Privacy Policy

1. Information we process

We process only what the service needs. We never store your password itself.

• Account (required): user identifier (sign-in name), display name, email address, a one-way hash of your password
• If you register a passkey: its identifier, public key, signature counter, and transports
• If you sign in with Google (planned): your Google account identifier, email address, and name. We never receive your Google password and access no Google data beyond confirming the sign-in
• Optional: phone number, language, time zone, and notification settings
• Generated by use: sign-in, sign-out, and account-switch records, sessions, the devices you chose to trust, IP address and access time, and the name, IP, and Tailscale sign-in account of devices you connect to the Company private network (tailnet)
• Work you enter or upload to the Platform: requests, conversations, documents, files
• Website: your IP address (processed in hosting) and, if you email us, your address and the message. The website has no sign-up and uses no visitor analytics

2. Why we process it

We use personal information only for these purposes; if a purpose changes, we take the steps the law requires, such as asking for your consent.

• Identifying you, signing you in, protecting your account, and preventing misuse
• Providing the Platform: handling requests, delivering results, sending notices
• Account recovery, announcements, and answering inquiries
• Investigating security incidents and meeting legal obligations

3. Legal basis for processing

Account details, passkey and Google sign-in data, records generated by use, and your work are processed without consent because they are necessary to perform our service agreement with you, as the Personal Information Protection Act permits.

Optional details (phone, notification settings) are processed with the consent you give when you add them, and the Platform works without them.

Website IP addresses and inquiry emails are processed without consent, to the extent necessary for the Company's legitimate interest in running the website and answering inquiries, as the Act permits.

4. How long we keep it

When the purpose is met or you ask us to delete your account, we destroy your account details, contacts, passkeys, sessions, and trusted-device records without delay.

Work you entered for a Company project, and the author marks left in its records (user identifier, display name, commit author name and email), are kept for as long as the project records are needed under your separate agreement with the Company, or de-identified.

Where a law requires retention, we keep that information separately for the required period.

5. How we destroy it

We destroy information within five days after its retention period ends.

Electronic files are deleted so they cannot be recovered; paper is shredded or incinerated.

6. Sharing with third parties

We do not provide your personal information to third parties unless you consent in advance or a law specifically requires it.

7. Processors and transfers outside Korea

To perform our service agreement with you, we entrust processing to the companies below and transfer personal information to the countries listed; a company with no country listed is in the United States. Information is sent over encrypted connections when you use the service and kept only as long as the work needs or each company's policy states.

If you do not want your information transferred abroad, you may ask us to delete your account; the Platform cannot then be used.

• Anthropic, PBC · OpenAI, L.L.C. · X.AI LLC — AI processing of your work
• Google LLC — AI processing of your work, sending email notices (recipient address, notice content), storing inquiry email (sender address, message), confirming Google sign-in once offered (account identifier, email)
• Cloudflare, Inc. — website hosting (IP address), forwarding inquiry email (sender address, message)
• Tailscale Inc. (United States, Canada, Germany, United Kingdom) — operating the private network used to reach the Platform (device name, device IP, Tailscale sign-in account)
• Company contacts: Anthropic privacy@anthropic.com · openai.com/policies/privacy-policy · x.ai/legal/privacy-policy · policies.google.com/privacy · Cloudflare privacyquestions@cloudflare.com · Tailscale privacy@tailscale.com

8. Your rights

You may at any time ask to access, correct, or delete your personal information, or to stop its processing. Some details, such as your display name, can be changed on the Platform account page.

For anything else, write to contact@mandyspace.com. We act without delay and tell you the result. A legal representative or someone you authorize may also exercise these rights for you.

9. How we protect it

We take these measures against loss, theft, leakage, alteration, and damage.

• Passwords are stored only as salted, deliberately slow one-way hashes, and sign-in attempts are limited
• The Platform is served only over HTTPS, is not exposed to the internet, and is available only to signed-in users on devices connected to the Company private network (tailnet)
• The account store is readable only by the service account, and passwords and other credentials are never written to logs or source code
• Access to personal information is limited to the fewest people, and administrator actions are recorded

10. Cookies

The Platform uses a session cookie to keep you signed in. The website uses only a cookie that remembers your language. We use no advertising or tracking cookies.

You can refuse cookies in your browser, but you will not be able to sign in to the Platform.

11. Children

Our services are not directed to children under 14, and we do not knowingly collect their personal information.

12. Privacy officer

For questions, complaints, or remedies about personal information, contact us. Privacy officer: Representative Director · Department handling privacy and complaints: Office of the Representative Director · contact@mandyspace.com

13. Remedies

For advice or dispute resolution about a privacy infringement, you may contact these Korean authorities.

• Personal Information Dispute Mediation Committee: 1833-6972 (www.kopico.go.kr)
• Personal Information Infringement Report Center: 118 (privacy.kisa.or.kr)
• Supreme Prosecutors' Office: 1301 (www.spo.go.kr)
• Korean National Police Agency: 182 (ecrm.police.go.kr)

14. Changes to this policy

We announce changes on this page at least 7 days before they take effect, and at least 30 days before for changes that materially affect your rights.