Veilink Inc. (주식회사 베일링크), Business Registration No. 843-87-03690, operates Veilink from the Republic of Korea. This policy describes private hiring and B2B introductions for eligible paid company plans. It is effective September 25, 2026.
If you live in the EEA or the United Kingdom, read the version for the EEA and the UK.
This document applies to Veilink hiring and to B2B introductions for eligible paid company plans. Review it before creating an account or connecting an AI agent.
To form and administer company agreements and document lawful sharing, we record the declared legal entity, registered address and country, authorised contact, verified work-email evidence, accepted version and time, and the completed encrypted contract. The legal basis depends on the record: contract performance where the individual is a party, applicable legal obligations, and legitimate interests in contract administration, accountability and legal claims. Personal evidence normally follows the bounded three-year period after account closure, subject to a documented legal hold. See the company data sharing terms. Optional cookie or marketing consent is separate from contract acceptance.
This policy applies to veilink.ai, Veilink-controlled API and MCP endpoints, account and dashboard pages, authentication links, hiring workflows, and B2B introductions.
When you use ChatGPT, Codex, Claude, Grok Bot, Meta Muse, Google sign-in, or an email provider, that provider separately controls information processed in its own product. Its terms and privacy policy also apply.
Account and consent data: email address, Google account identifier when Google sign-in is used, account role, selected data region, self-declared residence country, terms-acceptance and privacy-policy acknowledgment records, authentication attempts, session identifiers, and login results. Only when trusted edge verification is configured and available, we may also record a network-derived signup-country signal and the associated policy epoch. That signal may be unavailable and is not treated as nationality or proof of residence.
Candidate data: work history and evidence summaries, capabilities, supported outcomes, target work, location region, work arrangement, availability, compensation expectations, aspirations, preferences, constraints, and information you choose to submit during hiring requests and contact sharing.
Company data: company name, work-email domain, optional website, company region, representative contact details, the account user's confirmation that they may act for their own company, hiring briefs and expected outcomes, work location, compensation range, requirements, and information submitted through requests and contact sharing. For B2B introductions, this may also include seller offerings, private buyer sourcing briefs, commercial and delivery conditions, and evidence. Agency business verification does not request or collect client-mandate, client-consent, delegation, or per-role authority evidence.
Company billing data: selected plan, checkout and subscription identifiers, payment status, amount, currency, tax and invoice metadata, billing contact, and provider event history. Payment-card or bank-account details entered in Creem checkout are collected by Creem and are not stored by Veilink.
Generated and operational data: structured individual and hiring records and B2B offering and sourcing records; embeddings and relevance signals; closed clarification questions and answers; summaries; drafts; workflow status; consent and contact-sharing history; connected AI metadata; request logs; device or browser metadata; errors; abuse-prevention signals; and monitoring records.
Public site analytics records contain daily aggregate pageviews by public page path, an approximate country estimated locally from the connecting IP address, when available, and a coarse visit-source label. Your browser chooses that label from the referring site's host only, for example a search engine, an AI assistant, or a social site; any other site is grouped as 'other', and a direct visit, a visit for which your browser sends no referrer, or a visit from one of our own pages is recorded as 'none'. The referring page or URL is never sent to us or stored. After optional analytics consent, a random browser ID is converted to a one-way digest to count consenting browsers by day and once across a selected reporting period. Analytics records do not include account IDs, IP addresses, referring URLs or URL query strings. A VPN or relay can make the country estimate differ from your location.
We use personal data to obtain and record consent; create and secure accounts; link supported AI clients; structure confirmed individual evidence, preferences, and hiring briefs, and B2B seller offerings and private buyer sourcing briefs; identify potentially relevant records; issue closed clarification questions; keep requests and replies; present summaries; operate controlled contact sharing; administer company plans and payments; enforce allowances or billing pauses; provide support; prevent abuse; diagnose failures; and comply with legal obligations.
We use the self-declared residence country and any available trusted-edge signup-country signal to apply regional availability rules, investigate inconsistent signup claims, and prevent policy evasion. A network signal does not by itself determine residence or nationality.
We count public pageviews, with their page path, approximate country and coarse visit-source label, without a browser identifier to understand site use in aggregate, including which kinds of sites refer visitors. Optional returning-browser analytics uses consent and begins only after you allow it. You may reject or withdraw without losing access to the site.
Depending on the activity and applicable law, processing is based on consent, steps requested before or during service provision, performance of our agreement with you, compliance with law, or our legitimate interests in security and reliable operations.
