Teamping Privacy Policy

1. What we process and why

Serion Inc. (the "Company") processes the following personal data to provide the Teamping service. Without the required items the corresponding feature cannot be used.

1. Account (required): name, email, password (when you sign up with email · stored as a hash only), sign-up and email-verification time — identifying you, signing in, sending sign-in links, invitations and essential notices. If you sign in with Google, we receive the email and name Google provides (no password, and we do not store your Google account identifier) and treat that email as verified.

2. Workspace and project data: workspace membership, role (owner, admin, member, guest), invitation history (including the invitee's email — stored when the invitation is sent, even for people who have not signed up yet) — team structure and access control.

3. Connection tokens (optional): token hash, label, how it was issued (My page, setup kit or admin tool), the connected project, issue, last-use and revocation times, the revocation reason and who revoked it, and the plugin version number reported through that token with the time it was received — authenticating your AI agent and showing AI connections on My page and the company console. Token plaintext is not stored. If you received a key through the setup kit, we also store a computer marker: your device's unique number (a Mac's hardware UUID or Linux's machine-id) and your operating-system user number, one-way transformed (hashed) on your computer and hashed again by the server. The setup kit provided by the Company does not send the original numbers to the server. Because this value is linked to your account and can tell your computer apart, we protect it as personal data; it is used only to cut the old key when you reconnect the same project from the same computer, and it is deleted as soon as the key is revoked. While a setup-kit connection request is in progress (up to 10 minutes), we keep the port the connecting program uses on your computer, the operating-system type (Mac or Linux), and a value derived from the requesting IP address with a temporary secret key — to limit abuse of connection requests (see §2 item 1 for when it is deleted). The temporary key is discarded when the server restarts; the derived value is pseudonymised, not anonymous (the raw IP address is kept in the access logs under item 8, not in this record).

4. AI activity records (if you install the plugin or hooks): file name (path relative to the project), tool name and kind of action, size of the tool's result (character count), a repository identifier (git remote URL or project folder name), kind of AI tool, session and sub-agent identifiers, the numbers of commits newly created after git commit commands the AI agent ran (only those made as this device's git user after the AI's previous action · commits a person made on the same device in between may be included if the AI merges them · number only, no message, author or content), timestamps — file locks, the live team view, automatic linking to work cards, checking for changes not linked to Teamping records. File contents, diffs, prompts, environment variables and absolute paths are not collected.

5. Content: work reports, chat, meeting remarks and documents, roadmaps, emoji reactions, read marks — collaboration features. Limited to what you or your AI agent submit.

6. Notification settings (optional): Telegram chat identifier, notification preferences — delivering notifications to the channel you connected.

7. Profile (optional): avatar colour, emoji, image — display.

8. Access logs: IP address, request time and path, browser type — abuse prevention (rate limiting), incident response, security, visit statistics (only counts per date and source are kept; IP addresses are not stored and no cookies are used). Kept in server logs for at most 30 days.

9. Cookies: a sign-in session cookie, a language cookie, a time-zone cookie (the zone your browser reports, kept for a year), a short-lived (10-minute) invitation cookie set when you arrive via an invitation link, a short-lived (10-minute) sign-up verification cookie kept while you wait for the email verification code, two short-lived (10-minute) verification cookies used during the Google sign-in round trip and new-account completion, and two short-lived (10-minute) connection-check cookies set only on the setup-kit connection and app connection (connecting an AI app by signing in) screens — staying signed in, display language, showing times in your zone, continuing an invitation, preventing forged Google sign-ins and connection requests. No advertising or tracking cookies.

10. Inquiry content (optional): the sender's email address and the content of the inquiry — receiving and answering customer inquiries and complaints. Only if you contact us, and kept for 3 years after resolution.

11. Plan and billing records: workspace name, plan changes, payment and refund amounts and currency, the payment processor's transaction reference, the identifier of the account that acted, and the time — billing, refunds and statutory retention. Card numbers and other payment-method details go directly to the payment processor; the Company does not store them.

12. GitHub check (if a project admin turns it on): the connected repository's name and GitHub repository ID, the account identifier of the admin who turned it on, and for each push to it the commit numbers sent by GitHub Actions (up to 21 at a time), whether it was the default branch, and the time received — checking for changes not linked to Teamping records. We do not receive the repository's code, file names, commit messages or authors. Deleted when turned off or when the project is deleted; only the most recent 2,000 pushes per project and repository are kept.

