Privacy Policy
SHINSI Co., Ltd. ("SHINSI", "we") complies with the Personal Information Protection Act of Korea and other applicable laws. This policy explains what personal information we process, why, and how you can exercise your rights. The Korean version of this policy prevails in case of any inconsistency.
1. Purposes of processing
- Providing the service: connecting business calls (extensions and main numbers), incoming-call notifications, and the IVR, fax, recording and conference features under contract
- User verification: verifying users when they register the app (SMS verification code) and managing registered devices
- Customer support: handling inquiries and incidents, sending service notices
- Service integrity: preventing misuse, diagnosing failures and responding to security incidents
We do not use personal information for any other purpose and do not process it for advertising or marketing.
2. Information we process
| Category | Items | Source |
|---|---|---|
| User account | Name, extension number, mobile phone number, organization (company, department) | Registered in the portal by the business customer's administrator |
| App registration | Mobile phone number, verification records, device identifier (a random value generated by the app) | App registration |
| Call notifications | Push notification token (issued by Apple or Google) | Automatically when the app runs |
| Call records | Calling and called numbers, date, time and duration of calls, call result | Generated automatically when the service is used |
| If enabled by the business customer | Call recordings, fax documents, voicemail, conference participation records | Generated when the business customer turns on the feature |
| Access logs | IP address, access time, app version, operating system type | Generated automatically when the service is used |
| Inquiries | Name, company, email, phone number, message | When you contact us |
Call audio is relayed in real time to connect the call and is not stored unless the business customer has enabled call recording.
3. modu.PBX Phone app permissions
The app requests each permission when the related feature is first used. Optional permissions can be declined without affecting other features, and all permissions can be changed in your device settings.
| Permission | Type | Purpose |
|---|---|---|
| Microphone | Required | Phone calls |
| Notifications | Required | Incoming-call alerts (without them, you cannot receive calls while the app is closed) |
| Camera | Optional | Registering the app by scanning a QR code |
| Contacts | Optional | Importing your phone contacts into the app. Imported contacts are stored only on your device and never sent to our servers. |
| Bluetooth (Android) | Optional | Calls with Bluetooth headsets |
4. Retention
- User account and device information: until the business customer deletes the account or the service contract ends
- Call records, recordings, fax and voicemail: for the period set in the contract with the business customer (who can also delete them), and deleted when the contract ends
- Inquiry records: 3 years after resolution
Where Korean law requires retention, we keep the information for the required period, for example: communication confirmation data under the Protection of Communications Secrets Act (log records 3 months, other data 12 months); contract and payment records under the Electronic Commerce Act (5 years); records of complaints and disputes (3 years).
5. Disclosure to third parties
We do not provide personal information to third parties, except where required by law or requested by investigative authorities following legal procedures.
6. Service providers
We use the following service providers to operate the service and supervise them to keep personal information secure.
| Provider | Service |
|---|---|
| Google LLC (Firebase Cloud Messaging) | Incoming-call notifications for Android and web |
| Apple Inc. (Apple Push Notification service) | Incoming-call notifications for iPhone |
| Daou Technology Inc. (Ppurio) | Sending verification codes and registration links by SMS |
| Google LLC (Google Workspace) | Receiving and handling customer inquiry emails |
| Cloudflare, Inc. | Website hosting |
7. International transfers
To deliver incoming-call notifications, the following information is transferred outside Korea. You can turn off app notifications in your device settings, but you will then be unable to receive calls while the app is closed.
| Recipient | Country | Items | When and how | Retention |
|---|---|---|---|---|
| Google LLC | USA | Push token, notification content (caller number and display name) | Sent over the network for each incoming call | Per Google's policy after delivery |
| Apple Inc. | USA | Push token, notification content (caller number and display name) | Sent over the network for each incoming call | Per Apple's policy after delivery |
All other service data, including call connection, call records, recordings and fax, is processed on our servers in the Republic of Korea.
8. Deletion
When the retention period ends or the purpose is fulfilled, we delete personal information without delay. Electronic files are deleted so that they cannot be recovered, and paper records are shredded or incinerated. Information we must keep by law is stored separately.
9. Your rights
You may request access to, correction, deletion or suspension of processing of your personal information at any time by emailing our privacy contact below. We respond without delay and within 10 days. You may also make requests through a representative.
To delete your app account and data, see Support – Account and data deletion.
10. Security
- Administrative: minimal staff access, internal privacy management rules
- Technical: encryption in transit (HTTPS/TLS, SRTP for call audio), access control, access log retention, firewalls including blocking of overseas access to production systems, security updates
- Physical: access control to server and storage locations
11. Cookies and tracking
The modupbx.com website does not use cookies. The modu.PBX Phone app does not collect advertising identifiers and does not track you across other companies' apps or websites. The app contains no advertising or analytics SDKs.
12. Users of business customers
modu.PBX is a business service that companies provide to their employees. For employee information, call records and recordings registered or generated by a business customer, the business customer determines the purposes and means of processing, and SHINSI processes the information on its behalf. Please direct access or deletion requests to your company's administrator, or contact us and we will handle the request together with your company.
The service is not directed to children under 14.
13. Users in the EEA and UK
Where the GDPR applies, we process personal information on the basis of performance of a contract (providing the service), legitimate interests (security and abuse prevention) and compliance with legal obligations. You have the right to access, rectify, erase, restrict, port and object to the processing of your personal information, and to lodge a complaint with the data protection authority in your country. Personal information is processed in the Republic of Korea and in the countries listed in section 7.
14. Privacy contact
Privacy Officer / Privacy Team
Email [email protected] · Phone +82 2-750-4020
15. Remedies
For reports or consultation about privacy infringement, you may also contact the Personal Information Dispute Mediation Committee (1833-6972, www.kopico.go.kr) or the Personal Information Infringement Report Center (118, privacy.kisa.or.kr) in Korea.
16. Changes
This policy is effective from October 7, 2026. We will announce changes on this page at least 7 days before they take effect, or 30 days before for changes that materially affect your rights.