개인정보 처리방침

1. Scope

This Privacy Policy applies to the ZVZO public website (doers.company), the brand consultation form, the ZVZO for Creators app, and the external social media accounts that creators connect in the app. Information additionally processed in the ZVZO Store service for brands is described on the screens of that service.

2. Principles

Connecting an account is optional, and you can use the basic features of the app without connecting one. Before you connect, the app shows a consent screen for that platform. We process only the connecting creator's own account. The only permissions we request are: for YouTube and X, permission to read your account and post information (post information is read only for connections where we offer performance view, section 10); for TikTok, permission to read your basic information, profile and statistics; and permission to receive a refresh token so that we can keep confirming the connection without asking you to sign in again (for example, offline.access on X); and, only if you choose YouTube detailed analytics (section 10), the YouTube Analytics read-only scope (yt-analytics.readonly). Naver Blog verification does not request any permission. We never post, edit, delete or send messages on your behalf. Authorization tokens (access and refresh tokens) received through official connections (OAuth) are stored encrypted and used only to confirm the connection, refresh the information and, for connections where we offer performance view (section 10), fetch your own performance data. Naver Blog verification does not involve any token. We do not sell information received through connections and do not use it for advertising.

3. YouTube

ZVZO uses YouTube API Services. By connecting or registering a YouTube channel, you agree to be bound by the YouTube Terms of Service (https://www.youtube.com/t/terms). The Google Privacy Policy (https://policies.google.com/privacy) applies to information handled by Google.

• Connected channel (Google sign-in): after you sign in with Google and approve, we use the YouTube read-only scope (youtube.readonly) to read the channel managed by that Google account. We store the channel ID, channel handle, channel name, public subscriber count, authorization tokens, and the connection and verification times. We use them to confirm that you own the channel you registered and to show you the connection status and subscriber count. We request YouTube Analytics reports only if you choose YouTube detailed analytics (section 10), and we do not request revenue data.
• Connections with performance view (section 10): once a day, with the same scope (youtube.readonly), we read the channel's total view count and video count and the video ID, title, thumbnail, publish time and public view, like and comment counts of the 20 most recent uploads, store the latest values and use them to show you your performance. We do not store video descriptions. Daily records are described in section 10.
• Registered channel (no sign-in): for the YouTube channel you register in the app, we use the YouTube Data API once a day to read the channel ID, name and thumbnail, public subscriber, video and view counts, and the title, description, thumbnail, publish time and view, like and comment counts of recent public videos. We use them to show your creator profile and collaboration review screens, to check collaboration obligations and to measure performance.
• ZVZO's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.

4. TikTok

If you sign in with TikTok and approve, we use TikTok Login Kit with the user.info.basic, user.info.profile and user.info.stats scopes to read your account identifier (open_id), username, display name, profile link and follower count. The profile link is used only to find your username. We store the account identifier, username, display name, follower count, authorization tokens, and the connection and verification times, and use them to confirm account ownership and to show you the connection status and follower count. We do not offer performance view or daily records for TikTok connections. The TikTok Privacy Policy (https://www.tiktok.com/legal/page/global/privacy-policy/en) applies to information handled by TikTok.

5. X

If you sign in with X and approve, we request three scopes. users.read (read user information) and tweet.read (read posts) are read scopes; we request both because X requires them together to look up your own account, and we use them to read your own account information and, only for connections where we offer performance view (section 10), the metrics of your own recent posts. For connections without performance view, we do not read posts with your token. offline.access is not a read scope: it lets us obtain a refresh token so that access continues without you signing in again, and we use it only to refresh the token during our daily check. We store the X account ID, username, name, public follower count, authorization tokens (access and refresh tokens), and the connection and verification times, and use them to confirm account ownership and to show you the connection status and follower count. For connections with performance view (section 10), once a day we also store your public post count and read the post ID, publish time and view, like, reply and repost (including quote) counts of your 10 most recent posts (excluding replies and reposts), keeping only the latest values. We do not store post content and do not keep daily records of post metrics. If that day's check fails, we delete the stored post metrics right away so that they are never kept for more than 24 hours. For X post links you register as collaboration posts, we read the content and public engagement counts of that public post to check the collaboration post; the identifier of the post is sent to X. The X Privacy Policy (https://x.com/en/privacy) applies to information handled by X.

6. Naver Blog

When you place the verification code we issue in your blog introduction or a public post and ask us to check it, we read your blog's public RSS feed once per request to find the code. We store only the blog address (ID) and the verification time. We do not store the feed content and do not read it again periodically.

