ESTnote
Privacy Policy
[Company name] (the “Company”) operates the document collaboration service ESTnote (the “Service”), complies with the Personal Information Protection Act of the Republic of Korea and applicable laws, and processes users' personal information as described below. This policy applies to all users who sign in to the Service with a Google account.
1. Information collected and collection methods
The Company collects only the minimum information necessary to provide the Service. There is no separate registration procedure; an account is created when you first sign in with Google.
| Category | Information | When collected |
|---|---|---|
| Account information | Google account identifier, email address, name, profile picture, and Google Workspace domain, if any | Google sign-in |
| Google connection information | Google-issued access and refresh tokens, stored encrypted | Google sign-in and integration consent |
| User-created content | Pages, databases, comments, attachments, version history, and Space settings | While using the Service |
| Google Chat integration information | Chat user ID and display name sent by Google Chat, Chat space IDs and names, details of the direct message (DM) with the ESTnote app, commands the user runs and the message content they choose to save, links between spaces and pages or databases (team defaults), cards and notifications sent by the app, approval and check-in responses, and scheduled reminders | Using the ESTnote Chat app |
| Google tools information | Chat messages the user selects (text, sender name, time sent, and link to the original) and attachments, Chat spaces the user creates and the people they invite, Calendar events the user creates (title, time, attendees, and Meet link) and their results, and the list of Google permissions the user granted | When the user runs the feature |
| Invitation and sharing information | Recipients' email addresses entered when inviting or sharing | Invitation and sharing features |
| External connection information | API tokens and webhooks the user creates, external apps (for example EST Chat) and external agents (MCP) the user authorizes, and records of their use | When the user connects them |
| Mobile app information | Push notification token, device type (Android or iOS), and app version | Signing in to a mobile app and allowing notifications |
| Inquiries and reports | Bug reports and suggestions, screenshots submitted by users, and diagnostic information such as browser type, screen size, and error logs | Submitted by the user |
| Access records | IP address, browser information, access time, and request path | Generated automatically during use |
| Signup permission information | Email addresses or domains registered by administrators to allow signup, and accounts registered through those entries | Administrator registration |
2. Use of Google account data
The Service signs users in through Google OAuth 2.0. Sign-in requests only the basic profile and Drive file permissions; every other permission is requested separately when the user first runs a feature that needs it. Each permission is used only for its stated purpose.
| Permission scope | Purpose |
|---|---|
Basic profile (openid, email, profile) | Identify accounts and display names and pictures in the interface and collaboration history. Workspace domains identify company accounts. |
Google Drive files (drive.file) | Access only files created by the Service or opened in it by the user. Other Drive files are not viewed or listed. |
Google Tasks (tasks) | Requested only when the user enables task integration, to read and write their task lists. Access ends when integration is disabled. |
Google Forms (when publishing forms, using the drive.file permission) | Create forms and retrieve responses when the user publishes a database as a Google form. |
Read Google Chat messages (chat.messages.readonly) | Requested only when the user runs Save selected Chat thread messages or Save Chat attachments and Drive links. The Service loads and shows the thread of the message link the user pastes, and saves to the page only the messages (text, sender name, time sent, and link to the original) or the attachment the user selects. Messages are never read in the background. |
Create Google Chat spaces and invite members (chat.spaces.create, chat.memberships) | Requested only when the user runs Create project page and Chat space. The Service creates one space and invites the people the user enters. Members of other spaces are not viewed or changed. |
Google Calendar events (calendar.events.owned) | Requested only when the user runs Create meeting. The Service creates one event with a Meet link on the user's primary calendar, and changes or deletes only that event when the user edits or cancels the meeting in the Service. Events the Service did not create are not read. |
Google Chat app
The ESTnote Chat app receives and answers the information Google Chat sends (the Google Chat integration information in section 1) when the user runs one of the app's commands or message menu items in Google Chat, adds the app to a space, or presses a button on a card the app sent. The app uses this information to identify the user's ESTnote account, save the messages the user selects, and send cards and notifications to the user's DM with the app or to spaces the user chooses. Messages that contain an ESTnote document link get an information card that does not reveal the document's title or content. The app does not collect or read other messages in a space.
ESTnote's use and transfer to any other app of raw or derived user data received from Google APIs, including Google Workspace APIs, will adhere to the Google API Services User Data Policy, including the Limited Use requirements. This data is used only to provide and improve the features users use. It is not used for advertising or sold, and people read it only for security responses, legal compliance, or with user consent. Neither raw nor aggregated, anonymized, or derived data is used to develop, improve, or train AI or machine learning models, or transferred to third-party services that use it for that purpose. The Service does not send user data to AI models. External AI agents (MCP) and external apps that a user connects can read that user's documents within the access the user grants; what they do afterwards is governed by their own terms and policies.
