Piuda Privacy Policy

Last Updated: September 29, 2026 · Effective Date: September 29, 2026 · Version: v1.3.0

⚠️ Important Notice

Piuda (the “Service”) is not officially offered in the United States, EU member states, EEA member states, the United Kingdom, or any other country or region that Passion Factory Corporation (the “Company”) expressly designates as an unsupported region. Accordingly, this Privacy Policy is not intended to represent that the Service satisfies all requirements of privacy laws applicable in those excluded regions, including the GDPR, UK GDPR, and CCPA/CPRA, and should not be interpreted as an offer of the Service to users in those regions. For more information about excluded regions, please see Sections 4 and 25C of the Piuda Terms of Service.

This Privacy Policy (the “Policy”) explains how the Company collects, uses, stores, outsources the processing of, transfers, and deletes personal information in connection with the Piuda Service, and how users can exercise their rights.

This Policy has been prepared in accordance with Korea’s Personal Information Protection Act (PIPA), the Act on Promotion of Information and Communications Network Utilization and Information Protection, etc., the Act on the Protection and Use of Location Information, and other applicable laws. Additional provisions under Japan’s Act on the Protection of Personal Information (APPI) apply to users residing in Japan.

Any term used but not defined in this Policy has the meaning given in the Piuda Terms of Service.

Key Information

This summary is provided for convenience. The detailed rights and obligations are set out in the sections below.

1. Company Information

1.1 Personal Information Controller

1.2 Chief Privacy Officer

1.3 Privacy Contact

Routine questions about personal information processing and requests to exercise privacy rights are handled by the Chief Privacy Officer or through the same contact information listed above.

1.4 Notice About Excluded Regions

The Company does not currently designate the United States, EU/EEA, the United Kingdom, or any other region expressly identified by the Company as unsupported as an official service region. Accordingly, the Company has not appointed an Article 27 representative under the GDPR or UK GDPR for those regions. This Policy should not be interpreted as a guarantee that the Company already satisfies all legal requirements in those excluded regions or as an offer of the Service to users in those regions.

2. Scope of This Policy

2.1

This Policy applies to:

• Users who register for a Piuda account;
• Users of the Free, Pro, and Academy/Business plans;
• Administrators and members of Academy/Business organization workspaces;
• Visitors to the Company’s website or Service; and
• All users of the desktop app and web application.

2.2

This Policy applies to users in official service regions permitted under Sections 4 and 25C of the Piuda Terms of Service. Users in excluded regions, including the United States, EU/EEA, the United Kingdom, and any country or region expressly designated by the Company as unsupported, are not within the intended scope of this Policy, and the Company does not represent that it already satisfies every legal requirement applicable in those excluded regions.

2.3

If this Policy conflicts with the Piuda Terms of Service on a matter involving personal information processing, this Policy controls.

3. Personal Information We Process

3.1 Information Users Provide Directly

3.2 Content Users Upload or Enter

Users may upload or enter the following User Content while using the Service.

User Content may include sensitive or unpublished research material at the user’s discretion. The Company does not require sensitive personal information to use the Service. Whether to upload sensitive information or unpublished research material is the user’s voluntary choice. See Sections 7 and 8 for related responsibilities and safeguards.

3.3 Information Collected Automatically

The Company may use reasonable indicators such as IP address, access location, payment country, billing address, phone-country code, and institutional email domain to restrict account creation, payment, or Service use from excluded regions (see Section 4 of the Piuda Terms of Service).

3.4 Information Received from Third Parties

If additional authentication or payment providers are introduced, the Company will provide notice through this Policy or within the Service.

3.5 Information the Company Does Not Collect

• Korean resident registration numbers, foreigner registration numbers, or similar unique identifying information, except where a social-login or payment provider separately processes such information;
• Ideology or beliefs, trade-union or political-party membership or withdrawal, or political opinions;
• Health or medical information, genetic information, or biometric information;
• Original payment credentials such as card numbers or bank-account numbers. KCP and PayPal process those directly, and the Company receives only payment identifiers and payment results;
• Criminal-history information or credit information;
• Identifying information such as email address or name sent to AI processing providers (OpenAI, Anthropic, Google, Voyage AI); the system is designed to block such transmission; and
• Original paper PDF files, which remain on the user’s device.

