Privacy Policy
10xThings Co., Ltd. ("Company") protects users' personal data in accordance with Korea's Personal Information Protection Act (PIPA) and related laws. The Korean version of this policy is the legally binding version; this English text is provided for convenience.
1. Data we collect
- Account: email, password (hashed), invite code
- Service usage: project name, problem statement, self-introduction, stage progress, AI advisory conversations, deliverables
- Payment (future): handled by Lemon Squeezy (Merchant of Record); Company stores only transaction identifiers
- Automatic: IP, cookies, browser/OS info, event logs (email domain only — full email is stored separately)
2. Purposes
- Account identification and authentication; abuse prevention
- Service delivery: AI advisory conversations, progress save/restore, deliverable management
- Payment and subscription management; refunds and cancellations
- Customer support and notifications
- Aggregate/pseudonymized analytics for service improvement
3. Retention
We delete personal data without delay upon account deletion or fulfillment of purpose, except where Korean law requires longer retention:
| Contract / withdrawal records | 5 years (E-Commerce Act) |
| Payment / supply records | 5 years (E-Commerce Act) |
| Consumer complaint / dispute records | 3 years (E-Commerce Act) |
| Web access logs | 3 months (Protection of Communications Secrets Act) |
4. Third-party disclosure
We do not share personal data with third parties without consent, except as required by law, a lawful request by an investigative agency, or for the processors listed in §5.
5. Sub-processors & international transfer
| Supabase Inc. (USA) | Auth, database, edge functions (AWS ap-northeast-1/2) |
| Anthropic, PBC (USA) | AI advisory conversation processing (Claude API). Not used for training. |
| Resend, Inc. (USA) | Transactional email (auth, invites) |
| Vercel, Inc. (USA) | Web hosting / CDN |
| Cloudflare, Inc. (USA) | DNS |
| Lemon Squeezy | Payment processing (Merchant of Record), when payments launch |
Per Article 28-8 of PIPA, disclosure of this policy serves as consent to overseas transfer to the above processors. You may withhold consent separately; doing so may limit some service features.
6. Your rights
- Access, correct, delete, or restrict processing of your data
- Withdraw consent and delete your account
- Object to overseas transfer
Exercise your rights by emailing fractalreason@gmail.com or via in-app settings.
7. Security
- One-way password hashing (bcrypt); TLS in transit
- Admin role separation, access control, audit logging
- Periodic vulnerability review
8. Cookies
We use cookies and localStorage for login persistence and A/B test variant assignment. You can disable these in your browser, with possible loss of functionality.
9. Data Protection Officer
| Officer | Jinseok Lim (CEO) |
| fractalreason@gmail.com | |
| Address | 2F-116A, 47 Gangnam-daero 112-gil, Gangnam-gu, Seoul, Republic of Korea |
10. Remedies
For privacy disputes, contact: PIPC Dispute Mediation Committee (1833-6972 / kopico.go.kr), KISA Privacy Violation Center (118 / privacy.kisa.or.kr), or the Korean National Police Agency Cyber Bureau (182 / ecrm.cyber.go.kr).
11. Changes
This policy takes effect on the date above. Material changes will be announced at least 7 days in advance (30 days if unfavorable to users).