Effective date 2026.10.23
- 2026.10.23 (current)
- 2026.10.15
- 2026.10.03
This Policy is drafted in compliance with the Personal Information Protection Act (PIPA) and applicable laws.
Alphasov ("we", "us", or "our") takes the protection of users’ personal information seriously and works to protect their personal information and rights. We process personal information lawfully and transparently, only to the extent necessary, and we maintain this Privacy Policy so that users can readily exercise their rights regarding their personal information.
In this Policy, we explain what personal information we collect and use, the purposes for which we process it and how long we retain it, the outsourcing of personal information processing, international transfers, provision to third parties, and users’ rights and how to exercise them.
This Policy applies to the processing of personal information that takes place when users use VideoAlpha Sovereign (the "Software"), our website (alphasov.com), and related services.
1. Information We Collect
The Software and related services process only the following information, and only to the minimum extent necessary.
- For license verification and device registration: We process the license key, device identification information, and device name.
- For payment: Payment information (credit card, PayPal, etc.) is collected and processed directly by FastSpring, the Merchant of Record, through the FastSpring checkout. We do not collect or store full card numbers or other detailed payment method information. We also receive and process the following from FastSpring: order information (order ID; subscription ID; purchased product, quantity, amount, and currency; tax; order, payment, subscription, refund, and chargeback status; and purchase channel), purchaser information (email address, name, billing country, language, FastSpring newsletter subscription status, and, if entered by the purchaser, company name, address, phone number, and business tax number), and payment method information (payment method type, card brand or bank, and the last digits of the card number). We do not separately store any of this information that is not listed in the table in Article 3; we view it in FastSpring when needed to handle order inquiries and disputes, and FastSpring retains it as described in Article 4.
- When receiving a license free of charge: We process the email address.
- For customer support: We process the email address, inquiry content, and attachments that users send with their inquiries.
- When accessing the website (alphasov.com) and services: We process the IP address, access date, time, and region, and browser and program information.
- When participating in trial events: We process the email address; the device identification information and device name of the device on which the trial was activated; post URLs, post content, and the author name (account name); consent status; event participation history; and IP address.
- When downloading installers and verifying licenses: We process installer download records, license ID, language, license verification dates, IP address, and browser and program information.
- For license management: We process license change records and abnormal access records (including IP address and browser and program information).
2. Information Not Collected or Transmitted to Our Servers
The Software's channel library, video download history, Sovereign Key™ (the user's YouTube Data API key), and video file content are processed only locally on the user's PC and are not collected or transmitted to our servers.
Some functions of the Software use the YouTube API Services with the Sovereign Key™ registered by the user to retrieve publicly available channel and video information. The retrieved information is processed only on the user's PC and is not transmitted to our servers. The Google Privacy Policy (https://www.google.com/policies/privacy) applies to information processed by Google through the YouTube API Services. The user can stop the Software's use of the YouTube API Services at any time by deleting the API key in the Google Cloud Console.
3. Purposes and Retention Periods
We process and retain personal information as follows. The "Legal Basis" column refers to the applicable subparagraph of Article 15(1) of the Personal Information Protection Act. Information processed under subparagraph 1 (consent) is processed only if you have consented.
