This English version is a translation provided for convenience. If there is any inconsistency between this translation and the Korean version, the Korean version prevails.
In accordance with Article 30 of the Personal Information Protection Act of Korea (the "PIPA"), Nexora (the "Operator") establishes and discloses this Privacy Policy to protect the personal information of users of the Ollarai beta service (the "Service") and to handle related complaints promptly and smoothly.
At a glance
- What we collect
- Email, password (encrypted), questions and query history, access logs
- Why
- Account management, answering your questions, improving the Service and our AI
- Sharing with third parties
- None
- Processors
- Supabase, Amazon Web Services, Google
- International transfers
- Japan (authentication), United States (question analysis, analytics)
- Contact
- contact@ollarai.com
Article 1. Purposes of Processing
The Operator processes personal information for the purposes below and does not use it for any other purpose. If a purpose changes, the Operator will take the necessary measures, such as obtaining separate consent under Article 18 of the PIPA.
- Account registration and management: identifying members, email verification, approving beta access, managing usage limits, and processing account closure
- Providing the Service: analyzing questions, generating data queries (SQL), and providing query results
- Improving the Service and our AI: analyzing errors, improving retrieval-augmented generation (RAG) data, and training and evaluating AI models (using pseudonymized data under Article 8)
- Preventing misuse: detecting and blocking abnormal access and excessive requests
- Notifying pre-registered users: sending news about the launch and beta opening
- Website analytics: understanding traffic and improving the website
Article 2. Personal Information We Process
| Category | Items | How collected |
|---|---|---|
| Sign-up (required) | Email address, password | Sign-up screen |
| Using the Service (required) | Questions you enter, SQL and query results generated from them, answer mode (free/paid), daily usage count, last access time, IP address | Generated or collected while you use the Service |
| Pre-registration (optional) | Email address, registration date and time, selected language | Pre-registration form on the website |
| Website visits (automatic) | Cookie identifiers, pages visited and time of visit, browser and device information, IP address | Google Analytics |
- Passwords are stored with one-way encryption by our authentication provider (Supabase), and the Operator cannot see the original password.
- Please do not enter your own or anyone else's personal information (such as names, phone numbers, or account numbers) in the question field. Questions you enter are processed for the purposes in Article 1.
- The Operator does not collect sensitive information or unique identification information (such as resident registration numbers or passport numbers).
Article 3. Retention Periods
The Operator processes and retains personal information within the retention period required by law or consented to when the information was collected.
| Information | Retention period | Basis |
|---|---|---|
| Account information (email, account identifier, usage tier) | Until account closure | Performance of the service agreement |
| Questions, query history, access logs | 180 days from collection | Performance of the service agreement, error analysis, and misuse prevention |
| Pseudonymized question data | 3 years from pseudonymization | Article 28-2 of the PIPA |
| Pre-registration email | Until the launch notice is sent or you opt out (request deletion) | Consent |
| Website analytics | 2 months from collection | Consent (cookie settings) |
Article 4. Destruction Procedure and Method
- Procedure: The Operator destroys personal information without delay (within 5 days) once its retention period expires or its purpose is fulfilled. Information with automatic deletion set up, such as access logs, is deleted automatically when its retention period ends. If other laws require information to be kept, it is moved to a separate database, stored separately, and not used for any other purpose.
- Method: Electronic files are deleted using technical methods that make them unrecoverable, and paper documents are shredded or incinerated.
Article 5. Provision to Third Parties
The Operator processes personal information only within the scope stated in Article 1 and provides it to third parties only in the cases set out in Articles 17 and 18 of the PIPA, such as with your consent or under specific provisions of law. The Operator currently does not provide personal information to any third party.
Article 6. Entrustment of Processing
The Operator entrusts the processing of personal information as follows to provide the Service. The entrustment lasts until account closure or the end of the entrustment agreement.
| Processor | Task | Location |
|---|---|---|
| Supabase Inc. | Member authentication (sign-up, sign-in, verification emails) and storage of account information | Japan |
| Amazon Web Services, Inc. | Server operation, storage of data and access logs, storage of pre-registration information | Republic of Korea (Seoul region) |
| Google LLC (Gemini API) | Analyzing questions and verifying and refining generated SQL | United States |
| Google LLC (Google Analytics) | Website analytics | United States |
Under Article 26 of the PIPA, the Operator sets out in writing, such as in the entrustment agreement, the prohibition of processing for purposes other than the entrusted task, technical and administrative safeguards, restrictions on re-entrustment, management and supervision of the processor, and liability such as compensation for damages, and supervises whether processors handle personal information safely. Any change of processor or entrusted task will be disclosed through this Privacy Policy.
Article 7. International Transfers
Under Article 28-8(1)(iii) of the PIPA, the Operator transfers personal information abroad (through entrustment and storage) as follows to enter into and perform the service agreement.
| Recipient | Country | Items | Purpose | Timing and method | Retention |
|---|---|---|---|---|---|
| Supabase Inc. supabase.com/privacy | Japan | Email address, encrypted password, account identifier | Member authentication | Sent over the network at sign-up and sign-in | Until account closure |
| Google LLC (Gemini API) policies.google.com/privacy | United States | Questions you enter (including translated or processed forms) | Analyzing questions and verifying and refining SQL | Sent over the network when you submit a question | As set out in Google's API terms of service |
| Google LLC (Google Analytics) policies.google.com/privacy | United States | Cookie identifiers, visit records, IP address | Website analytics | Sent over the network when you visit the website | 2 months from collection |
How to refuse: If you do not want your information transferred abroad for authentication and question analysis, you may choose not to sign up or request account closure as described in Article 9; in that case you cannot use the member service. You can refuse the transfer to Google Analytics as described in Article 10 without affecting your use of the Service.
