Privacy Policy
OurHertz (우리들의주파수, the "Company") operates the VMSProbe service in compliance with the Personal Information Protection Act of the Republic of Korea and other applicable law, and maintains this policy to protect users' personal information. We process only what the Service needs, and we do not use personal information for advertising or behavioural analysis. This English text is a translation of the Korean original. If the two differ, the Korean version prevails.
1. Two kinds of information
The information the Service handles falls into two kinds. Who is responsible for it, and how you exercise your rights, differ between them, so we explain this first.
- Account information: information about you as a registered user (your e-mail address, sign-in records and so on). The Company processes it as the controller.
- Diagnostic data: the bundles you upload and their analysis results. This is mostly technical information about devices and networks, but it can contain information about your customers or third parties, such as the site name, device host names or user names, and, if you choose to include them, camera snapshots. For such personal information, the user who had the diagnosis done (or that user's customer) is the controller; the Company is the processor entrusted with it and processes it only as far as needed to provide the Service.
2. What we collect and how
| Category | Items | How collected |
|---|---|---|
| Sign-up and sign-in (required) | E-mail address | Entered by you on the sign-in screen |
| Account and organization | Organization name (initially set automatically to the part of your e-mail address before the @), plan, display language, sign-up time, last activity time | Created at sign-up, set during use |
| Sign-in records | Sign-in links, device codes and sign-in tokens (all stored only as hashes), times issued, expired and last used, device label (on the web, part of the browser identification; for the desktop app, the app version and PC name) | Generated automatically during sign-in |
| Upload consent records | Versions of the terms and policy accepted, time of acceptance, confirmation of authorisation to diagnose, masking choices, IP address at upload | Collected automatically on bundle upload |
| Diagnostic data | Bundles (device IP and MAC addresses, manufacturer, model, firmware and serial number, host names, measurements, ONVIF and RTSP message records, system information and process and event log summaries of PCs where the Agent ran, site name, camera snapshots if chosen), analysis results, AI explanations | Uploaded by you |
| Usage records | AI explanation usage (time, case, amount used), times analyses were requested or cancelled | Generated automatically during use |
| Payment (paid plans) | Subscription status and period, plan, Paddle customer and subscription identifiers, country, e-mail address | Received from the payment provider Paddle |
| Enquiries | E-mail address, name (if given), contents of the message and attachments | Sent by you by e-mail |
| Connection data | Request time, IP address, requested address, browser identification, error details | Generated automatically while operating the servers |
We do not ask for passwords, and we do not collect resident registration numbers or other unique identifiers, or sensitive information. Card numbers and other payment details are collected by Paddle directly and never reach us.
The camera and VMS passwords the desktop app and the Agent use to test devices are used only in the memory of your PC and are not put in bundles. ONVIF and RTSP message records have passwords, authentication digests, nonces and cookies removed before they are written to a bundle (device user names may remain). Before uploading, you can choose to mask the last part of IP addresses, host names and the site name, and to leave snapshots out.
3. Purposes of processing
- Identifying you, signing you in and keeping you signed in, and managing signed-in devices
- Storing, decrypting and analyzing bundles, providing analysis results and reports, and, on paid plans when you choose it, generating AI explanations
- Applying plans and performing the contract, including subscription management and refunds
- Keeping records of authorisation confirmations, preventing misuse, diagnosing faults and maintaining security
- Handling enquiries and complaints, and giving necessary notices such as changes to the Service or the terms
- Compiling anonymous statistics of test results per manufacturer, model and firmware (without organization, IP address or site name)
We do not use personal information for advertising or marketing, and we do not provide diagnostic data for training AI models.
4. Retention periods
We destroy personal information without delay once the purpose of processing has been achieved. The periods are as follows.
| Item | Retention |
|---|---|
| Account and organization information | Until the account is deleted |
| Sign-in link and device code records | Deleted automatically within 1 to 2 days after they expire (sign-in links are valid for 15 minutes, device codes for 10 minutes) |
| Sign-in token records and device labels | Until the account is deleted (a token itself stops working 180 days after issue or when you sign out) |
| Upload consent records | Until the account is deleted |
| Diagnostic data on the Community (free) plan | 7 days after upload; destroyed by an automatic deletion job that runs daily |
| Diagnostic data on paid plans | Kept while subscribed and the account exists. When a paid plan ends and the organization moves to Community, the cases it has at that time are deleted automatically 30 days later (subscribing again within that time keeps them). Deletion of individual cases can be requested at privacy@vmsprobe.com |
| Unfinished uploads | Deleted automatically 24 hours after the upload started |
| AI explanation usage records | Until the account is deleted |
| Enquiry e-mails | 3 years after the enquiry is resolved (records of consumer complaints and disputes) |
| Server connection data | Deleted automatically after our provider's (Cloudflare's) log retention period, currently a few days |
Where applicable law requires information to be kept, we keep it for the period the law sets and use it for no other purpose.
