Privacy Policy

1. Personal Data We Collect

• Required: email address (license key & receipt delivery, payment confirmation)
• At sign-in: the email address, name, and account identifier provided by your sign-in provider (such as Google), or your email address when signing in by email link, together with sign-in records (sign-in and sign-out times, sign-in method, the time a sign-in link was sent, and the time and reason a sign-in attempt was rejected) — used to identify your account, keep you signed in, and let you review your own sign-in history on the account security page
• Optional / B2B: business registration number, business name, and representative's name (when you request a Korean tax invoice)
• At checkout (optional) or when you request an invoice (purchase order / bank transfer): company name, business registration / tax ID (VAT/GST), billing country, postal code (optional), and purchase order number (optional) — used by the international payment provider to show your company details on the invoice and to determine tax. You can leave these blank and still complete a personal purchase
• Automatically collected: transaction identifiers assigned by the payment provider and the card display details it passes on (card issuer or brand and a partially masked card number — for showing the payment method in order details), access logs (security & fraud prevention)
• Collected automatically at checkout: your country (two-letter country code) and time zone — determined from your IP address, which itself is not stored — saved with your order record
• When you use team features: the team name, the member email addresses and roles (owner, admin, user) entered by the team administrator, and the last sign-in time for each seat — used for seat assignment, team management, and seat notification emails
• Aggregate usage counts (non-identifying): to improve the service, the Company stores hourly totals of page views and feature use. What is stored is those totals and the labels attached to them — page path, display language, browser language (first language code, two letters), referral source, country (two-letter country code), which action it was, and whether the request was human or automated — and nothing else. No IP address, device identifier or cookie is used, and no individual access record is kept, so no individual can be identified
• When you use the product (service usage records): feature-use events including time spent on each screen step, time of use, app version, display language, country (two-letter country code — determined from your IP address, which itself is not stored), plan tier, subscription identifier (if you have activated a license), and a random identifier stored in your browser — used to improve the service (analysing use by feature and screen step), on the basis of the Company's legitimate interest in improving the service (Article 15(1)(6) of the Personal Information Protection Act). Email addresses, IP addresses, browser information, file names, and model coordinates, loads and analysis result values are not stored (model size, analysis duration and the number of failed checks are recorded only as coarse ranges, and the verdict only as pass or fail), and nothing is collected while your browser's Global Privacy Control (GPC) signal is on — turning that signal on stops further collection, and you can ask the Company to stop processing records already kept, as described in Section 7
• During license activation: an app-instance identifier (UUID) randomly generated by the app, the subscription identifier, and the browser and operating-system names the app sends (e.g., Chrome · Windows) — used to manage concurrent use (when the app is opened somewhere else, the place where it was opened first is closed and told why). The Company does not register or identify your device
• When you use AI review assistance (subscribers only): the question you type and a summary of already-computed analysis and review results (member and nodal forces, utilization, verdicts) — if you enter personal data in your question it is included, and the Company keeps no separate copy. To manage usage limits, it records only the time of each use and the weekly use count per app-instance identifier (or subscription identifier if there is none)
• Never collected: raw card numbers, resident registration numbers, personal data of children under 14 (the service is for users aged 14 and older; if we learn that such data has been collected, we delete it without delay)

2. Purposes of Processing

• Identify users and sign them in (account authentication, session maintenance, and letting you review your own sign-in history)
• Confirm payment and automatically issue/deliver licenses
• Issue receipts and tax documents
• Respond to inquiries and handle disputes/refunds
• Prevent fraudulent payments and secure the service
• Show dates and currencies in your local format, calculate taxes by country, and comply with export controls
• Assign team seats and manage members
• Service operations statistics (usage and sales by country — used only as totals that do not identify anyone)
• Improve the service (analysing use by feature and screen step)
• Provide AI review assistance (generating explanations and advice from your input and the analysis summary)

3. Card Data

Card entry, authentication, and storage are handled directly by PCI DSS-certified processors (international: Paddle; domestic Korea: Toss Payments, etc.).

The Company's servers and database never receive or store raw card data — only transaction tokens/identifiers issued by the processor and the card display details it passes on (card issuer or brand and a partially masked card number, for showing the payment method).

4. Third-Party Sharing and Processing

The Company entrusts or shares personal data with the following providers for payment, issuance, tax, and notification purposes (processor — entrusted task):

• Paddle.com Market Ltd. — international payment processing, receipts, tax, and refunds (Merchant of Record; shared)
• Toss Payments Co., Ltd. — domestic payment processing and settlement
• Tax-invoice provider (e.g., Popbill) — issuing Korean tax documents
• Plus Five Five, Inc. (trading as Resend) — sending order, license, and subscription notification emails
• Vercel Inc. — hosting and operating the website, checkout, product, and portal (processing access logs)
• Supabase, Inc. — storing and operating the database (account, subscription, license, and order records, sign-in records, and service usage records)
• Anthropic, PBC — generating AI review assistance responses (processing the question you type and the analysis summary)

5. Cross-Border Transfer

The Company transfers personal data outside the Republic of Korea to Vercel, Supabase, Resend, and Anthropic as entrusted processing and storage needed to deliver the service (hosting, database, email delivery, AI review assistance and metering its use). These transfers are made by publishing the details below in this Privacy Policy, as permitted by Article 28-8(1)(3)(a) of the Personal Information Protection Act.