The Company recommends that users not upload the information listed above as part of User Content. If users choose to include such information in User Content, that upload is voluntary and remains the user’s responsibility.

3.6 Information About Minors

Minimum age requirements and parental or legal-guardian consent requirements are governed by Sections 5.6 through 5.9 of the Piuda Terms of Service. Until the Company completes the infrastructure needed to process legal-guardian consent, including email verification, identity-verification integration, consent verification, and withdrawal procedures, minors are not permitted to register for or use the Service. Accordingly, as of the effective date of this Policy, the Company does not collect personal information from minors or their legal guardians. If the Company later permits minors to use the Service, it will amend this Policy in advance and separately explain the consent process, data collected, and safeguards.

4. How We Collect Personal Information

The Company collects personal information through the following channels:

• Information entered directly by users on sign-up, login, payment, settings, and similar screens;
• Information automatically generated or collected during Service use, including Better Auth session data, client-side behavioral events captured through the PostHog SDK, Sentry error logs, Cloudflare HTTP metadata, Amazon SES email delivery results, and information generated through newsletter open-tracking images and link-tracking addresses;
• Information received from third-party authentication and payment services such as Google OAuth, KCP, and PayPal; and
• Information users voluntarily provide through customer support inquiries, email, feedback forms, event participation, and similar channels.

5. Purposes of Processing Personal Information

5.1 Processing Purposes

5.2 Purposes for Which the Company Does Not Use Personal Information

6. Legal Bases for Processing

6.1 Users in the Republic of Korea (PIPA)

6.2 Users in Japan (APPI)

The Company processes personal information lawfully within the scope of legitimate business purposes under Japan’s APPI. Personal information is used only for the purposes described in this Policy. If the Company needs to use personal information for a new purpose outside that scope, it will obtain consent in advance. Users residing in Japan may exercise their rights under Section 14.

6.3 Other Supported Regions

For users in other supported regions, mandatory local law prevails if it provides users with rights that are more protective than this Policy.

7. Special Notice About Sensitive Information and Research Data

7.1 The Company Does Not Require Sensitive Personal Information

The Company does not require sensitive personal information, including ideology or beliefs, political opinions, health information, sexual-life information, genetic information, or biometric information as defined under Article 23 of PIPA and applicable regulations, to use the Service. All Service features can be used without providing sensitive personal information.

7.2 User Responsibility for Voluntary Uploads

Users may choose to upload materials such as:

• Unpublished research data;
• Interview transcripts, survey responses, or clinical-trial data;
• Identifiable research-subject information;
• Medical or health-related materials;
• Internal institutional materials, trade secrets, or pre-filing patent materials; and
• Materials belonging to collaborators or protected by an NDA.

Uploading these materials is voluntary. Under Section 9 of the Piuda Terms of Service, users are responsible for the following.

7.3 Structural Safeguards

The Company applies the following structural safeguards in light of the nature of academic and research data.

📌 Absolute Rule for Original PDF Files

Under Piuda’s current technical architecture, original paper PDF files never leave the user’s device. The Company does not upload, store, or transmit original PDF files to Company servers, PostgreSQL, Cloudflare R2, Vercel AI Gateway, OpenAI, Anthropic, Google Gemini, Voyage AI, or external academic-search APIs.

Even when AI analysis is performed, only the minimum data needed for analysis is transmitted through Company servers and AI processing paths, such as parsed text generated on the user’s device, section information, analysis parameters, and prompts. References in this Policy to “PDF analysis,” “PDF preprocessing,” or “paper analysis” therefore do not mean that the original PDF file is sent to a server; they refer only to processing of parsed text generated on the user’s device.

This rule applies regardless of plan type, including Free, Pro, and Academy/Business. It may differ only if the user expressly enables a synchronization, sharing, backup, or integration feature, or if a separate agreement provides otherwise.

The Company’s safeguards do not replace the user’s responsibility to obtain any required permissions or approvals before uploading data.

7.4 Data Requiring the Company’s Prior Written Approval

Users must not upload the following data to the Service without the Company’s prior written approval (see Sections 9.6 and 17.2.5 of the Piuda Terms of Service):

• Personal information of residents of the EU/EEA or United Kingdom;
• Personal information subject to the GDPR or UK GDPR;
• Sensitive information subject to U.S. state privacy laws such as the CCPA/CPRA;
• Protected Health Information (PHI) subject to HIPAA; or
• Other data requiring special regulatory compliance.