| Purpose | Items | Retention Period | Legal Basis |
|---|---|---|---|
| Retention of e-commerce transaction records (contracts and withdrawals, payment and supply of goods) | Email address; order ID; subscription ID; purchased product, quantity, amount, and currency; order, payment, subscription, refund, and chargeback status; issued license key; purchase channel | 5 years | Subparagraph 2 (legal obligation: Article 6 of the Act on Consumer Protection in Electronic Commerce, etc.). Purchase channel: subparagraph 6 (legitimate interests) |
| License authentication, management of registered devices, maintenance of usage rights, and license-related notices | License key, license email address (the email address used to purchase or receive the license), device identification information, device name, activation status, language | 90 days from the date the license ends | Subparagraph 4 (performance of contract) |
| Provision of installer downloads, prevention of misuse, and usage statistics | Installer download records, license ID, language, license verification dates, IP address, browser and program information | 30 days | Subparagraphs 4 (performance of contract) and 6 (legitimate interests) |
| Prevention of license misuse and dispute response | License change records, abnormal access records (including IP address and browser and program information) | 1 year (IP address and browser and program information: 30 days) | Subparagraph 6 (legitimate interests) |
| Handling customer inquiries, investigating order and license processing errors, and responding to disputes | Email address, order ID, license ID, inquiry content, attachments, content of service operation emails | 3 years | Subparagraphs 4 (performance of contract) and 6 (legitimate interests). Records of consumer complaints or dispute handling: subparagraph 2 (legal obligation: Article 6 of the Act on Consumer Protection in Electronic Commerce, etc.) |
| Security and incident response for the website and services | IP address, access date, time, and region, browser and program information | 7 days (access records of license verification requests: 30 days) | Subparagraph 6 (legitimate interests) |
| Operation of trial events (issuing trials and preventing duplicate use, providing participation benefits, analyzing event effectiveness) | Email address, device identification information and device name of the device on which the trial was activated, post URLs and content, author name (account name), consent status, event participation history, IP address | 1 year from the last processing date of the participation record (IP address: 30 days). The email address and device identification information used to prevent duplicate use of the trial and participation benefits, together with the event participation history needed for that check, are retained while that trial is offered. | Subparagraphs 4 (performance of contract) and 6 (legitimate interests) |
| Promotional use of trial event posts and display of the author name (account name) | Post URLs and content, author name (account name) | Until consent is withdrawn | Subparagraph 1 (consent) |
| Event and product news | Email address, records of consent and opt-out (date, time and channel), language | Until you opt out | Subparagraph 4 (performance of contract) |
Personal information whose retention period has expired or whose processing purpose has been fulfilled is destroyed without delay. However, information retained under applicable laws is stored separately from other personal information for the period stated in the table above. Personal information in electronic file form is deleted using methods that prevent recovery, and copies remaining in a service provider's recovery backups are deleted when that service provider's backup retention period expires.
4. Outsourcing of Personal Information Processing
We outsource personal information processing to external providers to provide our services. Because all of our service providers are located outside the Republic of Korea, the service providers and outsourced tasks are listed together in Article 5 (International Transfers of Personal Information).
When entering into outsourcing contracts, we set out the necessary measures under Article 26 of the Personal Information Protection Act so that personal information is securely managed, and we supervise whether service providers process personal information securely. Any changes to outsourced tasks or service providers will be disclosed through this Policy.
Payment and sales transactions are processed by FastSpring as the Merchant of Record and seller, and in doing so FastSpring processes personal information in accordance with its own privacy policy. However, when FastSpring processes purchaser information at our request for upgrade payments, it does so as our service provider.
5. International Transfers of Personal Information
We transfer personal information overseas for the outsourcing and storage of personal information processing necessary to conclude and perform contracts with data subjects, and we disclose the following matters in this Policy pursuant to Article 28-8(1)(3)(a) of the Personal Information Protection Act. All transfers below constitute outsourcing of personal information processing (including storage).
| Recipient (Contact) | Destination Countries | Items Transferred | Outsourced Task | Retention/Use Period |
|---|---|---|---|---|
| Keygen LLC (legal@keygen.sh) | United States | License key, purchase and trial application email address, order ID, subscription ID, purchased product, quantity, amount, and currency, language, purchase channel, device identification information, device name, license and device registration status, IP address | License issuance and verification, and registered-device management | The retention periods in Article 3 (IP address: 30 days) |
| Cloudflare, Inc. (privacyquestions@cloudflare.com) | The 16 countries and 2 regions listed below | Information we retain under Article 3, and access records for the website and services | Website and service operation, data storage, and security | The retention periods in Article 3 |
| Plus Five Five, Inc. (Resend) (privacy@resend.com) | United States | Email address and the contents of emails sent | Delivery of service-related emails and event and product news emails | 30 days after sending |
| Google Asia Pacific Pte. Ltd. (Google Workspace) (privacy contact page) | The 33 countries and regions listed below | Customer inquiry, service operation, and trial event emails in our business mailboxes (email address, order ID, license ID, inquiry content, attachments, post URLs, coupon records) | Receipt and storage of business email | The retention periods in Article 3 (customer inquiry and service operation emails: 3 years; trial event emails: 1 year) |
| Bright Market, LLC d/b/a FastSpring (privacy@fastspring.com) | Canada, Germany, Netherlands, United Kingdom, United States | Purchaser email address and name, ordered product and quantity | Processing purchaser information in the upgrade checkout | Until termination of the outsourcing contract |
- Cloudflare destination countries and regions: Australia, Canada, France, Germany, India, Japan, Malaysia, Mexico, Netherlands, Portugal, Singapore, Sweden, Switzerland, United Arab Emirates, United Kingdom, United States, the European Economic Area (EEA), and the Asia-Pacific region (where our database is stored). Cloudflare does not disclose the specific countries within these two regions.