Article 8. Processing of Pseudonymized Information
To improve the Service and our AI models, the Operator pseudonymizes question data and uses it under Article 28-2 of the PIPA.
- Purpose: technology development and research, such as improving retrieval-augmented generation (RAG) data and training and evaluating AI models
- Items: questions you enter, and the SQL and processing results generated from them
- Pseudonymization method: information that can identify you, such as your email address, account identifier, and IP address, is deleted so the data cannot be linked to your account. If a question appears to contain personal information, that part is deleted or the question is excluded from training data.
- Retention: 3 years from pseudonymization
- Provision to third parties: pseudonymized information is not provided to any third party.
- Safeguards: no additional information that would allow re-identification is kept, access to pseudonymized information is restricted, and processing records are kept.
- Opting out of training: if you do not want your questions used for training, you may request this as described in Article 9, and questions not yet pseudonymized will be excluded from training data. Data that has already been pseudonymized cannot be linked to you, so it may not be possible to find and delete it individually.
Article 9. Your Rights and How to Exercise Them
- You may at any time request access to, correction or deletion of, or suspension of processing of your personal information, or withdraw your consent (Articles 35 to 37 of the PIPA).
- You may exercise these rights by email (contact@ollarai.com) or in writing (26 Gwandae-gil, Room 203, Gangneung-si, Gangwon State, Republic of Korea). After verifying your identity, the Operator will act without delay (within 10 days) and inform you of the result.
- To close your account, send a request to the email address above from the email address you signed up with. Your account information will be destroyed without delay.
- You may also exercise your rights through a representative, such as your legal representative or a person you have authorized. In that case, a power of attorney must be submitted.
- Requests may be restricted where the law so provides, such as under Article 35(4), Article 36(1), and Article 37(2) of the PIPA, in which case we will tell you the reason.
- Data transfer requests: The Operator is not currently subject to the transmission obligation under Article 35-2 of the PIPA, but on request will provide your account information and stored question history as a CSV or JSON file.
- You must keep your personal information accurate and must not infringe on, or enter into questions, the personal information of others.
Article 10. Automatic Collection Tools and How to Refuse Them
- Browser storage: authentication information that keeps you signed in, and display settings (whether the beta introduction was shown, your answer mode selection), are stored in your browser's local storage. Authentication information is deleted when you sign out.
- Analytics cookies: Google Analytics cookies are used for website analytics.
- The Operator does not collect or use behavioral information for online targeted advertising and does not use advertising cookies.
How to refuse
- Chrome: Settings > Privacy and security > Third-party cookies, or Delete browsing data
- Safari: Settings > Privacy > Manage Website Data
- Edge: Settings > Cookies and site permissions > Manage and delete cookies and site data
- Firefox: Settings > Privacy & Security > Cookies and Site Data
- To refuse only Google Analytics, install the Google Analytics Opt-out Browser Add-on.
If you block browser storage, you will not stay signed in and cannot use the member service. Refusing analytics cookies does not affect your use of the Service.
Article 11. Automated Decisions
The Operator does not make automated decisions within the meaning of Article 37-2 of the PIPA. The AI in the Service is used to turn your questions into data queries (SQL) and show the results, and it does not make decisions that affect your rights or obligations. Beta access is reviewed and approved by the Operator directly, and daily usage limits are applied according to criteria announced in the Service.
Article 12. Children's Personal Information
Children under 14 may not sign up for the Service, and the Operator does not collect personal information from children under 14. If the Operator learns that a child under 14 has signed up, it will destroy that personal information without delay.
Article 13. Security Measures
- Administrative: personal information handlers are limited to the representative, and access rights are reviewed regularly.
- Technical: encryption in transit (HTTPS), one-way encrypted password storage, authentication token verification, least-privilege access control (including a separate read-only account for data queries), retention of access logs, and separate storage of member information and service data.
- Physical: personal information is stored in the data centers of our cloud providers (Amazon Web Services, Supabase), and physical security such as access control follows those providers' security programs.
Article 14. Privacy Officer and Access Request Contact
The Operator's representative bears final responsibility for the processing of personal information and has designated the privacy officer below to oversee personal information processing and to handle complaints and remedies. Requests for access to personal information are received and handled at the same contact.
- Privacy officer: Taeho Jeon (Representative)
- Email: contact@ollarai.com
- Address: 26 Gwandae-gil, Room 203, Gangneung-si, Gangwon State, Republic of Korea
Article 15. Remedies for Infringement
To seek remedies for infringement of your personal information, you may apply for dispute resolution or counseling to the following Korean organizations.
- Personal Information Dispute Mediation Committee: +82-1833-6972 (www.kopico.go.kr)
- Personal Information Infringement Report Center (KISA): 118 within Korea (privacy.kisa.or.kr)
- Supreme Prosecutors' Office: 1301 within Korea (www.spo.go.kr)
- Korean National Police Agency: 182 within Korea (ecrm.police.go.kr)
Article 16. Changes to This Privacy Policy
If this Privacy Policy is amended, we will announce the changes on the website and in the Service at least 7 days before they take effect. For important changes that affect your rights, such as adding collected items or purposes, we will also notify members individually by email.
Revision history
- October 3, 2026: Established
- October 19, 2026: Added processing of pseudonymized information to improve the Service and AI (Article 8), detailed international transfer information, and supplemented required disclosures such as provision to third parties, destruction procedures, and remedies for infringement
This Privacy Policy takes effect on October 19, 2026.