If the Company becomes aware that a user has violated this restriction, it may suspend processing, restrict access, delete data, suspend the account, or take other actions under Sections 9.6.1 through 9.6.3 of the Piuda Terms of Service.

7.5 Local Vault

The Company may offer a Local Vault feature on the Pro or Academy/Business plans. Data designated for Local Vault is generally stored only on the local device in SQLite and excluded from server synchronization. If the user runs AI analysis, however, the minimum text needed for the analysis may be sent temporarily through Vercel AI Gateway to an AI processing endpoint using ZDR or a comparable restricted-retention approach where reasonably available (see Section 12 of the Piuda Terms of Service).

8. AI Features and Personal Information Processing

8.1 Overview of Piuda AI Features

Piuda provides AI-assisted features such as:

• Extracting metadata, abstracts, research questions, theoretical background, variables, methodology, and key findings from registered papers, including PDF preprocessing and section detection;
• Cross-paper analysis of similarities, differences, contradictions, and potential connections;
• Exploring research gaps, new research directions, and analytical combinations in Discovery mode;
• Reviewing originality, evidentiary strength, and feasibility of research ideas in Validate & Enrich mode;
• Providing comments to improve research proposals in Research Proposal mode; and
• Academic translation and text embeddings (concept vectorization).

8.2 Single-Channel Gateway Architecture

Piuda routes all LLM and embedding calls through Vercel AI Gateway. Users do not choose an individual AI provider; the Gateway automatically routes each task to an appropriate model.

8.3 Downstream AI Providers (via Gateway)

Specific model versions may change with the production environment. Current information may be provided in Appendix A or within the Service.

8.4 Commitment Not to Use User Content for AI Training

8.5 AI Data Flow

8.6 Limitations of AI Outputs

AI outputs may contain errors, omissions, hallucinations, misattributed sources, or nonexistent literature, figures, or statistics. The Company does not guarantee the accuracy, completeness, or academic validity of AI outputs. Users should verify source materials, citation information, and research-ethics requirements before relying on AI outputs. See Section 8 of the Piuda Terms of Service for more information.

8.7 Automated Decision-Making

The Company does not make decisions based solely on automated processing that produce legal effects or similarly significant effects for users. AI-generated scores, insights, and comments are reference material, and users remain responsible for final research decisions.

8.8 Academic Search APIs

The Company may use external academic database APIs to retrieve scholarly metadata. All calls are made server-side. Personal information such as user email addresses, names, and account identifiers is not sent; only search terms or paper identifiers such as DOI or paper ID are transmitted.

9. Data Handling by Plan

9.1 Free Plan

“Local-first storage” for the Free plan is the default approach used to minimize server-side storage. It does not mean that no data is ever transmitted externally under any circumstances (see Section 11.4.5 of the Piuda Terms of Service).

9.2 Pro Plan

9.3 Academy/Business Plan

For more information about content processing within organization workspaces, see Section 13 of the Piuda Terms of Service.

10. Retention and Use Periods

10.1 General Retention Periods

10.2 Handling After Account Deletion

Because of technical constraints, immediate deletion may not always be possible from backups, logs, caches, or security records. In those cases, the Company takes reasonable measures to ensure that the data is not reused in the ordinary provision of the Service (see Section 19.4 of the Piuda Terms of Service).

10.3 Locally Stored Data

Free plan local SQLite data, desktop-app local storage used for UI state, and Local Vault data are stored on the user’s device and therefore cannot be deleted directly by the Company. Users must delete those data themselves, for example by uninstalling the app, clearing browser data, or resetting the device.

10.4 Dormant Accounts

Under Sections 18.6 through 18.8 of the Piuda Terms of Service, the Company may classify an account as dormant after 12 months or more without Service access.

• The Company may provide advance notice at least 30 days before dormancy through email, in-service notice, a login pop-up, push notification, or similar method;
• If the user does not access the Service after notice, the account may be converted to dormant status; and
• Dormant-account data may be segregated and retained and may later be deleted according to the Company’s dormancy policy and applicable law.

