Privacy Policy

Effective date: To be announced (the day international sales open) (Korean original: effective September 29, 2026.)

TOVILAB (the "Company") takes care with the personal data of everyone who uses its services. This policy states plainly what we collect, why we collect it, and how long we keep it.

This policy applies to the Company's website (tovilab.com) and to every program the Company releases. Where a program differs, we name the program and describe the difference. The only program currently released is VoiceDaejang; when a new program is released, it will be added to this policy.

1. First of all — your script and your audio never reach us

This section is about the VoiceDaejang program.

Speech is generated inside your own computer. It is not generated on the Company's servers and sent to you.

For that reason, the following are never sent to the Company's servers:

• the text of the script you paste in;
• the audio files that are generated;
• character names, role settings, and anything else you edit inside the program.

The only thing about your script and audio that reaches the Company's server is the number of characters (a single number), used to count your trial amount. The technical information sent when the program encounters an error (section 2 below) also contains no script text, no file names, and no record of which voice you chose.

If you enter your own AI API key into the program and press [Find characters], your script is sent directly to the AI provider you chose, using your key. It does not pass through the Company's servers, and the Company does not receive it. The script is then handled under the terms between you and that AI provider. When you enter a key, only a request to check that the key is valid is sent; the script is not sent at that time. Words you add to the pronunciation dictionary are not sent to the server either. They stay on your computer only.

2. What we collect

We list separately what is collected on the website and what is collected in the program.

What we process with your consent, and what we process without it (legal basis)

• Because the data needed for your account is processed to perform the agreement rather than on the basis of consent, the sign-up screen does not ask you to consent to this policy separately; we inform you of it through this policy.
• If you do not provide the required data, you cannot create an account or make a purchase.

When you opt in to marketing emails (optional)

• Consent is asked in three separate parts: (1) consent to receive TOVILAB marketing emails, (2) consent to the use of your personal data for sending marketing emails, and (3) consent to the transfer of your personal data to service providers in other countries for sending marketing emails (section 6-2). We send marketing emails only to those who have given all three.
• Declining has no effect whatsoever on your sign-up or your use of the service.
• Retention: until you withdraw your consent or close your account. When you withdraw, we remove you from the list and keep only the fact and date of withdrawal, so that we do not email you again.
• How to stop: click [Unsubscribe] at the bottom of any marketing email (no login required), or let us know at the contact email below.
• Marketing emails are marked as advertising in the subject line, and we remind you of your consent every two years from the date you gave it.
• Notices required by the agreement — updates, security notices, changes to the terms, payment confirmations — are not advertising and are sent regardless of consent.

On the website — when you apply to become a partner

• Applications are kept in the same Google Sheet as the order ledger, and the Company's staff is notified of new applications through Slack.
• Retention: 3 years from the date we reply (so that we can check if you apply again or ask about the result). Because we usually reply within a day, applications in the sheet are deleted automatically 3 years and 1 month after receipt. If you become a partner, we keep your data until the partner agreement ends, and records of commissions paid for the period required by tax law (5 years).

On the website — when you send an inquiry

• Inquiries are kept in the same Google Sheet as the order ledger, and the Company is notified of new inquiries by email (sent through Resend).
• Retention: 3 years from the date we reply (records of consumer complaints and dispute handling must be kept for 3 years under Korean e-commerce law). Because we usually reply within a day, inquiries in the sheet are deleted automatically 3 years and 1 month after receipt. Notification emails and correspondence in the Company's mailbox are deleted after the same period.
• To prevent excessive submissions, a cookie that records only the number of submissions is placed in your browser (section 10).

On the website — when you make a purchase

International purchase page (Paddle). The checkout is operated by Paddle, the Company's authorized reseller and Merchant of Record. Paddle collects your email address, billing country (and, in some countries, postal code), and payment details directly, and handles them under Paddle's own privacy policy. The Company never receives or sees your card number.

• The Company stores these values in the order ledger and in the account on the license verification server.
• Order records are kept for the statutory period in section 4.
• The Company does not receive your name or phone number for international purchases.
• If you arrived through a partner's referral link, the referral code is stored with the order record (to calculate the partner's commission). The referral code identifies the partner and contains no information about you.

Purchases in Korea (PortOne). Purchases made on the Korean pages are processed by Korea PortOne, and the Company receives only the email address of the account you are logged in with.

When you create an account (required)

An account can be created either on the website or in the program. The data collected is the same.

In the VoiceDaejang program — while you use it (accumulated automatically)

In the VoiceDaejang program — when an error occurs (sent automatically)

When the program encounters an error, such as freezing or failing to save, it sends the technical information below to the Company's server, so that we can find and fix the problem before you have to report it.

• Not included: script text, generated audio, which voice you chose, file names, the pronunciation dictionary.
• The account in which the error occurred is recorded (so we can find it when you contact us).
• When it is sent: when you start the program, everything accumulated since the last start is sent at once.
• Retention: 90 days from receipt. It is then deleted automatically. If you close your account, it is deleted immediately.
• If you do not want this, let us know at the contact email below. We will stop receiving error information for that account and delete what we already have.

In the VoiceDaejang program — pronunciation dictionary (not collected)

The program has a pronunciation dictionary, where you can correct words the program reads incorrectly.

The words you add there are never sent to the Company's server. They stay on your computer only. The Company does not collect them, look at them, or share them with other users.

The program only works in the opposite direction: it downloads pronunciations the Company has prepared in advance. If you have added the same word yourself, your entry always takes precedence.

