법적 고지

개인정보처리방침

Effective 2026-08-08

This policy explains how () collects, uses, stores and discloses personal information when you use the AI WorkDeck website and desktop application, and what rights you have. We suggest reading it in full; if you only want the gist, the summary below covers it.

The short version

  • 01

    The Office/WPS add-in uses cloud processing. The current document, necessary conversation history and references you select reach our hosted backend, then OpenRouter and the inference provider serving your selected model. Raw document bodies use transient memory; user messages, AI replies and reasoning remain until you delete the conversation. See clauses 6 and 8.

  • 02

    The desktop application is local-first: your documents, projects and work history stay on your own machine. They are not uploaded, not retained, and never used to train models. The exception is an external service you invoke yourself (handing an image to text recognition, say) — see the next point.

  • 03

    Six platform-sourced services do pass through our servers (text recognition, web search, company registry data, securities and financial data, statute and case law search, meeting transcription): we buy from the vendor on your behalf so you need no key of your own, and the content each call requires is relayed through us to that vendor. All six vendors are inside mainland China, so this tier involves no cross-border transfer. Only meeting audio is held briefly on our side, and it is deleted once transcription finishes. Any of them can be switched to your own key or turned off. See clauses 2, 6, 7 and 8.

  • 04

    The site sets exactly one cookie (`awd_session`, to keep you signed in). There is no third-party analytics, advertising or tracking code, and web fonts are self-hosted, so no request goes to a third party.

  • 05

    Desktop telemetry is anonymous: a random install identifier, the app version and whitelisted event names. No IP address is stored, nothing is linked to your account, no document content is included, and it can be switched off.

  • 06

    Two things do leave mainland China: content you send through the platform AI channel, the Office/WPS add-in or the website's "AI-assisted Skill drafting" goes to OpenRouter; overseas visitors reach the site through a cache node in Singapore. See clauses 6 and 7.

  • 07

    To exercise your rights (access, correction, deletion, account closure, withdrawal of consent), write to . We respond within fifteen working days.

1. Who we are

Personal information handler: (), unified social credit code .

For anything concerning personal information protection, contact . The same address reaches the person responsible for personal information protection.

This policy covers the AI WorkDeck website, desktop application, Office add-ins and related services. It exists in Chinese and English; in the event of any discrepancy, the Chinese version prevails.

2. What we collect

We collect on a "no more than needed" basis. The table sets out what we collect, why, and on what basis.

ContextInformationPurposeBasis
RegistrationUsername, email, password, display name, bio (optional)Create and identify your account, account recovery, public profileNecessary to enter into and perform the contract
Staying signed inSession token (in the awd_session cookie)Maintain your sessionNecessary to perform the contract
Password storageSalted scrypt hash onlyVerify your passwordNecessary to perform the contract
Top-ups and paymentsOrder number, WeChat Pay transaction ID, payer WeChat openid, amount, status, timestampsTake payment, reconcile, handle refunds and disputesContract + legal obligation (tax and bookkeeping)
Wallet and transactionsBalance, ledger entries, purchases, entitlements, creator earningsAccounting, entitlement checks, settlementNecessary to perform the contract
Account keysSHA-256 hash and prefix only; no plaintext retainedAuthenticate the desktop applicationNecessary to perform the contract
AI creditRuntime key issued by the upstream model provider (stored encrypted), quota limit and usageProvision and meter your AI creditNecessary to perform the contract
Plaza submissionsThe Skill or plugin you submit and your author identityReview, publication, distribution, settlementNecessary to perform the contract
Desktop telemetryRandom install identifier (UUID), app version, whitelisted event names, a conversation sequence key, a small set of non-sensitive attributesMeasure activity and feature use, diagnose crashesYour consent (can be switched off)
Platform-sourced external servicesThe content each call requires (the image to recognize, a search query, a company name, a ticker, a search term, meeting audio), plus one ledger entry containing no content (service, quantity, amount, timestamp)Call the vendor on your behalf and meter the usageNecessary to perform the contract (your call is the request)
Server logsTimestamp, request path, status code, IP addressSecurity, troubleshooting, attack mitigationReasonably necessary security maintenance + legal obligation

About telemetry: the IP address of a telemetry request is used in memory for rate limiting only and is never written to the database. Nothing records a link between the random install identifier and your account, so we cannot trace telemetry back to a person.

