Privacy Policy

Effective date: June 27, 2026

Zero to One Flow (021flow) (the "Operator") complies with the Personal Information Protection Act and other applicable laws, and processes personal data as described below.

1. Controller & Data Protection Officer

• Trade Name: Zero to One Flow (021flow) / Representative: Sungtae Ryu
• Email: [email protected]
• Data Protection Officer: Sungtae Ryu (Representative, serving concurrently) / [email protected] / +82-70-8676-0210

2. Personal Data We Collect

• Account: email, name or nickname, login identifier
• Authentication: social login provider identifier, token-related metadata
• Payment-related: payment status, subscription plan, billing date, receipt/order identifiers, Paddle customer ID or transaction ID (sensitive instrument data such as card number/CVC is not stored directly by the Operator)
• Usage: access logs, IP address, browser/device info, usage volume, error logs
• Support: inquiry content, email, attachments, conversation records
• User content: text/files you input or upload to the Service
• Cookies and similar technologies

3. Purposes of Use

• Sign-up and account management
• Service provision and verification of paid/subscription status
• Payment, billing, refunds, tax/accounting
• Customer support and notices
• Security, fraud prevention, incident response
• Service improvement, statistics, analytics
• Compliance with legal obligations

4. Third-Party Provision & Processing

To operate the Service, the Operator entrusts or provides personal data as below.

5. Overseas Transfer

Because the Operator uses overseas providers (Paddle, cloud infrastructure, AI APIs, analytics), personal data may be transferred abroad. Recipients and destination countries are as listed in the table in Section 4 (Paddle.com — UK/EU; Google LLC, Apple Inc., Amazon Web Services, Inc., Anthropic PBC, OpenAI, L.L.C., Cloudflare, Inc. — USA, etc.), and the items, purposes and retention periods also follow that table. Transfers occur continuously over networks as you use the Service. You may object to overseas transfer (contact: [email protected]), but payment and core features may then be limited.

6. Retention

• Personal data is, in principle, deleted without delay upon account withdrawal.
• Payment/transaction/dispute records subject to statutory retention (e.g., contracts/withdrawal 5 years, payments 5 years, consumer complaints/disputes 3 years) are kept for the legally required period.
• Access logs are kept for 3 months under the Protection of Communications Secrets Act.
• Backups are deleted within 30 days; minimal records for fraud prevention may be kept as needed.

7. Your Rights

You may request access, correction, deletion, suspension of processing, withdrawal of consent, and account withdrawal via [email protected].

8. Cookies

• The Operator may use essential cookies (e.g., login, preferences) and analytics cookies.
• You may refuse cookies in your browser settings, but some features may be limited.
• If a cookie consent banner is used, you can change settings there.

9. Security Measures

The Operator applies reasonable safeguards including least-privilege access, encryption in transit/at rest, access logging, backups, security updates, and administrator access controls.

10. Children's Data

The Service targets users aged 14+ (or the applicable age threshold in each country) and assumes adult/B2B use. Personal data of children under 14 is, in principle, not collected.

11. Changes

This policy may be revised due to changes in law, policy or security technology; changes are announced at least 7 days before the effective date via in-service notice or this page. Effective date: June 27, 2026.