Privacy Policy

Daila (the "Service") values your privacy and is committed to protecting your personal information in compliance with applicable laws, including the Korean Personal Information Protection Act (PIPA), the EU General Data Protection Regulation (GDPR), and the California Consumer Privacy Act (CCPA). This Privacy Policy explains what personal information we collect, how we use it, who we share it with, and how you can exercise your rights.

1. Purpose of Processing Personal Information

We process personal information for the following purposes: (a) Member management: User identification, login authentication, session management, and account administration. (b) Core service delivery: Article saving, AI-powered summarization, key point extraction, concept tagging, content classification, semantic search, and embedding generation. (c) Subscription and payment management: Subscription status management, payment processing via Paddle, billing history, and promotional code administration. (d) Service improvement: Service quality enhancement, error analysis and diagnosis, usage statistics, security monitoring, and fraud prevention. (e) Communication: Service notices, policy change notifications, and responses to user inquiries. (f) Legal compliance: Fulfillment of obligations under applicable laws and regulations.

2. Personal Information Collected and Collection Methods

We collect the following categories of personal information. Items marked as required are necessary for service provision; optional items may be declined without affecting core functionality. Required information (Account): - Email address, name, profile image (as provided by your social login provider), password hash (for email registration), authentication tokens. Required information (Service): - Article URLs, titles, extracted body text, and related metadata saved through the web application or Chrome extension. Automatically generated information: - AI-generated summaries, key points, concept tags, content classifications, and embedding vectors produced by processing your saved content. Service usage information: - Usage records (e.g., save counts, AI analysis counts), subscription information, promotional code redemption records. Social activity information (optional): - Shared links, comments, likes, and display names created through the social features of the Service. Device and access information: - IP address, User-Agent string, browser type, Chrome extension version, access timestamps. OAuth information: - Social login provider (Google, GitHub, Facebook, Kakao) identifiers, email addresses, names, and profile images as authorized by you during the OAuth flow. Analytics information: - Website usage data collected through Google Analytics (e.g., page views, events, session duration). Collection methods: Direct input during registration; automatic collection through the web application, Chrome extension, cookies, and analytics tools; information received from third-party OAuth providers upon your authorization.

3. Retention Periods

We retain personal information only for as long as necessary to fulfill the purposes for which it was collected, or as required by applicable law. When the retention period expires, personal information is promptly destroyed. Service usage period: - Account information, saved content, and AI-generated data are retained while your account remains active. Upon account deletion, data is destroyed within 30 days, except as required by law. Statutory retention periods (Korean law): - Records of contracts and withdrawal of offers (Act on Consumer Protection in Electronic Commerce): 5 years - Records of payment and supply of goods/services: 5 years - Records of consumer complaints and dispute resolution: 3 years - Login and access logs (Protection of Communications Secrets Act): 3 months

4. Disclosure to Third Parties

We do not sell, rent, or trade your personal information. We may disclose personal information to third parties only in the following circumstances: (a) With your explicit consent. (b) Where required by applicable law, regulation, or legal process. (c) To protect the rights, property, or safety of the Company, our users, or the public. (d) In connection with a merger, acquisition, or sale of all or a portion of our assets, with notice to affected users.

5. Delegation of Processing

We use the following trusted service providers to operate and improve the Service. These providers process personal information only within the scope of their delegated tasks and under contractual data protection obligations. - AI processing (Google Gemini, OpenAI): Article summarization, key point extraction, concept tagging, embedding generation. - Payment processing (Paddle): Subscription management, payment processing, tax collection, refund processing. - Cloud infrastructure (Cloudflare): Service hosting, data storage, and computational processing. - AI observability (Langfuse): AI call logging and performance monitoring. - Error tracking (Sentry): Error reporting, diagnostic data collection. - Analytics (Google Analytics): Website usage statistics and user behavior analysis.

6. International Transfer of Personal Information

To provide the Service, your personal information may be transferred to and processed in countries outside your country of residence. We implement appropriate safeguards for all international transfers in accordance with applicable data protection laws. The following transfers are currently in effect: - Google (Gemini API) | United States | AI summarization and analysis | Article content, titles, URLs | Retained for up to 55 days for abuse monitoring (paid API; not used for model training) - OpenAI | United States | AI summarization and analysis (alternative provider) | Article content, titles, URLs | Retained for up to 30 days - Paddle | United Kingdom / United States | Payment processing | Email, payment information | Retained per Paddle's privacy policy - Langfuse | Germany (EU) | AI observability | AI call logs (may include prompt/response data) | Retained per retention settings - Sentry | United States | Error tracking | Error logs, user identifiers | Retained per Sentry's data retention policy For transfers from the EU/EEA, we rely on Standard Contractual Clauses (SCCs) or applicable adequacy decisions. For transfers from Korea, we comply with PIPA requirements for cross-border data transfers, including obtaining consent where required.

7. Destruction Procedures and Methods

When personal information is no longer needed for its intended purpose or the retention period has expired, it is promptly destroyed according to the following procedures: Procedure: The information subject to destruction is identified, approved by the person responsible for personal information protection, and then destroyed. Methods: - Electronic files: Permanently deleted using methods that prevent recovery (e.g., cascading database deletion, secure file erasure). - Physical documents: Shredded or incinerated.

