ilnetta AI assistant
ilnetta Service Privacy Policy
Effective 2026-10-17
CHO (the Company) provides ilnetta (the Service), a SaaS for field service operations. The Company complies with the Personal Information Protection Act of Korea and related laws, and publishes this privacy policy to protect the personal information of data subjects.
1. Scope
This policy applies to the Service and to the AI assistant feature that connects to the Service.
Personal information handled by the Company website (cho-stz.com) for sales inquiries and the member service is governed by the separate website privacy policy.
2. Purposes of processing
The Company processes personal information for the following purposes. It is not used for any other purpose, and separate consent is obtained if the purpose changes.
- Managing staff accounts and sign-in for client companies that use the Service (Clients)
- Supporting field service operations of Clients: order intake, technician assignment, scheduling, job completion and settlement
- Sending KakaoTalk notification messages to order customers and technicians according to Client settings
- Reading and processing data through external AI apps connected by Client staff (AI assistant)
- Preventing misuse, responding to security incidents and keeping access records
3. Personal information processed
The personal information processed in the Service consists of data that Clients register for their business and data generated while using the Service.
| Category | Items |
|---|---|
| Client staff accounts | Name, email, password (stored in an irreversible form), company, permission level |
| Order customers | Name, phone number, region (city, district), address, requests, order notes, order channel and channel order number |
| Orders | Order status, product name, amount paid by the customer, amount paid to the technician, scheduled time, completion time, job photos, status change history |
| Technicians | Name, phone number, service area, products handled, availability, order history, settlement records |
| Notification records | Recipient number, time sent, subject, template name, delivery status, content |
| Automatically generated data | Access logs, sign-in records, device and browser information, usage records |
4. Retention period
Personal information registered by a Client is retained until the Client contract ends or the Client requests deletion, and is then destroyed within 30 days.
Records whose retention period is set by law, such as the Act on Consumer Protection in Electronic Commerce and the Protection of Communications Secrets Act, are kept for that period.
5. Relationship between Clients and the Company, outsourcing
The personal information of order customers and technicians registered in the Service is collected by Clients for their own business, and the Client is its controller. The Company acts as a processor entrusted by the Client: it stores and processes the data only within the scope the Client directs inside the Service and never uses it for any other purpose without Client instruction. Clients may list the Company as a processor in their own privacy policies.
The Company sub-entrusts server hosting and notification message delivery to external providers. Provider names and entrusted tasks will be listed here as they are confirmed.
Being confirmedThe names of the hosting and notification providers will be confirmed and listed.
6. Provision to third parties
The Company does not provide personal information to third parties except with the consent of the data subject or the Client, or where specifically required by law.
Information sent to an external AI app through the AI assistant feature is not provided by the Company. It is sent, at the request of Client staff, to an app that the staff member chose, signed in to and connected themselves. The Company treats this as processing under the instruction of Client staff. Section 8 describes this in detail.
7. Overseas transfer
When the AI assistant feature is used, personal information may be processed outside Korea as described below. Client staff can stop this at any time by disconnecting.
- Recipient: the operator of the AI app connected by Client staff, such as Anthropic (United States) and OpenAI (United States)
- Country: the United States or wherever the servers of that operator are located
- Time and method: at each request made by the staff member in the AI app, over encrypted connections
- Items: the information needed for the request, from the items listed in the table in section 8
- Purpose of use and retention by the recipient: according to the privacy policy of that operator
Being confirmedThe location of the Service servers will be confirmed and stated.
8. AI assistant (connection to external AI apps)
The Company provides an AI assistant feature that lets Client staff read and process Service data from external AI apps they connect themselves, such as Claude by Anthropic and ChatGPT by OpenAI.
