Account Privacy Policy

1. Information we process and how we collect it

Email sign-up: Email address, name, and password (stored by the authentication provider in a non-reversible encrypted form)
Google sign-up and sign-in: Google account identifier, email address, name, and profile image URL
Using the account: Consent records for the account terms and each product's terms (agreed version and time)
Generated automatically: IP address, sign-in and authentication logs, browser information, and sign-in cookies

We collect this during sign-up, Google sign-in, and sign-in and verification.

2. Purposes

Identifying accounts, confirming sign-up, and verifying email
Signing in to the Operator's products with the same account and keeping you signed in
Resetting passwords and responding to account security incidents
Announcing account-related changes and answering inquiries

3. Retention and deletion

We keep account information until the account is deleted and destroy it without delay afterward.
Leaving a product does not delete account information. You can request account deletion at datasynalyst@gmail.com.
Information that applicable law requires us to keep is stored separately for the required period and then destroyed.

4. Disclosure to third parties

The Operator does not provide personal information to third parties except with your consent or as required by law.

5. Processors

Supabase, Inc.: Account authentication and storage
Supabase: Sending verification and password reset emails

The Operator sets data protection obligations in its processing agreements and supervises processors to ensure they handle personal information safely.

6. International transfer

Recipient: Supabase, Inc. (https://supabase.com)
Country: Australia
When and how: Transmitted over the network when you sign up or sign in
Information: All information listed in section 1
Purpose: Account authentication and storage
Retention: Until the account is deleted

When you sign in through a product's server, that server's processing and international transfer are covered by the product's privacy policy.

If you do not want your information transferred abroad, you can choose not to sign up or request account deletion. In that case you cannot use products that sign in with the account.

7. Your rights

You may request access to, correction, deletion, or suspension of processing of your account information at any time.
You can change your password with password reset on the sign-in screen.
Send account deletion and any other request to datasynalyst@gmail.com; we will act on it without delay after confirming your identity.

8. Cookies

We use authentication cookies to keep you signed in. Cookies are stored only for the address of the product you signed in to, and we do not use advertising or tracking cookies. You can refuse cookies in your browser, but you will not be able to sign in.

9. Security measures

Passwords are stored in a non-reversible encrypted form.
All traffic is encrypted with HTTPS.
Product servers hold no administrator key for all accounts and access account information only with the signed-in user's own permissions.
We keep access logs and apply security updates.

10. Children under 14

Children under 14 cannot sign up, and the Operator does not collect their personal information.

11. Privacy officer

In charge: Lulu Labs
Contact: datasynalyst@gmail.com

12. Remedies

For advice or dispute resolution about privacy violations, you can contact the following Korean agencies.

Personal Information Dispute Mediation Committee: 1833-6972 (www.kopico.go.kr)
Personal Information Infringement Report Center: 118 (privacy.kisa.or.kr)
Supreme Prosecutors' Office: 1301 (www.spo.go.kr)
Korean National Police Agency: 182 (ecrm.police.go.kr)

13. Changes to this policy

This policy applies from 2026-09-27. We announce changes in the Service at least 7 days before they take effect, or 30 days for significant changes, and ask for your consent again.