Explains what personal data is processed during signup, analysis, billing, and support flows, why it is processed, how long it is retained, and how users can exercise their rights.
The processors and service providers confirmed from the current codebase are Self-operated application hosting, Self-operated PostgreSQL database, NextAuth session management, Google OAuth, Configured SMTP mail provider, PortOne, OpenAI, Anthropic, Google AI / Gemini, Perplexity, and Essential cookies.
Some payment, email, authentication, and AI providers may process data outside Korea. The published processor list should be limited to providers that are actually enabled in production.
If this policy changes, the service will provide advance notice of the effective date and the reason for the change through the site or email when appropriate.
The current published version is 2026-04-15.v1, effective 2026-04-15.
Remove providers that are not enabled in production and publish only the providers actually used in the live environment.
Runs the Next.js application, middleware, and service APIs.
Data categories
account identifiers, analysis requests, support submissions, session metadata, IP/log data
Destinations
application server logs, runtime memory, service APIs
Trigger
Any page visit, account action, analysis request, or support submission.
Operator must confirm the production hosting vendor or infrastructure name before launch.
Stores accounts, subscriptions, payments, analysis history, and support-related records kept by the service.
Data categories
email address, hashed password, subscription records, payment records, analysis history, consent records
Destinations
PostgreSQL database
Trigger
Account creation, login, subscription management, and analysis persistence.
Operator must confirm the actual managed database or hosting vendor before launch.
Maintains authenticated sessions for account access.
Data categories
session token, account identifier, preferred locale
Destinations
HTTP-only session cookie, application auth middleware
Trigger
Login, authenticated navigation, and session refresh.
The service uses NextAuth cookies such as `next-auth.session-token` or `__Secure-next-auth.session-token` depending on transport.
Optional social login provider for account authentication.
Data categories
email address, profile name, profile image, OAuth account identifier
Destinations
Google identity platform, application auth database
Trigger
Only when Google login is enabled and the user chooses Google sign-in.
This processor should be disclosed only if Google login remains enabled in production.
Sends verification emails, password reset emails, and support email notifications.
Data categories
email address, email content, support message content
Destinations
outbound SMTP delivery, support mailbox
Trigger
Signup verification, password reset, and support-contact workflows.
Operator must confirm the branded mail processor name used in production SMTP settings.
Processes subscription checkout and payment verification.
Data categories
payer email, subscription plan, merchant UID, payment status, receipt URL
Destinations
PortOne checkout SDK, PortOne payment API
Trigger
Subscription purchase, payment verification, cancellation, and webhook handling.
If an underlying acquiring PG is separately disclosed, add that vendor to the published policy as well.
Optional AI analysis and web-search synthesis provider supported by the current codebase.
Data categories
analysis prompts, symbol/company context, generated report content
Destinations
OpenAI API
Trigger
Only when an OpenAI-backed analysis mode is selected or enabled in production.
If OpenAI is disabled in production, remove it from the published processor list.
Optional AI analysis provider supported by the current codebase.
Data categories
analysis prompts, symbol/company context, generated report content
Destinations
Anthropic API
Trigger
Only when an Anthropic-backed analysis mode is selected or enabled in production.
If Anthropic is disabled in production, remove it from the published processor list.
Optional AI analysis provider supported by the current codebase.
Data categories
analysis prompts, symbol/company context, generated report content
Destinations
Google Generative Language API
Trigger
Only when a Google-backed analysis mode is selected or enabled in production.
If Google AI is disabled in production, remove it from the published processor list.
Optional AI analysis provider supported by the current codebase.
Data categories
analysis prompts, symbol/company context, generated report content
Destinations
Perplexity API
Trigger
Only when a Perplexity-backed analysis mode is selected or enabled in production.
If Perplexity is disabled in production, remove it from the published processor list.
Stores locale preference and authenticated session continuity.
Data categories
locale preference, session token
Destinations
taltal-locale, next-auth.session-token, __Secure-next-auth.session-token
Trigger
Locale switching and authenticated browsing.
No analytics or marketing tracker was confirmed in the repository at planning time.