Privacy Policy
Currently under final review
Our formal privacy policy is being prepared in line with the Korean Personal Information Protection Commission's privacy policy guidelines. We will publish the full text as soon as the legally required details — such as business information and the designated privacy officer — are finalized. Until then, the facts below describe how we actually process personal information.
Information we collect
- Account information — email, name and password (hashed). If you sign up with a Google account, the email, name and profile image provided by Google.
- Optional information — company name and department.
- Access records — session IP address and browser information, plus audit logs of activity within your organization (who did what, and when). We record these for ISO access rights review (A.5.18).
- Materials you upload — evidence files and document content you enter while preparing for certification.
What we do not collect
- We do not store payment card details. Payments are handled by a payment processor; the service never receives card numbers.
- We do not use advertising or behavioural analytics tools. There are no analytics or ad scripts in the service code.
- We do not collect national identification numbers or other unique identifiers.
Where data is stored
- The database and server functions run in the Singapore region, which means personal information is stored outside Korea.
- Uploaded files are stored in separate object storage, and download links expire after a short time.
- When you use AI features, the content of that request is sent to the AI model provider. The recipients and items of cross-border transfer will be listed in a table in the full policy.
Retention period
- Login sessions expire after 7 days.
- Account information is destroyed when you delete your account. You can do this yourself under Settings > My profile after logging in.
- When you delete your account, identifying information such as your email and name is destroyed immediately. Your organization's certification records (projects, evidence, audit logs) are organizational assets and certification evidence, so they remain with authorship shown as anonymous.
- If an organization is left without an administrator because of account deletion, all of its data is destroyed after 30 days.
Your rights
- Organization owners can download all organization data as JSON under Settings > Data export.
- You may request access, correction, deletion or suspension of processing. Account deletion is available instantly within the service; other requests can be sent to the contact below.
This page is not the formal privacy policy but a status notice pending finalization. For questions about personal information processing or to exercise your rights, please contact us below.