Dodam AI Privacy Policy

VanillaX Inc. ("the Company") establishes and publishes this Privacy Policy under Article 30 of the Personal Information Protection Act ("PIPA") to protect the personal data of data subjects and to handle related complaints promptly. It applies to "Dodam AI", the cross-border marketplace listing inspection service the Company operates.

The Company processes business data of the traders and staff who use the Service. It does not collect personal data of children under 14.

(1) We collect only the minimum needed to provide the Service.

(2) We do not collect sensitive data such as beliefs, political opinions, health or sex life, and we do not collect resident registration numbers. Please avoid including sensitive or unique identifying information in your uploads.

(3) Declining the optional items does not restrict sign-up or inspection in any way.

(4) When paid billing begins, payment method details and transaction records will additionally be processed through a payment gateway ({{결제대행사}}). We will amend and announce this Policy before that starts. The Company does not itself store card numbers or other payment credentials.

We process personal data only for the following purposes, and will obtain consent in advance if a purpose changes.

1. 1.Identifying and authenticating users, managing accounts and organizations, granting roles.
2. 2.Running listing inspections, producing findings, applying automatic fixes and re-inspecting, delivering reports and outputs.
3. 3.Issuing API keys, authenticating calls, metering usage and enforcing allowances.
4. 4.Retaining your usage history so you can re-open your own results.
5. 5.Handling enquiries and complaints and delivering announcements.
6. 6.Preventing abuse, detecting intrusion attempts, keeping the Service stable.
7. 7.Statistical analysis for product improvement, in a form that cannot identify anyone.
8. 8.Telling users who opted in about new features and events.
9. 9.Meeting obligations imposed by law.

(1) We destroy personal data without delay once the purpose of collection has been achieved. The standard periods are as follows.

(2) The 30-day grace period after account deletion is the minimum needed to recover from mistaken deletion and to prevent abusive re-registration. If you ask for immediate destruction, we destroy everything except items we must keep by law.

(3) The following are kept separately for the periods set by law.

(4) Data kept under law is used only for that retention purpose and for nothing else.

(1) We do not provide your personal data to third parties.

(2) The exceptions are:

1. 1.You gave separate, prior consent.
2. 2.A specific provision of law requires it.
3. 3.An investigative authority requests it by presenting a warrant or equivalent under the procedure and in the manner prescribed by law.

(3) Even under paragraph (2)3, we verify that the request is lawful and in scope, provide only the minimum necessary, and tell you about it unless the law forbids us from doing so.

(4) Processors needed to operate the Service are disclosed in Article 6 and cross-border transfers in Article 7. Entrusting processing and transferring abroad are distinct from disclosure to a third party.

(1) To run the Service we entrust processing as follows.

(2) Our processing agreements set out, in writing, technical and organisational safeguards, restrictions on sub-processing, supervision of the processor, and liability including damages.

(3) If the entrusted work or the processor changes, we publish the change in this Policy.

(1) To provide the Service we transfer personal data abroad as follows.

(2) Supabase stores data in the Seoul region of the Republic of Korea, but staff located in the United States may access it remotely for operational support, so it is disclosed here as a cross-border transfer.

(1) We destroy personal data without delay once the retention period ends or the purpose is achieved.

(2) Procedure: data due for destruction is identified and destroyed with the approval of the privacy officer. Data that must be retained by law is moved to a separate database with restricted access and destroyed when its period ends.

(3) Method: electronic records are permanently deleted by a method that prevents recovery; uploaded images and outputs are deleted from storage objects and removed from backups. Printed records are shredded or incinerated.

(4) Anything remaining on backup media is overwritten and lost once the backup retention cycle (up to 30 days) has passed.

(1) You may exercise the following rights at any time.

1. 1.Request access to your personal data.
2. 2.Request correction of anything inaccurate.
3. 3.Request deletion.
4. 4.Request suspension of processing.
5. 5.Withdraw consent, including consent to marketing messages.

(2) Exercise them directly in the settings screens, or by emailing admin@vanillax.co. We act within 10 days of receiving a request and tell you the outcome.

(3) You may act through a legal representative or an authorised agent. In that case a power of attorney in the form of Annex 11 to the Notice on Personal Information Processing Methods must be submitted.

(4) Access and suspension requests may be restricted where the law allows, and data that another law requires us to collect cannot be deleted. We tell you the reason if that happens.

(1) We use only the cookies the Service needs to work. We use no advertising or behavioural-profiling cookies and no third-party tracking scripts.

(2) You can refuse cookies in your browser settings. Refusing the authentication cookies means you cannot stay signed in, and the Service cannot be used.

(3) For example — Chrome: Settings › Privacy and security › Third-party cookies; Safari: Settings › Privacy › Block cookies; Edge: Settings › Cookies and site permissions.

We take the following measures to keep personal data safe.

1. 1.Organisational: an internal management plan, the smallest possible number of staff handling personal data, separated access rights, and regular training.
2. 2.Technical: access-right management, row-level security in the database so organizations are isolated from each other, one-way password hashing, TLS in transit and encryption at rest.
3. 3.Access control: uploads are stored in a private bucket and can be opened only through short-lived signed URLs.
4. 4.Log retention: access logs of the personal-data processing system are kept for at least 3 months and protected against tampering.
5. 5.Physical: we follow the data-centre security policies of our cloud providers and operate no server room of our own.

(1) The Company designates a privacy officer to oversee personal data processing and to handle complaints and remedies for data subjects.

(2) Requests for access, correction, deletion or suspension go to the same contact. We act immediately on receipt and report the outcome within 10 days.

You may apply to the following bodies for mediation or advice about a privacy infringement. They are independent of the Company; use them if you are not satisfied with our handling or need further help.

If your rights or interests are harmed by a disposition or omission by the Company in response to a request under PIPA Articles 35 (access), 36 (correction or deletion) or 37 (suspension), you may also file an administrative appeal under the Administrative Appeals Act. (Central Administrative Appeals Commission, 110 in Korea, www.simpan.go.kr)

(1) This Policy applies from its effective date. Additions, deletions or corrections are announced inside the Service at least 7 days beforehand, or at least 30 days beforehand where user rights change materially.

(2) Earlier versions are available on request. The change history is as follows.