This English version is a translation provided for convenience. If there is any inconsistency between this translation and the Korean version, the Korean version prevails.
In accordance with Article 30 of the Personal Information Protection Act of Korea (the "PIPA"), Nexora (the "Operator") establishes and discloses this Privacy Policy to protect the personal information of users of the Ollarai service (the "Service") and to handle related complaints promptly and smoothly.
At a glance
- What we collect
- Email, password (encrypted), Google account information (if you sign in with Google), questions and query history, access logs, payment and subscription information (if you use the Paid Service)
- Why
- Account management, answering your questions, payments for the Paid Service, improving the Service and our AI
- Sharing with third parties
- Paddle (overseas payments only)
- Processors
- Supabase, Amazon Web Services, Google, our payment service provider in Korea
- International transfers
- Japan (authentication), United States (question analysis, analytics), United Kingdom (overseas payments)
- Contact
- contact@ollarai.com
Article 1. Purposes of Processing
The Operator processes personal information for the purposes below and does not use it for any other purpose. If a purpose changes, the Operator will take the necessary measures, such as obtaining separate consent under Article 18 of the PIPA.
- Account registration and management: identifying members, email verification, managing usage limits, and processing account closure
- Providing the Service: analyzing questions, generating data queries (SQL), and providing query results
- Payments for the Paid Service: subscription and recurring payments, handling withdrawals and refunds, payment-related notices and support, and preventing fraudulent payments
- Improving the Service and our AI: analyzing errors, improving retrieval-augmented generation (RAG) data, and training and evaluating AI models (using pseudonymized data under Article 8)
- Preventing misuse: detecting and blocking abnormal access and excessive requests
- Notifying pre-registered users: sending news about the launch and beta opening
- Website analytics: understanding traffic and improving the website
Article 2. Personal Information We Process
| Category | Items | How collected |
|---|---|---|
| Sign-up (required) | Email address, password, display language | Sign-up screen |
| Google sign-in (required if chosen) | Email address, name, profile picture, Google account identifier | Received from Google |
| Using the Service (required) | Questions you enter, SQL and query results generated from them, answer mode (free/paid), usage counts (daily for the free mode, monthly for the paid mode), last access time, IP address | Generated or collected while you use the Service |
| Domestic payments (required for the Paid Service) | Order number, payment amount and time, payment status, card issuer, partially masked card number, billing key for recurring payments, subscription information (plan, start date, next billing date, cancellation time) | Collected through our payment service provider on the checkout screen |
| Overseas payments (required for the Paid Service) | Paddle customer and subscription identifiers, order number, payment amount, currency and time, payment status, country, subscription information (plan, start date, next billing date, cancellation time) | Received from Paddle |
| Pre-registration (optional) | Email address, registration date and time, selected language | Pre-registration form on the website |
| Website visits (automatic) | Cookie identifiers, pages visited and time of visit, browser and device information, IP address | Google Analytics |
- Passwords are stored with one-way encryption by our authentication provider (Supabase), and the Operator cannot see the original password.
- Please do not enter your own or anyone else's personal information (such as names, phone numbers, or account numbers) in the question field. Questions you enter are processed for the purposes in Article 1.
- Payment method details such as the full card number, expiry date, and CVC are processed directly by our payment service provider or Paddle, and the Operator does not store them.
- For overseas payments, information that Paddle collects directly on its checkout screen as the Merchant of Record (such as your name, email address, payment method, and billing country and postal code) is handled under the Paddle Privacy Policy.
- The Operator does not collect sensitive information or unique identification information (such as resident registration numbers or passport numbers).
Article 3. Retention Periods
The Operator processes and retains personal information within the retention period required by law or consented to when the information was collected.
| Information | Retention period | Basis |
|---|---|---|
| Account information (email, account identifier, usage tier) | Until account closure | Performance of the service agreement |
| Questions, query history, access logs | 180 days from collection | Performance of the service agreement, error analysis, and misuse prevention |
| Billing key for recurring payments, subscription information | Until the subscription is cancelled or the account is closed | Performance of the service agreement |
| Records of contracts and withdrawals | 5 years | Article 6 of the Act on the Consumer Protection in Electronic Commerce |
| Records of payments and supply of goods or services | 5 years | Article 6 of the Act on the Consumer Protection in Electronic Commerce |
| Records of consumer complaints and dispute handling | 3 years | Article 6 of the Act on the Consumer Protection in Electronic Commerce |
| Pseudonymized question data | 3 years from pseudonymization | Article 28-2 of the PIPA |
| Pre-registration email | Until the launch notice is sent or you opt out (request deletion) | Consent |
| Website analytics | 2 months from collection | Consent (cookie settings) |
Article 4. Destruction Procedure and Method
- Procedure: The Operator destroys personal information without delay (within 5 days) once its retention period expires or its purpose is fulfilled. Information with automatic deletion set up, such as access logs, is deleted automatically when its retention period ends. If other laws require information to be kept, it is moved to a separate database, stored separately, and not used for any other purpose.