3. What we do not collect

The document and AI-conversation statements below concern local desktop use. The Office/WPS add-in processes documents and conversations through our hosted backend, as explained in clauses 6 and 8. Otherwise, we do not actively collect the following:

  • Your documents, case files or project files and their contents — the desktop application is local-first and these stay on your device. When you hand a specific piece of content to a specific external service (an image to text recognition, a recording to transcription): we then relay the part of it that the call requires to the vendor. Apart from meeting audio held briefly, we retain none of it (see clauses 6 and 8);
  • Your desktop AI conversations — the desktop application talks to the model provider directly; hosted processing and retention for the Office/WPS add-in are covered separately in clauses 6 and 8;
  • Sensitive personal information such as phone numbers, ID numbers, facial images or fingerprints;
  • Location, contacts, call logs, messages or photo libraries;
  • Your browsing outside this service — we run no third-party analytics or advertising SDK.

We do not use any of your content to train models, and we do not sell personal information.

4. Cookies

The site sets one cookie:

NamePurposeAttributesLifetime
awd_sessionKeeps you signed inHttpOnly, SameSite=Lax30일

This cookie is strictly necessary for signing in and cannot be disabled while staying signed in. We use no analytics, advertising or cross-site tracking cookies. Web fonts are bundled into the site at build time, so loading a page makes no font request to any third party.

You can delete the cookie in your browser; the effect is the same as signing out.

5. How we use it

  • Running the service: identifying accounts, checking entitlements, settling charges, delivering what you bought;
  • Security: spotting anomalous sign-ins and abuse, rate limiting, mitigating attacks, diagnosing faults;
  • Improving the product: aggregate statistics from anonymous telemetry showing which features get used and where people drop off;
  • Legal obligations: keeping records required by tax, accounting and cybersecurity rules;
  • Communicating with you: service changes, security incidents, changes to the terms.

We do not use the information for anything else. If we ever need to, we will ask for your consent separately. We do not carry out automated decision-making, and we do not use personal information for targeted messaging or differential pricing.

6. Disclosure and third parties

Recipients of add-in AI requests. Official add-in requests reach the AI WorkDeck cloud backend, then OpenRouter, then the inference provider serving the selected model. Available model developers include DeepSeek, Z.ai, Moonshot AI, Alibaba/Qwen, Anthropic, Google, OpenAI and xAI. A model's developer and its inference host can differ depending on routing. Requests include the current question, necessary conversation history, the current document and references the user selects. OpenRouter and each inference provider have their own retention, training and processing-location policies; our transient processing rule does not promise third-party zero retention. See the OpenRouter provider list (https://openrouter.ai/providers/) and OpenRouter privacy policy (https://openrouter.ai/privacy/).

We do not provide your personal information to third parties except as follows:

RecipientInformationPurposeLocation
Tenpay Payment Technology Co., Ltd. (WeChat Pay)Order number, amount, item descriptionCollect payment, refunds, reconciliation중국 본토
OpenRouter, Inc.Content you send to the AI; the quota key issued for youRoute model calls, meter usageUnited States
GitHub, Inc.Network request data when downloading installersHost installers and open-source codeUnited States
Alibaba Cloud Computing Ltd.Server and network-level technical dataHosting and network accelerationMainland China + Singapore node
Alibaba Cloud (Tingwu)Your meeting audio and its transcriptSpeech transcription and speaker separation중국 본토
Alibaba Cloud (OCR)The image you submit for recognitionImage text recognition중국 본토
Bocha (web search)Your search queryReturn web search results중국 본토
QichachaThe company name or unified social credit code you look upReturn company registry data중국 본토
TushareThe ticker and fields you queryReturn securities and financial data중국 본토
PKULawYour statute and case law search termReturn statute and case law results중국 본토

How the six platform-sourced services flow. The last six rows are the vendors behind the "platform-sourced" tier: we buy from them on your behalf, so you need no key of your own, and the content each call requires is relayed to the vendor through our servers and metered against your balance. All six are inside mainland China, so this tier involves no cross-border transfer. We do not log, store or train on what we relay; the sole exception is meeting audio, which is held briefly in our object storage so the transcription service can read it and is deleted once that finishes (see clause 8). Any of them can be switched, under Settings → Platform Services in the desktop app, to your own key (the app then talks to that vendor directly, bypassing us) or turned off entirely.