3. Purposes of processing personal information
- Sign-in, account identification, and user verification
- Service features, including creating, storing, sharing, and collaborating on documents
- Google Chat and Calendar integration features (saving messages, sending cards and notifications, creating Chat spaces and meetings)
- Invitation, sharing, and notification emails, and mobile app push notifications
- Signup eligibility checks against administrator-registered emails and domains for non-company accounts
- Handling bug reports and suggestions
- Service stability, abuse prevention, and security incident investigation
4. Retention periods
| Information | Retention period |
|---|---|
| Account and Google connection information | Until account deletion is requested or the Service ends |
| Sign-in sessions | Seven days after sign-in or until sign-out |
| User-created content | Until deleted by the user. Documents in trash are permanently deleted after the recovery period. |
| Document version history | 30 days after a version is saved, subject to operational settings |
| Google Chat integration and Google tools information | Until the account is deleted. Links between spaces and pages (team defaults) are Space settings and remain until the link is removed. Temporary data for a save screen opened from Chat is deleted after 10 minutes, and card button actions within a day of expiring. Messages and attachments saved to a page are kept like other user-created content. |
| External connection information | Until the user removes the connection, revokes the token, or deletes the account |
| External agent (MCP) activity records | 90 days |
| Push notification tokens | Until sign-in on that device ends (sign-out or session expiry) |
| Bug reports and suggestions | [Retention period] after resolution |
| Access records | [Retention period], or a legally required period |
5. Disclosure to third parties
The Company does not disclose personal information to third parties except with user consent or a legally based request. When you share documents with another user or invite them to a Space, they can see your name, email, profile picture, and shared content.
At the user's own request, information is passed on as follows. Sharing a document to Google Chat or posting a card makes the shared content visible to the members of that space, and creating a meeting sends a Google Calendar invitation to its attendees. External apps (for example EST Chat) and external AI agents (MCP) the user authorizes, and API tokens and webhooks the user creates, receive the user's data within the access the user grants. The user can remove these connections in the Service at any time.
6. Processors and international transfers
The following providers process information to operate the Service. Information is transferred to providers outside Korea only as necessary to provide the Service.
| Provider | Purpose | Transferred information | Country |
|---|---|---|---|
| Google LLC | Authentication; Drive, Tasks, Forms, Chat, and Calendar APIs; mobile app push notification delivery (Firebase Cloud Messaging) | Account information, data needed for each API, and push notification tokens and notification content | United States |
| [Hosting provider] | Server and storage operation | All information stored in the Service | [Country] |
| [Email provider] | Invitation and notification emails | Recipient email addresses and message content | [Country] |
| OpenStreetMap Foundation (Nominatim) | Address searches in map views | Address text entered in the search field | United Kingdom and Netherlands |
Map address searches send only the text entered by the user, and only when they search. Account information is not sent.
7. Destruction of information
Information is destroyed without delay when its retention period ends or its processing purpose is fulfilled. Electronic files are deleted using methods that prevent recovery. Account deletion removes account and Google connection information, private content, Google Chat integration and Google tools information, and push notification tokens; revokes API tokens, webhooks, and connected external apps; and revokes Google permissions. Chat schedules the user registered stop and are deleted. Shared content, comments, version history, team check-in answers, and approval and announcement records remain, but the author is shown as “Deleted user” and their name, email, and picture are removed. Backups are deleted progressively according to the backup cycle.
8. Your rights and how to exercise them
- You may request access, correction, deletion, or suspension of processing at any time. Contact the privacy officer below for prompt assistance.
- You can delete your account within the Service. Open the gear beside your account at the bottom of the sidebar (Account settings) and request Delete account. You are signed out immediately; deletion occurs seven days later. Sign in during that period to cancel. If you own a Space with other members, transfer ownership or delete the Space first.
- You can revoke Google permissions at any time through Google account app permissions. The Service will no longer access Google data, and new consent is required to sign in again.
- You can turn off or remove task integration, the Google Chat account connection, connected external apps, and API tokens in the Service. Google permissions granted for individual features (Chat, Calendar, and others) are revoked through the Google account app permissions above.
9. Security measures
- All communications are encrypted with HTTPS.
- Google refresh tokens are stored using AES-256-GCM encryption; encryption keys remain only in the server environment.
- Sessions use HttpOnly cookies. Requests that change state are protected by origin checks and CSRF tokens.
- Requests from Google Chat are processed only after their sender is confirmed with a token signed by Google.
- Administrative access to personal information is minimized, and server access requires key-based authentication.
- Data is regularly backed up, and backups receive equivalent protection.
10. Cookies and automated collection
- Sign-in session cookies last up to seven days; Google sign-in state cookies last ten minutes. Both are necessary for sign-in, which cannot work if they are refused.
- Browser storage retains convenience information such as interface settings. This information is not sent to the server.
- No third-party advertising or analytics cookies are used. Page views are counted within the Service and are not shared externally.
11. Children under 14
The Service is a business collaboration tool and does not collect personal information from children under 14.
12. Privacy officer
For inquiries, complaints, or requests to exercise your privacy rights, contact:
- Privacy officer: [Name and position]
- Email: [Email address]
- Address: [Company address]
You may also seek remedies through the Personal Information Dispute Mediation Committee (1833-6972, kopico.go.kr) or the Privacy Infringement Report Center (118, privacy.kisa.or.kr).
13. Policy changes
Changes and their effective dates are announced in the Service or on this page at least seven days before they take effect. Changes unfavorable to users are announced at least 30 days in advance.
Change history
- Version 1.1 (effective October 7, 2026): Added the Google Chat and Calendar permissions and the information they involve, mobile app push notifications, external app and AI agent connections, and the ban on AI training. Removed the organization directory permission, which is no longer requested, changed the server operator, and listed what account deletion removes.
- Version 1.0 (effective September 24, 2026): First version