13. Company console: The company owner (and admins the owner allows) can see, on the console, each project's work progress, pending approvals, assignees, due dates, file locks, open meetings and GitHub link; for each member, their role (owner, admin, member), the projects where they are lead or deputy, the title, stage and due date of the work they are assigned, and whether their AI is connected, how, and on which plugin version; and project- and company-level flow (number of done reports, time to approval, conflicts blocked). The console exists to coordinate work; it does not show sign-in times, per-person activity logs or comparisons between people.

14. File sending (if files are uploaded on the paid plan): the uploaded file itself, its name, size and type, the account identifier of the person who uploaded it, the upload time and the malware-scan result — to hand files over along with work cards and to block malware. Only people who can enter the same project can download a file, and the Company's operators do not view file contents.

15. App connections (optional · if you connected an AI app such as Codex by signing in): the app's name, the label you give it, an app-type hint (a marker such as "Codex" chosen from the client information the app sends — that information itself is not stored), the connected project, connection, last-use and refresh times and the date you must reconnect by (30 days after connecting), the revocation reason and who revoked it, and the hash of the access keys the app received — authenticating the AI app and showing it under "Connected apps" on My page and to admins. While a connection request is in progress (up to 5 minutes), we keep the hash of the one-time authorisation code, the local address the app returns to on your computer (a port on 127.0.0.1) and the label (see §2 item 1 for when they are deleted). Access-key plaintext is not stored, and no separate request is sent to the app's servers.

2. Retention and deletion

1. Account (email, name, password, profile), connection tokens, app connections, notification settings and AI activity observation records: deleted immediately when you close your account. Sign-up and email-verification times remain on the anonymised row. Records of revoked connection tokens and of revoked or expired app connections (label, times, revocation reason, who revoked it, token hash) are kept for 90 days from revocation (for app connections, from revocation or expiry, whichever is earlier) to check for account compromise or misuse and to resolve disputes, and are then deleted within an hour — earlier if you close your account or the workspace is deleted. The setup kit's computer marker is deleted as soon as the key is revoked. Setup-kit and app-connection request records (port, operating-system type, derived IP value, one-time code hashes, label) are deleted within two hours of the request at the latest.

2. Content (work reports, chat, meeting remarks and the like) and the team's audit records (file-lock history, role-change history, invitation history and the like): deleted together with their workspace or project (plan and payment records are the exception in item 5). When an author closes their account, their posts and records remain as part of the team's record with the author shown as "Deleted user"; your name as stored inside those records may, however, remain visible to team members. Files uploaded through file sending are different: they are deleted automatically 30 days after upload (they stay with the team until then even if the uploader closes their account), and the record of a file that was deleted or blocked by the malware scan (name, size, uploading account, time) is deleted within 30 days of its deletion or blocking.

3. Access logs: at most 30 days. (The operators' "control-room view log" is kept separately for at least one year — item 6.4.)

4. Backups: service data is backed up daily and backup copies are automatically deleted after at most 30 days. Deleted data may therefore remain in backups for up to 30 days.

5. Data that law requires us to keep is kept separately for the statutory period and then destroyed. Plan-change, payment and refund records (workspace name, amount and currency, payment-provider transaction id, the identifier of the account that acted, and time) are kept for 5 years under the Korean Act on Consumer Protection in Electronic Commerce even after the workspace is deleted or the account is closed.

6. Method: electronic files are deleted in a way that prevents recovery.

3. Disclosure to third parties

The Company does not disclose your personal data to third parties, except on a lawful request from authorities under applicable law or with your separate consent.

Your name, profile and content being visible to members of the same workspace is a function of the Service, not a disclosure to third parties.

4. Processors and international transfers

The Company entrusts processing to the following providers to operate the Service. Entrusting is not disclosure to a third party — processors may not use personal data beyond the purposes the Company sets.

1. Amazon Web Services, Inc. (United States · contact aws.amazon.com/privacy) — servers, database, backups, email delivery and receiving (Amazon SES; inquiry emails sent to support@teamping.dev are stored in Amazon S3), and storage and malware scanning of files uploaded through file sending (Amazon S3 · Amazon GuardDuty). Data is physically stored in the AWS Seoul region (Republic of Korea) and transferred and stored over encrypted connections. Because AWS is a US company and personnel located abroad may have access for incident response and maintenance, this is notified as an international transfer under applicable law. Country: United States · items: everything in section 1 · timing and method: encrypted network transfer on storage and sending · retention: as in section 2.

