This Policy covers personal data processed by the ASIV website (www.asiv.ai.kr, asiv.ai.kr): browsing the public pages, Google sign-in, the community, the Book a Demo page and cookie choices. Processing inside the separate ASIV console is outside this Policy (section 9). Visiting the website or reading this Policy is not blanket consent.
01Operator
ASIV is the service name operated by Lee Young Seok, who is currently the individual responsible for this processing; the name does not identify a separate incorporated entity. If the same individual registers a business, we update the registration details. A transfer to another operator or legal entity follows the applicable notice and transfer procedures.
02Information and purposes
- Visiting the website: IP address, request path and time, browser/device information handled by the hosting provider (Vercel) to deliver pages, diagnose problems and prevent abuse. The website has no analytics or advertising tools.
- Google sign-in: the email address, name, profile-picture address and Google account identifier that Google passes on; the sign-in method (Google), your ASIV account ID and session data. The account profile stores email, display name, profile-picture address and sign-in provider. The sign-in service’s audit log keeps sign-up, sign-in and deletion records with the email address and account ID. Used to identify your account, keep you signed in, let you use the community and secure sign-in. ASIV never receives your Google password.
- Community: public profile (nickname and similar), posts, answers, comments, ERP interests, saved items, reactions, message recipients/content, reports (including a copy of the reported content taken when the report was filed, up to 1,000 characters), blocks and moderation actions, plus request data when you view the post list before signing in. Visibility follows the feature and selected recipients.
- Optional community activity: currently switched off on the public website, so nothing is recorded. Where switched on and allowed: signed-in identity, impressions, opens, post/ERP/topic identifiers, search filters, result counts, presence of a query and event time (never the query text), for recommendation improvement. We will update this Policy and the choice panel before switching it on.
- Demo requests and enquiries: the content of the email you send from your own mail app: name, email, request type, workflow needs and discovery source; depending on the type, company, role, team, ERP and preferred schedule, or individual category, preferred plan and billing period; optional fields (age, affiliation, company size, notes); your sending address and email headers. Used to answer the request. Selecting a preferred plan is not a purchase or payment authorization.
- Cookies and browser storage: sign-in session values, the return path after sign-in, the console handoff time and your cookie-choice record (version, choice, saved and expiry times), as explained in the Cookie Notice. The website serves its own fonts and makes no request to external font providers.
03Demo requests
The demo request page currently does not send your entries to an ASIV server, and the website has no server-side store for demo requests. Selecting “Email this request” opens the mail app on your device with a draft addressed to LeeYoungSeok@asiv.ai.kr containing the fields you filled in (blank fields, the hidden field and the consent tick are left out). Nothing is transmitted until you send that email yourself. It arrives in the contact mailbox (Microsoft Exchange Online), and your own mail service may keep a sent copy under its settings. If we introduce server-side submission, we will update this Policy first.
Required fields are marked *. You may leave them out, but then we cannot process the request. Optional fields may be left blank. Answering your request is not permission for marketing. Do not include passwords, keys, national identifiers, other people’s detailed personal data or confidential originals.
04Retention
We keep personal data only while it is needed for its purpose. Account data, community posts and messages, and enquiry emails are not deleted automatically merely because time has passed. Instead, when data is no longer needed, because its purpose has ended or because of a deletion request or withdrawal of consent, the designated operator (Lee Young Seok) checks its scope and any legal duty to preserve it, and the data is destroyed without delay as Article 21 of Korea’s Personal Information Protection Act requires. The operator’s check is the step that carries out destruction; it does not mean data is kept without limit. This Policy sets no arbitrary number of days. Data another law requires us to preserve is kept separately, only for that purpose and period.
Safety clean-ups, such as expiry of sign-in sessions and authentication tokens, happen automatically and separately. The 180 days for the cookie-choice record is a separate period.
- Account and profile (Supabase): while needed to maintain the account; ends when an account deletion request is carried out (section 5).
- Community posts and messages (Supabase): while needed to provide posting and conversations, or until a deletion request is carried out. The minimum records needed for a report or dispute are kept separately until that purpose ends. We cannot recall copies others saved themselves.
- Enquiry and demo emails (contact mailbox, Microsoft Exchange Online): until the request and necessary follow-up are resolved, then reviewed and deleted without delay under the procedure above. A sent copy in your own mailbox is under your control.
- Optional community activity (Supabase): currently off, so nothing is recorded. Where switched on: while needed for the permitted recommendation purpose; you can delete it in your account settings.
- Cookie-choice record (your browser): created only when you save a choice where an optional item is switched on; visiting the current public website does not create it. Used for up to 180 days. When expired, the site removes it on your next visit and asks again. It cannot erase browser storage remotely while the site is not running.
Where records must be preserved for an actual dispute, abuse or specific legal claim, we identify the legal basis and the records needed, keep them apart from ordinary use and destroy them when the basis ends. The mere possibility of future disputes is not a reason to keep everything.
05Account deletion and remaining copies
The website currently has no screen for deleting your own account. Account deletion works as follows.
- Send a deletion request to LeeYoungSeok@asiv.ai.kr.
