개인정보 처리방침

1. Who operates Will AI and when this policy applies

Until a legal entity is formed, Will AI is operated by Will AI Team. Privacy requests and support inquiries can be sent to support@willai.app.

This policy applies to the Will AI iOS app, Watch companion, website, sync and analysis servers, and support channels. It is written for users in Korea, the United States, and Canada and will be updated when the operator information changes.

2. Information we collect

• Account data: Apple, Google, and Kakao sign-in identifiers, email address, profile name, and authentication session data
• Health and fitness data: read-only HealthKit data that the user authorizes in Apple Health, workouts, sleep, heart rate, activity, and manual health records
• Location, calendar, and environment data: location data if authorized, place labels, Apple Calendar entries, weather, and air-quality context
• User content: chats, voice input and transcripts, photos or images, personal records, meal, medication, supplement, and symptom notes, generated reports, and personal wiki content
• Device, identifier, and diagnostic data: Supabase user ID, provider ID, device ID, push token, app usage events, crash/performance diagnostics, and device usage records (screen lock and unlock timestamps)

3. How we use information

• To create and personalize daily timelines, reflections, reports, chat answers, personal wiki content, and memories
• To provide sync, data restore, data export, account management, and account deletion
• To perform user-requested AI analysis, summarization, voice transcription, and image analysis
• To diagnose errors, maintain security, prevent abuse, improve service reliability, and provide support
• To provide service notifications about permissions, data gaps, report readiness, and account operations

4. AI processing and model training

Will AI sends only the data needed for user-requested analysis and response generation to AI processors. The current AI processors are Anthropic, OpenAI, and DeepSeek; providers may be added or changed per feature. For example, proactive nudge notifications use DeepSeek. Food and alcohol lookups are handled by the Google Search API rather than by AI analysis.

Will AI does not permit user data to be used to train AI foundation models. AI outputs are for wellness and self-understanding only and do not replace medical diagnosis, treatment, emergency decisions, or medication instructions.

5. Retention, export, and deletion

Collected data is stored primarily on Will AI's servers (Supabase, Seoul, South Korea region), with a copy kept on your device for display and offline use. Raw events, derived facts, reports, memories, personal records, and conversation records are retained to provide the service and sync data across devices. Some temporary originals or processing artifacts may be cleaned up after a short period, but not all data is automatically deleted immediately after analysis.

Users can export data or delete their account in the app. When account deletion is complete, user-owned server data, personal-record images, the authentication account, and local data on the device are deleted. Limited records may be retained only where legally required.

6. Processors and international transfers

Will AI may use Supabase for authentication, database, storage, and Edge Functions; Sentry for diagnostics; PostHog for product usage analytics (EU region); Apple, Google, and Kakao for sign-in and platform services; Anthropic, OpenAI, and Google for request-based AI processing; Resend for export email; Apple HealthKit/WeatherKit; and external services the user connects.

Product usage analytics (PostHog) receives only app usage events such as screen views, feature usage, and subscription screen impressions, together with device model, OS and app version, and an internal user ID. Health metrics, record and chat content, location, name, and email are never included in analytics events, and Will AI does not use the advertising identifier (IDFA).

These processors may process data on infrastructure located outside Korea, the United States, or Canada, and data from Canadian users may be transferred to processors in the United States and elsewhere. Will AI transfers data only as needed to provide the service and contractually requires processors to provide appropriate protection.

7. Cross-border transfer of personal information (notice for Korean users)

This section sets out the items that must be disclosed when obtaining consent for cross-border transfer under Article 28-8(2) of the Korean Personal Information Protection Act. Will AI obtains separate consent for this item on the onboarding consent screen.

• Categories transferred: timeline event summaries included in an analysis request, health, activity, sleep, and heart-rate metrics, text entered by the user (chat, notes, personal records), voice transcripts, and images attached by the user. Food and alcohol lookups transfer the search term the user entered. Direct identifiers such as name, email, and phone number, and account credentials, are not included in the transfer. Product usage analytics transfers app usage events such as screen views, feature usage, and subscription screen impressions, together with device model, OS and app version, and an internal user ID; health metrics, record and chat content, location, and direct identifiers are not included.
• Destination country: the United States and China (DeepSeek). Timing: transferred per request, at the moment the user asks for report generation, chat responses, voice transcription, image analysis, or a food or alcohol lookup, or when a proactive notification is generated. Method: sent from Will AI servers or the app to each processor's API over an encrypted HTTPS connection. The source database remains in the Seoul, South Korea region. Product usage analytics events are sent to Germany (EU Frankfurt region) at the moment each event occurs while the app is in use.
• Recipients and contacts: Anthropic PBC (US, [email protected]), OpenAI OpCo LLC (US, [email protected]), DeepSeek (China, via the contact channel listed in its published privacy policy), Google LLC (US, via the contact channel listed in its published privacy policy), Functional Software Inc. dba Sentry (US, [email protected]), Resend Inc. (US, [email protected]), Supabase Inc. (US entity; data stored in the Seoul region, [email protected]), and PostHog Inc. (US entity; analytics data stored and processed in the EU Frankfurt region, [email protected]).
• Purpose and retention: AI processors (Anthropic, OpenAI, DeepSeek) use the data solely to perform the analysis, summarization, transcription, or image interpretation the user requested, or to generate proactive notifications, and delete it within the period set by each provider's abuse-monitoring policy (up to 30 days) after processing. Google is used solely to process food and alcohol search queries; Will AI does not use Google as an AI analysis processor. Will AI contractually requires that this data is not used to train AI models. Sentry retains diagnostic data for up to 90 days, Resend for as long as needed to deliver export email, and Supabase until the account is deleted. PostHog is used solely to analyze onboarding, feature usage, and subscription conversion, and the user's analytics events are deleted upon account deletion or on request.
• How to refuse, and the effect of refusal: you may refuse by declining the cross-border transfer item on the onboarding consent screen and not completing sign-up, and after sign-up you may withdraw by emailing support@willai.app or deleting your account in the app. Because AI analysis is performed only through overseas processors, refusing or withdrawing means AI-based features such as reports, chat, voice transcription, and image analysis cannot be provided. Refusal does not otherwise disadvantage your use of the service or your account. Product usage analytics events are not essential to providing app features, so withdrawing does not affect your use of the app; deletion of collected analytics events can be requested at support@willai.app.