10.5 Leaving an Organization Workspace

When a user leaves an Academy/Business organization, data is handled under Sections 13.6 and 13.7 of the Piuda Terms of Service.

• Personal account data remains associated with the user;
• Organization Content created within the organization workspace may remain with the organization;
• The user’s access to organization data ends immediately; and
• Before access ends, the user may export personal content within a reasonable period where no legal, security, or contractual restriction applies.

11. Measures to Protect Personal Information

11.1 Administrative Safeguards

• Appointment and operation of a Chief Privacy Officer and privacy personnel;
• Periodic privacy training for personnel who process personal information;
• Establishment and implementation of internal privacy-management plans;
• Operation of privacy and access-control policies;
• Periodic review of service providers; and
• Centralized secret management through Infisical for API keys, database passwords, and similar credentials.

11.2 Technical Safeguards

11.3 Physical Safeguards

• Data centers operated by cloud infrastructure providers used by the Company, including Google Cloud Platform, Cloudflare, and AWS, apply industry-standard physical security measures such as access controls, CCTV, and 24-hour monitoring.
• The Company applies security policies to devices used to access internal business systems.

11.4 Requirements for Service Providers

The Company contractually requires the service providers listed in Section 12 to maintain or support the following measures:

• Industry-standard security certifications such as SOC 2, ISO 27001, or comparable certifications;
• Encryption in transit and at rest;
• Access controls and audit logs;
• Security-incident response procedures;
• Processing only on the Company’s instructions;
• No use of User Content for AI model training and prioritization of ZDR or comparable restricted-retention processing where reasonably available.

11.5 Personal Information Breach Notification

12. Outsourcing of Personal Information Processing

12.1 Service Providers and Outsourced Processing

The Company engages the service providers below to process personal information on its behalf as necessary to provide the Service. Appendix A provides more detailed information about the providers, their processing activities, and processing locations. If a provider changes, the Company will update this Policy or provide notice within the Service.

12.2 Controls Applied to Service Providers

Under Section 10.3 of the Piuda Terms of Service, the Company requires service providers to follow, or takes contractual and technical measures designed to ensure, the following:

• Process data only on the Company’s instructions;
• Do not use data beyond the purpose of providing the contracted service;
• Maintain appropriate technical and administrative safeguards;
• Do not use User Content to train AI models, and prioritize ZDR or comparable restricted-retention processing where reasonably available;
• Limit sub-processing or third-party disclosure without the Company’s approval;
• Notify the Company of security incidents and cooperate with incident response;
• Delete or return data after the contract ends or the processing purpose has been fulfilled; and
• Apply protections required by applicable law and this Policy.

12.3 Difference Between Processing Outsourcing and Third-Party Disclosure

Outsourcing personal information processing means that an external service provider processes personal information on the Company’s behalf to provide the Service. This is not a disclosure for the service provider’s own marketing purposes. Service providers may process data only to perform the contracted processing activities and may not use it for their own independent purposes.

12.4 Changes to Service Providers

The Company may change service providers to improve the Service, reduce costs, or strengthen security. If a service provider changes, the Company will update this Policy or provide notice within the Service.

13. Cross-Border Transfers of Personal Information

13.1 Overview

The Company’s main PostgreSQL database and Redis Cloud cache are located in the Seoul Region of the Republic of Korea and therefore do not constitute cross-border transfers. The Amazon SES resources and email event stores used by the Company are also configured in the Seoul Region (ap-northeast-2). During final email delivery, however, information necessary to deliver the message, including the recipient’s email address and email content, may be sent to a mail service outside Korea depending on where the recipient’s mail service operates. This occurs as part of delivering the email to the recipient’s chosen mail service. Other service providers listed below process personal information outside Korea, including in the United States.

13.2 Cross-Border Transfer Details

13.3 Consent to Cross-Border Transfers

Users consent to the cross-border transfers described above through agreement to the Piuda Terms of Service, acknowledgment of this Policy, and where required, a separate cross-border transfer consent process. For PostHog behavioral analytics, separate consent under Article 28-8 of PIPA is obtained through an opt-in banner for anonymous visitors and a cross-border transfer consent screen for logged-in/authenticated users. Google Ads conversion measurement uses a non-essential advertising cookie for conversion measurement rather than personalized advertising and is managed through notice in this Policy and the Cookie Policy + user opt-out, without a separate cookie-consent banner.

