Privacy Policy

Specnote (specnote.io, "the Service"), operated by Dannect, Inc. ("the Company"), establishes and publishes this Privacy Policy in accordance with Article 30 of the Korean Personal Information Protection Act (PIPA) to protect the personal information of data subjects and to address related grievances promptly.

The Service is an AI-powered scenario verification and test-automation service: it organizes the checks a user describes in natural language into test scenarios, verifies them by operating a real browser like a human, and provides a results report. In this process, the Service may automatically access and operate a third-party website designated by the user, using test-account credentials the user has registered.

This policy takes effect on July 24, 2026.

Article 1 — Personal information collected and collection methods

1. Required items

  • Sign-up: email address, name, password (stored only as a one-way hash (bcrypt); the actual password is not stored)
  • Social login (Google · GitHub): email address, profile name, profile image URL, social account identifier
  • Usage environment: country / currency (used to route payment)
  • Paid billing: card issuer name, last 4 digits of the card number, billing email, and the recurring-billing key (billing key) delivered by the payment processor (Toss Payments / Paddle). The billing key is stored encrypted with AES-256; the full card number and CVC (card security code) are not stored.
  • Scenario verification automation: third-party website addresses the user registers as verification targets, test-account credentials the user registers (IDs, passwords, etc. — stored encrypted), and the verification scenarios/steps the user creates
  • Auto-collected: access IP address, browser/device information (User-Agent), cookies, access and usage logs

2. Optional items (only when the relevant feature is used)

  • Marketing consent: opt-in to promotional information, notification settings
  • Organization info: company name, role (when subscribing to team/enterprise plans)
  • GitHub repository connection: if the user installs the GitHub App and connects a repository — the repository's source code, commit history, list of changed files, and repository name. Source code is stored only after secret-key and personal-information patterns are removed (masked); the original secrets/personal information are not stored. The GitHub connection is read-only and does not store the user's GitHub access token.
  • Source-code / document transfer: source code or documents (e.g., requirement specs) that the user sends via connection tools (MCP / command-line tools) or uploads/delivers on the Service screens. Stored only after secret keys and personal information are removed (masked); the original secrets/personal information are not stored.

※ The Company does not collect date of birth. Whether a user is at least 14 years old is confirmed through an identity-verification step at sign-up (Article 12).

3. Collection methods

  • Direct input on sign-up and login forms
  • Direct input on screens for registering verification-target sites and test accounts
  • Source code and commit information collected via GitHub when a repository is connected (GitHub App installation)
  • Source code and documents transferred via connection tools (MCP / command-line tools) or the Service screens
  • Automatically generated and collected during service usage
  • Payment information delivered through Toss Payments / Paddle at checkout
  • Email and contact-form submissions for customer inquiries

Article 2 — Purposes of collection and use

  • Member management: identification, identity verification, sign-up intent verification, abuse prevention, restriction of users under 14
  • Service delivery: organizing verification scenarios, running automated verification in a real browser, providing results reports, storing/syncing verification data, collaboration features
  • Paid billing: charging, identity verification, billing-key management, recurring billing, settlement, refunds
  • Notifications: terms changes, policy changes, service maintenance, billing-date prior notices
  • Customer support: receiving and handling inquiries (support via tools such as Channel Talk)
  • Marketing (separate consent): new-service announcements, event information, promotional information, and personalized advertising via ad platforms (such as Meta and Google) using hashed-email matching — limited to members who consented to marketing
  • Statistics and analysis: service quality improvement, new-feature development, statistical analysis (pseudonymized/anonymized)

Article 3 — Retention periods

We destroy personal information without delay once the collection/use purpose is achieved. However, the following are retained for the period prescribed by law:

  • Sign-up information: until member withdrawal (destroyed within 30 days after)
  • Test-account credentials registered by the user: until the user deletes them or withdraws membership (destroyed immediately at that point)
  • Connected/transferred source-code snapshots and documents (masked): until the user deletes them or the corresponding project is deleted. Disconnecting GitHub immediately stops further code access.
  • Contract/withdrawal records: 5 years (Korean E-Commerce Act §6)
  • Payment and supply records: 5 years (Korean E-Commerce Act §6)
  • Consumer complaints/disputes: 3 years (Korean E-Commerce Act §6)
  • Display/advertising records: 6 months (Korean E-Commerce Act §6)
  • Access logs/IP info: 3 months (Korean Communication Privacy Act §15-2)
  • Identity verification records: 6 months (Korean Information Communications Act §44-5)
  • Abuse records: 1 year (abuse-prevention purpose)

Article 4 — Third-party disclosure

We do not disclose personal information to third parties without prior consent from the data subject, except in the following cases:

  • Toss Payments Co., Ltd. / Paddle.com Market Limited: paid-billing processing, billing-key issuance, recurring billing — name, email, card details — for the period prescribed by the E-Commerce Act.