2. Telegram FZ-LLC (United Arab Emirates · contact dpo@telegram.org) — only if you connect Telegram notifications yourself, your Telegram chat identifier and notification text are sent over encrypted connections to Telegram's servers (in the UAE and elsewhere abroad). Nothing is sent unless you connect, and you can disconnect at any time from My Page. Retention is as in section 2.

3. (Planned · not yet entrusted) Korea Payment Networks Limited (KPN) (Republic of Korea · kpn.co.kr) — processing payments and payment cancellations (refunds) for the paid plan. Entrusted only once paid checkout is available, and only for users who pay; nothing is sent before then. Card numbers and other payment-method details are entered directly with the processor and are not stored by the Company. Retention is as in Section 2, item 5.

4. The Company does not send your content to external AI model providers. When you view content through your own AI agent, the recipient of that transfer is your own tool.

5. Your rights

1. You can view and edit your information, revoke connection tokens, disconnect connected apps, disconnect notifications and close your account at any time from My Page.

2. You may ask the Company to access, correct, delete or suspend processing of your personal data; the Company acts without delay (within 10 days) and informs you of the result. Send requests to support@teamping.dev.

3. We do not knowingly collect personal data from children under 14. If we learn that such an account exists, we delete it immediately.

4. You may exercise these rights through a legal representative or an authorised person.

5. Users resident in the EEA, the UK or elsewhere may have additional rights under their local law (such as lodging a complaint with their local supervisory authority), independent of the rights described in this policy.

6. Security measures

1. Passwords are stored only as hashes and connection tokens only as hash values. All traffic is encrypted with HTTPS.

2. All data is isolated per workspace, and AI agents cannot reach data except through the tools the Service exposes. AI agents have no power to approve or apply work (see the roadmap note below). Roadmap note: when a workspace owner or admin asks, that person's AI can confirm or reject items on a project roadmap and change their progress status, assignee and commit link.

3. Server access is limited to the minimum number of people, and deployment, backup and monitoring are automated so that people rarely touch production data directly.

4. For service operation, customer support and payment checks, the Service's operators can view each company's name, plan, seat count, usage statistics (numbers such as card and chat counts, and the time of the latest activity), the email of the company's primary owner, billing records, and visit statistics. They do not view the content of conversations, cards, meetings or files. The operators' viewing history (the control-room view log) is kept for at least one year.

5. If we become aware of a personal data breach, we notify affected users and the relevant authorities without delay as required by law.

7. Cookies

The Service uses only a session cookie to keep you signed in, a cookie that remembers your display language, a time-zone cookie, a short-lived invitation cookie when you arrive via an invitation link, a short-lived (10-minute) sign-up verification cookie kept while you wait for the email verification code, two short-lived (10-minute) verification cookies used during the Google sign-in round trip and new-account completion, and two short-lived (10-minute) connection-check cookies set only on the setup-kit connection and app connection screens. You can refuse or delete cookies in your browser settings (e.g. Chrome Settings > Privacy and security > Third-party cookies and site data; Safari Settings > Privacy). If you do, you will not stay signed in and will not be able to complete email sign-up, accepting an invitation, Google sign-in, setup-kit connection or app connection (a connection token issued on My page works without cookies, but with cookies refused you cannot sign in to issue a new one). No advertising or behavioural-tracking cookies and no external analytics scripts are used.

8. Data protection officer

Data protection officer: Hyungseok Kim (Representative) · support@teamping.dev · Tel. 050-7871-1707

Controller: Serion Inc. · Business registration no. 539-86-03983 · 3F 302-67 (Sejong Plaza), 25 Jangcha-ro 13beon-gil, Gochon-eup, Gimpo-si, Gyeonggi-do, Republic of Korea

Send privacy questions, complaints and remedy requests to the address above. If you are not satisfied with the Company's response, you may seek help from the Korea Personal Information Infringement Report Center (privacy.kisa.or.kr · 118) or the Personal Information Dispute Mediation Committee (kopico.go.kr · 1833-6972).

9. Changes to this policy

Changes are announced on the Service at least 7 days before they take effect (30 days for material changes).

This policy takes effect on 2026-10-14.