Users have the right to refuse consent to a cross-border transfer.

13.4 Separate Consent Under Article 28-8 of PIPA for PostHog Behavioral Analytics

PostHog data includes identifiers such as the Better Auth user ID and IP address and is therefore not treated as pseudonymized or anonymous information. The Company operates a separate cross-border transfer consent process under Article 28-8 of PIPA.

• For anonymous visitors, consent is obtained through an opt-in banner on the landing page that combines notice of device access under Article 22-2 of the Information and Communications Network Act with Article 28-8 PIPA cross-border transfer notice. Only after consent does the Company store an analytics identifier in localStorage and enable persistent tracking. The banner decision, including consent status, policy version, and timestamp, is stored on the device and is carried into the server-side ConsentEvent record when the user logs in. Client activation is controlled by a separate gate, WEB_COOKIE_CONSENT_ENABLED.
• Consent history is retained for 5 years in the ConsentEvent table as an append-only audit log.
• In production, if the consent process is incomplete, collection is automatically blocked. Server-side usage aggregation is controlled by the POSTHOG_PIPA_FOLLOWUP_COMPLETE environment variable.
• No PostHog data is sent after a user withdraws consent.

Anonymous usage statistics collected independently of consent are not part of the separate consent described above. These statistics do not store anything on the device or read stored device information, except that for sign-up/login-start events the banner consent record may be checked solely to avoid duplicate collection of users who consented, as described in Section 6.4 of the Cookie Policy. The statistics do not send IP addresses or create personal profiles in the analytics tool. They may include page-view-type events such as visits, referrers, and download-button clicks, as well as key interaction events such as sign-up/login starts and pricing-page views. Temporary identifiers used to connect screens within a web visit or desktop-app session exist only in browser or app memory and disappear when the window closes or the app restarts, so returning users cannot be linked to earlier visits or sessions. Collected fields are limited to predefined event-specific lists. Because these statistics cannot identify a specific individual, they are not subject to separate consent under Article 28-8 of PIPA. Web handling follows Section 6.4 of the Cookie Policy and is controlled by the WEB_ANON_ANALYTICS_ENABLED gate. On the desktop app, the same anonymous aggregation may be used only for users who explicitly declined or did not respond to the cross-border transfer consent; events from users who consented are not included in that anonymous path and are sent only through the identified path. Desktop activation is controlled by the DESKTOP_ANON_ANALYTICS_ENABLED gate.

13.5 Safeguards for Cross-Border Transfers

The Company applies safeguards including:

• Data-processing agreements with service providers, including security requirements;
• Encryption in transit using TLS/HTTPS;
• Access control and audit logging;
• Prioritization of ZDR or comparable restricted-retention processing for AI providers where reasonably available;
• Automatic PII scrubbing and blocking rules for Sentry and PostHog;
• Requirements for industry-standard security certifications;
• Prohibition on using User Content to train AI models; and
• Prompt incident-notification obligations for service providers.

13.6 Rights Related to Cross-Border Transfers

Users in the Republic of Korea may exercise rights under PIPA including:

• Request notice of or access to information about cross-border transfers;
• Refuse or withdraw consent to a cross-border transfer, which may limit use of the relevant feature; and
• File a complaint with the Personal Information Protection Commission in the event of a violation.

14. Data Subject Rights and How to Exercise Them

14.1 User Rights

Users may exercise the following rights with respect to their personal information.

14.2 How to Exercise Rights

14.2.1 Biennial Confirmation of Newsletter (Marketing) Email Consent

Under Article 50(8) of Korea’s Act on Promotion of Information and Communications Network Utilization and Information Protection, etc. and Article 62-3 of its Enforcement Decree, the Company confirms newsletter (marketing) email consent every two years from the date consent was originally obtained. This is not a new consent request. It is a notice confirming the existing consent. The Company provides the sender’s name, the fact and date of the consent, and instructions for maintaining or withdrawing consent.

Unless the user separately indicates an intention to withdraw consent, the existing consent remains effective. A user is not removed from the newsletter recipient list solely because the user does not respond to the biennial confirmation notice.

