Privacy Policy
DEKREL processes personal information needed to operate accounts and projects, create and store requested results, handle billing and support, and protect the service. This Privacy Policy explains what information DEKREL collects, why it is used, who receives it, when it is deleted, and the choices and rights available to you.
1. Controller and Contact
Ankyrian, a Korean business, is the controller responsible for the DEKREL service.
- Business name: Ankyrian
- Representative: (Representative name)
- Business registration number: (Business registration number)
- Business address: (Business address)
- Telephone: (Telephone number)
- Privacy officer or responsible department: (Privacy officer or responsible department)
- Privacy inquiries: support@dekrel.com
You can use this contact to request access, correction, deletion, restriction or suspension of processing, withdrawal of consent, account closure, or help with a privacy concern.
2. Information We Process
Depending on the features you use, DEKREL processes:
Account and Sign-In Information
Your email address, account identifier, email-verification status, name and profile information provided by a sign-in provider, and login session.
Projects, Conversations, Attachments, and Generated Results
Project descriptions, prompts and conversations, files you attach and their name, format, size and processed content, generated designs and plans, organizational structures, documents, code and other results, and revision, approval, and rerun records.
Subscription, Usage, and Billing Information
Your plan, billing period, usage granted, used and remaining, payment, cancellation and refund status, and order, transaction, and receipt identifiers. Full card numbers, security codes, and payment passwords are processed in the checkout of the domestic payment provider or Paddle. DEKREL receives the transaction result and identifiers needed to provide the service.
Support Information
The sender's name and email, account and order identifiers, inquiry, attachments, DEKREL's response, and handling records.
Service Operations and Security Information
DEKREL may process access time, IP address, browser, operating system, device type, requested screen and feature, request identifier, processing status and duration, error code, and records of sign-in, permission changes, project saving and deletion, and billing-status changes. Operational and security records that do not contain conversation text are kept distinct from conversation content.
Cookies, Browser Storage, and Optional Analytics
DEKREL stores session information needed to keep you signed in and device settings such as language, pinned projects, acknowledged notices, and cookie choices. If you allow visitor analytics, Google Analytics may process page views, approximate location, browser and device information, permitted usage events, and cookie identifiers.
Optional Conversation Use for Quality Improvement
If you separately allow DEKREL quality-improvement participation, DEKREL processes the conversations stored in your account at that time, later conversations, related results, and feedback within the scope described in Section 7.
DEKREL does not ask for sensitive information or government identifiers that are unnecessary to provide the service. Do not put passwords, API keys, full card numbers, authentication codes, Korean resident registration numbers, health information, or other unnecessary sensitive information in project conversations, attachments, or support inquiries.
3. Collection, Purposes, and Legal Bases
DEKREL receives information directly from you during sign-up, sign-in, project conversations, file uploads, plan selection, and support inquiries; from records created by your browser and DEKREL's servers while you use the service; from transaction results sent by the domestic payment provider or Paddle; and from optional analytics and quality-improvement choices you make.
DEKREL processes personal information for the following purposes and legal bases:
| Purpose | Main information | Legal basis |
|---|---|---|
| Account creation, sign-in, and account access | Account and sign-in information | Entering into and performing the DEKREL service agreement |
| Project conversations, result generation, saving, reopening, and revision | Projects, conversations, attachments, and generated results | Performing the DEKREL service agreement and responding to your request |
| Plans, usage, payments, cancellations, refunds, and transaction records | Subscription, usage, and transaction information | Performing the agreement and complying with legal obligations |
| Support, identity checks, dispute handling, and responses | Support information and necessary account or transaction information | Responding to your request, performing the agreement, and complying with law |
| Preventing and responding to misuse, account takeover, malicious requests, security incidents, and outages | Operational and security records and necessary account or project information | Protecting DEKREL, users, and third parties where permitted by law |
| Conversation use for DEKREL quality improvement | Conversations, results, and feedback you authorize | Your optional consent, separate from required terms |
| Google Analytics visitor analytics | Page, device, and usage events you authorize | Your optional consent |
| Legal compliance, lawful authority requests, and establishment or defense of rights | Information necessary for the request | Legal obligation or establishment, exercise, or defense of rights |
Withdrawing optional analytics or quality-improvement consent does not affect processing that was lawful before withdrawal. DEKREL does not sell project content or use it for personalized advertising.
