Privacy Policy
Youbrothers Co., Ltd. ("the Company") operates Hippho Office (https://hipphooffice.com, "the Service"), an internal business application. This policy explains what personal information the Service handles and how.
1. Company information
- Company: Youbrothers Co., Ltd. (㈜유브라더스), Republic of Korea
- Business registration no.: 641-88-03621
- Representative: Seongmin Yu
- Email: fhdnwm1526@gmail.com
- Phone: +82-10-2278-0344
- Address: Union Town, 223-5 Itaewon-ro, Yongsan-gu, Seoul, Republic of Korea
2. Nature of the Service and its users
The Service is an internal tool used by head-office staff and franchise operators of the Company's Vietnamese restaurant brand Hip-Phở. It is not offered to the general public. Access requires an account issued by the Company.
3. Information we collect
| Category | Items | How collected |
|---|
| Login account | User ID, name, password (stored only as a hash), store, role | Entered by an administrator when creating the account |
| Access logs | Time, IP address, action performed (login, permission change, file download, etc.) | Generated automatically during use |
| Store operations data | Sales, purchase orders, settlement data, transaction records | Entered by users or retrieved from connected services |
| Financial inquiry data | Transaction history of company/store bank accounts and corporate cards, and the credentials needed to query them (stored encrypted) | Registered by users; retrieved via the Hecto Data (CODEF) API |
| Connected-platform credentials | Access tokens for YouTube, Instagram and TikTok accounts | Issued when a user authorizes the connection on each platform |
The Service does not collect national ID numbers, location data or biometric data.
4. Purposes of processing
- Identifying users, login, and role-based access control
- Logistics ordering, settlement, accounting and store performance analysis
- Publishing the Company's own video content to the Company's YouTube, Instagram and TikTok accounts
- Keeping access logs to prevent unauthorized access and respond to security incidents
5. Retention
- Login accounts and access logs: until the account is deleted (employment or contract ends). Access logs are deleted automatically one year after creation.
- Store operations and transaction data: until the franchise contract ends, except records that Korean tax and commerce laws require us to keep (up to 5 years).
- Connected-platform credentials: deleted immediately when the user revokes the connection or the account is deleted.
6. Sharing with third parties
We do not provide personal information to third parties, except where required by law through due legal process.
7. Processors (service providers)
| Provider | Purpose |
|---|
| SmileServ (iwinv) | Cloud server hosting the Service (Korea) |
| Google LLC | Backup storage (Google Drive); video upload via YouTube Data API |
| Anthropic PBC | Text processing for the in-app AI assistant (questions typed by users and related business data) |
| Hecto Data (CODEF) | Retrieving transaction history of registered bank accounts and cards |
| Meta Platforms, Inc. | Posting to Instagram via the Instagram Graph API |
| TikTok Pte. Ltd. | Video upload via the TikTok API |
| Comware (Baljugo) | Retrieving store purchase-order data |
Google, Meta, TikTok and Anthropic are located outside Korea; data is transferred to their servers only to the extent needed for the function used (the video and its title/description for uploads; the text and related data entered into the AI assistant).
8. YouTube, Instagram and TikTok integrations
- The Service uses YouTube API Services. By using the YouTube features you are also bound by the Google Privacy Policy (https://policies.google.com/privacy). You can revoke the Service's access at any time via the Google security settings page (https://security.google.com/settings/security/permissions).
- Instagram and TikTok access can likewise be revoked at any time from each platform's account settings.
- From these platforms the Service receives only the access token needed for uploading and the result of each post (post ID and status). No information about other users of those platforms is collected.
9. Your rights
You may at any time:
- request access to, correction or deletion of your personal information, or suspension of its processing;
- revoke any connected-platform authorization.
Send requests to the email address in section 1. We will act without undue delay (within 10 days) and inform you of the result. We may verify your identity before acting.
10. Security measures
- Passwords are stored only as irreversible bcrypt hashes
- Financial credentials and platform tokens are encrypted with a separate key
- Role-based access (head office vs. store) enforced on the server side
- All traffic over HTTPS; access logging; blocking of abnormal access attempts
- Server access limited to designated administrators
11. Data protection officer
- Name: Seongmin Yu (CEO)
- Email: fhdnwm1526@gmail.com
- Phone: +82-10-2278-0344
12. Effective date and changes
- This policy is effective from 23 October 2026.
- Changes will be posted on this page with the new effective date.
Change history
- 2026-10-23: First version