Draft — under legal review.
Privacy
Operator: iTBROWN Co., Ltd. (아이티브라운). Privacy officer: 황성훈, CEO — hello@jaryo.org.
What we handle
When you get an API key we receive:
- your e-mail address;
- the country you tell us you work from;
- the country of the IP address you sign up from (as reported by Cloudflare);
- optional: if you tick the box, that you agreed to receive product updates and news about Jaryo, such as new plans, and when you agreed or withdrew. We use your e-mail for this only until you withdraw or no longer have a key; if you replace your key, your choice carries over. The times stay with the key record until it is deleted (see How long). You can turn it off on the key page at any time, and refusing does not affect your key. Service notices about outages, terms or the end of the beta may be sent regardless of this choice.
While running the service the following is also created or processed:
- a one-way hash of your key (never the key itself) and its first characters (shown on the key page), and the calls made with it (time, endpoint, status, response time, whether it came from the API, MCP or this website, and the country reported by Cloudflare, never the IP address), to enforce the limits and measure use of the service;
- sign-in records kept by our sign-in provider (Supabase Auth): a user id, sign-in logs (time, IP address, e-mail) and sign-in sessions (IP address, browser), to keep sign-in secure;
- for requests without a key, a salted one-way hash of the IP address, for rate limiting only — deleted within an hour;
- the IP address and request information (such as URL, headers and time) of every request to the website and the API, keyless or not, which Cloudflare processes to deliver and protect the traffic;
- the sign-in e-mail itself (your address, the sign-in link) and its delivery metadata, which our e-mail provider processes to send it.
The website sets no tracking cookies. On the key page the sign-in session is kept in your browser's local storage. All scripts are served from jaryo.org itself. Usage counts by record type are kept without any key, IP address or e-mail. For calls without a key we keep the same call details and whether a company was found, without any IP address or other identifier, as statistics. Call records never contain the text of your search. A registration number checked live with the National Tax Service is cached with its status, not linked to you.
Why, and on what basis
To issue your key, enforce its limits, keep sign-in secure and contact you about your key. This processing is necessary to provide the service you request (Personal Information Protection Act, Art. 15(1)4). For visitors without a key, we and Cloudflare process the IP address to deliver, rate-limit and protect the website and the API; this is our legitimate interest, which clearly outweighs the visitor's rights (Art. 15(1)6) (under legal review). We send product updates and news only if you opted in, on the basis of your consent (Art. 15(1)1).
How long
For as long as your key is active, and until 30 days after it is revoked or replaced. An hourly job then deletes that key record and its call log. When you have no key left, your sign-in account is deleted 30 days after your last sign-in — also if you signed in but never created a key. Sign-in logs (time, IP address, e-mail) are deleted 30 days after they are recorded, and sign-in sessions (IP address, browser) 30 days after their last use.
- Backups. On our current plan (Supabase Pro) the database is backed up daily and each backup is kept for 7 days, so deleted data disappears from backups within 7 days after deletion. If we ever restore a backup, data that had been deleted is deleted again by the next scheduled job.
- Provider logs. Our database provider's own service logs (including sign-in events) are kept for 7 days on our plan, then deleted by the provider.
- How we delete. Records are deleted from our database by scheduled jobs. Copies held by our providers (the database backups and logs above, and the records of Cloudflare and our e-mail provider) are deleted by them on their own schedules, shown in the table below.
Processors and transfers abroad
We entrust the processing below to these companies and, because of how they operate, your data is transferred abroad (PIPA Art. 28-8).
| Recipient (contact) | Data | Country | When and how | Purpose and retention |
|---|---|---|---|---|
| Supabase Pte. Ltd. — Supabase (privacy@supabase.com) | E-mail, countries, key hash and first characters, call log, sign-in records; API requests while they are handled | Singapore (the company); the database and our API functions run in the Seoul region (Republic of Korea); backups, logs, operations and support access may be in the United States, Singapore or other countries | Over the network, when you request a key or call the API | Database, sign-in and running the API; for the periods above (backups and logs 7 days) |
| Cloudflare, Inc. (privacyquestions@cloudflare.com; DPO dpo@cloudflare.com) | IP address and request contents (URL, headers including your API key, body, and the key shown once when it is issued) | Cloudflare's global network (the data center that receives the request); the United States and the European Economic Area for the provider's own records | Over the network, on every request | Website hosting, request routing and protection; Cloudflare does not publish a fixed retention period for these request logs, and we keep no copy of them |
| Plus Five Five, Inc. — Resend (privacy@resend.com) | E-mail address, sign-in e-mail content (link) and delivery metadata | Sent from the Tokyo region (Japan); stored and mainly processed in the United States | Over the network, when you ask for a sign-in link | Sending the sign-in e-mail; Resend keeps e-mail records for 30 days (its documented retention for our plan) and deletes account data within 90 days after our account ends |
If you do not want this: do not request a key; the consequence is that you cannot get or use an API key, and the e-mail, sign-in and key data above are never created. Every request to the website and the API, keyless ones too, still passes through Cloudflare, which processes your IP address; if you refuse that, you cannot use the website or the API. You can also ask us at hello@jaryo.org to stop the processing or delete your data at any time; you then lose your key.
Your rights
You can ask to see, correct, delete or stop the processing of your data at any time: hello@jaryo.org. We answer within 10 days.
Security
Keys are stored only as one-way hashes; database access is limited to our service account; data in transit is encrypted (HTTPS/TLS).
Complaints
If you think your rights were infringed, you can also contact the Personal Information Infringement Report Center (개인정보침해신고센터, privacy.kisa.or.kr, +82-118) or the Personal Information Dispute Mediation Committee (kopico.go.kr).
Governing law
The laws of the Republic of Korea.
Effective from the public beta launch. Changes are announced on this page with their date.