurs only if you choose Google sign-in.
- Recipient
- Cloudflare, Inc.
- Country
- United States
- When and how
- When you visit the www address (www.dueta.ai), encrypted over the network.
- Items transferred
- IP address, request metadata.
- Purpose
- Name resolution for this domain, and redirecting the www address.
- Retention and use period
- The processor's operational log retention period.
- How to refuse, and its effect
- Visit dueta.ai without the www; the request then does not pass through this provider.
- Recipient
- Slack
- Country
- United States
- When and how
- When an inquiry is received or a payment changes state, encrypted over the network (HTTPS).
- Items transferred
- For an inquiry: the name, email address, company, telephone number and content, the job reference and the account identifier. For a payment notice: the account identifier, the order number and the amount.
- Purpose
- Notifying the Company's staff so that they can answer inquiries and handle payments.
- Retention and use period
- Until the Company deletes the message.
- How to refuse, and its effect
- For an inquiry, telephone the number below instead of using the contact form. Payment notices are part of handling a payment, so refusing them means not buying credit.
- Recipient
- Twilio Inc.
- Country
- United States
- When and how
- When you ask for a verification code to a mobile number outside the Republic of Korea, encrypted over the network (HTTPS).
- Items transferred
- The telephone number and the text of the verification message.
- Purpose
- Delivering the SMS verification code.
- Retention and use period
- The processor's message log retention period.
- How to refuse, and its effect
- Verify a Korean mobile number instead, which is sent through a processor in the Republic of Korea, or do not verify a number; downloads do not require phone verification.
- Recipient
- Functional Software, Inc. (Sentry)
- Country
- United States
- When and how
- When an error occurs on the website, console or API, and for a sample of 5% of page loads and requests, encrypted over the network (HTTPS).
- Items transferred
- The error message and where in the code it occurred, the page address or API route with any credentials removed, the browser, operating system and device type, and the IP address of the connection, which the Company configures the service not to store. No audio, request content, cookies, sign-in details, email addresses or keys.
- Purpose
- Finding and fixing errors and slow responses in the service.
- Retention and use period
- 90 days, after which the reports are deleted.
- How to refuse, and its effect
- Block the reports in your browser, for example with a content blocker; the service works the same. Reports of errors in the API are sent by the Company's servers and contain no personal data.
- Recipient
- Microsoft Corporation (Microsoft Clarity)
- Country
- United States
- When and how
- While you browse the website's public pages or the console, encrypted over the network (HTTPS).
- Items transferred
- Page views, clicks, scrolling and pointer movement, the layout of the page, the browser, device and screen size, the approximate country derived from the IP address, and identifiers kept in Clarity's cookies. Text on the console and contact pages and anything typed into a field are masked before sending. The billing, account, settings and API key pages, the sign-in pages and shared results are not recorded.
- Purpose
- Understanding how the site is used, so that it can be improved.
- Retention and use period
- Session recordings for 30 days, aggregate statistics for 13 months.
- How to refuse, and its effect
- Reject optional analytics in the cookie banner or withdraw it through Cookie settings in the footer; the service works the same.
How to refuse: a data subject may refuse the transfer of their personal data abroad through the contact details below. The effect of refusing is as set out under "How to refuse, and its effect" for each transfer above.
- support@dueta.ai
- Phone
- +82-70-5102-6560
Article 7 (Data handling principles)
The Company treats the privacy of its users as its first consideration, and handles data on the following principles.
- Your audio is not used to train models. Audio submitted is processed and returned; it does not enter a training set.
- Audio is not reviewed as a matter of course. Where a user asks the Company to investigate why a particular job failed, the Company may listen to that job's audio to diagnose it, and only that.
- Audio is processed by the Company on GPU servers the Company rents and operates (Article 6), and is not sent to any third-party speech or artificial-intelligence API.
Article 8 (Procedure and method of destruction)
In principle the Company destroys personal data without delay once the purpose of its collection and use has been achieved and its retention period has expired, by the following procedure and method.
- Procedure. All personal data a user has provided is automatically selected for destruction and destroyed when its retention period expires, in accordance with internal policy and the relevant statutes.
- Method. Personal data held in electronic file form is permanently deleted by a technical method that makes the record irrecoverable. Personal data held on paper or other printed output is permanently destroyed by shredding or incineration.
Article 9 (Measures to secure safety)
The Company takes the following measures to secure the safety of users' personal data.
- Establishing and operating internal rules and guidance. Internal rules such as an information security policy are enacted and applied.
- Managing access rights. Access rights to personal data are granted differently according to each employee's duties and grade, and access is monitored.
- Password management. Passwords are stored one-way hashed. API keys are stored hashed on the same basis, and the full value is shown once, at creation.
- Controlling access by unauthorized persons. Access to a job is permitted only after confirming that the requesting account owns it, and persons without access rights are prevented from reaching the database.
- Encryption of personal data. All communication is served over HTTPS. A card kept on file is held as an encrypted token that leaves the database only in a request to the payment provider; the card number itself never reaches the Company.
- Retaining access records and preventing their forgery or alteration. Login records of employees who have accessed the systems (time, subject, IP and so on) are retained.
The session is kept in a cookie marked `httpOnly`, which scripts running on this site cannot read. The console and the login and signup pages also operate under a strict script execution policy.
No system is completely secure, and the Company has not yet undergone an external audit or obtained a formal certification. We do not display a certification we do not hold. If you find a vulnerability, please tell us.
Article 10 (Data protection officer)
A user may bring an inquiry or a complaint about the protection of their personal data to the data protection officer below.