For international payments, the Company provides personal data to Paddle.com Market Ltd. (United Kingdom), the Merchant of Record, for payment processing (third-party provision). Because this is a provision rather than entrusted processing, the clause above does not apply; instead, the Company presents the details below on the international checkout screen and obtains your separate consent to the cross-border provision (Article 28-8(1)(1)). The recipients and details are:

• Paddle.com Market Ltd. (United Kingdom; contact: paddle.com/legal/privacy) — items: email, product and amount, transaction identifiers, withdrawal-consent flag and timestamp, cross-border-consent flag and timestamp, and — at checkout (optional) or when you request an invoice (purchase order / bank transfer) — company name, business registration / tax ID, billing country, postal code and purchase order number (for card payments, billing country, billing address, and card details are entered by you directly in Paddle's checkout and are governed by Paddle's privacy policy) / purpose: international payment processing, receipts, tax calculation, refunds / when and how: transmitted over an encrypted connection (TLS) at the time of an international payment / retention: for the statutory retention period applicable to payment and tax records (per Paddle's policy)
• Vercel Inc. (United States; contact: vercel.com/legal/privacy-policy) — items: access records (IP address, browser information, requested URL) / purpose: hosting and securing the website, checkout, product, and portal / when and how: transmitted when you access the service (server processing: checkout and product in the Seoul, Korea region; portal in the Seoul, Korea region; website static assets and access records via a global delivery network) / retention: the "access records" period in Section 6
• Supabase, Inc. (United States; contact: supabase.com/privacy) — items: email, account, subscription, license, and order records, sign-in records, service usage records, AI review assistance usage-metering records (app-instance or subscription identifier, time of use, and weekly use count), payment-method references and card display details (card issuer or brand and a partially masked card number — never raw card data) / purpose: database storage and operation / when and how: transmitted when an account is created, a payment is made, or the service is used (stored in the Seoul, Korea region) / retention: the period for each item in Section 6, plus statutory retention
• Plus Five Five, Inc. (trading as Resend) (United States; contact: resend.com/legal/privacy-policy) — items: email address and message body (order details, license instructions, subscription notices) / purpose: delivering transactional and notification emails / when and how: transmitted at the time of sending (processed in the Virginia, United States region) / retention: the "email delivery records" period in Section 6
• Anthropic, PBC (United States; contact: anthropic.com/legal/privacy) — items: the question you enter in AI review assistance and the analysis and review summary (including any personal data you type into the question) / purpose: generating AI review assistance responses / when and how: transmitted over an encrypted connection (TLS) through the Company's server function (Seoul, Korea region) when you run AI review assistance / retention: the Company stores no request or response body. Under its commercial service policy the recipient automatically deletes the inputs and outputs it receives within 30 days; where automated checks flag a Usage Policy violation, it retains the inputs and outputs for up to 2 years and the resulting classification scores for up to 7 years (training on this content is contractually prohibited)
• How to refuse and consequences — you may object to the cross-border transfer by contacting the data-protection officer below. Because these transfers are necessary for payment processing and service delivery, refusing them may limit your use of the service, including international payment, license issuance, and receiving notification emails.

6. Retention Period

The Company destroys personal data without delay once its purpose is met. Retention periods by item:

• Account information (email address, sign-in provider identifier, name, team members and roles): until you close your account (account deletion) — destroyed without delay after closure. An account with no active subscription or license whose last sign-in was more than 3 years ago is destroyed after notice by email 30 days in advance (except the statutory items below)
• App-instance identifiers and the subscription identifier of that seat (the values held in license seat records, including the browser and operating-system names received with them): 1 year from the day the seat was closed — for handling inquiries and disputes about concurrent use; subscription identifiers in subscription, license, and order records follow the statutory retention items below, and those inside service usage records follow the "service usage records" period below
• Activation codes and team invitation links: 30 days after use or expiry
• Access records (IP address, browser information, requested URL): deleted automatically when Vercel Inc.'s log retention period (up to 30 days) expires — the Company keeps no separate copy
• Email delivery records (recipient address and message body): deleted automatically when Resend's 30-day retention period expires — the Company keeps no separate copy of message bodies
• Sign-in records (sign-in and sign-out times, sign-in method, the time a sign-in link was sent, and the time and reason a sign-in attempt was rejected): 1 year from the date recorded, then destroyed automatically — IP addresses and browser information are not stored, and the account security page shows only the most recent 90 days
• Service usage records (feature-use events including time spent on each screen step, time of use, app version, display language, country, plan tier, subscription identifier, and a random identifier): 13 months from the date recorded, then deleted automatically — totals derived from them (daily, weekly, and monthly figures that do not identify anyone) are kept without a time limit
• AI usage metering records (app-instance or subscription identifier, time of each AI review assistance use, and the weekly use count): deleted automatically within 8 days of the last use
• Records on contracts/withdrawal: 5 years
• Records on payment and supply of goods: 5 years
• Records on consumer complaints/disputes: 3 years

7. Your Rights

Users may request access, correction, deletion, or suspension of processing of their personal data at any time; the Company will act without delay under applicable law.