When there is a legal basis or a lawful request from an investigative authority, we may provide information without consent.

Article 5 — Processing entrustment

For smooth service delivery, we entrust personal information processing to the following parties:

  • Amazon Web Services, Inc. (AWS): cloud infrastructure hosting, email delivery (AWS SES), AI verification/analysis processing (AWS Bedrock) — until contract termination
  • Toss Payments Co., Ltd.: domestic payment processing and recurring-billing management — for the period prescribed by the E-Commerce Act
  • Paddle.com Market Limited: international payment processing (Merchant of Record) — for the period prescribed by the E-Commerce Act
  • Google LLC: usage-behavior analytics (Google Analytics 4), advertising performance and conversion measurement (Google Ads conversion tag) — until the analytics/advertising purpose is achieved
  • PostHog, Inc.: product-usage analytics — until the analytics purpose is achieved
  • Meta Platforms Ireland Limited: advertising performance and conversion measurement (Meta Pixel and Conversions API), and building custom-advertising audiences by matching the hashed emails of marketing-consented members — until the advertising/analytics purpose is achieved
  • Twilio Inc. (SendGrid): marketing email delivery (limited to marketing-consented members) — until contract termination or consent withdrawal
  • Functional Software, Inc. (Sentry): error/exception log collection and monitoring — 90 days
  • Langfuse GmbH: AI processing quality observability and debugging (prompt and response records) — until contract termination
  • Google LLC / GitHub, Inc.: social-login identity verification — at the time of authentication
  • Channel Corporation: operating the customer-support widget (Channel Talk), receiving and handling inquiries — no separate retention period beyond the support session (subject to Channel Talk's own policy). A domestic Korean entity (headquartered in Seoul), so this is not an international transfer.

Article 6 — International transfers

The Company transfers personal information overseas as follows (PIPA Article 28-8). Transfers occur via information and communications networks (network transmission) at the time of service use.

  • Google LLC (United States) — Items: access IP, device information, usage logs (Google Analytics 4), advertising conversion events such as sign-up and payment (Google Ads conversion tag) / Purpose: usage-behavior analytics, advertising performance and conversion measurement / Retention: until the analytics/advertising purpose is achieved / Method: network transmission
  • PostHog, Inc. (United States) — Items: usage logs, device information / Purpose: product-usage analytics / Retention: until the analytics purpose is achieved / Method: network transmission
  • Meta Platforms Ireland Limited (Ireland / United States) — Items: hashed email, conversion events such as sign-up and payment, and the hashed emails of marketing-consented members (custom-advertising audiences) / Purpose: advertising performance and conversion measurement, building custom-advertising audiences / Retention: until the advertising purpose is achieved or consent is withdrawn / Method: network transmission
  • Twilio Inc. (SendGrid · United States) — Items: email address and name of marketing-consented members / Purpose: marketing email delivery / Retention: until contract termination or consent withdrawal / Method: network transmission
  • Amazon Web Services, Inc. (United States — AWS Bedrock, us-west-2) — Items: verification scenarios, user-input text, masked source code, and other data needed for AI processing / Purpose: AI scenario verification and analysis / Retention: at the time of processing (not stored) / Method: network transmission
  • Langfuse GmbH (Germany — data processing region: Japan) — Items: prompt and response bodies used in AI processing (verification scenario descriptions, user-input text, screen text from the target site, etc.), user identifiers, job identifiers / Purpose: AI processing quality observability and error-cause analysis / Retention: until contract termination or a deletion request / Method: network transmission
  • Paddle.com Market Limited (United Kingdom / EU) — Items: name, email, payment-related information / Purpose: international payment processing / Retention: for the period prescribed by the E-Commerce Act / Method: network transmission

※ AWS infrastructure hosting and transactional email delivery (AWS SES) are processed in a domestic region (ap-northeast-2, Seoul); marketing emails are sent via Twilio SendGrid (United States) only to members who consented to marketing. Data subjects may refuse the above international transfers; refusal may limit the use of the corresponding features (analytics, international payment, marketing emails, etc.).