Where AI content actually goes deserves a note. The direct desktop connection described below does not apply to the Office/WPS add-in, which uses the hosted route set out in this clause. When you use the platform AI channel in the desktop application, your content goes directly from your machine to OpenRouter and never passes through our servers — we only issue the quota key and cannot see your conversations. When you use the website's "AI-assisted Skill drafting", the brief you type is relayed to OpenRouter by our server. Either way, the content leaves mainland China.

We may also disclose information where the law requires: cooperating with judicial or administrative authorities, where necessary to protect the public interest or someone's vital interests, or where you have made the information public yourself. In a merger, division or transfer of assets we will transfer personal information along with the business, telling you the recipient's name and contact details beforehand; the recipient must continue to honour this policy or seek your consent afresh.

7. Transfers outside mainland China

Given the architecture described above, your information is transferred outside mainland China in the following cases:

  • Content sent through the platform AI channel, the Office/WPS add-in or the website's AI-assisted Skill drafting goes to OpenRouter, Inc. in the United States for inference and metering;
  • Downloading a desktop installer sends your request to GitHub, Inc. in the United States;
  • Visitors outside mainland China are served by a cache node in Singapore, which fetches from the origin server in Beijing.

The six platform-sourced services do not leave the country. The vendors behind text recognition, web search, company registry data, securities and financial data, statute and case law search and meeting transcription are all inside mainland China (see clause 6). Content in that tier never leaves the mainland, and no separate cross-border consent is required for it. The three cases listed above are the complete set of transfers.

AI content need not leave the country. The desktop application lets you configure your own model provider, including mainland providers and fully local models; once you do, AI content no longer passes through OpenRouter. Installers are currently distributed only via GitHub, which cannot be avoided.

As required by the Personal Information Protection Law, we tell you separately the name and contact details of each overseas recipient, the purpose and method of processing, the categories of information involved and how to exercise your rights against that recipient, and we obtain your separate consent. You may withdraw that consent at any time; we will then stop the corresponding transfer, though the related features will no longer work.

8. How long we keep it

Add-in document and conversation retention. Inline document bodies and raw tool arguments/results are used for the current turn and transient memory caches, not stored in the request queue or conversation history. The add-in does not automatically create durable conversation summaries. Queued input bodies expire after at most 30 minutes and may be evicted earlier or lost on restart; a new upload is then required. User messages, AI replies and reasoning remain as conversation history until the user deletes the conversation, with no separate automatic expiry. This includes document text pasted by the user or quoted by the AI. Conversation deletion also removes queue requests and derived summaries and clears document caches; billing usage records remain. Copies already mirrored to a desktop project follow that project's rules and are not remotely erased by deleting the cloud conversation. Earlier versions stored inline bodies in the queue and tool excerpts and summaries in conversation storage. This update removes historical inline bodies from the live request queue. It also removes raw tool excerpts and derived summaries from conversations still identifiable as Office/WPS add-in conversations through their request-source records. Historical conversations without those source records cannot be reliably classified and are not covered by this Office-specific cleanup. Operational backups and material already sent to third parties are separate; this is not a promise of retrospective erasure of every copy.

CategoryRetention
Account informationWhile the account exists; deleted or anonymised within 30 days of closure
Session tokens30일 후 자동 만료
계정 키 해시철회 또는 계정 폐쇄 시 삭제
주문, 원장 및 인보이스 기록거래 완료일로부터 최소 10년(『』 제29조). 계정을 폐쇄해도 이 기간은 단축되지 않습니다
Plaza 게시물삭제 후 90일 이내에 삭제되며, 이미 배포된 사본에는 영향을 미치지 않습니다
플랫폼 발신 통화를 위해 전달되는 콘텐츠보관하지 않습니다. 해당 통화가 진행되는 동안에만 서버를 경유합니다
회의 오디오 파일전사가 완료되거나 작업이 실패하면 즉시 프로그램에서 삭제되며, 오브젝트 스토리지의 24시간 수명 주기 규칙이 누락된 항목을 정리합니다. 데스크톱 앱으로 반환된 후에는 당사 측에 전사본을 보관하지 않습니다
익명 텔레메트리24개월 후 순차적으로 삭제
서버 로그6개월(『사이버보안법』 제21조에 따라 6개월 이상 보관 필요)

이 기간이 지나면 삭제 또는 익명화합니다. 법률에서 더 긴 기간을 요구하는 경우 해당 법률이 우선됩니다.

