Comitia Privacy Policy
This English translation is provided for convenience only. If there is any discrepancy between this translation and the Korean original, the Korean version shall prevail.
Lindy Operation, Inc. (hereinafter the "Company") complies with the Personal Information Protection Act and other applicable laws and regulations, and establishes and discloses this Privacy Policy in order to safely process users' personal information as follows.
- Service name: Comitia
- Operator: 주식회사 린디오퍼레이션 (Lindy Operation, Inc.)
- Business registration number: 193-87-03843
- Address: Unit 1413, DMC Star Palace, 34 Kkotmaeul-ro, Deogyang-gu, Goyang-si, Gyeonggi-do, Republic of Korea
- Effective date: October 21, 2026
Article 1 (General Provisions)
(1) This Policy applies to all users of the Comitia service (web).
(2) The Company processes personal information only within the purposes specified in this Policy, and where the purpose changes, the Company will take necessary measures, such as obtaining separate consent, in accordance with applicable law.
(3) The Company does not collect personal information from children under the age of 14, and children under 14 may not register for the Service.
Article 2 (Items of Personal Information Collected)
The Company collects only the minimum personal information necessary to provide the Service.
1. Registration and login
| Category | Items | Required/Optional |
|---|---|---|
| Email registration | Email address, password, name | Required |
| Social login (Google, Apple) | Social account identifier (registration channel and unique ID) | Required |
| Social login (Google, Apple) | Email address, name (if provided by the social account) | Depends on social account settings |
- Passwords are stored only in one-way encrypted form (bcrypt hash) that cannot be decrypted; the Company does not store the plaintext password.
- If a user declines to share their email address when signing in with Apple, they may still register without an email address, in which case a substitute address for internal identification purposes is generated automatically.
2. Workspace (company) information
| Item | Required/Optional |
|---|---|
| Company name | Required |
3. Data entered or uploaded by users
- Business-related materials: transaction records, documents, notes, and other text data that users directly enter or upload
- Uploaded files: file names and text content extracted from files (the original files themselves are not stored on the server)
- Web page addresses (URLs) entered by users and text retrieved from those pages
- Data source (connector) information: source type, name, and connection settings
4. Information automatically generated or collected while using the Service
- Date and time of registration; date and time of data creation and modification
- Conversation history with the AI assistant (questions, answers, and the source information underlying answers)
- Knowledge pages generated by the AI by organizing the user's data
- Server error logs (time of error, request path, etc.). Access information such as IP addresses may be automatically recorded in the hosting infrastructure's access logs.
5. Cookies and device-stored information
The Company does not use cookies or behavioral-information collection tools (such as advertising or analytics SDKs). Authentication tokens and workspace identifiers used to maintain login state are stored only in the user's device browser storage (localStorage) and are deleted upon logout.
Article 3 (Methods of Collecting Personal Information)
The Company collects personal information through the following methods:
- Direct input by the user during registration, login, and workspace creation
- Receipt of verified account information from Google or Apple upon social login
- Direct input or upload by the user on the Service screen, or collection requested by the user by registering a web page address
- Automatic generation by the system in the course of using the Service
Article 4 (Purposes of Use of Personal Information)
The Company uses the personal information it collects only for the following purposes:
- Member identification and authentication: processing registration and login, and confirming access to the user's own workspace
- Provision of the Service: collecting and organizing the business data entered by the user (generating knowledge pages) and providing question-and-answer responses through the AI assistant
- Service operation and stability: diagnosing and resolving errors, and preventing fraudulent use
Article 5 (Retention and Use Period of Personal Information)
(1) The Company retains and uses a user's personal information until the user withdraws from membership, and destroys it without delay upon withdrawal. Membership withdrawal may be requested by email to the Personal Information Protection Officer designated in Article 11.
(2) When a knowledge page is deleted, that page is immediately removed from the database. When a data source connection is disconnected, the original data already collected is not deleted and remains stored; users who wish to have the original data or AI conversation history deleted may request this by email as set out in Article 11.
(3) Where applicable law requires records to be retained (such as records arising from contracts or payments), the necessary items are separately retained for the period prescribed by that law. Service access records are kept for a short period under the log retention policy of the hosting provider (Vercel) and then automatically deleted.
Article 6 (Provision of Personal Information to Third Parties)
The Company does not provide users' personal information to third parties. If provision to a third party becomes necessary in the future, the Company will disclose the recipient, purpose, items, and retention period, and obtain separate consent.
