PodoLay

Privacy Policy

Podo Co., Ltd. (the "Company") protects users' personal data in accordance with the Personal Information Protection Act of the Republic of Korea and handles related concerns promptly under this policy.

1. Data we collect and how

  1. Registration and account management: email address, name, password (stored only as an irreversible hash), country, language setting.
  2. Generated while using the Service: IP address, browser type, access times, usage records (document edit history, PDF export history), questions typed into the help assistant.
  3. Paid subscriptions: the Company does not collect payment details (card numbers, etc.); our Merchant of Record, Paddle, collects and processes them directly. The Company receives only the subscription status, billing period and a customer identifier from Paddle.
  4. Customer support: what users write in support inquiries.
  5. How: entered by users on the registration and settings screens, generated automatically during use, and received from Paddle's payment notifications.

2. Purposes

  1. Identifying members and logging in, email verification, account security (lockout after failed logins).
  2. Providing the Service — storing documents, generating PDFs, enforcing plan limits.
  3. Reflecting the payment status of paid subscriptions, billing and refunds, tax reporting.
  4. Responding to inquiries, announcing notices and changes to the terms.
  5. Keeping the Service stable, preventing abuse, and statistics in a form that does not identify individuals.
  6. Legal basis: the items required to sign up (email, name, password, country, language) are processed to conclude and perform the service contract with you (Personal Information Protection Act, Article 15(1)4), and we also ask for your separate consent to their collection and use when you sign up. Billing and tax data are processed to meet legal obligations (Article 15(1)2); service stability and abuse prevention rest on the Company's legitimate interest (Article 15(1)6).

3. Retention

  1. Member data is kept until the account is closed and deleted without delay thereafter, except where the following laws require retention.
  2. Act on Consumer Protection in Electronic Commerce: records of contracts and withdrawals, 5 years; records of payment and supply, 5 years; records of consumer complaints and disputes, 3 years.
  3. Protection of Communications Secrets Act: access logs, 3 months.
  4. Questions to the help assistant are not stored after the answer is produced; only counts and token usage are aggregated.

4. Provision to third parties

The Company does not provide personal data to third parties, except with the user's consent or where specifically required by law.

5. Processors and international transfers

To provide the Service, the Company entrusts processing to the following parties; some data is transferred abroad.

  1. Paddle.com Market Limited (United Kingdom) and its affiliates — payment, billing, refunds and tax handling for paid subscriptions (Merchant of Record). Data: email, name, country, payment details (collected by Paddle directly). When: at payment. Retention: per Paddle's policy and applicable law. Paddle Privacy Policy
  2. Google Cloud (servers located in the Seoul region, Republic of Korea) — hosting, storage and backup. Data: all member data and Content.
  3. Anthropic, PBC (United States) — generating help assistant answers. Data: the question typed by the user and a hint about the current screen (document text is not sent). When: each time a question is asked. Retention: per Anthropic's API data policy after the answer is generated (not used for training).
  4. If processors or destinations change, this policy is updated and announced.

6. Deletion

  1. Data is deleted without delay once the retention period ends or the purpose is achieved.
  2. Electronic files are deleted in a way that prevents recovery; paper documents are shredded or incinerated.
  3. Data that must be kept by law is stored separately and not used for any other purpose.

7. Your rights

  1. You may at any time access, correct or delete your personal data or request that processing be suspended. Name, password, language and country can be changed on the My Account page.
  2. You can close your account on My Account › Account (password confirmation required) or by emailing support@podo.it.kr. On closure your documents, uploaded files and edit history are deleted immediately and account details such as your email and name are anonymised; only records subject to statutory retention under Section 3 (billing and inquiry records) are kept for the required period.
  3. Requests can be made by email and are acted on without delay. A legal representative or an authorized agent may also make requests.

8. Security measures

  1. Passwords are stored only as irreversible hashes.
  2. All traffic is encrypted with HTTPS; login tokens are short-lived and refreshed.
  3. Administrator access to personal data is minimized, and administrators view user accounts in read-only mode.
  4. Data is backed up daily and backups are kept in access-controlled storage.

9. Cookies and browser storage

The Company does not use advertising cookies. Browser local storage is used to keep you signed in and to remember language and unit settings. Clearing browser storage signs you out and resets these settings.

10. Children under 14

The Company does not collect personal data from children under 14, who may not register.

11. Privacy officer

You may contact the above for inquiries, complaints or remedies regarding personal data. If you are not satisfied with the Company's handling, you may contact the Personal Information Dispute Mediation Committee (+82-1833-6972) or the Privacy Call Center (118 within Korea).

12. Changes to this policy

Changes are announced in Notices at least 7 days before they take effect; changes important to users are also sent by email.

Supplementary provisions

This policy takes effect on 2026-10-03.