MalsamAI (operated by Malsam AI, Inc. / 말씀에이아이, hereinafter "Company," "we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, store, and protect your personal information when you use our website, mobile application, desktop application, and all related services (collectively, the "Service").
By using the Service, you agree to the practices described in this policy. If you do not agree, please discontinue use of the Service.
You may contact us at any time to exercise your rights regarding access, correction, deletion, restriction of processing, withdrawal of consent, or to lodge a complaint.
We collect only the minimum information necessary to provide the Service. The specific data collected may vary depending on how you use the Service, which features you access, your platform, and your device.
| Category | Data Elements |
|---|---|
| Account & Identity | Email address, password (hashed), display name or nickname, social login identifier, profile information |
| Learning Activity | Learning language, translation language, difficulty level, selected topics, sentence IDs, learning history |
| Voice & Pronunciation | Recorded or uploaded voice audio, speech-to-text (STT) results, waveform data, pronunciation accuracy scores |
| 3D Gosu | Selected language and topic, chat messages (text or voice), AI response history, error logs |
| AI Chat | Selected language, conversation topic, AI conversation messages (text or voice), AI response history, report/block records |
| Payments & Subscriptions (future feature) | Not currently collected. If in-app purchases or subscriptions are introduced, this policy will be updated before rollout. |
| Customer Support | Email address, name or nickname, inquiry content, attachments, handling history |
| Automatically Collected | IP address, access timestamps, device information, OS, browser type, app version, log records, error logs |
We process your data for the following purposes and legal bases (GDPR Article 6):
| Purpose | Legal Basis (GDPR) |
|---|---|
| Account creation, login, and identity verification | Contract performance |
| Providing foreign language learning content | Contract performance |
| Pronunciation comparison, STT evaluation, waveform display, accuracy scoring | Contract performance |
| Article generation, translation, AI-assisted learning | Contract performance |
| 3D Gosu response generation and learning features | Contract performance |
| AI Chat (AI conversation) operation, safety filtering, report/block processing | Contract performance |
| Paid service provision, subscription management, billing and refunds (future feature) | Contract performance (when introduced) |
| Customer support and inquiry handling | Contract performance / Legitimate interest |
| Security, fraud prevention, service stability | Legitimate interest |
| Service improvement, usage analytics, feature development | Legitimate interest |
| Legal compliance, dispute resolution | Legal obligation |
| Personalized recommendations and automated learning suggestions | Legitimate interest / Consent |
We retain personal data only as long as necessary for the purposes for which it was collected, or as required by applicable law.
| Data Type | Retention Period |
|---|---|
| Account information | Until account deletion |
| 3D Gosu session data | 30 days, then deleted |
| Generated article data | Processed temporarily for display; deleted after session |
| AI Chat (AI conversation) messages | 30 days, then deleted |
| Camera / live video | Not recorded or stored |
| Avatar images (user-uploaded) | Stored on your device only; deleted when you remove the avatar or uninstall the app |
| Voice data (pronunciation practice & AI conversation) | Up to 3 years for service quality and improvement; then deleted or de-identified |
Data that must be retained under applicable law will be stored separately and used only for the legally required purpose.
MalsamAI provides the following camera and image-related features in the 3D Gosu and pronunciation practice screens:
In none of these cases does MalsamAI perform facial recognition, identity verification, biometric identification, emotion analysis, or profiling. Camera and photo library access requires your explicit permission, which you may revoke at any time through your device settings. You will be shown a clear disclosure notice the first time you activate any camera feature.