8. Data Subject Rights and How to Exercise Them

You have the following rights regarding your personal information, which you may exercise at any time: (a) Right of access: Request access to your personal information and details of its processing. (b) Right to correction: Request correction of inaccurate or incomplete personal information. (c) Right to deletion: Request deletion of your personal information, subject to legal retention requirements. (d) Right to suspend processing: Request that we suspend the processing of your personal information. (e) Right to data portability: Request a copy of your personal information in a structured, commonly used format (where technically feasible). (f) Right to object: Object to the processing of your personal information, including for automated decision-making. How to exercise your rights: Send a request to shickcoong777@gmail.com specifying which right you wish to exercise. We will verify your identity and process your request within 10 days. If we cannot comply with your request, we will notify you of the reason within the same period. You may exercise these rights directly or through a legally authorized representative. If you use a representative, a power of attorney must be submitted.

9. Automated Decision-Making

The Service uses AI technology to perform automated processing of your saved content. In accordance with Article 37-2 of the Korean Personal Information Protection Act, we disclose the following: Types of automated decisions: - Content type classification (e.g., news article, technical blog, academic paper) - AI-generated summarization and key point extraction - Automatic concept extraction and tagging - Similarity-based article recommendations via vector embeddings (cosine similarity) Key personal information used: Article titles, body text, URLs, and content metadata. These automated processes are designed to assist your knowledge management and do not produce decisions with legal or similarly significant effects on you. All AI-generated results are provided for reference purposes only. Your rights: You may request an explanation of how automated decisions were made and may object to such processing. To do so, contact us at shickcoong777@gmail.com.

10. Cookies and Tracking Technologies

We use cookies and similar technologies to operate and improve the Service. Types of cookies used: - Essential cookies: Required for authentication, session management, and security. These cannot be disabled without losing core functionality. - Preference cookies: Store your language, theme, and display settings. - Analytics cookies: Collect usage statistics through Google Analytics to help us understand how the Service is used and improve it accordingly. Cookie management: You can manage or delete cookies through your browser settings. Please note that disabling essential cookies may prevent you from using the Service. For users in the EU/EEA, non-essential cookies are only set with your prior consent. Do Not Track: We currently do not respond to Do Not Track (DNT) browser signals, as there is no universally accepted standard for DNT compliance.

11. Behavioral Information Collection (Chrome Extension)

The Daila Chrome extension collects certain behavioral information to provide its core functionality. Information collected: - URLs and body text of web pages you explicitly choose to save - Page metadata (title, author, publication date) of saved pages - Extension usage events (e.g., save button clicks) Purpose: To enable article saving, AI analysis, and content management within the Service. Information NOT collected: - General browsing history or activity on pages you do not save - Data from other browser tabs or windows - Keystrokes, form inputs, or credentials on any website The extension operates in compliance with applicable browser extension data-use policies. Data collected through the extension is used solely for user-facing features of the Service and is never used for advertising, sold to data brokers, or transferred to third parties for purposes unrelated to the Service.

12. Security Measures

We implement the following technical and organizational measures to protect your personal information: Technical measures: - All data transmitted over HTTPS (TLS encryption in transit) - Database access mediated through authenticated Cloudflare Worker bindings - Secrets managed through Cloudflare Workers secrets - Internal task ingress protected by a dedicated token Organizational measures: - Access to personal information restricted to authorized personnel on a need-to-know basis - Internal data handling procedures and guidelines - Regular review of security practices

13. Data Protection Officer

For any inquiries, complaints, or requests related to the processing of your personal information, please contact: Data Protection Contact: - Service: Daila - Email: shickcoong777@gmail.com The Data Protection Contact will respond to your inquiries and process your data subject rights requests.

14. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or Service features. Notification procedures: - For general changes: We will post the updated policy on the Service and announce the changes at least 7 days before the effective date. - For significant changes that materially affect your rights (e.g., changes to the categories of information collected, purposes of processing, or third-party disclosures): We will provide at least 30 days' prior notice through in-service announcements and, where feasible, individual notification (e.g., email). The revised policy takes effect on its stated effective date. Your continued use of the Service after the effective date constitutes acceptance of the updated policy.

15. Remedies for Rights Violations

If you believe your personal information rights have been violated, you may seek assistance from the following organizations: Korean agencies: - Personal Information Dispute Mediation Committee: (02) 2100-2499 | https://www.kopico.go.kr - Korea Internet & Security Agency (KISA) Privacy Center: 118 | https://privacy.kisa.or.kr - Supreme Prosecutors' Office Cyber Investigation Division: (02) 3480-3573 - Korean National Police Agency Cyber Bureau: 182 | https://ecrm.cyber.go.kr For EU/EEA users (GDPR): You have the right to lodge a complaint with your local data protection supervisory authority. You also have the right to access, rectification, erasure, restriction of processing, data portability, and to object to processing. To exercise these rights, contact us at shickcoong777@gmail.com. For California users (CCPA/CPRA): You have the right to know what personal information we collect and how it is used, the right to request deletion, and the right to opt out of the sale or sharing of personal information. We do not sell your personal information. To exercise your rights, contact us at shickcoong777@gmail.com. We will not discriminate against you for exercising your CCPA rights.