7. Registered accounts and display to brands

The YouTube channel ID, X username and Naver Blog ID confirmed through a connection or verification are filled in automatically into your registered social account fields only when those fields are empty; existing values are not changed and are used only to check that they match. TikTok usernames are not filled in. A value filled in this way is not connection information: it becomes part of the registered social account information on your creator profile and is treated like a value you entered yourself. It stays after you disconnect, after you revoke access on the platform, and after the connection information is deleted, and it is kept and deleted together with your other member information. You cannot edit or delete registered social account information yourself in the app; to change or delete it, contact your ZVZO manager or email support@doers.company, and we will handle the request without delay and let you know the result. Your registered social account links and the public information of your registered YouTube channel (public subscriber count and public view, like and comment counts of videos) are shown on the ZVZO brand screens (ZVZO Store) so that brands can review collaborations. Information received through official connections (tokens, the subscriber or follower counts read through the connection, and the performance data and daily records in section 10) is shown only to you in the app and is not provided or shown to brands, except for registered account fields filled in as described above, which are shown like any other registered account and remain shown after you disconnect.

8. Disconnecting and revoking access

You can disconnect each platform at any time in the app under "Connected social accounts" (연결 SNS 계정 관리). When you disconnect YouTube, TikTok or X, we ask the platform to revoke the token and delete the connection information and tokens immediately. Naver Blog verification has no token to revoke; when you remove it on the same screen, we delete the verification record (blog address and verification time) immediately. Disconnecting does not delete values filled in automatically into your registered social account fields (see section 7). You can also revoke ZVZO's access at any time on the Google security settings page (https://security.google.com/settings/security/permissions), or remove ZVZO from the connected apps (app permissions) in your TikTok or X account settings. Deleting information held by ZVZO does not delete your content or data on YouTube, TikTok, X or Naver.

9. Retention and deletion

• Connection information and tokens are kept while you stay connected. Every day we read the connected YouTube, TikTok and X accounts again (refreshing the token when needed) to verify that the authorization is still valid and to update the display name, handle and follower count, and, for connections with performance view, the performance data in section 10. Naver Blog verification records are kept until you remove the verification or close your account and are not checked again.
• Disconnecting in the app: deleted immediately. Removing a Naver Blog verification also deletes the verification record immediately.
• Revocation on the platform: deleted as soon as our daily check detects it, and in any case within 30 days of revocation.
• Authorization that cannot be verified: deleted 30 days after the last successful verification.
• Account closure: for YouTube, TikTok and X we ask the platform to revoke the token and delete the connection information and tokens, and for Naver Blog we delete the verification record (blog address and verification time), as soon as possible and within 7 days.
• Performance data (section 10): the account summary and recent post metrics are kept with the connection and replaced with the latest values every day. If we close performance view for a platform, they are deleted at the next daily check, and X post metrics are deleted right away if that day's check fails.
• Daily records (section 10): deleted together with the connection when the connection is deleted (disconnecting, detected revocation, 30 days without verification, or account closure). Figures that are no longer recorded (videos that have dropped out of the 20 most recent uploads, or connections whose performance view has been closed) are deleted 30 days after the last record. If you connect a different account on the same platform, the performance data and daily records of the previous account are deleted right away.
• Sign-up connection records (section 11): deleted immediately if the application is rejected, and deleted together with the application if the application is deleted. If the application is not approved within 30 days of verification, the stored tokens are deleted, and the account identifier, handle and verification time are kept until the application is approved, rejected or deleted. When the application is approved, the records are moved to your creator connections and follow the periods above; records that could not be moved are deleted together with the application right after approval.
• YouTube detailed analytics (section 10): deleted right away if you disconnect YouTube in ZVZO, and at the next day's sync if you revoke the permission in your Google account settings. Records that are no longer refreshed are deleted after 30 days, and they are deleted within 7 days if you close your account.
• Values filled in automatically into your registered social account fields: these are registered information, not connection information, so they are not deleted on the schedule above; they are kept and deleted together with your other member information (see section 7).
• Deletion requests: you can disconnect in the app or email support@doers.company. We handle emailed requests as soon as possible and within 7 days of receipt, and let you know the result.

