Overseas personal data transfer notice (draft)
Document version: draft-2026-10-11. This describes the current architecture. Provider contracts, destination countries and retention periods still need confirmation. This draft does not mean all transfer conditions have been finalized. The Korean text is authoritative.
1. Processing paths
| Processing path | Information involved | Purpose and timing |
|---|---|---|
| Vercel web hosting | Account and request information needed to process web requests | Delivering pages and processing submitted forms |
| Supabase authentication, database and attachment storage | Email, account and consent records, support messages and attachments | Registration, sign-in, settings changes and support requests |
| Resend email delivery | Recipient email, verification codes, invite links or service notices | Sending authentication, invitation and service email |
| Model providers reached through OpenRouter (current production setting: OpenAI and Anthropic) | Judgment requests, relevant confirmed memories and context, material needed for extraction, and material needed to sort decision cases your AI agent sent (including your words) | Processing the relevant AI feature, and when the server sorts cases awaiting review |
Service-to-service transfers use encrypted connections. Using Seoul for functions or databases does not establish that all contracted processing and support access remain in Korea. Memory content and raw connection tokens are not included in notification email.
2. Conditions to confirm before finalization
The legal entity, contact details, destination countries, retention periods and deletion conditions for Vercel, Supabase, Resend, OpenRouter and each actual model provider must be checked against contracts and production settings. The current production setting restricts OpenRouter to models from OpenAI and Anthropic, so these two companies are the actual model providers. If that setting changes, this notice will be updated. Their processing countries and retention periods are still being confirmed. We do not currently guarantee a single-country model route or immediate deletion by providers.
Changes requiring new consent will be explained and that consent requested separately. This document remains a draft pending confirmation of the service operator and provider conditions and legal review.
3. Refusal and withdrawal
You may refuse overseas transfer consent. The current registration flow requires this consent, so refusal prevents completion of registration. Use the contact form below to request withdrawal or suspension of processing. Features that depend on external processing may become unavailable. The final notice will specify the required scope and consequences of refusal.
Contact and rights requests
Last updated Oct 11, 2026