4. Disclosures to Third Parties
DEKREL does not sell personal information. It does not disclose personal information to an outside party except when:
- You separately consent to a specific disclosure
- Disclosure is required by law, a court, or a competent authority
- An urgent disclosure is necessary to protect life, physical safety, or other substantial rights where permitted by law
- A merger, business transfer, or service transfer actually occurs and personal information must be transferred. DEKREL provides notice and preserves applicable rights as required by law.
Providers that process information on DEKREL's instructions for hosting, storage, AI generation, analytics, or support have a different role from an independent seller such as Paddle. Section 6 identifies those roles and processing scopes.
5. Storage and External AI Processing
Account, project, conversation, generated-result, and operational information is processed through the hosting, authentication, and storage providers listed in Section 6. Your browser stores information needed to keep you signed in and remember selected interface settings.
DEKREL uses the OpenAI or Anthropic API to create requested results. The selected provider may receive the project name, your input, conversations and responses, derived summaries and classifications, the current question, remaining points requiring confirmation, progress information, attachment content or processed summaries and metadata, previous results, and conditions needed to generate a safe result.
The external AI provider may process this information to provide its API, prevent misuse, maintain security, and meet legal obligations. The applicable entity, processing country, retention period, and API account setting follow the contract and provider information in Section 6.
When project content must be reviewed for support, a security investigation, service-misuse review, or a legal obligation, only authorized personnel may access the minimum information needed. DEKREL records the reason and access activity.
6. Service Providers and Cross-Border Transfers
DEKREL uses the providers below to deliver the service. A cross-border transfer is based, as applicable, on processing or storage needed to perform the service agreement, your optional consent, or information you provide directly to an international seller at checkout. Named parenthesized fields remain for the actual contracting entity, contact, country or region, and retention period to be confirmed from the applicable contract and settings.
Service Provider Details
| Function | Transfer basis | Recipient and contact | Country or region | Information | Timing and method | Purpose | Retention |
|---|---|---|---|---|---|---|---|
| Web hosting and delivery | Processing and storage needed to perform the service agreement | (Vercel contracting entity), contact: (Vercel privacy contact) | (Vercel processing country or region) | IP address, request and response data, browser and device information, error and security records | Online when you access the service | Website and service delivery and protection | (Vercel contractual or configured retention period) |
| Authentication and project storage | Processing and storage needed to perform the service agreement | (Supabase contracting entity), contact: (Supabase privacy contact) | (Supabase storage country or region) | Account, projects, conversations, attachments, results, usage and transaction identifiers, and operational records | Online when you use the service | Sign-in, storage, retrieval, and account access management | (Supabase contractual and backup retention period) |
| AI result generation | Processing and storage needed to perform the service agreement | (OpenAI contracting entity), contact: (OpenAI privacy contact) | (OpenAI processing country) | Project input and conversations, derived summaries, classifications, questions and progress data, attachment content, metadata or summaries, previous results, and generation conditions | Online through the API when you use an AI feature | Create the AI result you requested | (OpenAI API account and contractual retention period) |
| AI result generation | Processing and storage needed to perform the service agreement | (Anthropic contracting entity), contact: (Anthropic privacy contact) | (Anthropic processing country) | Project input and conversations, derived summaries, classifications, questions and progress data, attachment content, metadata or summaries, previous results, and generation conditions | Online through the API when you use an AI feature | Create the AI result you requested | (Anthropic API account and contractual retention period) |
| Optional visitor analytics | Your optional consent | (Google Analytics contracting entity), contact: (Google Analytics privacy contact) | (Google Analytics processing country) | Page views, approximate location, browser and device information, permitted usage events, and cookie identifiers | Online after you allow analytics | Visitor analytics | (GA4 configured retention period) |
| Support email | Processing needed to respond to your inquiry and perform the service agreement | (Support email provider entity), contact: (Support email provider privacy contact) | (Support email processing country) | Sender email, inquiry, attachments, and response records | Online when you send a support email | Receive and answer support inquiries | (Support email retention period) |
You may be unable to use a relevant feature or DEKREL if you refuse a cross-border transfer required for hosting, authentication, storage, or AI result generation. Refusing Google Analytics does not affect access to public pages or DEKREL features. Contact the address in Section 1 to exercise rights concerning a cross-border transfer.