Requests can be made to the data-protection officer below.

8. Cookies and Browser Storage — Use and How to Refuse

The Company uses cookies and browser storage (localStorage / sessionStorage) to the extent needed to provide and improve the service. It does not use cookies or browser storage for advertising or for tracking you across other websites or apps.

The items used across the Company's website, checkout, product, and portal are:

• Checkout — cookies `apay_locale` / `apay_theme` (language and theme preference, retained 1 year); session storage holding in-progress payment-method and billing registration steps (cleared when the browser tab closes)
• Website — storage `astruttie-www.locale` / `astruttie-www.theme` (language and theme, until the user clears it)
• Product (AStrutTie) — storage `astruttie.locale`, `astruttie.theme`, `astruttie.uimode`, `astruttie.layout`, `astruttie.guideseen` (display settings and whether guidance was shown); `st.device.v1` (app-instance identification for managing concurrent use) / `st.entitlement.v1` (license entitlement); session storage `st.activation.pending.v1` (license activation in progress, cleared when the tab closes); storage `st.usage.anon.v1` (the random identifier for service usage records, until the user clears it) and session storage `st.usage.session.v1` / `st.usage.session.at.v1` (usage session identifier and last activity time, cleared when the tab closes) — these three `st.usage.*` values are neither created nor sent while your browser's Global Privacy Control (GPC) signal is on
• Customer portal — cookie `apass_portal_session` (keeps you signed in — required to use the service); `apass-portal-lang`, `apass-portal-theme`, `apass-portal-cur` (language, theme, display currency; retained 1 year)
• How to refuse — you may block cookies or delete stored values in your browser settings. Note that refusing the cookie used for the sign-in session will prevent you from staying signed in, which limits use of the portal and checkout.

9. Destruction of Personal Data — Procedure and Method

When the retention period expires or the purpose of processing is achieved, the Company destroys the personal data without delay. Data that must be kept under other laws (the statutory items in section 6) is stored separately from other personal data for that period only and then destroyed.

Method — electronic files are permanently deleted so they cannot be recovered or regenerated, and data held in processors' systems is deleted together under the processing agreements and each provider's deletion procedure. Any paper records are shredded or incinerated.

10. Security Measures

• Administrative — access to personal data is limited to the minimum staff needed for the work, only the minimum role-based access rights are granted to the processing systems, and the Company's rules on handling personal data and on access rights apply to all staff.
• Technical — all data in transit is encrypted (HTTPS/TLS), and the database holding personal data is protected by authentication and access controls. Raw card numbers and resident registration numbers are never collected (sections 1 and 3); payment data is handled by PCI DSS-certified processors.
• Physical — the Company does not keep personal data in its own server room; it relies on the physical security of the data centres of its hosting and database providers (section 4).
• Access records — access logs of the processing systems and the hosting provider are retained for each provider's retention period (section 6), and the Company periodically reviews the state of access rights.

11. Data Protection Officer and Contact for Access and Other Requests

• Officer: Kyuhwan Hwang
• Contact: support@aroaduser.com
• Address: #307, 243, Digital-ro, Guro-gu, Seoul, Republic of Korea (08382)
• Contact for requests to access, correct, delete, or suspend processing: Customer Support (support@aroaduser.com) — the Company notifies you of the outcome, or the grounds for refusal, within 10 days of receiving the request.

12. Remedies for Infringement of Rights

You may report or seek advice on personal-data infringements from the following authorities in the Republic of Korea, including where you are not satisfied with the Company's own handling of your request.

If your rights or interests are infringed by the Company's decision or inaction on a request under Articles 35 (access), 36 (correction and deletion), or 37 (suspension of processing) of the Personal Information Protection Act, you may file an administrative appeal under the Administrative Appeals Act (Central Administrative Appeals Commission, 110, www.simpan.go.kr).

• Personal Information Dispute Mediation Committee — 1833-6972 (no area code), www.kopico.go.kr
• Personal Information Infringement Report Center (Korea Internet & Security Agency) — 118, privacy.kisa.or.kr
• Supreme Prosecutors' Office, Cyber Investigation Division — 1301, www.spo.go.kr
• Korean National Police Agency, Cyber Bureau — 182, ecrm.cyber.go.kr