Privacy Policy for the EEA and the UK

Effective date: 2026-10-29.

Veilink Inc. (주식회사 베일링크), Business Registration No. 843-87-03690, Republic of Korea, is the controller for the processing described in this policy unless a specific processing arrangement says otherwise. Our business address is 4F Room 4146, 69 Pungmu 1-ro, Gimpo-si, Gyeonggi-do, Republic of Korea (경기도 김포시 풍무1로 69, 4층 4146호). Our privacy contact is Eam Juhyuk, Representative and Privacy Contact, at support@veilink.ai.

Our representative in the European Union under Article 27 of the GDPR is Data Protection Representative Limited (trading as DataRep), DataRep, 77 Camden Street Lower, Dublin, D02 XE80, Ireland, datarequest@datarep.com. Our representative in the United Kingdom under Article 27 of the UK GDPR is Data Protection Representative Limited (trading as DataRep), DataRep, 107-111 Fleet Street, London, EC4A 2AB, United Kingdom, datarequest@datarep.com. You may contact us or the relevant representative about the processing covered by this policy.

This policy covers processing in connection with Veilink services offered to people in the EEA and the UK, including account access, supported AI connections, private hiring introductions, eligible business introductions and company billing. It also applies wherever the GDPR or the UK GDPR otherwise governs our processing.

An employer or business that receives information for its own decisions is normally a separate controller for that use. The AI client you choose, an identity provider and a payment provider may also be separate controllers for their own activities.

We receive information from you, the AI client or sign-in provider you authorize, your organization's authorized representatives, and participants in a request involving you. We also generate information as the service operates.

Account and access: email, account role, sign-in provider identifier, residence country, selected service region, authentication and connection records, age confirmation, and acknowledgment or consent history.

Individual profile: work history and evidence summaries, skills, interests, availability, location and work preferences, pay expectations, and conditions you choose to provide.

Organization and opportunity: company identity and domain, business contact details, representative authority, hiring requirements and conditions, and business offerings or sourcing needs where enabled.

Requests and shared information: questions, answers, summaries, requests, decisions, contact details approved for sharing, and the record of what was authorized.

Information created by the service: structured records, information about potential relevance between records, summaries and status. This can be linked to your account even when your name is not shown to another participant.

Billing and support: plan and subscription references, invoices, tax and payment status, billing contact details, correspondence, complaints and rights requests. Card or bank details entered in Creem's checkout are handled by Creem, not stored by Veilink.

Technical and security: network and request information, device or browser information, session and connected-client metadata, errors, and abuse-prevention and security records.

Public site analytics: aggregate pageviews by UTC date, public page path, an approximate country estimated locally from the connecting IP address when available, and a coarse visit-source label. Your browser chooses that label from the referring site's host only, for example a search engine, an AI assistant or a social site; any other site is grouped as 'other', and a direct visit, a visit for which your browser sends no referrer, or a visit from one of our own pages is recorded as 'none'. The referring page or URL is never sent to us or stored. If you allow optional analytics, a random first-party browser ID is converted to a one-way digest for counting consenting browsers by day and once across a selected reporting period. We do not put IP addresses, account IDs, referring URLs or query strings in this analytics dataset. A VPN or relay can affect the country estimate.

Please do not submit sensitive information the service does not ask for, such as health, religion or belief, political opinions, trade union membership, sexual orientation, biometric data or criminal records. We do not request these for matching, and our systems remove or refuse such information where they detect it. If you sent it by mistake, contact us and we will remove or restrict it.

If we receive information about you from someone else, we tell you within the required time, normally within one month and sooner if we contact you or disclose it before then.

Creating and running an individual account, signing you in, keeping information you ask us to hold, connecting your chosen client and answering service requests: performance of our agreement with you, Article 6(1)(b).

Making your profile available for matching and the related limited disclosures when you opt in: consent, Article 6(1)(a). You can withdraw matching consent without closing your account.

Sharing optional direct contact details with an identified participant: separate consent, Article 6(1)(a), given at the sharing step. Accepting an introduction alone is not this consent.

Running company workspaces and communicating with their representatives, and managing company plans and payments: our legitimate interest in providing and administering the service the organization requested, Article 6(1)(f), or Article 6(1)(b) where you are the contracting customer.

Protecting accounts, preventing misuse, applying access restrictions, diagnosing failures, handling complaints and keeping necessary evidence of authorizations: our and our users' legitimate interests in a secure, reliable and accountable service, Article 6(1)(f).

Counting public pageviews, with their page path, approximate country and coarse visit-source label, without a browser identifier: our legitimate interest in understanding use of the public site, including which kinds of sites refer visitors, using aggregate records, Article 6(1)(f). Counting returning browsers with the optional first-party analytics cookie: your consent, Article 6(1)(a).

Meeting legal obligations, including data-protection duties: Article 6(1)(c), where the obligation applies under EU, Member State or UK law.