Article 7 — Data subject rights and exercise method

Data subjects may exercise the following rights at any time:

  1. Request to inspect personal information
  2. Request to correct errors
  3. Request to delete
  4. Request to suspend processing
  5. Withdraw consent
  6. Right to data portability (PIPA §35-2)

Some information can be edited directly at "My Page → Account." Rights such as inspection, deletion, and suspension of processing can be requested by emailing the Data Protection Officer at privacy@specnote.io. We respond within 10 days.

Article 8 — Destruction procedure and method

  • Procedure: After the retention period, data is moved to a separate database and stored under internal policy for a defined period, then destroyed.
  • Method: Electronic files are permanently deleted in an unrecoverable manner (NIST SP 800-88 standard); paper documents are shredded or incinerated.

Article 9 — Cookies and opt-out

We use cookies to provide the Service and to analyze usage.

  • Essential cookies: login session, security (CSRF defense) — until session ends
  • Functional cookies: user settings (theme, language) — 1 year
  • Analytics cookies: service usage statistics via Google Analytics 4 and PostHog — until the analytics purpose is achieved
  • Advertising cookies: advertising performance and conversion measurement via Meta Pixel and the Google Ads tag — until the advertising purpose is achieved
  • Support cookies: operating the Channel Talk customer-support widget — until the support session ends

In regions that require prior consent — such as the EU, the European Economic Area (EEA), and the United Kingdom — analytics and advertising cookies operate only after the user's consent; elsewhere they operate by default. Users may withdraw consent or block cookies at any time. Support cookies enable a feature the user directly requests (treated like essential/functional cookies) and are provided without a separate consent step; no marketing pop-ups are sent through this channel.

Cookie opt-out: cookies can be blocked in browser settings. Blocking essential cookies may limit some service features.

Article 10 — Security safeguards

  • Technical: one-way password hashing (bcrypt), TLS 1.3 in transit, billing keys encrypted with AES-256-GCM, test-account credentials protected with AWS KMS envelope encryption, encrypted backups, secret-key and personal-information masking before storing source code/documents, and a read-only GitHub connection that does not store the user's access token
  • Administrative: minimized number of data-handling personnel, regular security training, separation of access privileges, access logs retained for at least 6 months
  • Physical: AWS data centers (ISO 27001 certified), office access control

Article 11 — Data Protection Officer and operator

  • Operator: Dannect, Inc. (CEO Wonyoung Choi)
  • Business registration number: 425-87-03610
  • Address: 3F, Room 304-92, 10 Chunghon-gil 52beon-gil, Chuncheon-si, Gangwon State, Republic of Korea (Onui-dong)
  • Phone: +82-70-7777-9433
  • Data Protection Officer: Wonyoung Choi (CEO) — privacy@specnote.io
  • Customer inquiries: support@specnote.io

Remedies for rights infringement (Korea):

  • Personal Information Dispute Mediation Committee (privacy.go.kr / 1833-6972)
  • Personal Information Infringement Reporting Center (privacy.go.kr / 118)
  • Supreme Prosecutor's Office Cyber Investigation (spo.go.kr / 1301)
  • Korean National Police Cyber Bureau (ecrm.cyber.go.kr / 182)

Article 12 — Personal information of children under 14

Only users aged 14 or older may register as members, and each user confirms that they are at least 14 years old at sign-up. The Company does not collect the personal information of children under 14. If an account is later identified as belonging to a child under 14, membership is terminated immediately and all collected personal information is destroyed.

Article 13 — Changes to this Privacy Policy

We will notify users via service announcements at least 7 days before any change takes effect, when content is added, removed, or modified due to law, policy, or security technology. When material changes to user rights are involved, we notify at least 30 days in advance.

  • Amended: July 24, 2026
  • Effective: July 24, 2026
  • Previous effective date: July 16, 2026
  • Amendment history: reflected the already-operating Google Ads conversion tag in the processing-entrustment, international-transfer, and advertising-cookie items (retroactive correction); clarified that marketing consent covers custom-advertising audiences on ad platforms (such as Meta and Google) via hashed-email matching; and added Twilio Inc. (SendGrid) as the marketing-email delivery processor (entrustment and international transfer).