- Identity check: the request must come from the account’s email address, or, if sent from another address, be confirmed from the account’s email address. We do not ask for passwords or full identity documents.
- The operator deletes that sign-in account in Supabase.
- Under the database’s linking rules, the account and what it created are deleted with it: account profile, community profile, the questions, posts, answers and comments it wrote, the messages it sent, saved items (bookmarks), solution reports, privacy and message settings, block list, reports it filed, and activity records.
- The operator queries the database again to check what remains (including the items under “What can remain” below) and tells you the result.
Effects on other members. Deleting an account also deletes or changes other members’ data. Answers and comments other members wrote under the deleted member’s questions and posts, and other members’ saved items and solution reports on those posts, are deleted together with those posts. A one-to-one message conversation with the deleted member is deleted as a whole, including the messages the other member sent. Other members’ blocks of the deleted member are deleted. If the deleted member’s answer had been accepted on another member’s question, it is no longer accepted.
What can remain after deletion, and how it is handled.
- Reports filed by other members keep a copy of the reported content taken when the report was filed (up to 1,000 characters: the text of a post, comment, message or solution report, a profile name and similar), and the community moderation log keeps the identifiers of the items concerned. When handling a deletion request, the operator reviews these and removes those copies unless they must be kept to handle an open report or for a legal duty, and tells you the result.
- The sign-in service’s (Supabase Auth) audit log keeps sign-up, sign-in and account-deletion records with the email address and account ID (deleting the account adds one more record). These remain in the sign-in service’s logs; the operator handles their deletion with the provider where possible and tells you the result.
- Providers’ platform logs and backups may keep copies for the period the provider sets.
- Related emails in the contact mailbox (Microsoft Exchange Online) are found and deleted separately by the operator. By default Exchange Online keeps deleted items in the Recoverable Items folder for 14 days (configurable up to 30), and longer while a hold applies (Microsoft documentation). A sent copy in your own mailbox is under your control.
When we report the result, we tell you what was deleted and what remains and under which conditions; we do not describe deletion as complete while copies remain. We keep only the minimum record needed to show the request was handled (time, scope, result), for as long as that purpose requires, without copying the deleted content into it.
06AI and language models
The website (the scope of this Policy) sends none of your information to AI or language-model providers. A check on 2026-11-07 of the live website’s source code and deployed files found no code or address that sends requests to an AI or language-model provider. Reading this Policy or making a cookie choice is not consent to AI training. Before the website introduces any feature that sends information to such a provider, we will publish the provider, data, countries and retention conditions here. AI processing in the ASIV console is outside this Policy (section 9).
07Processors and external services
The website uses: Vercel Inc. (delivering the website files); Supabase Pte. Ltd. (sign-in, account and community database); Cloudflare, Inc. (security and delivery in front of Supabase; Supabase responses try to set its security cookie __cf_bm); Microsoft (Microsoft 365, Exchange Online), for receiving and storing mail for the contact address LeeYoungSeok@asiv.ai.kr, with retention and deletion as in sections 4 and 5; and Google LLC, the sign-in method you choose, which processes the sign-in under its own policy and passes the signed-in account’s information to ASIV. The body and attachments of enquiry e-mails are stored in the South Korea region of Microsoft Exchange Online. For the providers confirmed to store or process data abroad, or to have access from abroad (Vercel, Supabase, Cloudflare, Google), data, countries, timing, retention and how to refuse are in the table in section 8. A provider’s own-purpose processing is also covered by its own policy. Public posts are visible according to their visibility settings. Valid legal demands follow applicable disclosure requirements.
08International transfers
The table below sets out, for personal data transferred abroad or processed by providers abroad while you use the website, the items listed in Article 28-8(2) of Korea’s Personal Information Protection Act: the data transferred; the country, timing and method; the recipient and its contact; the recipient’s purpose and retention period; and how to refuse, the procedure and the effect. Each country cell was checked against the basis stated in it; a provider’s headquarters is not used in place of a storage country. Send requests to refuse or stop a transfer to LeeYoungSeok@asiv.ai.kr.