We do not sell personal data or use it for behavioral advertising, and we do not use it to train AI models of our own. How our AI provider may use the data it processes for us is described in the automated-assistance section. We do not add a new incompatible purpose by changing this policy.

We use automated processing, including AI assistance, to organize submitted information, help identify potentially relevant records and prepare summaries. It uses information supplied for the service, such as experience, skills, preferences and opportunity requirements, and it can affect which records are presented for review. Inaccurate or incomplete inputs can affect the results.

Veilink does not make an employer's final hiring decision or a participant's decision to accept work or a contract. Introduction and contact-sharing approvals stay with the people involved.

You can correct information and ask support@veilink.ai for an explanation or a human review of processing by Veilink that affects you. Where Article 22 of the GDPR or the UK GDPR applies, you keep its protections, including human intervention, expressing your view and contesting a decision.

Necessary inputs are processed by our AI service provider for the stated tasks. OpenAI does not use these inputs or outputs to train its models. We send requests with response storage turned off. OpenAI may keep inputs and outputs in abuse-monitoring logs for up to 30 days, or longer where the law requires it or where needed to protect its services or others from harm. The AI client you choose has its own handling of conversations and files, which you should review separately.

Other participants receive only what the current stage and your choices allow. When your anonymous profile appears in a company's search results, the company does not see your name or contact details. A request may show the company or opportunity while keeping direct personal contact details separate. Limited or de-identified information can still be personal data and is protected accordingly.

For a business review between companies in different regions, the shared conditions, questions, answers, summary and introduction approval records are processed in the buyer workspace's region. Before introduction approval, the review page identifies both workspace regions. Approved business contacts are shared with both companies only after the buyer requests and the seller accepts the introduction.

When you authorize an AI-client connection, the client receives the account information and responses that authorization allows. Revoking a connection stops further access but does not erase copies the client already holds.

We use providers for cloud hosting and databases (Google Cloud), email (Resend), optional sign-in (Google), AI assistance (OpenAI) and company billing (Creem). Providers acting on our instructions are bound by data-processing agreements. Providers acting for their own purposes are responsible for those activities under their own notices.

Authorized staff may access information only when needed to provide support, secure the service, handle a complaint or meet a legal obligation. Each staff view of an identifiable person's data is recorded with its purpose. We may disclose information to authorities or others where legally required or necessary to address fraud, security or legal claims.

Veilink is established in the Republic of Korea. Service processing may also take place in the United States and other locations used by the providers listed below. Choosing a service region does not by itself keep all hosting, support, email, sign-in or AI processing inside that region.

Service management and support by Veilink Inc. in the Republic of Korea rely on the European Commission's adequacy decision for the Republic of Korea and, for the UK, the UK adequacy regulations for the Republic of Korea.

Hosting, databases and operational records: Google Cloud, provided to us by Google Cloud Korea LLC, Seoul. If you live in the EEA, your account and profile data are stored in Belgium (Google Cloud region europe-west1). If you live in the UK, they are stored in the United States (Iowa, region us-central1). A shared cross-region business review, its approval records and approved business contacts are stored in the buyer workspace’s region; this can be the United States even when the seller is in the EEA. Sign-in attempts, AI-client authorizations and staff access records are stored in the United States for everyone. Safeguard: transfers to Google LLC in the United States rely on the EU-U.S. Data Privacy Framework and its UK Extension, to which Google LLC is certified; Google's Cloud Data Processing Addendum provides the European Commission's Standard Contractual Clauses for other transfers.

Transactional email: Resend, provided by Plus Five Five, Inc., San Francisco, United States. Resend and its subprocessors process data in the United States. Message content and delivery records are stored in the United States even when an EU sending region is used. Safeguard: the European Commission's Standard Contractual Clauses in Resend's data processing addendum, with the UK Addendum for UK data. Resend is also a listed participant in the EU-U.S. Data Privacy Framework and its UK Extension.

Optional Google sign-in: if you choose it, Google handles the sign-in as the controller of your Google Account: Google Ireland Limited, Ireland, if you live in the EEA, and Google LLC, United States, if you live in the UK. We request only your email address, whether it is verified, and a Google account identifier. Google's privacy policy covers Google's own processing.

AI processing: OpenAI, provided by OpenAI OpCo, LLC, United States. Safeguard: the European Commission's Standard Contractual Clauses in OpenAI's data processing addendum, with the UK Addendum for UK data.

Company checkout and billing: Creem, operated by Armitage Labs OÜ, Estonia. Creem is the merchant of record and legal seller of company plans. It handles checkout, payment, tax and billing records under its own privacy policy, and we do not receive card details.

Where no adequacy decision covers a transfer, we use the European Commission's Standard Contractual Clauses and, for UK transfers, the UK International Data Transfer Agreement or the UK Addendum to those clauses, together with any required assessment and supplementary measures. You can ask support@veilink.ai for information about these safeguards.

We keep personal data only while needed for the stated purpose, and delete or irreversibly anonymize it when the need ends.

