ZeroCall Security Policy

The purpose of this Security Policy is to describe the measures the Company implements to protect call data, customer information and account information processed in the course of providing the ZeroCall service.

This Policy applies to the ZeroCall web and app, the administrator console, the call processing infrastructure and the entire AI answering process.

1. Minimum collection: we collect and process only the minimum information necessary to provide the service.
2. Least privilege: data access permissions are granted only to the minimum extent necessary to perform the work.
3. Separation: data for each user (Client) is logically separated, and controls prevent access to other users' data.
4. Traceability: access to and processing of key data is recorded and retained.

All communication between the web and app and our servers is encrypted in transit with HTTPS (TLS).

Voice traffic is processed with protection measures for the communication path according to the service architecture, and the segments connected to network carriers also follow protection procedures under applicable laws and carrier policies.

1. Passwords are stored using one-way encryption that cannot be decrypted.
2. Call recording files, STT results and AI summary data are kept in storage with access controls applied.
3. Sensitive payment and settlement information is processed through the payment gateway, and the Company does not directly keep payment method information such as card numbers.

Access to production systems is limited to authorized staff, and permissions are granted separately for each account.

In the administrator console, Client administrators can set permissions for each member (numbers, call records, viewing recordings, etc.) themselves.

When there is a reason to change permissions, such as resignation or a change of duties, access permissions are revoked or adjusted without delay.

Access records and processing history for key systems are kept and monitored so that anomalies can be identified.

Outages and security events are notified to the staff in charge and go through a review procedure.

1. Security updates for the software and libraries used in the service are applied on an ongoing basis.
2. Malware prevention measures are applied, and vulnerabilities are checked regularly.
3. Vulnerabilities found are prioritized and addressed according to their level of risk.

The Company establishes and implements an internal management plan for personal information protection and designates as few personal information handlers as possible.

Regular security training is provided to personal information handlers.

The Company may entrust part of its personal information processing work to outside parties to the extent necessary to provide the service. In such cases, it enters into agreements in accordance with applicable laws and manages and supervises the trustees' processing.

Details of trustees, entrusted work and cross-border transfers can be found in Articles 9 and 10 of the Privacy Policy.

When a security incident is confirmed, the Company immediately carries out procedures to identify the cause, prevent the damage from spreading and recover.

As required by applicable laws, the Company notifies users of the incident and reports it to the relevant authorities.

Call recording, STT (speech-to-text conversion) and AI summaries are processed only for users who use those functions.

Recording, STT and summary data are kept for 12 months from the last day of the month in which the call took place and then destroyed automatically. Business Clients may extend the retention period per call month (extension history recorded). The retention period is kept consistent with Article 12 of the Privacy Policy.

Data whose retention period has passed is deleted by a method that makes recovery impossible.

1. The AI agent “Colly” answers only within the answering manual and settings registered by the user.
2. The AI does not answer topics the user has excluded from the manual, and can be set to transfer the call to a staff member when it determines that a call concerns such a topic.
3. A user's call data is processed to provide the service to that user and is not used for the purposes of other Clients without the user's consent.

The Company protects the confidentiality of communications under the Protection of Communications Secrets Act and does not view or provide call content without lawful procedures based on law.

Users who use the call recording function are responsible for complying with the notice and consent procedures required by applicable laws.

To provide the service reliably, the Company checks system status and operates backup procedures to guard against data loss.

If the service is temporarily suspended for scheduled maintenance or similar reasons, we announce it in advance.

Please send security inquiries and vulnerability reports to the contacts below.

1. Email: flover@flover.ai
2. Phone: 070-5236-0799 (weekdays 10:00–18:00)

If you need separate security review materials while evaluating adoption, contact us and we will advise after review.

This Policy may be amended in accordance with changes in applicable laws and the service, and changes are announced through a public page within the service.