- Method: Electronic files are deleted using technical methods that make them unrecoverable, and paper documents are shredded or incinerated.
Article 5. Provision to Third Parties
The Operator processes personal information only within the scope stated in Article 1 and provides it to third parties only in the cases set out in Articles 17 and 18 of the PIPA, such as with your consent or under specific provisions of law. Only for members who choose overseas payment, the Operator provides personal information as follows with consent obtained on the checkout screen.
| Recipient | Purpose | Items | Retention |
|---|---|---|---|
| Paddle.com Market Limited | As Merchant of Record: selling the Paid Service, billing and payment, tax collection and filing, refunds, and fraud prevention | Email address, account identifier, selected plan | As set out in Paddle's Privacy Policy and applicable laws (such as tax laws) |
You may refuse this consent, in which case you cannot use overseas payment (domestic payment and the free mode are not affected).
Article 6. Entrustment of Processing
The Operator entrusts the processing of personal information as follows to provide the Service. The entrustment lasts until account closure or the end of the entrustment agreement.
| Processor | Task | Location |
|---|---|---|
| Supabase Inc. | Member authentication (sign-up, sign-in, Google sign-in, verification and password reset emails) and storage of account information | Japan |
| Amazon Web Services, Inc. | Server operation, storage of data and access logs, storage of pre-registration information | Republic of Korea (Seoul region) |
| Payment service provider in Korea (name to be added once contracted) | Processing domestic payments and managing payment methods for recurring billing | Republic of Korea |
| Google LLC (Gemini API) | Analyzing questions and verifying and refining generated SQL | United States |
| Google LLC (Google Analytics) | Website analytics | United States |
Under Article 26 of the PIPA, the Operator sets out in writing, such as in the entrustment agreement, the prohibition of processing for purposes other than the entrusted task, technical and administrative safeguards, restrictions on re-entrustment, management and supervision of the processor, and liability such as compensation for damages, and supervises whether processors handle personal information safely. Any change of processor or entrusted task will be disclosed through this Privacy Policy.
Article 7. International Transfers
Under Article 28-8(1)(iii) of the PIPA, the Operator transfers personal information abroad (through entrustment and storage) as follows to enter into and perform the service agreement. The transfer to Paddle for overseas payments is made with your consent, obtained on the checkout screen, under Article 28-8(1)(i).
| Recipient | Country | Items | Purpose | Timing and method | Retention |
|---|---|---|---|---|---|
| Supabase Inc. supabase.com/privacy | Japan | Email address, encrypted password, account identifier, display language; with Google sign-in, name, profile picture and Google account identifier | Member authentication | Sent over the network at sign-up and sign-in | Until account closure |
| Google LLC (Gemini API) policies.google.com/privacy | United States | Questions you enter (including translated or processed forms) | Analyzing questions and verifying and refining SQL | Sent over the network when you submit a question | As set out in Google's API terms of service |
| Google LLC (Google Analytics) policies.google.com/privacy | United States | Cookie identifiers, visit records, IP address | Website analytics | Sent over the network when you visit the website | 2 months from collection |
| Paddle.com Market Limited paddle.com/legal/privacy | United Kingdom | Email address, account identifier, selected plan | Overseas payments (Merchant of Record) | Sent over the network when you proceed with an overseas payment | As set out in Paddle's Privacy Policy and applicable laws |
How to refuse: If you do not want your information transferred abroad for authentication and question analysis, you may choose not to sign up or request account closure as described in Article 9; in that case you cannot use the member service. You can refuse the transfer to Google Analytics as described in Article 10 without affecting your use of the Service. You can refuse the transfer to Paddle by not consenting on the checkout screen, in which case you cannot use overseas payment.
Article 8. Processing of Pseudonymized Information
To improve the Service and our AI models, the Operator pseudonymizes question data and uses it under Article 28-2 of the PIPA.
- Purpose: technology development and research, such as improving retrieval-augmented generation (RAG) data and training and evaluating AI models
- Items: questions you enter, and the SQL and processing results generated from them
- Pseudonymization method: information that can identify you, such as your email address, account identifier, and IP address, is deleted so the data cannot be linked to your account. If a question appears to contain personal information, that part is deleted or the question is excluded from training data.
- Retention: 3 years from pseudonymization
- Provision to third parties: pseudonymized information is not provided to any third party.
- Safeguards: no additional information that would allow re-identification is kept, access to pseudonymized information is restricted, and processing records are kept.
- Opting out of training: if you do not want your questions used for training, you may request this as described in Article 9, and questions not yet pseudonymized will be excluded from training data. Data that has already been pseudonymized cannot be linked to you, so it may not be possible to find and delete it individually.
Article 9. Your Rights and How to Exercise Them
- You may at any time request access to, correction or deletion of, or suspension of processing of your personal information, or withdraw your consent (Articles 35 to 37 of the PIPA).