Active account, profile and opportunity information: while you use the account or keep the record active; removed when you correct, withdraw or delete it, subject to the limited exceptions below.

Account closure: access and new discovery stop on closure. Live account and profile content is routinely removed within 30 days. A legal erasure request is handled without undue delay; the routine schedule does not create a waiting period.

Authentication and security records: Server request and error logs are kept for 30 days, and sign-in sessions expire after 30 days. Sign-in, connection and security event records are kept while your account is active. After an account deletion request, necessary records may be kept for up to 180 days.

Request and workflow records: Records of condition reviews, introductions and contact exchanges are kept while your account is active, so both participants can confirm what was agreed. After an account deletion request, necessary records may be kept for up to 365 days, and contact details you shared in a completed exchange are removed when that period ends.

Consent and contact-sharing evidence: while needed to show what was authorized, and for up to 1,095 days after an account deletion request where justified. Keeping this evidence does not keep consent in force or allow further matching.

Public site analytics: aggregate daily pageviews, including the approximate country and coarse visit-source label, and daily pseudonymous consenting-browser records are removed after 400 days. The optional browser ID and the cookie-choice setting expire after 180 days unless you clear them sooner. Withdrawal stops future identified analytics.

Billing, tax, complaints and legal claims: Plan, subscription and billing reference records are kept for 5 years from the filing deadline of the relevant tax year, as Korean tax law requires. Complaint and legal-claim records are kept until the matter is resolved and the applicable limitation period has ended. Card details and receipts are held by Creem.

Backups: database backups and recovery logs are kept for up to 7 days after they are created and are used only for recovery and security. If a backup is restored, earlier removals are applied again.

Creem separately keeps records it needs for its own legal obligations; its notice states seven years for accounting records. That does not set Veilink's own retention period.

Under the GDPR or the UK GDPR you may ask for access to and a copy of your information, correction, erasure, restriction, and portability of information you provided that we process by automated means on the basis of consent or contract. You can download a copy of your information at any time from your account settings. You may withdraw consent at any time without affecting earlier lawful processing.

You may object to processing based on legitimate interests for reasons relating to your situation. We will stop unless we show compelling legitimate grounds or need the processing for legal claims. You can object to direct marketing at any time.

Send requests to support@veilink.ai or to our representative. We respond without charge and within one month. Where the law allows up to two more months because of complexity or the number of requests, we tell you within the first month. We ask only for the identity information reasonably needed.

You may complain to a supervisory authority without contacting us first: in the EEA, particularly where you live, work or where an infringement occurred (the European Data Protection Board lists national authorities at edpb.europa.eu); in the UK, the Information Commissioner's Office at ico.org.uk. You also keep your right to a judicial remedy.

We count public pageviews in aggregate without placing an analytics identifier in your browser. Each counted pageview carries a coarse visit-source label that your browser chooses from the referring site's host only; the referring page or URL is never sent or stored. Optional first-party analytics storage is used only after you select Allow analytics. We do not use advertising or cross-site tracking cookies.

Analytics choice cookie (veilink_analytics_choice): remembers allow or reject so we can honor your choice; HttpOnly, SameSite=Lax, up to 180 days. You can change it through Cookie settings in the site footer.

Optional analytics visitor cookie (veilink_analytics_visitor): a random browser ID for counting consenting browsers by day and once across a selected reporting period; HttpOnly, SameSite=Lax, up to 180 days. It is set only after you allow analytics and is deleted when you reject or withdraw. The public site remains usable without it.

Sign-in session cookie (veilink_app_session): keeps you signed in; HttpOnly and secure; up to 30 days or until you sign out.

Google sign-in check cookie: links a Google sign-in request to your browser; HttpOnly and secure; up to 30 minutes.

Theme setting (local storage): remembers the light or dark theme you chose; kept until you clear it in your browser.

Notice setting (local storage): remembers that you closed an in-app notice; kept until you clear it in your browser.

Short-lived tab storage (session storage): keeps a sign-in, connection, company-join or contact-sharing step in progress; removed when the step completes or the tab closes.

Creem's checkout is a separate page operated by Creem, which uses its own cookies under its own notice.

We use measures appropriate to the information and the risk, including restricted and recorded staff access, protected connections and controls over contact sharing. No online service can remove all risk. If a breach requires notice to you or an authority, we give it as the law requires.

Veilink is for people aged 18 or older, and you confirm your age when you create an account. If you believe someone younger has given us personal data, contact support@veilink.ai so we can review and remove it.

We update this policy when our purposes, providers, data flows or legal requirements change. We show the effective date and give advance notice of material changes where required. A new purpose needs its own legal basis; updating this policy does not by itself obtain consent.

For privacy questions and requests, contact support@veilink.ai, Veilink Inc. at 4F Room 4146, 69 Pungmu 1-ro, Gimpo-si, Gyeonggi-do, Republic of Korea (경기도 김포시 풍무1로 69, 4층 4146호), or our EU or UK representative named in the first section.