9. 정보 보호 방식

  • 전송 중: 사이트 전체에 HTTPS 적용
  • 비밀번호: salted scrypt 해시로 저장 — 원래 비밀번호는 복구할 수 없습니다
  • 계정 키: 해시와 접두사만 저장되며, 평문은 생성 시 한 번만 표시되고 이후 당사 시스템 어디에도 존재하지 않습니다
  • 모델 키: 암호화되어 저장
  • 접근 통제: 프로덕션 접근은 필요한 인원으로 제한됩니다
  • 내구성: 금융 데이터는 트랜잭션 방식으로 기록되며 정기적으로 백업됩니다.

어떤 시스템도 완벽하게 안전하지는 않습니다. 개인정보가 유출, 변조 또는 분실되어 사용자에게 피해가 발생할 수 있는 경우, 법이 요구하는 대로 즉시 시정 조치를 취하고 사용자와 관할 당국에 통지합니다.

10. 사용자의 권리

개인정보보호법에 따라 귀하는 당사가 처리하는 개인정보에 대해 다음과 같은 권리를 가집니다:

  • 열람 및 복사 — 귀하에 대해 당사가 보유한 정보를 확인하고 사본을 받을 수 있습니다;
  • 정정 및 보완 — 부정확하거나 불완전한 정보의 수정을 요청할 수 있으며, 계정 정보는 직접 수정할 수도 있습니다;
  • 삭제 — 처리 목적이 달성된 경우, 동의를 철회한 경우, 또는 당사가 불법적으로 처리한 경우 삭제를 요청할 수 있습니다;
  • 이동(포터빌리티) — 국가 사이버공간 관리 기관이 정한 요건을 충족하는 경우, 귀하가 지정한 다른 처리자에게 정보 이전을 요청할 수 있습니다;
  • 동의 철회 — 텔레메트리 및 국경 간 이전 등 동의를 기반으로 처리되는 사항에 대해 동의를 철회할 수 있습니다;
  • 처리 제한 또는 거부 — 특정 처리의 제한 또는 거부를 요청할 수 있습니다;
  • 설명 요청 — 본 정책 및 당사의 처리 규칙에 대한 설명을 요청할 수 있습니다;
  • 계정 탈퇴 — 언제든지 계정을 탈퇴할 수 있으며, 탈퇴 후 귀하의 정보는 제8조에 명시된 대로 처리됩니다.

권리 행사 방법: 계정 정보 수정 및 계정 키 철회는 계정에서 직접 하실 수 있으며, 그 외의 사항은 계정과 요청 사항을 명시하여 에 문의해 주시기 바랍니다. 신원 확인을 먼저 요청드릴 수 있습니다. 당사는 15 영업일 이내에 회신하며, 복잡한 요청으로 더 오랜 시간이 필요한 경우 그 사유를 설명드립니다.

이용자가 사망한 경우, 그 근칭자는 이용자가 생전에 달리 정하지 않은 한 해당 이용자의 관련 개인정보에 대해 열람, 복사, 정정 및 삭제 권리를 행사할 수 있습니다.

11. 미성년자

본 서비스는 전문가를 대상으로 하며, 14세 미만 어린이에게 제공되지 않습니다. 당사는 어린이의 개인정보를 고의로 수집하지 않습니다. 보호자의 사전 동의 없이 수집된 사실을 발견하면 즉시 삭제하겠습니다.

이러한 사실을 인지한 보호자는 로 당사에 연락하실 수 있습니다.

12. 정책 변경

당사는 본 정책을 개정할 수 있습니다. 정보의 목적, 방법 또는 범주에 대한 중대한 변경의 경우, 시행 전에 웹사이트 공지 또는 이메일로 안내하며, 법에서 요구하는 경우 새로운 동의를 받겠습니다.

이전 버전은 이메일로 요청 시 제공됩니다.

13. 문의 및 불만

본 정책 또는 개인정보 처리에 대한 질문, 의견, 불만이 있으시면 로 문의해 주시기 바랍니다. 당사는 15 영업일 이내에 회신합니다.

당사의 처리로 권리가 침해되었다고 판단되고 당사의 회신으로 문제가 해결되지 않는 경우, 관할 사이버공간, 통신, 공안 또는 시장감독 기관에 불만을 제기하거나 서비스 이용약관에 명시된 분쟁 해결 절차를 따르실 수 있습니다.