For individuals protected by Korean law, we apply the relevant basis under the Personal Information Protection Act to each activity. Contract-related processing is limited to what is necessary to provide the requested service; a legitimate-interest basis requires the statutory balancing of interests. Reading this policy or accepting the Terms is not blanket consent to optional processing, third-party disclosure, or overseas transfers.
Optional contact sharing requires a separate user action where indicated. Veilink does not make an employer's hiring decision, a person's career decision, a buyer's purchasing decision, or a seller's contracting decision.
Veilink uses AI models to normalize individual, hiring, and B2B offering and sourcing inputs; create embeddings; identify potentially relevant records; and generate summaries or suggested next steps. Relevant inputs and system instructions may be sent to our AI processor as needed for those tasks.
AI outputs and similarity signals can be incomplete or wrong. Veilink does not expose a candidate-quality, employability, or hiring-eligibility score. Internal role-specific retrieval signals are used only to organize potentially relevant records for review; they are not a final employment or purchasing decision and do not send contact details on your behalf.
You may ask for access, correction, deletion, an explanation of automated processing, or human review where applicable by emailing support@veilink.ai.
Before direct contact sharing, hiring uses limited individual and company information. A permitted hiring conversation request identifies the company, while the representative's name, email, and phone number remain separate. In B2B introductions, buyer sourcing briefs are not searchable by sellers or exposed as leads. After a buyer initiates an inquiry, the selected seller receives only the approved, stage-limited structured projection needed to review the seller offering against that sourcing need. Direct contact details are not part of an initial request.
Names, email addresses, phone numbers, and other direct contact details open through the secure contact-sharing flow only after the required user actions. This is the intended product flow, not an absolute technical guarantee.
Where Korean law requires consent to third-party provision, the disclosure must identify the recipient, purpose, data items, recipient retention period, and the right to refuse and consequences before consent is requested. Accepting a conversation request alone does not authorize contact disclosure. Refusing optional contact sharing prevents that exchange and does not itself require account closure.
When you approve an AI-client connection requesting identity access, Veilink provides that client with a stable account identifier. If you also approve email access, the client can receive your verified sign-in email and its verification status for account identity and organization domain restrictions. For an OpenAI connection, OpenAI receives this information. Existing connections do not gain email access without a new approval. This identity access is separate from disclosure to hiring participants; you can revoke the client connection in your account settings.
Other hiring participants receive only the information allowed by the current request, clarification, and contact-sharing stage. The same staged-access principle applies to B2B introductions; sellers cannot search private buyer sourcing briefs or use Veilink for outbound pitching. Do not submit another person's data unless you are authorized to do so.
Google Cloud processes hosting, databases, logs, and monitoring data; Resend processes transactional email; Google processes OAuth sign-in data; OpenAI processes the inputs needed for normalization, embeddings, relevance checks, and summaries; and Creem processes company checkout, subscription, payment, tax, invoice, cancellation, and refund information. Each provider processes data for its service role and under its own terms and safeguards.
We may disclose information when required by law or reasonably necessary to investigate fraud, abuse, security incidents, rights violations, or threats to users or the service. We do not sell personal data or use it for behavioral advertising.
Accounts are available in supported countries, including the EEA and the United Kingdom. EEA account and profile data is stored in Belgium, and UK account and profile data is stored in the United States. Sign-in attempts, AI-client authorizations and staff access records use shared infrastructure in the United States. The European Privacy Policy explains the regional handling, including shared business reviews. New accounts in South Korea remain unavailable. Data retained for an existing user or company representative in Korea remains assigned to the US region for permitted account management, closure, security and legal-retention purposes. We do not offer a separate Korea-only database or Korean data-residency option.
Google, Resend, OpenAI, and Creem may process necessary data in the United States and other provider locations through encrypted network transmission when you sign in, receive email, use AI-assisted features, or manage company billing. Retention follows the periods below and each processor's service lifecycle.
For Korean personal data, overseas processing or storage necessary to enter into or perform the service agreement may rely on Article 28-8(1)(3) of the Personal Information Protection Act only with the required disclosures. A transfer outside that basis requires a separate lawful basis, including separate consent where applicable. An overseas recipient's own policy or acceptance of these Terms does not replace Veilink's obligations.
Before a Korean-law transfer begins, Veilink must disclose the recipient's legal name and contact details, country, data items, transfer timing and method, purpose, retention period, and refusal procedure and consequences through the applicable policy or notice. A generic reference to other provider locations does not replace those disclosures.