| Recipient and contact | Data | Country (basis) | Timing and method | Purpose and retention | How to refuse and effect |
|---|---|---|---|---|---|
| Vercel Inc. — privacy@vercel.com | IP address, user agent, request path, referrer and similar request data | United States (Vercel DPA 13.1: primary processing facilities are in the United States). Responses are served from a nearby edge location (observed 2026-11-05: Seoul), which is not a storage location. | On each website visit, from your browser to Vercel over HTTPS | Delivering the website and security. Processed for the term of ASIV’s contract with Vercel; on termination Vercel deletes the data within a commercially reasonable timeframe (DPA 12.1; no number of days is given). | The website is delivered through Vercel, so refusing means the website cannot be used. |
| Supabase Pte. Ltd. (Singapore) — privacy@supabase.com | Google account email, name, profile-picture address and account identifier; sign-in session data; sign-in audit records; community profile, posts, comments, messages, saved items and reports; request data such as IP address when viewing the community before signing in | Database server: Republic of Korea (AWS Seoul region, ap-northeast-2) — the result of matching this project’s database server address, obtained by public DNS lookups on 2026-11-05 and 2026-11-07, against AWS’s published IP-range list. Support and operations access: transfers to the United States and Singapore are possible under Supabase’s privacy policy. Supabase’s public documentation does not state where backups are kept. | When you sign in, use the community after signing in, or view the community before signing in; from your browser over HTTPS | Sign-in, accounts and the community. On ASIV’s side, until the account is deleted (sections 4–5). Supabase processes the data for the term of the agreement and deletes all copies after a 30-day return-request period following expiry (Supabase DPA 11.2, Schedule 3). | Nothing is sent if you neither sign in nor open the community pages. Refusing means sign-in and the community are unavailable; other public pages and demo request emails remain available. |
| Cloudflare, Inc. — dpo@cloudflare.com | Request data such as IP address when Supabase is called, and the security cookie __cf_bm | Under Cloudflare’s privacy policy, stored primarily in the United States and the European Economic Area. The edge location observed on 2026-11-05 was Seoul, which is not a storage location. | When you use pages that call Supabase (sign-in, community), over HTTPS | Defence against automated malicious requests and delivery. __cf_bm expires after 30 minutes (Cloudflare cookie documentation). Other request data is kept, under Cloudflare’s policy, for a period consistent with its business purposes; no number of days is published. | Nothing is sent if you do not use sign-in or the community. Refusing means sign-in and the community are unavailable. |
| Google LLC — contact form in Google’s Privacy Policy | Google → ASIV: the signed-in Google account’s email address, name, profile-picture address and account identifier. ASIV → Google: sign-in request data (ASIV’s client ID and return address) | Under Google’s Privacy Policy, Google maintains servers around the world and your information may be processed on servers outside the country where you live (no specific country is named). | When you press “Continue with Google”; your browser is redirected to Google’s sign-in page | Authenticating your Google account. Google’s retention varies by data type under Google’s policy. What ASIV receives follows the Supabase row. | Do not use Google sign-in. There is currently no other sign-in method, so refusing means you cannot sign in or post in the community. Public pages and demo request emails remain available. |
09ASIV console (separate service)
The ASIV console (asiv-console-yc-demo.up.railway.app) is a separate service from the website. Its work area opens only for accounts the operator has approved (or with an access code the operator issued); an account that is not approved does not get in even after signing in (as checked in the live console code on 2026-11-05). This Policy does not cover processing inside the console; the console’s processing is described separately.
What the website itself sends to the console:
- When you open the console: when a signed-in user opens the website’s console entrance (
/console), the website sends your current sign-in token (a Supabase access token) and the console page you asked for to the console’s/auth/site/handoffin a form POST body, never in the address bar or a cookie. Per Supabase’s documentation the token contains your ASIV account ID, email address, a phone-number field, sign-in method (provider) information, user information (for Google sign-in, the name, profile-picture address and similar data Google passed on), session ID, role, and issue and expiry times. The console uses the token to identify the account; if the account is not approved, the console records its account ID and email address as an access request. - When you sign out of the website: to end console sessions too, the website sends your current sign-in token to the console’s
/auth/site/logout(even if you never opened the console, as long as you were signed in). - To prevent handoff loops, the website stores the handoff time (
asiv_console_handoff_at) in the browser tab’s storage.
A cookie choice made on the website does not reach the console and does not control it.
10Cookies and choices
See the Cookie Notice for cookies, localStorage, sessionStorage, lifetimes and controls, and review the storage in use, or change your choice where an optional item is switched on, under . The website has no advertising, analytics or cross-site tracking tools; we will update this Policy and the controls before adding any. Changes apply to this browser and origin, not to other devices or the console.
11Rights
You or an authorized representative may exercise applicable rights of access, correction, deletion, restriction and withdrawal of consent. Email your account address and the scope of the request; do not send passwords, payment-card numbers or full identity documents. We ask only for what is needed to verify identity or authority, and we do not require a particular email subject or a paid account.
We may redact material to protect other people’s information. If we cannot fulfil a request in whole or in part, we explain why, what we can do and how to seek review, within applicable deadlines. We do not penalize lawful rights requests.
US residents may have rights under applicable state laws, depending on coverage, including access, deletion, correction, portability and opt-outs. Request reconsideration of a refused request at the same contact. A Global Privacy Control signal blocks this site’s optional community activity recording.
12Children and sensitive information
The ASIV website is not directed to children. Tell us if you believe data of a child under 14 was submitted. Do not post sensitive or national-identifier information in demo requests or the public community.
13Protection, updates and complaints
We apply safeguards appropriate to the processing, including access management, authentication and encryption in transit (HTTPS), and review provider conditions. Incidents are handled with applicable notification and reporting duties. Material changes to purposes, providers, retention or rights procedures are reflected in an updated version with any required notice or consent; changes do not retroactively authorize earlier processing. This Policy creates no service-level or performance warranty that has not otherwise been agreed; legal obligations, your rights and the commitments in this Policy remain effective.
Privacy contact: Lee Young Seok, LeeYoungSeok@asiv.ai.kr. In Korea you may also contact the Personal Information Infringement Report Center or the Personal Information Dispute Mediation Committee.