- Google Workspace destination countries and regions: Argentina, Australia, Austria, Belgium, Brazil, Canada, Chile, Denmark, Finland, France, Germany, Hong Kong, India, Ireland, Israel, Italy, Japan, Malaysia, Mexico, Netherlands, New Zealand, Norway, Philippines, Poland, Singapore, Spain, Sweden, Switzerland, Taiwan, Thailand, United Kingdom, United States, Uruguay
- Time and method of transfer: Transmitted over the network when you use the services.
- How to refuse transfer and its effect: If you do not want your personal information transferred overseas, you may request this at support@alphasov.com. If you refuse a transfer, we will be unable to provide the services performed by that provider in the table above. The LITE edition can be used without license verification.
- Sub-processors: The companies to which each service provider further outsources its tasks (sub-processors), and those tasks, can be found in the lists published by each company. Keygen (Section 1.9 of its privacy policy) · Cloudflare · Resend · Google Workspace · FastSpring
6. Provision of Personal Information to Third Parties
Under Article 17 of the Personal Information Protection Act, we do not, as a rule, sell, lend, share, or provide users' personal information to third parties. The following are exceptions.
- Where the user has given prior consent
- Where required by applicable laws, or where requested by an investigative authority for investigation purposes in accordance with the procedures and methods set forth by applicable laws
7. Cookies and Automatic Collection Devices
The website (alphasov.com) may use a minimal number of technical cookies set by Cloudflare's default features.
In addition, if a visitor dismisses the language notice banner, we store a functional cookie for up to 30 days solely to record that fact, so that the same notice is not shown again.
If a visitor selects a language directly, we store that language setting in a functional cookie for up to 1 year so that pages are displayed in the selected language on the next visit.
These functional cookies are not used for analytics, advertising, or behavioral tracking. Users may refuse cookie storage using the methods below.
- Microsoft Edge: [Settings] → [Cookies and site permissions] → [Manage and delete cookies and site data]
- Chrome: [Settings] → [Privacy and security] → [Cookies and other site data]
Behavioral Information Collected by Third Parties (Meta Pixel · Microsoft Clarity · NAVER Conversion Tracking · Google Ads Conversion Tracking)
(1) To measure ad performance and to deliver ads tailored to your interests, we have installed the Meta Pixel on our website; to analyze and improve how our website is used, we have installed Microsoft Clarity; to measure the performance of our NAVER search ads, we have installed NAVER Conversion Tracking; and to measure the performance of our Google search ads, we have installed Google Ads Conversion Tracking. We allow Meta Platforms, Inc. ("Meta"), Microsoft Corporation ("Microsoft"), NAVER Corporation ("NAVER"), and Google LLC ("Google") to collect the behavioral information below through cookies and similar technologies.
| Collection Tool | Collecting Company | Behavioral Information Collected | Purpose of Collection |
|---|---|---|---|
| Meta Pixel (JavaScript, web pages) | Meta Platforms, Inc. (Meta Platforms Ireland Limited if you access the site from the EU/EEA) | Website visit, usage, and purchase history; browser and device information; IP address; cookie identifiers | Measuring ad performance; delivering ads tailored to your interests |
| Microsoft Clarity (JavaScript, web pages) | Microsoft Corporation | Website visit and usage records (screen interactions such as page navigation, clicks, and scrolling); browser and device information; IP address; cookie identifiers | Analyzing and improving how the website is used |
| NAVER Conversion Tracking (JavaScript, web pages) | NAVER Corporation | NAVER ad click information; website visit, usage, and purchase history; browser and device information; IP address; cookie identifiers | Measuring the performance (conversions) of NAVER search ads |
| Google Ads Conversion Tracking (JavaScript, web pages) | Google LLC (Google Ireland Limited if you access the site from the EU/EEA or Switzerland) | Google ad click information; website visit, usage, and purchase history; browser and device information; IP address; cookie identifiers | Measuring the performance (conversions) of Google search ads |
(2) We do not transmit your name, email address, or other information you enter through the Meta Pixel. Microsoft Clarity masks the content entered in input fields, such as email addresses, and does not record the entered values. We do not transmit email addresses or order numbers through NAVER Conversion Tracking or Google Ads Conversion Tracking.
