Privacy Policy

Controller: Zero to One Flow (021flow) (Rep. Sungtae Ryu) · Email: [email protected] · Data Protection Officer: Sungtae Ryu (the Representative) · Contact: [email protected], 070-8676-0210

• • Account data: email, name or nickname, login identifier.
• • Authentication data: social-login provider identifier, token metadata.
• • Billing data: payment status, plan, billing dates, receipt/order identifiers, Paddle customer/transaction ID (we do not store card numbers, CVC or other payment-instrument details).
• • Usage data: access logs, IP address, browser/device info, usage and error logs.
• • Support data: inquiry content, email, attachments, support history.
• • Cookies and similar technologies.
• • Your content: proposals, documents, prompts and files you input into the Service.

• • Account registration and management.
• • Providing and operating the Service.
• • Verifying plan/subscription status; billing, refunds and tax/accounting.
• • Customer support and notices.
• • Security, abuse prevention and incident response.
• • Service improvement, statistics and analytics.
• • Compliance with legal obligations.

We rely on the following processors (recipient · data · purpose · retention · cross-border):

• • Payments: Paddle.com Market Limited (Paddle) — payment status/order IDs · payment, tax, receipts, refunds, payment-related support · as required by law · cross-border (EU/UK).
• • Delivery/network: Cloudflare, Inc. (DNS/content delivery) — access/request data · delivering and securing the Service · for the service term · cross-border (US and others). The Service's servers themselves are operated by us in the Republic of Korea (see Database/storage below).
• • Email delivery: Amazon Web Services, Inc. (Amazon SES, Seoul region) — email/send metadata · invites, notifications and notices · minimal period after sending · processing entrusted to a US company.
• • Analytics: Google LLC (Google Analytics, Google Tag Manager) — usage/device data · statistics and analytics · up to 14 months · cross-border (US).
• • Ad performance measurement: HawkEyeOps — first-party analytics cookie (_heo_vid, up to 400 days) and visit data · measuring ad performance · up to 400 days.
• • Web font delivery: jsDelivr (open-source CDN, operated by Cloudflare and Fastly) — request metadata such as IP and User-Agent · delivering the UI typeface (Pretendard) · per the CDN operators' log policy · cross-border (US and others).
• • Auth providers: Google LLC, Apple Inc. — auth identifier · social login · until account deletion · cross-border (US).
• • AI APIs: Anthropic, PBC; OpenAI, LLC; Google LLC (Gemini); ElevenLabs, Inc. (voice synthesis) — text/content you submit for generation · producing results · transient (retention per each provider's policy) · cross-border (US).
• • Database/storage: no processor — account and content data are stored on servers we operate ourselves in the Republic of Korea (MongoDB, Redis, S3-compatible file storage) · for the service term · no cross-border transfer.
• • Error tracking (when enabled): Functional Software, Inc. (Sentry) — error details, browser/device data, account identifier · diagnosing failures · per the provider's retention policy · cross-border (US).
• • Mobile app analytics: Google LLC (Firebase Analytics) — app screen views, device data, app-instance identifier · app usage statistics · up to 14 months · cross-border (US).
• • GitHub integration (if you connect it): GitHub, Inc. — GitHub account identifier and access token (stored encrypted on our servers), and the project files you ask to push · pushing to the repository you choose · until you disconnect (pushed files stay in your GitHub repository) · cross-border (US).

We do not sell your personal data, except where required by law.

Using Paddle (UK/EU), content delivery (Cloudflare, US and others), AI APIs (Anthropic, OpenAI, Google, ElevenLabs — US), analytics (Google and Firebase, US), error tracking (Sentry, US) and the GitHub integration (US) may involve transferring data internationally. The recipient, destination country, data, purpose, method (network transmission when you use the Service) and retention follow the processor list in section 4. You may refuse such transfers, but some essential features (e.g. payment) may then be unavailable.

We delete your personal data when you close your account or once the purpose is fulfilled. However, payment/transaction/dispute records may be retained for statutory periods (e.g. Korean e-commerce law); backups are purged on a rolling schedule within 30 days; and minimal records may be kept to prevent abuse.

You may request access to, correction of, deletion of, or restriction of processing of your personal data, withdraw consent, or close your account by contacting [email protected].

We use essential cookies for sign-in and preferences (language/region); any analytics/marketing cookies are identified separately. You can refuse cookies in your browser, though some features may not work.

We apply reasonable safeguards including access controls, encryption in transit, log management, backups, security updates and administrator access controls.

The Service is intended for adults/business users and is not directed to children under 14 (or the applicable age in your country). If we learn we have collected a child's data, we delete it promptly.

If you need to report or seek advice about an infringement of your personal data, you may contact the following bodies (Republic of Korea).

• • Personal Information Dispute Mediation Committee: 1833-6972 (www.kopico.go.kr)
• • Personal Information Infringement Report Center (KISA): 118 (privacy.kisa.or.kr)
• • Supreme Prosecutors' Office: 1301 (www.spo.go.kr)
• • Korean National Police Agency: 182 (ecrm.police.go.kr)

If you are in the EEA or the UK, you also have the right to lodge a complaint with the data protection supervisory authority where you live or work.

This policy applies from its effective date; we announce changes in-product or by email in advance. Privacy questions: [email protected]