- Name
- Mihyun Park (박미현)
- Role
- Senior Manager
- Phone
- +82-70-5102-6560
- support@dueta.ai
You may also raise a request through the contact form, which reaches the same inbox and lets you attach a job reference.
Article 11 (Rights of the data subject and how to exercise them)
You may request access to, correction of, deletion of, or suspension of the processing of your personal data, and you may withdraw consent. A legal representative may act for a data subject who cannot exercise these rights themselves.
Much of it needs no request. Your job history, usage and credit ledger are visible in the console at any time, and API keys can be revoked there. Your account data can be downloaded from My page. For anything else, contact us from the email address on the account. The Company acts within 10 days as the Personal Information Protection Act requires, and does not treat a user unfavorably for having exercised a right.
Deleting your account removes your ability to reach any audio still stored for it.
Article 13 (Remedies for infringement of rights)
Tell us first; most of it we can settle there. Where that does not resolve it, you may apply to the bodies below for dispute resolution or advice. They are separate from the Company.
- Personal Information Dispute Mediation Committee: 1833-6972, kopico.go.kr
- Privacy Infringement Report Centre (Korea Internet & Security Agency): 118, privacy.kisa.or.kr
- Supreme Prosecutors' Office cybercrime division: 1301, spo.go.kr
- National Police Agency cyber investigation bureau: 182, ecrm.police.go.kr
You may also seek relief in the courts under the Personal Information Protection Act.
Article 14 (Amendment of this policy)
Where what we do changes, we update this page and the last-updated date at the top of it together. Changes are announced from 7 days before they apply, and from 30 days before where they materially affect users. If the retention window in Article 3 changes, this page changes with it.
Revision of September 30, 2026: Articles 5 and 6 now name Amazon Web Services, Inc. (Seoul region), where the service's servers, database and stored audio are, and the GPU servers in Singapore on which audio and text for speech synthesis are processed, and they correct the earlier statement that audio was not transferred abroad. Article 2 now lists the text for speech synthesis, and the email address and telephone number of an inquiry.
Revision of October 1, 2026: Article 6 now states what the GPU servers' processing logs keep (a job's number, its inputs by position and the length of a synthesis text) and that each log is deleted after at most 15 days.
Revision of October 2, 2026: Article 2 now lists the name (optional) an account may carry, entered by the user or taken from the Google profile, and no longer says that a name is not asked for. Article 4 now says that the members of an organization can see it.
Revision of October 3, 2026: Article 4 states that an Owner's own console work and purchases are not shown to the members of that Owner's organization.
Revision of October 6, 2026: Article 7 states what is done with audio and no longer describes how the Company's models work, and the Korean text of Articles 1, 3 and 12 was reworded without a change in substance.
Revision of October 16, 2026: Article 2 adds the telephone number, verified by SMS code where you choose to share or download a result, and no longer says that no telephone number is asked for. Article 3 states how long it is held. Articles 5 and 6 add the two SMS providers, Aligo (Republic of Korea) and Twilio (United States).
Revision of October 15, 2026: the Text to Speech service ended and the clauses describing it were removed, effective October 15, 2026. The one-way hashes of the text of past requests are kept for the retention period of the job records and then deleted. Article 3 now says that a deleted job moves to the trash, where it can be restored for 30 days, and that its audio and results are deleted after those 30 days, no longer at once.
Revision of October 17, 2026: Article 5 now names the GPU servers in the AWS Seoul region on which audio is processed, and describes the GPU servers in Singapore as standby. Article 6 now says that audio is transferred to Singapore each time a job is processed on those servers.
Revision of October 25, 2026: the server in Singapore is described by what it does now. It relays the connection when you submit a web address as the source of a job, and it no longer processes audio. Articles 5 and 6 state what passes through it and that it keeps nothing. The cookie section no longer says that a copy of the session token is kept in local storage; the session is in an `httpOnly` cookie.
Revision of October 28, 2026: Articles 5, 6 and 12 add Microsoft Clarity (Microsoft Corporation, United States), which records how the public pages and the console are viewed, clicked and scrolled so that the Company can improve the site; text on the console and contact pages and anything typed into a field are masked before sending, and the billing, account, settings, API key and sign-in pages and shared results are not recorded. Article 12 lists its two analytics cookies. The same Articles 5 and 6 add Functional Software, Inc. (Sentry, United States), which receives a report of each error on the website, console and API, and of a sample of page loads and requests, so that the Company can find and fix faults; IP addresses are not stored by it.
Revision of November 1, 2026: Article 3 now states that the identity fields of a closed account are replaced 30 days after closing, that the telephone number in the verification log and the inbox kept for the sign-up credit are then kept only as keyed one-way values, and that sign-in and sign-up records are kept for 365 days. Article 11 now says that account data can be downloaded from My page. Article 1 now states that the Service is for adults and that the Company does not knowingly collect the personal data of children under 14. Article 3 now says that server and access logs are kept for 1 year, in Amazon CloudWatch in Seoul, where it said 3 months.
Revision of October 30, 2026: optional analytics requires a choice before its script loads. Cookie settings allows rejection or withdrawal, advertising storage is denied, and browser privacy signals are honored. Phone verification is no longer required for downloads; public result sharing has ended.
- Company
- Mindlogic, Inc. (마인드로직 주식회사)
- CEO
- Yongwoo Kim, Jinwook Kim
- Business registration no.
- 331-81-01353
- Mail-order business registration no.
- 2025-Seoul Gangnam-01813
- Address
- #101, 32 Seolleung-ro 111-gil, Gangnam-gu, Seoul, Republic of Korea
- Phone
- +82-70-5102-6560
- support@dueta.ai