- You may exercise these rights by email (contact@ollarai.com) or in writing (26 Gwandae-gil, Room 203, Gangneung-si, Gangwon State, Republic of Korea). After verifying your identity, the Operator will act without delay (within 10 days) and inform you of the result.
- To close your account, send a request to the email address above from the email address you signed up with. Your account information will be destroyed without delay. However, payment records are stored separately for the periods required by law under Article 3 and then destroyed.
- You may also exercise your rights through a representative, such as your legal representative or a person you have authorized. In that case, a power of attorney must be submitted.
- Requests may be restricted where the law so provides, such as under Article 35(4), Article 36(1), and Article 37(2) of the PIPA, in which case we will tell you the reason.
- Data transfer requests: The Operator is not currently subject to the transmission obligation under Article 35-2 of the PIPA, but on request will provide your account information and stored question history as a CSV or JSON file.
- You must keep your personal information accurate and must not infringe on, or enter into questions, the personal information of others.
Article 10. Automatic Collection Tools and How to Refuse Them
- Browser storage: authentication information that keeps you signed in, and display settings (language, display currency for amounts, whether the introduction was shown, your answer mode selection), are stored in your browser's local storage. Authentication information is deleted when you sign out.
- Google sign-in: the Google sign-in button on the sign-in screen is provided by Google, which may use cookies and similar technologies to show the button and process the sign-in, under the Google Privacy Policy.
- Analytics cookies: Google Analytics cookies are used for website analytics.
- Checkout screen: on the checkout screen, our payment service provider or Paddle may use cookies and similar technologies for payment processing and fraud prevention, under their own privacy policies.
- The Operator does not collect or use behavioral information for online targeted advertising and does not use advertising cookies.
How to refuse
- Chrome: Settings > Privacy and security > Third-party cookies, or Delete browsing data
- Safari: Settings > Privacy > Manage Website Data
- Edge: Settings > Cookies and site permissions > Manage and delete cookies and site data
- Firefox: Settings > Privacy & Security > Cookies and Site Data
- To refuse only Google Analytics, install the Google Analytics Opt-out Browser Add-on.
If you block browser storage, you will not stay signed in and cannot use the member service. Refusing analytics cookies does not affect your use of the Service.
Article 11. Automated Decisions
The Operator does not make automated decisions within the meaning of Article 37-2 of the PIPA. The AI in the Service is used to turn your questions into data queries (SQL) and show the results, and it does not make decisions that affect your rights or obligations. Daily usage limits for the free mode and monthly limits for the paid mode are applied equally to all members according to criteria announced in the Service.
Article 12. Children's Personal Information
Children under 14 may not sign up for the Service, and the Operator does not collect personal information from children under 14. If the Operator learns that a child under 14 has signed up, it will destroy that personal information without delay.
Article 13. Security Measures
- Administrative: personal information handlers are limited to the representative, and access rights are reviewed regularly.
- Technical: encryption in transit (HTTPS), one-way encrypted password storage, authentication token verification, least-privilege access control (including a separate read-only account for data queries), retention of access logs, and separate storage of member information and service data. Payment method details such as card numbers are not stored.
- Physical: personal information is stored in the data centers of our cloud providers (Amazon Web Services, Supabase), and physical security such as access control follows those providers' security programs.
Article 14. Privacy Officer and Access Request Contact
The Operator's representative bears final responsibility for the processing of personal information and has designated the privacy officer below to oversee personal information processing and to handle complaints and remedies. Requests for access to personal information are received and handled at the same contact.
- Privacy officer: Taeho Jeon (Representative)
- Email: contact@ollarai.com
- Address: 26 Gwandae-gil, Room 203, Gangneung-si, Gangwon State, Republic of Korea
Article 15. Remedies for Infringement
To seek remedies for infringement of your personal information, you may apply for dispute resolution or counseling to the following Korean organizations.
- Personal Information Dispute Mediation Committee: +82-1833-6972 (www.kopico.go.kr)
- Personal Information Infringement Report Center (KISA): 118 within Korea (privacy.kisa.or.kr)
- Supreme Prosecutors' Office: 1301 within Korea (www.spo.go.kr)
- Korean National Police Agency: 182 within Korea (ecrm.police.go.kr)
Article 16. Changes to This Privacy Policy
If this Privacy Policy is amended, we will announce the changes on the website and in the Service at least 7 days before they take effect. For important changes that affect your rights, such as adding collected items or purposes, we will also notify members individually by email.
Revision history
- October 3, 2026: Established
- October 19, 2026: Added processing of pseudonymized information to improve the Service and AI (Article 8), detailed international transfer information, and supplemented required disclosures such as provision to third parties, destruction procedures, and remedies for infringement
- November 20, 2026: With the introduction of the Paid Service, added purposes, items, and retention periods for payment and subscription information, entrustment to our payment service provider in Korea, and provision and international transfer to Paddle for overseas payments; added the items processed for Google sign-in, updated the usage limit and browser storage items, and removed the operator approval step
This Privacy Policy takes effect on November 20, 2026.