10. Performance view and daily records

• For connections on platforms where we have opened performance view, we show you, and only you, the performance of your connected account in the app (account summary, recent post metrics and daily trends). Performance view covers YouTube and X connections; we do not offer it for TikTok or Naver Blog connections. For connections with performance view, the consent screen shown before you connect also lists the performance items.
• Account summary and recent post metrics: we receive the items described in sections 3 and 5 at each daily check and store the latest values.
• Daily records: on each day the daily check succeeds, we record your account figures once with the date — for YouTube, the public subscriber count, total view count and video count; for X, the follower count and post count. For YouTube, we also record the public view, like and comment counts of each video among the 20 most recent uploads, with the video ID and date; titles and thumbnails are not kept in these records. We do not keep daily records of X post metrics.
• Performance data and daily records are shown only to you and are not provided or shown to brands (section 7). Retention and deletion are described in section 9.
• YouTube detailed analytics (optional): only if you tap "자세한 분석 보기" (See detailed analytics) on the performance screen and additionally grant the YouTube Analytics read-only scope (yt-analytics.readonly) through Google, we use the YouTube Analytics API to read reports for your own channel only: daily views, engaged views, watch time, average view duration, average view percentage, subscribers gained and lost, likes, comments and shares (including by content type); daily views, watch time, average view duration, likes, comments, shares and subscribers gained for each of your recent uploads; and audience age and gender percentages and views and watch time by country, traffic source and device for the last 28 days. On first grant we read the last 365 days of channel metrics and the last 90 days per video once, then refresh the last 7 days daily. This data is shown only to you. It is never shown or provided to brands or other third parties, never sold or used for advertising, and not combined across creators. It is covered by the Google API Services User Data Policy, including the Limited Use requirements (section 3). If you disconnect YouTube in ZVZO, we delete the stored analytics right away; if you revoke the permission in your Google account settings, we delete it at the next day's sync. Records that are no longer refreshed are deleted after 30 days, and they are deleted within 7 days if you close your account.

11. Connecting accounts during sign-up

• While you apply to join as a creator, we may ask you to verify your YouTube or X account through an official connection (OAuth), or your Naver Blog with a verification code. Before you connect, we show a consent screen for the application. TikTok is not connected during sign-up.
• What we store: the account identifier (YouTube channel ID, X account ID or Naver Blog ID), the handle (YouTube channel handle or X username) and the verification time. If you agree on the application consent screen, we also store your YouTube or X authorization tokens (access and refresh tokens) and the list of granted scopes, encrypted. For connections made without that consent screen (for example, from an older version of the app), we do not keep the tokens. We do not store display information such as the channel name or subscriber count, or any metrics, during sign-up.
• How we use it: to confirm that the account in your application is yours, to fill in the social account address in your application with the verified account's address, and to review your application. During sign-up we do not use the stored tokens to read information from the platform or to refresh them.
• When your application is approved, the verified accounts are moved to your creator connections, so they continue as the connections described in sections 3, 5 and 6 without connecting again. YouTube and X are moved only if tokens were stored; Naver Blog verification records are always moved. Moved YouTube and X connections are checked once after approval and then daily, and they fill in empty registered social account fields as described in section 7. If an account cannot be moved because it is already connected to another creator or has no stored tokens, you need to connect it again in the app after approval.
• When we delete sign-up connection records, we do not ask the platform to revoke the tokens. You can revoke access on the platform at any time through the Google security settings page or your X account settings (section 8). Retention and deletion are described in section 9.

12. Data protection

We treat OAuth tokens and connected account data as sensitive data, including the tokens and account information we store during sign-up (section 11). We protect them, together with other personal information, as follows.

• Encryption in transit: all traffic between the ZVZO for Creators app or our website and our servers is encrypted with HTTPS (TLS 1.2 or later). Plain HTTP requests are redirected to HTTPS.
• Encrypted tokens: OAuth tokens (access and refresh tokens) received from YouTube, TikTok and X are encrypted with AES-256-GCM before they are stored in our database. Tokens stored from YouTube or X connections made during sign-up are encrypted in the same way. The encryption key is kept separately from the database in an encrypted secret store.
• Encryption at rest: the production database that holds member and connected account information, including its backups, and our image file storage are encrypted at the storage level.
• Limited exposure: tokens are never included in responses to the app or website and are not shown on staff admin screens. Token values are filtered out of service logs and error reports.
• Access control: the production database accepts connections only from our internal network and a limited set of addresses we allow. Staff admin screens require sign-in with a company Google account (@doers.company), and sensitive functions such as member management and payouts are granted only to staff who need them for their work.
• Access records: when staff change data through admin functions, we record who changed what and when.
• Deletion: sections 8 and 9 describe how connection information and tokens are deleted when you disconnect, revoke access or close your account.

13. Advertising and device information

We do not allow third parties to serve advertisements on our website or in the ZVZO for Creators app. To analyze service use and fix errors, we automatically collect cookies and visit records on our website, and device information (including the device advertising identifier) and app usage records in the app, using Firebase, Mixpanel, Airbridge, Sentry and Microsoft Clarity. You can refuse cookies in your browser settings and limit or reset advertising identifier tracking in your device settings.

14. Contact

Questions, complaints and deletion requests: support@doers.company — Doers Corp., 8F, 398 Seocho-daero, Seocho-gu, Seoul, Republic of Korea. Effective date of this version: 2026-11-03.