You can refuse international processing before submitting information or contact support@veilink.ai to request processing suspension, consent withdrawal where processing relies on consent, or account deletion. If the refused transfer is necessary to provide your account, we cannot provide the account on the current infrastructure. Refusal relating only to an optional feature restricts that feature. Withdrawal does not erase a separate statutory retention duty.
Account, individual, company, and hiring-position data, plus B2B seller-offering and buyer-sourcing data, is kept while the account or applicable record is active. After a valid deletion request, access is disabled and the request enters retention review. Data is then deleted or irreversibly anonymized unless a legal, security, dispute, or shared-workspace reason requires limited retention. Residual backup copies expire through the applicable backup lifecycle.
After an account deletion request, the account-linked retention deadlines run from the request date: up to 180 days for authentication and security records, 365 days for structured request and workflow records, and 1,095 days for consent and contact-sharing evidence needed to establish what users authorized. These are deletion-related retention periods, not a promise that active-account logs expire that many days after creation. Complaint and dispute evidence is retained only as needed for the applicable dispute or legal obligation.
Public site daily aggregate counts, including the approximate country and coarse visit-source label, and consenting-browser daily digests are deleted after 400 days. The analytics choice and optional browser-ID cookies expire after 180 days unless you clear them earlier. Withdrawing analytics consent deletes the browser-ID cookie and stops future identified analytics.
Subscription, invoice, transaction, tax, cancellation, and refund records may be retained for the period required by accounting, tax, payment-dispute, anti-fraud, and other applicable legal obligations, even after a company stops using a paid plan.
A legal hold, security investigation, unresolved dispute, or statutory duty may require longer retention. When data is no longer needed, it is deleted or irreversibly anonymized using the applicable database, storage, and backup deletion process.
Subject to applicable law, you may request access, a copy, correction, deletion, suspension or restriction of processing, withdrawal of consent, information about contact sharing, and review or explanation of automated processing.
Send requests to support@veilink.ai from the email associated with the account. We may verify identity and authority before acting. You may authorize a representative where applicable law permits.
Residents of California, the EEA, the United Kingdom, Korea, and other jurisdictions may have additional rights under local law. We will honor those rights where they apply and will not discriminate for exercising them.
Veilink uses an essential secure session cookie after authentication. Restricted pre-release access may use a separate essential access cookie. These are required to keep the relevant session available and protected.
The website stores theme preference and dismissed in-app notices in browser local storage. We do not currently use advertising cookies or cross-site behavioral advertising trackers.
We count public pageviews by UTC date, page path, approximate country and a coarse visit-source label without an analytics identifier. Your browser chooses the label from the referring site's host only, such as a search engine, an AI assistant, or a social site; the referring page or URL is never sent or stored. If you allow optional analytics, a first-party random browser ID helps us count consenting browsers by day and once across a selected reporting period. The analytics choice and visitor cookies last up to 180 days; the visitor cookie is removed if you reject or withdraw. Aggregate counts and one-way daily visitor digests are removed after 400 days. We do not store IP addresses, account IDs, referring URLs or URL query strings in this analytics dataset. Use Cookie settings in the footer to change your choice at any time.
We use safeguards including access controls, signed AI-agent requests, session expiration, encryption in transit, restricted contact-sharing stages, rate limits, logging, and monitoring. No internet service can guarantee absolute security.
Authorized Veilink operators may access account, workflow, security, and support data only when needed to operate, secure, investigate, or support the service. Sensitive access may require additional controls and is logged where supported.
Veilink is a professional introduction service and is not directed to children. Do not create an account unless you have the legal capacity to use the service and provide the required consent.
Privacy contact: Eam Juhyuk, Representative and Privacy Contact, Veilink Inc. (주식회사 베일링크). Email: support@veilink.ai.
You may also contact the competent privacy or data-protection authority in your jurisdiction. In Korea, this includes the Personal Information Protection Commission and the channels it identifies for complaints and remedies.
We may update this policy as the service, providers, data flows, or law changes. The current version and effective date will remain published here. We will provide additional notice or request renewed consent when a material change requires it.
Current access, company-plan pricing, and operational limits are described on the Pricing page. A material change to payment processing or the categories of personal data involved will be reflected in this policy before it applies where required.
The current version and effective date remain published on this page. Mandatory privacy rights are not reduced by this policy.
Email support@veilink.ai from your account address for privacy questions, access, correction, or deletion requests.