| Law | Records | Period |
|---|---|---|
| Act on Consumer Protection in Electronic Commerce | Records of contracts and withdrawal of offers | 5 years |
| Act on Consumer Protection in Electronic Commerce | Records of payment and supply of goods or services | 5 years |
| Act on Consumer Protection in Electronic Commerce | Records of consumer complaints and dispute resolution | 3 years |
| Protection of Communications Secrets Act | Records of access to the Service (log records, access location) | 3 months (where such records are kept) |
Payment records are kept by Paddle, the merchant of record, itself; the Company keeps the records it needs for subscription management for the periods above.
The anonymous statistics of test results per manufacturer, model and firmware cannot identify any person or site and are therefore not personal information; they may remain after an account or case is deleted.
5. Provision to third parties
We do not provide your personal information to third parties, except where you have agreed in advance, where a law specifically provides for it, or where an investigative authority or other body demands it following the procedure set by law. Unless the law forbids it, we tell the user concerned.
6. Entrustment of processing
We entrust the processing of personal information as follows to provide the Service. Our agreements with these processors set out what is needed to keep personal information safe, and we check that they comply.
| Processor | Work entrusted |
|---|---|
| Cloudflare, Inc. | Hosting the web service, operating the database (D1) and file storage (R2), sending sign-in e-mails, receiving and forwarding enquiry e-mails |
| Anthropic, PBC | Generating AI explanations (only on paid plans when you choose AI analysis) |
| Paddle.com Market Limited | Payment, tax handling, invoices and refunds for paid plans (including what it handles directly as the seller) |
| Google LLC | Operating the support and privacy mailbox (Gmail) |
If a processor or the work entrusted changes, we will amend this policy and give notice.
7. Transfer of personal information abroad
All of the processors above are outside Korea, so under Article 28-8 of the Personal Information Protection Act we disclose the transfers as follows. Every transfer takes place over the network (encrypted in transit) at the time you use the Service.
| Recipient (contact) | Country | Items transferred | Purpose | When and how | Retention |
|---|---|---|---|---|---|
| Cloudflare, Inc. (www.cloudflare.com/privacypolicy) | United States and Cloudflare's data centres worldwide | Account information, sign-in records, upload consent records, all diagnostic data, connection data, the address a sign-in e-mail is sent to, enquiry e-mails | Hosting, data storage, sending and forwarding e-mail | Continuously over the network while you use the Service | For the retention periods in section 4 (until the processing agreement ends) |
| Anthropic, PBC (privacy@anthropic.com) | United States | Findings from the analysis results (titles, details and evidence such as device IPs, models, firmware and measurements), the root-cause verdict, the site name (the short name if you chose masking) | Generating AI explanations | Sent via API when you choose AI analysis and the analysis runs | Retained for the period set by Anthropic's commercial terms and data retention policy, then deleted |
| Paddle.com Market Limited (www.paddle.com/legal/privacy) | United Kingdom | E-mail address, country, plan and subscription details, our organization identifier (payment details are entered by you directly with Paddle) | Payment, tax handling, invoices, refunds | Sent over the network when you pay and when the subscription changes | For the period required by law and Paddle's policies (transaction records usually 5 years or more) |
| Google LLC (support.google.com/policies) | United States | Sender address, name, contents and attachments of enquiry e-mails | Receiving and answering support and privacy enquiries | Forwarded when you e-mail support@ or privacy@ | 3 years after the enquiry is resolved |
Transfers to Anthropic happen only on paid plans. Each time an analysis runs, the Service asks whether to include an AI explanation, and you can refuse the transfer to Anthropic by choosing "rules only". In that case only the AI explanation is not provided; all other analysis results are provided as usual. According to Anthropic's commercial terms, data sent through its API is not used to train models by default.
Transfers to Cloudflare and Paddle are essential to operating the Service and taking payment, so if you refuse them you cannot use the Service (or, for paid plans, pay for it). If you do not want these transfers, you can choose not to sign up or delete your account. A transfer to Google happens only when you contact us by e-mail.
8. Destruction of personal information
(1) Personal information whose retention period has ended or whose purpose has been achieved is destroyed without delay. Information that must be kept under the law is stored separately from other information.