8-1. Scope of data sent. Each time a staff member makes a request in an AI app, only the information needed for that request, from the Client the staff member belongs to, is sent to the AI app. Data of other Clients is never sent. Phone numbers are sent only with the middle four digits masked. The items that may be sent are listed below.
| Category | Items that may be sent to the AI app |
|---|---|
| Order customers | Name, phone number (middle four digits masked, 010-XXXX-1234), region (city, district), address, requests, order notes, order channel and channel order number |
| Orders | Order status, product name, amount paid by the customer, amount paid to the technician, scheduled time, completion time, number of job photos (the photos themselves are not sent), status change history |
| Technicians | Name, phone number (middle four digits masked, 010-XXXX-1234), service area, products handled, availability, order counts by status, recent orders |
| Settlement | Technician payout totals by period and itemized records |
| Notification records | Recipient number (middle four digits masked), time sent, subject, template name, delivery status, content (first 300 characters) |
| Connected staff member | Company name, staff name, connection permission |
8-2. Connecting and disconnecting. A connection is made only when the staff member signs in with their own Service account and chooses a permission level (read only, or read and process). Sign-in takes place on the Company Service screen, and the AI app operator never receives the Service password. Staff can disconnect at any time under MY and then AI assistant connections in the Service, and data stops being sent from the next request. A connection that is not used for 90 days expires automatically.
8-3. Information the Company keeps. The Company keeps the following information to operate the AI assistant feature. The content of order and customer data sent to the AI app is not stored separately.
| What | Content | Retention |
|---|---|---|
| Connection records | Connected staff member, company, connection name (for example ChatGPT), permission, created time, last used time, expiry date | Connection keys up to 365 days, sign-in connections 90 days after last use. Disconnected records are kept in a disconnected state and deleted one year after disconnection |
| Access keys | Only an irreversible hash is stored, never the original key | Same as connection records |
| Usage records | Which feature was called and when, success or failure, error message, target identifier. Query results such as names and phone numbers are not recorded | Follows the Service server log policy |
| Processing records | Actions taken through the AI assistant are recorded in the order history with the label AI assistant, the staff name and the connection name | Same as order history |
| Sign-in attempt limit | To block repeated wrong passwords, the access IP and email are held briefly in server memory | 10 minutes, never written to disk |
8-4. Processing by AI app operators. Information sent to an AI app is processed under the privacy policy of that operator, whose servers may be located outside Korea, including in the United States.
8-5. Confirmation step for processing features. Requests that change data, such as assignment, scheduling and cancellation, are first shown as a preview by the AI app and are executed only after the staff member confirms. Executed actions are recorded in the order history as AI assistant. Assignment, scheduling, cancellation and completion may trigger KakaoTalk notification messages to order customers or technicians depending on Client settings.
9. Destruction procedure and method
Personal information whose retention period has passed or whose purpose has been achieved is destroyed without delay. Electronic files are deleted in a way that prevents recovery, and printed material is shredded or incinerated.
10. Rights of data subjects and how to exercise them
Data subjects may at any time request access to, correction of, deletion of or suspension of processing of their personal information. Client staff can correct their own data in the Service or send a request to the contact below.
Requests about order customer and technician data registered by a Client are handled fastest when sent to the Client that collected the data. When a request reaches the Company, it works with the Client to act without delay.
11. Security measures
- Encryption in transit (HTTPS)
- Passwords and AI assistant access keys stored in an irreversible form
- Access control per Client. Staff and AI assistant connections of one Client cannot reach the data of another Client
- Permission selection when connecting the AI assistant, and a preview plus confirmation step for requests that change data
- Sign-in attempt limits and access record retention
- Minimal number of people handling personal information and an internal management plan
12. Automatic collection
The Service stores authentication data in the browser to keep users signed in. No advertising or tracking cookies are used.
13. Privacy officer and support contact
- Privacy officer: Seongbin Hong (CEO)
- Email: sales@cho-stz.com
- Phone: +82 10-6671-3829
- Support inquiries are received at the same email address.
14. Remedies for infringement of rights
- Personal Information Infringement Report Center 118 (privacy.kisa.or.kr)
- Personal Information Dispute Mediation Committee 1833-6972 (www.kopico.go.kr)
- Supreme Prosecutors Office 1301, Korean National Police Agency 182
15. Changes to this policy
When this policy changes, the effective date and the changes will be announced on this page.
Items to be filled in as confirmed
The items below will be added to the text as they are confirmed. They do not affect the validity of this policy.
- Names of the hosting and notification providers
- Location of the Service servers