8. Rights regarding automated decisions

Will AI analyzes collected data with AI to automatically generate timeline summaries, reports, insights, and notifications. These outputs are informational and support self-understanding; they do not make decisions with a significant effect on the user's rights or obligations, such as hiring, credit, insurance, or eligibility determinations. Will AI therefore assesses that these are not automated decisions subject to the right of refusal under Article 37-2(1) of the Korean Personal Information Protection Act.

For transparency, Will AI nevertheless discloses the criteria and procedure for automated generation in line with Article 37-2(4), and accepts requests for explanation and for stopping automated generation.

• Criteria: Will AI assembles the health, activity, sleep, location, calendar, voice, and manually entered records you have authorized into a chronological set of factual data, then generates analysis based on deviation from your own baseline and on temporal proximity between items.
• Procedure: collection (L1) → timeline consolidation (L2) → factual summary (L3) → AI analysis (L4) → safety review (L5) → delivery (L6). The safety review step blocks numeric inconsistencies and definitive medical claims.
• Explanation and opt-out: you may request an explanation of which data a specific report or insight was based on at support@willai.app. If you do not want automated generation at all, you can turn off report and notification generation in app settings or revoke the underlying data permission; on request, a person reviews the case and takes appropriate action.

9. Location information

Will AI collects location data only when you grant the device permission, and uses it to reflect your daily movement and places visited in your timeline. Location data is not provided to third parties.

The location-based service terms required by the Korean Act on the Protection and Use of Location Information are provided as a separate document. Those terms cover the operator's contact details, user rights and how to exercise them, the location-based services offered, the legal basis and retention period for records confirming use and provision of location data, and the purpose and period for retaining personal location data.

Will AI automatically records and retains records confirming the use and provision of location data in its location information system. You may revoke location permission in device settings at any time; features other than location-based ones remain available.

10. Marketing and promotional messages

Will AI obtains explicit prior consent before sending commercial promotional messages. This consent is optional, and declining it does not restrict your use of the service. Operational notifications required to provide the service, such as permission status, data gaps, or report readiness, are not promotional messages and are sent regardless of this consent.

Separate prior consent is obtained to send promotional messages between 9:00 PM and 8:00 AM. Users who have not consented to night-time receipt are not sent promotional notifications during those hours.

Promotional messages display the sender's name and contact details together with how to opt out or withdraw consent. Opt-out is processed immediately in app settings at no cost. Will AI confirms marketing consent status every two years and notifies users of the result.

11. Tracking, sale, and advertising

Will AI does not combine user data with third-party data for advertising tracking, and does not sell personal data to advertisers, insurers, or data brokers.

In App Store Privacy Nutrition Labels, some collected data types may be declared as linked to the user, but that does not mean Will AI uses the data for tracking or sale.

12. Children’s privacy

Will AI is not directed to children under 14 in Korea or under 13 in the United States. Users below those thresholds may not use Will AI.

If Will AI learns that it has processed personal information from a child below those thresholds, we will review requests sent to support@willai.app and take appropriate action, including deletion where required.

13. User rights

Korean users may request access, correction, deletion, suspension of processing, and other rights available under applicable law. U.S. users may request access, deletion, correction, portability, or limitation of sensitive data use where available under state law. Canadian users may request access, correction, and withdrawal of consent under PIPEDA and Quebec Law 25.

If a request cannot be completed in the app, email support@willai.app from the account email with your request. We may request additional information to verify identity.

14. Canadian users (PIPEDA and Quebec Law 25)

This section applies when Will AI is made available to Canadian users. Canadian users are covered by the federal PIPEDA; Will AI obtains user consent through in-app permission and consent screens before collecting sensitive data such as health, location, and voice, and supports withdrawal of consent and access/correction requests.

Will AI's AI processors and database (Anthropic, OpenAI, Supabase, and others) process and store data outside Canada, including in the United States. This is a transfer for processing; Will AI discloses this cross-border transfer and contractually requires comparable protection from processors.

Quebec residents are additionally covered by Law 25. In connection with making the service available to Quebec users, Will AI fulfills Law 25 requirements including an assessment of protection before transfers outside Quebec, privacy-protective defaults, and designation of a Privacy Officer.

Canada-related privacy requests and Privacy Officer inquiries can be sent to support@willai.app. Privacy Officer details will be updated after the legal entity (Ambients) is formed.