We do not sell your personal information. We share your data with third parties only in the following circumstances:
We use the following third-party service providers to operate the Service. Each provider processes data only as necessary and is bound by contractual data protection obligations.
| Provider | Purpose | Location |
|---|---|---|
| Google Cloud (Firebase / Firestore / Storage) | Data storage, server operations, backups, log management | United States (multi-region) |
| OpenAI | AI-assisted learning responses (chat) | United States |
| Google Gemini | 3D Gosu and AI Chat response generation, grammar explanation, article generation | United States |
| Microsoft Azure Speech | Text-to-speech (TTS), voice synthesis, viseme processing | United States / Global |
| Google Cloud Logging | Server log management, incident response, security | United States |
| Firebase Authentication | Account authentication, security verification | United States |
| Apple App Store / Google Play / Stripe | App distribution and optional in-app purchases/subscriptions (planned for a future release) | United States |
To provide the Service globally, we may store or process your personal information outside your country of residence. Currently, user data and service data are stored in Google Cloud's United States multi-region infrastructure, and server processing may occur in the United States.
Data transferred internationally may include: account information, service usage records, 3D Gosu request data, AI Chat (AI conversation) data, voice data, and customer support data.
We use external AI providers (OpenAI, Google Gemini, Microsoft Azure Speech) to deliver grammar explanations, article generation, 3D Gosu, AI Chat, text-to-speech synthesis, and viseme-based avatar animation.
Voice data collected during pronunciation practice and AI conversations may be used to maintain service quality, improve features, and enhance app performance. If we intend to use voice data for additional purposes (e.g., training AI models), we will provide a separate notice and obtain your explicit consent before doing so.
You may request deletion of your voice data or related data at any time by contacting privacy@malsam.ai.
Current age-based service availability:
At this time, AI Chat provides AI-to-user conversations only. Person-to-person chat, friend matching, and similar social messaging features are not currently offered.
Protections for minors (aged 13–17) include:
Depending on your country of residence, you may have the following rights regarding your personal data:
| Right | Description |
|---|---|
| Access | Request a copy of the personal data we hold about you |
| Rectification | Request correction of inaccurate or incomplete data |
| Erasure ("Right to be Forgotten") | Request deletion of your personal data |
| Restriction | Request that we limit how we process your data |
| Data Portability | Receive your data in a structured, machine-readable format |
| Object | Object to processing based on legitimate interests |
| Withdraw Consent | Withdraw consent where processing is based on consent |
| Account Deletion | Delete your account and associated data |
| Voice Data Deletion | Request deletion of voice recordings or related data |
| Opt-Out of Analytics | Request that we limit analytics processing related to your account |
To exercise any of these rights, contact us at privacy@malsam.ai. We will respond within the timeframe required by applicable law (generally 30 days).
When personal data is no longer necessary for its original purpose, when you withdraw consent, or when you delete your account, we will promptly delete your data using the following methods:
Data required to be retained by applicable law will be stored separately and used only for the legally mandated purpose.
We use cookies, local storage, and similar technologies solely for the following purposes: maintaining login sessions, saving user preferences (such as selected language and difficulty), and storing onboarding completion status.
We do not currently serve advertisements and do not use advertising identifiers or ad-measurement SDKs (such as Google AdMob or AdSense) at this time. If we introduce advertising features in the future, we will update this policy and, where required by law, obtain your consent before doing so.
You may clear cookies or local storage through your browser or device settings at any time.
We implement the following technical and organizational security measures:
We may perform limited automated processing based on your learning level, selected language, translation language, topics, pronunciation accuracy, and usage history — for example, to recommend articles, adjust AI responses, or suggest a learning sequence.
We do not make automated decisions that produce significant legal effects on you without human oversight. Where such decisions might occur, we will provide appropriate notice and safeguards in accordance with applicable law, including GDPR Article 22.
The Service may contain links to external websites, app stores, payment pages, third-party login providers, advertisements, or other third-party services. These external services are governed by their own privacy policies. We encourage you to review those policies before providing any personal information to third-party services.
We may update this Privacy Policy to reflect changes in law, our services, processing practices, third-party providers, or security policies. For material changes, we will provide advance notice via our website, an in-app notification, email, or a comparable method. The "Last Updated" date at the top of this page will always reflect the most recent revision.
Continued use of the Service after the effective date of a revised policy constitutes your acceptance of the changes.