Privacy Policy

1. At sign-up (social login): email, name/nickname, profile picture, and the social account identifier (Kakao/Google).
2. During onboarding: optional personalization details such as your role and research interests.
3. School email verification (optional): your school email address and the time it was verified, used only to apply the student discount.
4. At payment: plan, amount, payment time, and subscription status. Sensitive payment details such as card numbers are collected and stored by Stripe; the Company never holds them.
5. While using the Service: papers you read, library collections, PDFs you upload and their extracted text, notes, AI conversations, usage records, and access logs.
6. Stored in your browser (never sent to us): highlights and display settings live in your browser's localStorage.
7. Service analytics: pages visited, features used, key actions such as sign-up and subscription, plus browser, device, and referral information. Email, name, questions asked about papers, and uploaded file names are never sent to analytics tools; you are identified only by an internal account identifier.

1. Providing the Service: paper reading, summarization, research support, personalized recommendations, and the library.
2. Processing payments, managing subscriptions, and measuring usage.
3. Confirming eligibility for the student discount.
4. With your consent: emails about new features and curated papers in your field.
5. Improving quality and diagnosing errors.

We entrust personal data processing to the providers below; some processing takes place outside Korea.

1. Supabase (database and authentication; servers in the Seoul, Republic of Korea region) — stores accounts, profiles, and usage records.
2. Vercel (United States) — service hosting and request handling.
3. Stripe, Inc. (United States) — payment processing and card storage.
4. Resend (United States) — transactional email such as verification codes.
5. Google, Anthropic, OpenAI (United States) — target content and your questions are sent to their APIs to generate AI summaries and answers. We use API settings under which data is not used to train models.
6. Google Analytics (United States) — traffic sources and page usage statistics.
7. PostHog (United States) — feature usage flows and drop-off analysis, used solely to improve the service.

1. Account data: kept until you delete your account, then destroyed without delay.
2. Transaction records (payments, refunds) under the Act on Consumer Protection in Electronic Commerce: kept 5 years, then destroyed.
3. Access logs: kept 3 months under the Protection of Communications Secrets Act.

You may request access, correction, deletion, or suspension of processing of your personal data at any time. Manage it yourself in Settings or write to hello@aewollabs.com — we act without delay.

We use essential cookies to keep you signed in, and localStorage for display settings and highlights. We do not use advertising or tracking cookies.

1. Traffic is encrypted in transit (HTTPS) and database access is restricted (row-level security policies).
2. Card details are never stored by the Company; they are handled by Stripe, which is PCI-DSS certified.
3. Uploaded PDFs are kept in private storage and are only ever served through short-lived signed links issued after an ownership check.
4. Access to personal data is minimized and access is logged.

Officer: Sungwoo Choi (representative, Aewol Research Lab) · Contact: hello@aewollabs.com

You may also contact the Korea Internet & Security Agency's Privacy Center (privacy.kisa.or.kr, dial 118) for reports or consultation.