How Alpaon LLC processes personal information in the AlpaConnect mobile app and the AlpaConnect cloud service. The company website (alpaon.com) is covered by a separate policy.
1. Purposes
We process personal information only for the following purposes.
Sign-up, sign-in, identity verification, and account management
Viewing, configuring, and controlling the devices of your organization and teams
Delivering device events and alerts as push notifications
Diagnosing app crashes and improving stability
Preventing abuse and responding to security incidents
2. Information we process
Account (required): username, email, name, password (stored only as a one-way hash)
Social sign-in (optional): the account identifier, email, and name provided by Google or Apple
Service usage: organization, team, role, device command history, access time and IP address
Device: push notification token, app version, OS version
Crash data: crash reports and device model when the app terminates unexpectedly
Bluetooth is used only to find nearby AlpaConnect Link devices and send settings to them. We do not collect location, contacts, photos, or advertising identifiers.
3. How we collect it
Entered by you on the sign-up and sign-in screens
Provided by Google or Apple with your consent when you use social sign-in
Generated automatically while you use the app (push token, crash reports, access logs)
4. Retention
Account: deleted without delay when you delete your account. We erase your username, email, name, password hash, social sign-in links, and push tokens, and remove your organization memberships and pending invitations.
Organization records: audit and command records of devices managed by your organization keep only an internal number that cannot identify you.
Crash data: up to 90 days from collection
Access logs: up to 3 months for security
Records required by law: for the period the law requires
5. Disclosure to third parties
We do not disclose personal information to third parties unless you consent or the law requires it. Administrators of your organization can see members' names, emails, roles, and activity records as part of the service.
6. Processors and international transfer
We use the following processors to provide the service. Some items are transferred abroad over the network while you use the service.
Google LLC (Firebase Authentication, Firebase Cloud Messaging, Firebase Crashlytics)
Task
Social sign-in, push notification delivery, crash analysis
Country
USA
Items transferred
Account identifier, email, name, push token, crash reports, device model, app and OS version
Retention
Until the contract ends or you delete your account (crash data up to 90 days)
Apple Inc. (Sign in with Apple, Apple Push Notification service)
Task
Apple sign-in, iOS push notification delivery
Country
USA
Items transferred
Account identifier, email (if you choose to share it), push token
Retention
Until the contract ends or you delete your account
Our service servers and databases are located in a data center in Korea operated by the company.
7. Deleting your account and your rights
In the app: go to Settings > your name (Profile settings) > [Delete account] at the bottom of the screen. Accounts created with a password are asked to confirm the current password; accounts that use only Google or Apple sign-in are deleted without a password.
If you are the only administrator of an organization that has other members, transfer the administrator role first.
You may request access, correction, deletion, or suspension of processing, or withdraw consent, in the app or by email (support@alpaon.com). We act without delay. You may also act through a representative.
If you used Sign in with Apple, you can also remove AlpaConnect under your Apple Account in iPhone Settings.
8. Security measures
Passwords are stored only as one-way hashes
Sign-in credentials are kept in the device's secure storage (iOS Keychain, Android Keystore)
All traffic is encrypted with TLS
Role-based access control and access logging
Staff training and an internal management plan
9. Destruction
When the retention period ends or the purpose is achieved, we destroy the information without delay. Electronic files are deleted so that they cannot be recovered.
10. Children
AlpaConnect is an equipment management service for businesses and institutions and is not directed to children under 14. We do not knowingly collect their personal information.
11. Privacy officer
Name: Jisub Kim Title: Chief Technology Officer (CTO) Contact: support@alpaon.com
12. Remedies
For consultation or remedies regarding privacy infringement, you may contact the Personal Information Dispute Mediation Committee (+82-1833-6972) or the Personal Information Infringement Report Center (118).
13. Effective date
If this policy changes, we will announce it in the app or on the website at least 7 days before it takes effect.