Privacy Policy

1. What we collect and how

We collect and process the following personal data. Items marked 'optional' are not required to use the core Service.

[Account — email sign-up] Email address, name, password (stored only as a non-reversible one-way hash), language preference.

[Account — social login (GitHub/Google)] The email address, name, and profile (avatar) image the provider passes to us.

[Security · optional] Passkeys (WebAuthn public-key credentials) and two-factor authentication data (TOTP secret, backup codes).

[Profile · optional] @handle, bio, preferred genres/tastes, avatar image.

[Billing] Payment-method details (card numbers, etc.) are collected and processed directly by our payment processor, Polar; the Service does not store them. We keep only your subscription status and period, the token grant/spend ledger, and order-processing records.

[Push · optional] A device push token and platform info for mobile app notifications.

[Usage] Workspace (works/rooms) data, uploaded audio and separation results, token usage history, last-active time, notification state and email preferences.

[Communication] Room chat messages, comments, and reactions — processed in order to display them in the Service.

[Automatic] Access and security logs (IP address, access time, device/browser info) and session cookies.

How we collect: entered directly by you during sign-up and use, received from social login providers, or generated automatically while you use the Service.

2. Why we process it

Member identification, authentication, and account management: sign-up confirmation, email verification, login, password reset, security features (passkeys, two-factor authentication).

Core features: audio (stem) separation, spatial-audio processing, saving/playing/sharing works.

Community features: displaying @handles and profiles, follows, running and joining rooms, showing chat/comments/reactions, the gallery.

Paid services: subscription and token management, payment and refund processing (via our payment processor, Polar), keeping transaction records.

Notices and notifications: service notifications, required transactional email (verification, billing), opt-in news email (e.g., the weekly digest), push notifications (when registered).

Safe operation: preventing fraud and abuse, enforcement actions, security incident response, dispute records, and compliance with legal obligations.

We process personal data only within the stated purposes and obtain separate consent in advance if a purpose changes.

3. Retention and deletion

In principle, we destroy your personal data without delay when you delete your account. You can delete your account yourself from My Page.

Exceptions required by law are stored separately for the stated period and then destroyed: records of contracts and withdrawal of offers, 5 years; records of payment and supply of goods, 5 years; records of consumer complaints and dispute handling, 3 years (Korean E-Commerce Act); access records, 3 months (Protection of Communications Secrets Act).

Accounts whose email has not been verified within 7 days of sign-up may be destroyed.

Uploaded audio and separation results are kept within the scope of processing and provision; result URLs at the external processor expire after a period of time. Items you delete from your library are removed from the Service.

Destruction procedure and method: electronic files are permanently deleted in a non-recoverable way. Data retained under law is stored separately and destroyed the same way without delay once its retention period ends.

4. Disclosure to third parties

We do not provide personal data to third parties except with your consent or where the law requires it, and we do not sell personal data.

5. Outsourcing and cross-border transfers

When you connect your API key, connection checks and the instructions, project context or selected media required for execution are sent over HTTPS to your selected provider: Replicate, fal, OpenAI, Anthropic or Google. The key is sent only to that provider for authentication. Provider retention, processing locations and data-use conditions follow your provider agreement and account settings; free and paid APIs may have different terms. Keys stored by ULLIMO are encrypted and removed when you delete the key or your account.

To provide the Service reliably, we outsource processing to the overseas providers below. Under Article 28-8 of PIPA, we disclose the cross-border transfers as follows.

You may refuse the cross-border transfer of your personal data by contacting the privacy officer (support@ullimo.com).

However, these transfers are essential infrastructure for the Service, so refusing them may make sign-up or use of the Service impossible or limited.

6. Connected social accounts (YouTube, Instagram, TikTok)

This section applies only to the YouTube, Instagram and TikTok accounts you connect yourself. If you never connect an account, none of it applies to you.

[What we collect] The account identifier, channel name and handle the platform returns; the list of permissions (scopes) you granted; the identifier, link and status of each publish; public per-post metrics (views, likes, comments, shares, saves, watch time and the like) and account-level metrics (follower counts and the like). Access and refresh tokens are stored encrypted and never appear in plain text on screen, in responses or in logs. We never store your profile image — even when the platform returns one we keep no copy, and the connections screen shows a disc with your initial instead.

[Why we process it] To publish, schedule and retry exactly as you instruct; to show publish status; and to give you analytics and summaries of your own results. Data received from the platforms is never used for ad targeting, never sold to third parties and never shown to other members.

[YouTube] The YouTube part of this feature uses YouTube API Services. The YouTube Terms of Service (https://www.youtube.com/t/terms) therefore also apply, and the Google Privacy Policy (https://policies.google.com/privacy) governs what Google collects and processes. You can revoke this app's access at any time in your Google account security settings (https://myaccount.google.com/permissions).

[Instagram and TikTok] The Instagram part uses Meta's Instagram Platform and the TikTok part uses the TikTok for Developers API; each platform's own terms and privacy policy apply alongside this one.