(3) You can reject or re-allow these cookies at any time under “Cookie settings” at the bottom of each page. If you reject them, information is no longer transmitted through the Meta Pixel, Microsoft Clarity, NAVER Conversion Tracking, or Google Ads Conversion Tracking from then on, and the Meta, Clarity, NAVER, and Google cookies stored on our website are deleted. Information already transmitted is processed in accordance with the Meta Privacy Policy, the Microsoft Privacy Statement, the NAVER Privacy Policy, and the Google Privacy Policy. Even if you reject them, you can continue to use all features, including downloads and purchases. If you access the site from the EU/EEA, the United Kingdom, or Switzerland, we use the Meta Pixel, Microsoft Clarity, NAVER Conversion Tracking, and Google Ads Conversion Tracking only after you select “Allow cookies” in the notice at the bottom of the screen.
(4) Your choice under “Cookie settings” is stored in your browser for up to one year so that the same notice is not shown again.
Notice for use of SovereignSignet™ authentication: When the user signs in to an external platform (e.g., YouTube) using the SovereignSignet™ authentication feature of the Software, login session cookies issued by that platform may be stored locally on the user's PC. These cookies are used solely to process content the user has access to, and are not transmitted to Alphasov's servers. The user may delete this authentication information from program settings.
8. Children
We do not knowingly collect personal information from children under the age of 14. The Software is intended for users who have reached the age of majority under the laws of their country or region of residence (see Article 16 of the End User License Agreement). If we learn that personal information of a child under 14 has been collected without the consent of a legal representative, we will destroy the information without delay.
9. Rights and Obligations of Data Subjects and How to Exercise Them
Under the Personal Information Protection Act, users may exercise the following rights regarding their personal information.
- Right to request access to personal information
- Right to request correction or deletion of personal information
- Right to request suspension of processing of personal information
- Right to withdraw consent to the processing of personal information
All requests can be submitted through support@alphasov.com, and we will take action without delay. However, deletion may not be requested where personal information is specified as a subject of collection under other applicable laws. You may also exercise these rights through a representative, such as your legal representative or a person you have authorized. In that case, the representative must submit a power of attorney in the form of Annex 11 to the Notice on Methods of Processing Personal Information.
10. Chief Privacy Officer
Under Article 31 of the Personal Information Protection Act, we have designated a Chief Privacy Officer (CPO) as follows to protect users' personal information and to handle complaints related to personal information.
| Category | Name / Position | Contact |
|---|---|---|
| Chief Privacy Officer (CPO) | 정동훈 / Representative | support@alphasov.com / 070-8095-2037 |
11. Remedies for Infringement of Rights
The following Korean public agencies may also be available for relief, consultation, and dispute resolution related to personal information infringement. These agencies are separate from us; if you are not satisfied with our internal handling of personal information complaints or relief, or need more detailed assistance, please contact them directly.
- Korea Internet & Security Agency (KISA) — Privacy Infringement Reporting Center: privacy.kisa.or.kr / 118 (no area code)
- Personal Information Dispute Mediation Committee: kopico.go.kr / 1833-6972
- Cyber Investigation Division, Supreme Prosecutors' Office: spo.go.kr / 1301 (no area code)
- Cyber Investigation Bureau, National Police Agency: ecrm.police.go.kr / 182 (no area code)
12. Measures to Ensure the Security of Personal Information
Under Article 29 of the Personal Information Protection Act, we take the following measures necessary to ensure security.
- Administrative measures: We limit the people who handle personal information to the minimum necessary and apply two-step verification to the administrator accounts of the services that store personal information.
- Technical measures: We encrypt communications between the Software or website and our servers (HTTPS), and email addresses stored in our database are encrypted or partially masked.
- Physical measures: We do not operate our own servers or server rooms; the physical security of servers and data storage facilities is managed by the service providers listed in Article 5.
13. Changes to This Privacy Policy
This Privacy Policy applies from the effective date shown above.