(2) When you delete your account, we delete without delay the account information, sign-in records, upload consent records and the organization's cases, bundles and analysis results. Deleted information remains in the database's point-in-time recovery records for up to 30 days and then disappears automatically; during that time it is used for nothing other than recovering from failures.
(3) Electronic files are deleted in a way that prevents recovery; printed material, if any, is shredded or incinerated.
9. Your rights and how to exercise them
(1) You may at any time ask to access, correct, delete or suspend the processing of your personal information, and withdraw your consent.
- Reviewing signed-in devices and signing them out: the account screen in the Service
- Deleting your account (withdrawing consent and leaving the Service): "Account > Delete account" in the Service
- Any other request to access, correct, delete or suspend processing, or to delete individual cases: e-mail privacy@vmsprobe.com from your account's e-mail address.
(2) We handle a request within 10 days of receiving it and tell you the result. Information the law requires us to keep cannot be deleted; in that case we tell you why. We may ask you to confirm the request from your account's e-mail address to verify your identity.
(3) A legal representative or a person you have authorised may make a request on your behalf by submitting a power of attorney.
(4) Requests about personal information of a user's customers or third parties contained in diagnostic data should be made to the user who uploaded that data (the controller). If such a request reaches us directly, we pass it on to that user and act on their instructions.
(5) We make no automated decisions that have legal effect on, or significantly affect, users. The Service's automated analysis and AI explanations concern the state of devices and networks.
10. Security measures
- Encryption in transit: all traffic of the web, the API and the desktop app is encrypted with HTTPS (TLS).
- Bundle encryption: a bundle is encrypted with AES-256-GCM on your PC when it is created, and its key is wrapped with the Service's RSA public key. Bundles are decrypted only in the cloud for analysis and are stored encrypted.
- Encryption at rest: the database and file storage are encrypted at rest by our provider (Cloudflare).
- Protection of sign-in credentials: the Service uses no passwords. Sign-in links, device codes and sign-in tokens are stored only as hashes; sign-in links expire after 15 minutes and device codes after 10 minutes, and each can be used only once.
- Protection of device credentials: camera and VMS passwords are never put in bundles, and protocol message records have passwords, digests, nonces and cookies removed before they are stored.
- Access control: every request is checked for a valid sign-in token and organization membership so that no one can reach another organization's data, and operator privileges and decryption keys are kept to the minimum.
- Data minimisation and automatic deletion: free-plan data after 7 days, expired sign-in records and unfinished uploads are deleted automatically.
11. Cookies and similar technologies
We do not use cookies. The web interface stores the following in your browser's local storage (localStorage).
| Name | Purpose | Type |
|---|---|---|
| vmsprobe.token | Keeps you signed in (sign-in token) | Strictly necessary |
| vmsprobe.case | The case you opened last | Functional |
| vmsprobe.device | The device code of a desktop app sign-in you are approving | Functional |
| vmsprobe.lang | Your chosen display language | Functional |
This information stays in your browser, and the sign-in token is removed when you sign out. You can clear site data in your browser settings, but you will then have to sign in again. We use no advertising cookies, analytics tools or behavioural tracking, and the web interface loads no scripts or fonts from other sites.
12. Children under 14
The Service is a business service for companies and engineers who work with video surveillance systems, and children under 14 may not register. If we learn that personal information of a child under 14 has been collected, we destroy it without delay.
13. Privacy officer
For questions, complaints or requests for remedies regarding the processing of personal information, contact us below. We reply and act without delay.
| Role | Details |
|---|---|
| Privacy officer | GO GEON NYEONG (Representative) |
| privacy@vmsprobe.com | |
| Telephone | +82-50-6891-3237 |
| Address | 165 Sucheong-ro, Osan-si, Gyeonggi-do 18108, Republic of Korea |
14. Remedies
If you need advice or help resolving a dispute about a privacy infringement, you can contact the following Korean bodies.
| Body | Telephone | Website |
|---|---|---|
| Personal Information Dispute Mediation Committee | +82-1833-6972 | www.kopico.go.kr |
| Privacy Infringement Report Center (Korea Internet & Security Agency) | +82-118 | privacy.kisa.or.kr |
| Supreme Prosecutors' Office | +82-1301 | www.spo.go.kr |
| Korean National Police Agency | +82-182 | ecrm.police.go.kr |
15. Changes to this policy
We may amend this policy as the law or the Service changes. Changes are posted in the Service at least 7 days before they take effect; changes that matter for your rights, such as to the items collected, the purposes, provision to third parties or transfers abroad, are posted at least 30 days before they take effect and also sent to your registered e-mail address.
Addendum
This policy takes effect on 2 November 2026.
This English text is a translation of the Korean original. If the two differ, the Korean version prevails.