[Retention] Tokens are kept only while the connection lasts. Publish history (title, caption, publish time, link) is kept until you delete it or close your account, and metrics received from a platform are kept until you disconnect that account or delete the post.

[How and when we delete] You can disconnect at any time on the connections screen of the Publish sector (/publish/connections). On disconnect we delete that account's tokens immediately, ask the platform to revoke access, and destroy the metrics taken from that account and the analytics derived from them within 7 days — the same deadline the YouTube API Services Developer Policies require. Your own publish history (title, caption, time, link) stays, with the account shown as 'disconnected'. If you close your account, everything is destroyed together with the rest of your data.

[First comments] (applies from 2026-10-01) First-comment and later-comment text that you switch on and write for each post is sent to that platform exactly as written under your own account name and kept with your publish history (it stays if you disconnect) until you close your account, and the TikTok API for Business token you connect separately for TikTok comments is stored encrypted and deleted immediately when you disconnect that connection or the TikTok account, or close your account.

[Contact] To check the progress of a deletion or to make any other request, write to the privacy officer (support@ullimo.com); we act without delay and tell you the outcome.

7. Your rights and how to exercise them

You may at any time request access to, correction or deletion of, or suspension of processing of your personal data.

You can change your profile and email preferences and delete your account directly from My Page. For other requests, email the privacy officer (support@ullimo.com); we will act without delay within the statutory period and inform you of the result.

Rights may also be exercised through a legal representative or an authorized agent; we may ask for documents confirming the authorization.

Where another law designates the data for collection, deletion may not be possible, and suspension requests may be limited by law.

8. Children under 14

The Service does not accept sign-ups from children under 14. If we learn we have collected a child's personal data, we destroy it without delay.

9. Cookies and similar technologies

We use cookies and similar technologies in three categories:

[Necessary] Keeping you signed in (session cookie), security, and feature settings such as theme and language. Required for the service to work; used without consent.

[Analytics] Cookies that anonymously measure visits and usage flow to help us improve the service. We use Google Analytics 4 (via the GTM container).

[Marketing] Cookies and pixels for ad measurement and personalized advertising. With marketing consent, Meta Pixel and Conversions API send page visits, completed registrations, checkout starts and purchases to Meta. Server events may include IP address, browser information, ad click/browser identifiers (fbc/fbp), a hashed account identifier, event time/ID, and purchase value/currency. With the same consent, we also send page visits, completed registrations, checkout starts, subscriptions and purchases to OpenAI (ChatGPT ads) and Reddit (both US companies) through their pixels and conversions APIs. These may include IP address (hashed for Reddit), browser information, each company's ad click/browser identifiers, a hashed account identifier and hashed email address, event time/ID, and subscription or purchase value/currency; both pixels may use automatic matching that detects and hashes customer information shown on the page. With the same consent, the Google Ads (US company) conversion tag measures completed subscription purchases with their value, currency and order identifier, and its enhanced conversions feature may hash customer information shown on the page, such as your email, and send it to Google. We never send your creations, prompts or card numbers, and we do not send your email to Meta. You can withdraw consent in Cookie settings; we also honor GPC.

Analytics and marketing cookies run only with your consent. You choose on first visit via the consent banner; before consent, both analytics and ad storage are denied under Google Consent Mode v2. Your choice is stored in the ull_consent cookie for about 180 days.

You can change or withdraw consent anytime via the 'Cookie settings' link in the page footer, and you can refuse cookies in your browser settings; refusing the session cookie will prevent sign-in and related features.

We honor the browser's Global Privacy Control (GPC) signal as an opt-out preference. When GPC is present, marketing and advertising cookies (ad storage) are disabled automatically; we also declare this at /.well-known/gpc.json.

10. Security measures

Encryption in transit (TLS) and one-way password hashing.

Data minimization, least-privilege access for processing, and access controls including two-step verification on the admin console.

Audit logs of processing are retained and reviewed for misuse.

11. Privacy officer and remedies

Privacy officer: the Service operator · email: support@ullimo.com

The same contact receives and handles access requests and other rights requests. General inquiries: support@ullimo.com

For reports or counseling about privacy infringement, you may contact: Personal Information Infringement Report Center (KISA) — 118 (in Korea) · privacy.kisa.or.kr / Personal Information Dispute Mediation Committee — 1833-6972 · kopico.go.kr

12. Changes to this policy

Changes to this policy are announced via the notices page at least 7 days before they take effect; changes material to your rights (collected items, purposes, cross-border transfers, etc.) are announced at least 30 days in advance.

Announced: 2026-09-22 · Effective: 2026-09-30 (version 2026-09-30). The previous privacy policy (effective September 14, 2026) is superseded by this one from the effective date. This revision adds the data collected and the cross-border transfers introduced by the new connected-social-accounts feature (YouTube, Instagram, TikTok), and adds OpenAI and Reddit (and, from 2026-10-01, Google Ads) as ad-measurement partners.

Questions about this policy: support@ullimo.com.