Article 7 (Outsourcing of Personal Information Processing and Cross-Border Transfer)
(1) The Company outsources the processing of personal information as follows in order to provide the Service, and where the recipient is a foreign entity, the Company discloses the cross-border transfer details together, in accordance with Article 28-8 of the Personal Information Protection Act.
| Recipient (transferee) | Country | Items transferred | Purpose of transfer | Method of transfer | Retention/use period |
|---|---|---|---|---|---|
| Vercel Inc. (vercel.com) | United States | All information transmitted to the server in the course of using the Service; access and error logs | Web/API server hosting and operation (compute region: Seoul) | Transmission over the network while using the Service | Until termination of the outsourcing agreement or withdrawal of membership |
| Supabase Inc. (supabase.com) | United States (data storage location: Seoul, Republic of Korea region) | All items stored as described in Article 2 | Database storage and management | Transmission over the network while using the Service | Until termination of the outsourcing agreement or withdrawal of membership |
| Anthropic PBC (anthropic.com) | United States | Company name; conversation content entered by the user into the AI assistant; content of the company's knowledge pages; original data subject to organization | Generating AI responses and automatically organizing data | Transmission via API upon AI processing requests | Retained for a limited period under Anthropic's commercial API data policy after processing is complete, then destroyed (not used for model training) |
(2) The transfers above are outsourcing arrangements essential to the provision of the Service. Users may refuse the cross-border transfer, but in that case use of the Service will not be possible. A refusal of cross-border transfer may be requested through the contact set out in Article 11.
(3) The Company manages and supervises its outsourcing partners to ensure they process personal information safely.
Article 8 (Procedures and Methods for Destroying Personal Information)
(1) The Company destroys, without delay, personal information for which the retention period has elapsed or the processing purpose has been achieved.
(2) Information in electronic file form is permanently deleted from the database using methods that prevent recovery. The Company does not retain personal information in physical form, such as on paper.
(3) Information that must be retained under applicable law is stored separately and destroyed immediately once the retention period has elapsed.
Article 9 (Rights of Data Subjects and How to Exercise Them)
(1) Users may exercise the following rights at any time:
- Request to access personal information
- Request to correct errors, if any
- Request for deletion (including withdrawal of membership)
- Request to suspend processing
(2) What users can do directly within the Service: view entered data and knowledge pages, and disconnect data source connections. For other rights — such as checking or modifying account information, modifying workspace information, or deleting knowledge pages, original data, or conversation history — users may request action, which the Company will take without delay, by emailing the Personal Information Protection Officer designated in Article 11.
(3) Rights may also be exercised through a user's legal representative or an authorized agent, in which case a power of attorney that satisfies the requirements of applicable law must be submitted.
(4) Until a correction or deletion is completed, the Company will not use or provide the relevant personal information.
Article 10 (Measures to Ensure the Security of Personal Information)
The Company takes the following measures to ensure the safe processing of personal information:
- One-way encryption of passwords: passwords are stored only as bcrypt hashes; the Company does not retain plaintext passwords.
- Encryption in transit: communications between the Service and the server, and between the server and the database, are encrypted using TLS/SSL.
- Access control: token (JWT)–based authentication is applied, and users can access only the data in their own workspace.
- Account protection: upon social login, the Company links to an existing account only where ownership of the email has been verified, in order to prevent account takeover.
- Minimization of access rights: the number of personnel with access to personal information is kept to the minimum necessary.
Article 11 (Personal Information Protection Officer)
The Company designates the following Personal Information Protection Officer, who oversees personal information processing and handles users' complaints and remedies for damage:
- Name: 이대훈
- Title: CEO (대표)
- Email: danny@lindyoperation.com
If you need to report a personal information infringement or seek consultation, you may contact the following organizations:
- Personal Information Infringement Report Center (privacy.kisa.or.kr / 118, no area code)
- Personal Information Dispute Mediation Committee (kopico.go.kr / 1833-6972)
- Supreme Prosecutors' Office Cyber Investigation Division (spo.go.kr / 1301, no area code)
- National Police Agency Cyber Investigation Bureau (ecrm.police.go.kr / 182, no area code)
Article 12 (Amendment and Notification of the Privacy Policy)
(1) This Policy is effective as of September 17, 2026.
(2) If this Policy is amended due to changes in applicable law, the content of the Service, or the Company's internal policies, the Company will post notice on the Service's initial screen or on a website operated by the Company at least 7 days before the effective date (or at least 30 days before the effective date, if there is a material change to users' rights).