If you use [Export] in the dictionary window and send us the file with an inquiry, the Company may review it and include it in the Company dictionary in a later version. This happens only when you send it yourself; the program never sends it automatically.

What we do not collect

• Date of birth, sex, address, location data.
• Your name and phone number (not for sign-up and not for any purchase, in Korea or internationally).
• Payment card numbers (handled by Paddle or the payment provider; the Company never receives or stores them).
• Usage records (what you made, when and how often you used the program) or which voice you chose (only the technical information described above is received when an error occurs).
• Words added to the pronunciation dictionary — they never leave your computer.
• Your IP address — it is used only for a moment at the time of connection, to block brute-force login attempts, and is not written to any file. It is gone when the server restarts.

3. Why we collect it (purposes)

1. To create your account and log you in.
2. To determine your trial amount and whether you have the Full Version.
3. To prevent one account from being shared across several computers.
4. To answer inquiries and to find and fix errors.
5. To send marketing emails about new products and discounts to those who opted in (only those who opted in).
6. To confirm purchases and send activation instructions.
7. To review partner applications and calculate commissions on referred purchases.

We do not use your data for any other purpose. If the purpose changes, we will ask for your consent again.

4. How long we keep it (retention)

• When you close your account, your data is deleted without delay.
• Technical information from errors is deleted automatically 90 days after receipt (immediately if you close your account).
• Website inquiries are kept 3 years from the date we reply (inquiries in the sheet are deleted automatically 3 years and 1 month after receipt; section 2).
• When deleting, electronic files are erased irrecoverably, and paper documents are shredded.
• The following, however, are retained for the period required by law.

5. Do we give it to others (third-party disclosure)

We do not give your personal data to anyone. There are no exceptions. We do not sell personal data.

Only when required by law, such as by a court order, do we disclose data within the scope required, and we inform you when that happens.

6. Do we entrust it (processors)

To operate the service, we entrust the following processing tasks to the following companies.

Each processor is bound by contract not to use personal data beyond the entrusted task, to handle it securely, and not to subcontract it, and the Company supervises this.

If the tasks or the processors change, we update this policy to inform you.

6-2. Where your data is located (international transfers)

The Company is located in the Republic of Korea, but it rents its servers, and those servers are in other countries. Wherever you live, your data will therefore be processed outside your own country. Here is where it goes.

• The Company's staff, located in the Republic of Korea, accesses this data to operate the service.

• No recipient may use your personal data beyond the purpose stated above. All connections are encrypted.

• The transfer needed for marketing emails requires your separate consent. Because marketing is not part of performing the agreement, the email address of users who opt in is sent to Contabo (website processing, Japan), Google (list storage, United States), and Resend (sending, United States) only if you have checked "[Optional] I consent to the transfer of my personal data to other countries for sending marketing emails" on the sign-up screen. If you do not check it, you simply do not receive marketing emails, with no other consequence.

• Contact details of the recipients, as each company publishes them in its own privacy policy:

  Recipient	Contact
  Contabo GmbH	Data protection officer datenschutzbeauftragter@contabo.de (general inquiries info@contabo.de; Welfenstrasse 22, 81541 München, Germany)
  Oracle Corporation	Inquiry form at https://www.oracle.com/legal/data-privacy-inquiry-form/; Oracle Corporation, Global Data Protection Officer, Willis Tower, 233 South Wacker Drive 45th Floor, Chicago, IL 60606, U.S.A.
  Paddle	privacy@paddle.com (as published in Paddle's privacy policy)
  Google LLC	Through Google's privacy help center
  Plus Five Five, Inc. (Resend)	support@resend.com
  Slack Technologies, LLC	privacy@slack.com (data protection officer dpo@slack.com; 50 Fremont Street, San Francisco, CA 94105, U.S.A.)

  For any of these, you can simply write to the Company's email address and we will handle it for you. You do not need to contact them yourself.

• You may object to these transfers. Let us know at the Company's email address. Please note, however, that because the license verification server is located abroad, the service cannot be used without them. If you object, we will help you close your account, and any refund due will be handled under the refund rules.

7. How we protect it

• Passwords are stored in an irreversible form (scrypt). The Company itself cannot recover the original.
• All communication between the program and the server is encrypted with HTTPS.
• Data is backed up automatically every day, and backups are kept only on servers managed by the Company.
• Only the Company's staff has access to the servers.

8. Your rights

You may at any time ask us to:

• show you your data;
• correct anything that is wrong;
• delete it (close your account);
• stop processing it.

Write to tovilabcompany@gmail.com and we will act within 10 days.

Depending on the law of the country where you live, you may have further rights (for example, to object to processing, to data portability, or to lodge a complaint with a supervisory authority). We honor those rights as the applicable law provides.

9. Children

The Company does not accept sign-ups from children under 14, and confirms at sign-up that the user is 14 or older. Where the law of your country sets a higher minimum age for providing personal data without parental consent, that age applies. If we learn that we have collected data from a child below the applicable age, we delete it.

10. Cookies

The program uses no cookies. The website (https://tovilab.com) uses only the cookies below. We use no advertising or tracking cookies.

You can delete or block cookies in your browser settings. If you block tl_session, however, you will not be able to log in.

11. Changes to this policy

Changes to this policy are announced on the website at least 7 days before they take effect. Changes that are unfavorable to users are announced at least 30 days before, and also sent to the email address registered to your account.

12. Privacy contact

If you need further help with a privacy matter, you may also contact the data protection authority of the country where you live. In the Republic of Korea, where the Company is located, that authority is the Personal Information Protection Commission (https://www.pipc.go.kr).