Payment Providers and International Seller
| Route | Processing or transfer basis | Provider and contact | Country | Information | Timing and method | Purpose | Retention |
|---|---|---|---|---|---|---|---|
| Domestic KRW payment | Performing the service agreement and complying with legal obligations | (Domestic payment provider and processing role), contact: (Domestic payment provider privacy contact) | South Korea | Buyer, order, payment, cancellation, refund, and payment-method information | Online through domestic checkout | Payment authorization, settlement, cancellation, and refund | (Domestic payment contract and statutory retention period) |
| International USD payment | Entering into and performing a transaction with the international seller | (Paddle contracting entity), seller for the international transaction, contact: (Paddle privacy contact) | (Paddle contracting-entity country) | Buyer, order, payment method, receipt, tax, cancellation, and refund information | Online through international checkout | International sale, payment, tax, receipts, and refunds | (Paddle contractual and statutory retention period) |
The domestic payment provider and Paddle process payment information under their checkout and privacy terms. If you refuse the transfer required for Paddle checkout, you cannot complete a payment in US dollars.
7. Optional Conversation Use for Quality Improvement
Processing conversations to create project results is necessary to provide DEKREL. Using conversation content for DEKREL's own quality improvement is a separate, optional choice.
Quality-improvement participation is off by default. At sign-up it is presented separately from required terms, is not preselected, and does not affect access to features.
If you enable it in Settings, all conversations already stored in your account at that time and all future conversations enter the quality-improvement scope. Before activation, DEKREL tells you that existing history is included and that authorized DEKREL personnel may review necessary conversations or extract copies for review.
If you turn it off, DEKREL stops new selection, review, and extraction from that point. Copies already extracted are deleted under the 90-day maximum below. Conversations from users who have not opted in are not used for general quality improvement.
Copies extracted for quality review are kept for no more than 90 days from extraction. Examples still needed are converted into synthetic regression scenarios that do not identify the user or actual business, then the original copies are deleted. Materials retained for a security incident, legal dispute, or legal obligation are managed separately from quality-improvement copies.
If you submit specific feedback or join a beta, DEKREL separately confirms which conversations you agree to provide and the purpose.
Minimal operational statistics that do not contain conversation text, such as error codes, processing time, step completion or interruption, and save or retrieval success, may be used to maintain service reliability and are kept separate from conversation content.
8. Cookies, Essential Storage, and Optional Analytics
DEKREL uses essential cookies and browser storage to keep you signed in, support security, and remember language and interface settings. Blocking them may prevent login or essential features from working.
Google Analytics visitor analytics are optional. Google Analytics does not run and analytics information is not sent until you allow it. You can use DEKREL without allowing visitor analytics.
Use the initial choice dialog to allow or reject analytics, and use Cookie Settings in the footer to change that choice. Withdrawing permission stops new analytics transfers. Information already sent to Google follows Google's processing rules and the retention period in Section 9.
Cookie consent and conversation-based quality improvement are separate choices. One does not change the other.
9. Retention and Deletion
DEKREL retains information only as long as needed for its purpose and deletes it when that purpose or the applicable legal period ends.
| Information | Retention rule |
|---|---|
| Account information | Until the end of the 30-day withdrawal period after an account-closure request. Deleted after 30 days if the request is not withdrawn. |
| Personal projects, conversations, attachments, and generated results | Until you delete them or the 30-day account-closure withdrawal period ends. Deletion reaches backups within (Backup deletion propagation period). |
| Contract and withdrawal records | Five years where required by Korean law. |
| Payment and service-supply records | Five years where required by Korean law. |
| Consumer complaint and dispute records | Three years where required by Korean law. |
| Advertising records | Six months where required by Korean law. |
| General support inquiries | (General support inquiry retention period). A consumer complaint or dispute follows the three-year rule above. |
| Security and access records | (Security and access record retention period) |
| Conversation copies extracted for quality review | No more than 90 days from extraction under the separate opt-in |
| Minimal operational statistics without conversation content | (Minimal operational-statistics retention period) |
| Google Analytics data | (GA4 configured retention period) |
| External AI provider data | The provider's actual API account setting, contract, and legal exceptions |
| Records of deletion, consent, and privacy-rights requests | (Request-handling record retention period) |
Deleting a personal project removes that project's conversations, attachments, and results from the service interface and propagates deletion through operational storage and backups within the periods above. Billing, dispute, or security records that must be kept separately remain segregated and are deleted when their own period ends.