14.3 Identity Verification

The Company may take reasonable steps to verify that a person exercising privacy rights is the data subject or an authorized representative. For requests made through an authorized representative, the Company may request a power of attorney and a copy of identification.

14.4 Response Time

14.5 Limits on Rights

A request may be limited or denied where:

• The data is subject to a statutory retention requirement, such as 5-year payment or consent records;
• Granting the request would create an unreasonable risk to another person’s life, body, property, rights, or interests;
• Applicable law provides a lawful ground for refusal; or
• The data is needed for dispute response, security-incident investigation, or abuse prevention.

If the Company restricts a privacy-rights request, it will notify the user of the reason.

14.6 Remedies and Complaint Channels for Users in Korea

Users in the Republic of Korea may contact the following bodies for privacy complaints or consultation.

15. Cookies and Similar Technologies

15.1 Overview

The Company may use cookies and similar technologies, including localStorage, local SQLite, and OS Keychain storage, to operate the Service reliably and improve user convenience.

15.2 Cookie Categories in Use

The Company does not use client-side analytics/tracking cookies, personalized advertising/retargeting cookies, or third-party tracking cookies. PostHog behavioral analytics uses the client-side posthog-js SDK and localStorage, not cookies. Google Ads conversion tracking through gtag.js does set advertising/conversion-linking cookies, but those cookies are used for conversion measurement rather than personalized advertising and are managed through notice + opt-out (see Section 4.6 of the Cookie Policy). The Company also uses open-tracking images and link-click tracking only in newsletters sent to users who have consented. These are email-based technologies separate from website cookies. Details about the personal information processed are governed by Sections 3, 5, and 12 of this Policy and Section 4.7 of the Cookie Policy.

15.3 Managing Cookies

Users can manage cookies through:

• Web-browser settings, including blocking, deletion, and notification controls.

For more information, see the separate Piuda Cookie Policy.

15.4 Effect of Blocking Cookies

Blocking essential cookies may prevent core functions such as login from working.

15.5 Local Storage

The desktop app uses the following local storage technologies. Local SQLite, OS Keychain, and localStorage used only for UI state are not sent to the server. After consent, however, the PostHog SDK stores analytics identifiers such as distinct_id in localStorage and sends them with behavioral events to PostHog Cloud in the United States. Before consent, the opt-out persistence configuration prevents those analytics identifiers from being stored (see Section 13.4).

16. Information Processing in Organization Workspaces

16.1 Visibility Within an Organization

When a user joins or creates an Academy/Business organization workspace, the following information may be visible to organization members.

16.2 Administrator Permissions

Organization administrators may:

• View and manage the member list, roles, and permissions;
• Access, manage, export, and delete Organization Content;
• Invite or remove members and change permissions;
• Manage security settings and billing; and
• Manage data under the organization’s policies.

16.3 Notice Before Joining an Organization

Before a user joins an organization workspace, the Company provides general information about data visibility within the organization and administrator permissions. Each organization and its administrators determine their own detailed internal policies, security settings, and data-management practices.

17. Other Circumstances in Which Personal Information May Be Disclosed

17.1 Legal and Safety-Related Disclosures

The Company may disclose personal information to the extent permitted by applicable law when necessary to:

• Comply with a legal obligation or respond to a lawful request from a law-enforcement or regulatory authority;
• Protect the safety, property, or rights of the Service, users, third parties, or the public;
• Enforce the Terms of Service, this Policy, or other Company policies; or
• Provide pseudonymized or anonymized information for statistics, research, or public-interest purposes.

Where reasonably possible, the Company will try to notify users of such disclosures, except where notice is prohibited by law.

17.2 Business Transfer, Merger, or Similar Transaction

If the Company is involved in a merger, acquisition, sale of business, division, or transfer of operations, personal information may be transferred as part of the transaction. In that case, the Company will ensure that:

• A comparable level of protection continues after the transfer;
• Users receive advance or prompt notice of a change in the personal information controller; and
• Users are given an opportunity to provide consent or exercise applicable rights where required by law.

17.3 Pseudonymized and Anonymous Information

The Company may process pseudonymized or anonymized information for statistical analysis, scientific research, or public-interest archiving where the information cannot identify a specific person without additional information. Fully anonymized information is outside the scope of this Policy.