Electronic records are deleted in a manner designed to prevent recovery. Paper records, if any, are shredded or destroyed. Information still needed for statistics or regression testing is retained only after it has been de-identified so the user and actual business cannot be identified, and DEKREL does not attempt to re-identify it.
10. Account Closure
Closing an account is different from canceling a subscription. Request account closure through DEKREL Settings or support@dekrel.com.
If you have a paid subscription, cancel it through the applicable billing route before requesting account closure. Cancel a domestic KRW subscription through DEKREL's subscription and billing screen, and an international USD subscription through Paddle's subscription-management route.
An account-closure request starts the process of ending account access and deleting personal information. You may withdraw the request for 30 days. If you do not withdraw it, DEKREL deletes the account's projects, conversations, attachments, and generated results after 30 days. Payment, refund, dispute, security, and other records required or permitted by law are stored separately for the applicable period in Section 9.
11. Your Rights
You may request information about processing, access, correction, deletion, restriction or suspension of processing, or withdrawal of consent. Where the law of your location provides them, you may also request data portability, object to processing, appeal the result of a privacy request, or complain to a supervisory authority.
Send the request to the contact in Section 1. DEKREL may verify identity through the account email, sign-in confirmation, or information appropriate to the request. An authorized representative may need to prove authority.
You can change these choices independently:
- Conversation use for DEKREL quality improvement in Privacy and Data in Settings
- Google Analytics permission through Cookie Settings in the footer
DEKREL may limit all or part of a request where law requires retention or fulfillment would infringe another person's rights. Where permitted, DEKREL explains the reason and result. DEKREL does not discriminate against you for exercising a privacy right.
In South Korea, you may also contact the Personal Information Infringement Report Center (privacy.kisa.or.kr, 118), the Personal Information Dispute Mediation Committee (kopico.go.kr, 1833-6972), or the Privacy Portal (privacy.go.kr). If you live elsewhere, you may contact the privacy authority for your location.
12. Adult Users
DEKREL is for people who are legal adults under the law that applies to them. DEKREL does not knowingly seek to collect personal information from children. If DEKREL confirms that a non-adult's information has been processed, it reviews the account and information and deletes it or takes other protective action as required by law. Contact the address in Section 1 about such a case.
13. Safeguards and Authorized Access
DEKREL applies administrative and technical measures appropriate to the nature and risk of the information, including account authentication, project-owner-based access controls, access restrictions, access and change records, warnings for certain sensitive inputs, nonpublic management of operational secrets, and incident-response procedures.
When authorized personnel review project content for support, consented quality improvement, a security investigation, service-misuse review, or a legal obligation, access is limited to what is needed for the task and the reason and access activity are recorded.
No internet service removes every risk. Do not enter passwords, API keys, full card numbers, authentication codes, Korean resident registration numbers, or unnecessary sensitive information in project conversations or support messages. Confirm that you have permission before entering another person's information or trade secrets.
To report suspected account compromise or information exposure, contact support@dekrel.com or see Security Reporting.
14. Personal Data Breaches
If DEKREL confirms a personal data breach, it investigates the impact and scope, works to stop further exposure, and takes recovery and prevention measures. Where law requires notice to users or an authority, DEKREL provides it within the required period and describes the affected information, what happened, DEKREL's response, and steps you can take.
15. Changes and Effective Date
DEKREL provides notice through the service or registered email before a material change takes effect. It generally gives at least 30 days' notice for a material change that adversely affects user rights. A shorter period may apply when immediate action is required by law or for security reasons.
- Notice date: (Notice date)
- Effective date: (Effective date)
- Last updated: (Last updated date)
When an earlier version exists, DEKREL makes the changes and previous version available together.