18. Third-Party Integrations (When Enabled by the User)

18.1 Available Integrations

The Company may in the future offer integrations with reference-management tools, cloud storage, academic database APIs, document-authoring tools, collaboration tools, and similar external services. The specific list may change; the current list is provided within the Service (see Section 10.6 of the Piuda Terms of Service).

18.2 Enabling an Integration

A third-party integration is activated only when the user expressly grants permission.

18.3 Scope of the Company’s Responsibility

The Company is not responsible for data processing performed by a third-party service after data has been transferred to that service. Users should review the third party’s terms and privacy policy before enabling an integration. This does not limit liability where the Company is responsible under applicable law because of its intent or negligence (see Section 10.7 of the Piuda Terms of Service).

19. Additional Regional Information

19.1 Users in the Republic of Korea

This Policy is intended to comply with Korea’s PIPA, the Act on Promotion of Information and Communications Network Utilization and Information Protection, etc., and related laws. All provisions of this Policy apply to users in Korea, who may also contact the complaint and remedy bodies listed in Section 14.6.

Main data for users in Korea, including account, session, and consent records, is stored in the GCP Seoul Region (asia-northeast3) and is therefore not a cross-border transfer. Some service providers listed in Section 13.2 process data outside Korea; those transfers are handled through the required notice or consent process.

19.2 Users in Japan (Additional APPI Notice)

19.2.1 Scope

This section applies in addition to the rest of this Policy to users residing in Japan or using the Service in Japan.

19.2.2 Third-Party Disclosure

The Company does not provide personal information of users in Japan to third parties for those third parties’ own purposes. Outsourced processing by service providers is limited to operational purposes.

19.2.3 Cross-Border Transfers

As described in Section 13, data of users in Japan may be processed by overseas service providers, including providers in the United States. When the Company sends service/transactional emails or newsletters using Amazon SES in the Seoul Region, information necessary to send the email to a user in Japan, including the email address and email content, may be processed in the Republic of Korea. If newsletter open/click tracking is used, related events may also be processed in Korea. The Company applies contractual and technical measures designed to satisfy the protections required under the APPI.

19.2.4 User Rights

Users residing in Japan may exercise rights available under the APPI, including requests for:

• Notice of the purpose of use of retained personal data;
• Disclosure;
• Correction, addition, or deletion; and
• Suspension of use, erasure, or cessation of third-party provision.

See Section 14 for how to exercise these rights.

19.2.5 Japanese-Language Version

If a separate Japanese version of the Privacy Policy is provided, it may take precedence for users residing in Japan, unless a separate notice or agreement states otherwise.

19.3 Users in Other Supported Regions

19.3.1

This Policy also applies to users in supported regions other than the United States, EU/EEA, the United Kingdom, and any country or region expressly designated by the Company as unsupported.

19.3.2

If mandatory law in the applicable region gives users rights that are more protective than this Policy, that mandatory law prevails.

19.3.3

The Company does not list every supported country individually. Access from a particular country may be restricted based on applicable law, international sanctions, export controls, payment-network rules, or policies of cloud and AI processing providers (see Section 25B of the Piuda Terms of Service).

19.4 Excluded Regions, Including the United States, EU/EEA, and United Kingdom

The United States, EU member states, EEA member states, the United Kingdom, and any other country or region expressly designated by the Company as unsupported are not currently official Piuda service regions. This Policy should not be interpreted as a representation or guarantee that the Company already satisfies all requirements of laws in those excluded regions, including the GDPR, UK GDPR, CCPA/CPRA, and HIPAA (see Sections 4 and 25C of the Piuda Terms of Service).

If the Company later adds one of those excluded regions as an official service region, it will review the required legal and operational measures and provide notice before official launch.

20. Privacy of Minors

Minimum age requirements and legal-guardian consent requirements are governed by Sections 5.6 through 5.9 of the Piuda Terms of Service. Until the Company has fully implemented the infrastructure needed to process legal-guardian consent, including email verification, identity-verification integration, consent verification, and consent-withdrawal procedures, minors are not permitted to register for or use the Service. Accordingly, as of the effective date of this Policy, the Company does not separately collect personal information from minors or their legal guardians.

If the Company later permits minors to use the Service, it will revise this Policy in advance and separately explain the legal-guardian consent process, data collected, safeguards, applicable age ranges, and applicable regions. If permitting minors requires the Company to collect personal information about a legal guardian, such as name, relationship, or contact email address, the Company will provide any separate notice or consent process required by applicable law when that consent process is introduced or changed.

If, during a period in which minor-use restrictions apply, the Company becomes aware that it has unintentionally collected personal information from a person below the applicable minimum age, it will promptly delete that information and take any required follow-up action under applicable law. A legal guardian who believes that a child’s personal information has been collected may contact [email protected].

21. Changes to This Policy

21.1 Policy Changes

The Company may update this Policy in response to changes in law, policy, security technology, service providers, or related operating practices.

21.2 Notice of Changes

The Company will provide notice of changes as follows.

21.3 Version History

Previous versions of this Policy are available on request by contacting [email protected].

21.4 Continued Use

If a user continues to use the Service after the effective date of an updated Policy, the user may be deemed to have agreed to the updated Policy. Where applicable law requires express consent, the Company will obtain separate consent instead.

22. Contact Information

22.1 General Privacy Inquiries

22.2 Chief Privacy Officer

22.3 Privacy Complaints

Users in the Republic of Korea may refer to the complaint and remedy bodies listed in Section 14.6.

Appendix A: Detailed Service Provider and Cross-Border Transfer Information

Last Updated: September 29, 2026 · Technical Status Date: September 29, 2026

This Appendix describes service providers, processing locations, and processing activities confirmed as of the Technical Status Date above. Specific AI model subversions, internal operational identifiers, environment-variable names, internal domains, and other security-sensitive or frequently changing operational information are not included in this public document and are managed through internal Company documentation or separate in-service notices. Service-provider caching policies, retention periods, processing locations, and similar external-provider settings may change faster than the formal revision cycle of this Policy. Material or unfavorable changes will be addressed under the change procedures in Section 21.

The specific service providers and processing arrangements in this Appendix may change. The Company will update this Policy or provide notice within the Service when required.

A.1 Cloud Infrastructure / Database

A.2 AI Gateway and AI Providers

A.2.1 AI Gateway

A.2.2 Downstream AI Providers (via Gateway)

Specific model subversions are managed internally as of the Technical Status Date. If a change is material or unfavorable to users, the Company will provide notice through this Policy or within the Service.

A.2.3 AI Data-Processing Principles

A.3 Payment Processing

A.4 Email Delivery

A.5 Analytics — PostHog (Behavioral Analytics)

A.6 Analytics — Sentry (Error Tracking)

A.6b Advertising — Google Ads (Conversion Tracking)

A.7 Authentication Services

Authentication Data Handling

A.8 Security — Secret Management

Security Policy Summary

• API keys are never embedded in the desktop app, including in packaged asar files.
• All LLM calls are made server-side.
• Original PDF files never leave the user’s device; only parsed text is sent to the server when needed.
• CSP headers are applied with nodeIntegration: false and contextIsolation: true.

A.9 Academic Search APIs (Server-Side Calls Only)

All calls are made server-side. User personal information such as email address, name, and account identifier is not sent; only search keywords or paper identifiers are transmitted.

A.10 Third-Party Integrations (When Enabled by the User)

Only when the user expressly enables an integration may the Service in the future connect to third-party services such as those below. The specific list may change; current available integrations are identified within the Service.

The third party’s own terms and privacy policy apply separately to the integrated service.

Appendix B: Summary of Personal Information Collected

B.1 Information Collected Directly

B.2 Information Collected Automatically

B.3 User-Generated Data

Appendix C: Summary of Cross-Border Transfer Recipients

Appendix D: Purposes for Which the Company Does Not Use User Content — Summary

Under Section 7.5 of the Piuda Terms of Service, the Company does not use User Content for the following purposes.

End of Policy

This Policy was originally written in Korean. If an English or other translated version is provided, the Korean version prevails for users in the Republic of Korea. If a Japanese version is provided, it may take precedence for users residing in Japan. In other supported regions, the English version or another version separately designated by the Company may apply.

By using Piuda, the user is expected to have read and understood this Privacy Policy and to have agreed to it.