1. Consent to the Collection of Personal Information
When collecting and using personal information, the Company clearly explains the purpose of processing, items collected, retention period, and consequences of refusing consent, and obtains any consent required. When a user clicks the “Agree” button associated with that notice, the user is deemed to have consented to processing within the stated scope.
2. Purposes, Items, and Retention Periods
Ending TEAM access is not account withdrawal or data deletion. Existing teams, members, roles, research and responses are preserved with access blocked and become accessible when the billing owner restores team entitlement. This does not restart or indefinitely extend personal-data retention periods; account withdrawal, data deletion and the general retention and destruction rules below continue to apply.
The Company processes personal information for the following purposes and does not use it for purposes other than those stated.
| Category | Items Collected | Purpose of Use | Retention and Use Period |
|---|---|---|---|
| Membership Registration and Management | Email, password (stored using one-way encryption), name (nickname) | Identification of Service users and confirmation of intent to register | Deleted 30 days after completed membership withdrawal. A request awaiting payment-closure confirmation is not completed withdrawal. |
| Customer Inquiries | Email, inquiry details, attachments (optional) | Review of inquiries and notification of results | 3 years for consumer complaint or dispute records subject to the applicable statutory retention obligation |
| Paid Subscriptions, Payments, and Refunds | Verified email; account, customer, subscription, transaction, item, and adjustment identifiers; plan and period; currency, net price, tax, discounts, and actual total; information needed for billing-country, business, and tax classification; consent and policy version; payment, cancellation, and refund states and times | Payment verification and reconciliation, paid access, cancellation and refunds, prevention of duplicate processing and additional charges before withdrawal, and support | 5 years for minimum contract or payment records subject to the Korean statutory obligation. Other items follow their processing purpose and specific legal basis as described below |
| Usage and Refund Evidence | Plan allowances, period and elapsed time, completed response and email-send counts, first valid request time and channel, and usage, calculation, approval or rejection evidence frozen on receipt | Determine unused full or usage-based partial refunds, fix the submitted amount, and handle separate rights inquiries and disputes. Research answer content and email recipient lists are not sent to Paddle for billing | Only minimum evidence subject to contract, payment, or dispute retention obligations is kept for the applicable period. Routine operational data is deleted when its purpose is fulfilled |
| Service-impact Notices | Notice identifier, email and language, minimum context for plan and status changes, delivery state, attempt count, and delivery reference | Notify plan activation, end, and transition to FREE, separately from Paddle receipts and statutory payment notices. These notices do not consume the Service email-send allowance | Limited to delivery and necessary error handling or audit purposes. Specific item-level periods are finalized and disclosed before sales; records are not retained indefinitely |
Paddle and payment institutions directly process the name, billing address, business and tax details, card information, and device or browser information used in checkout. The Company receives only the minimum results needed for the Service and does not store full card numbers, CVCs, Paddle card tokens, or recurring-charge billing keys.
Separate Retention Required by Law
The periods below apply only to records for which the Company is subject to the relevant Korean electronic-commerce retention obligation. They do not apply uniformly to every country’s transactions or all personal information processed by Paddle.
| Record | Retention Period |
|---|---|
| Records concerning labeling and advertising | 6 months |
| Records concerning contracts or withdrawal | 5 years |
| Records concerning payments and the supply of services | 5 years |
| Records concerning consumer complaints or dispute resolution | 3 years |
General member and research cleanup is separate from payment-evidence retention. Only minimum records supported by a statutory duty or a specific ongoing refund or dispute are kept separately with restricted access, then destroyed without delay when their purpose and period end. Any additional legal hold has a recorded basis and review point and is not used for marketing. Specific Paddle-related item-level periods, legal bases, and post-withdrawal de-identification will be finalized and disclosed here before sales. Live payments are unavailable until then.
3. Methods of Collection
- Online collection through website registration, inquiries, and similar interactions
- Offline consultations received by telephone, fax, mail, and similar means
- Automatic collection through generated-information collection tools, including cookies
- At payment, transaction, subscription, and refund results are received through encrypted APIs and signature-verified payment event notices between the Company and Paddle. Information entered directly into Paddle checkout is subject to Paddle’s notices.
4. Destruction Procedures and Methods
In principle, the Company destroys personal information without delay when it is no longer necessary, including when its retention period has expired or the processing purpose has been achieved.
- Procedure: General member and owned research information is deleted under the existing cleanup policy 30 days after completed membership withdrawal. Accounts whose withdrawal is incomplete because payment closure is unconfirmed are not included. Minimum payment, refund, or dispute evidence requiring separate retention is not deleted with general data; it is retained and destroyed under Section 2.
- Method: Electronic files are destroyed using technical methods that prevent recovery, and paper documents are shredded or incinerated.
5. Payment Seller and Privacy Roles
Paddle is the legal seller (Merchant of Record) for payment transactions, while the Company provides Alioth Research. Paddle is not described as merely a payment processor acting only on the Company’s instructions. Each party is responsible as a controller for its own processing purposes.
The contracting entity for your purchase location is identified in the Paddle Buyer Terms and checkout. Paddle’s processing, group entities, and rights channels are described in its Privacy Policy. Any processing separately outsourced by the Company will be disclosed with the actual processor and activities.
6. Third-party Sharing and International Transfers
The Company processes information for the disclosed purposes and verifies the legal basis and separate consent or notice requirements for third-party sharing and international transfers. Paddle’s seller role is not treated as blanket consent to all sharing or transfers.
Payment integration uses only necessary information such as email, an opaque internal account identifier, selected plan, price, currency, and order details. Company passwords, research answer content, and email recipient lists are not provided to Paddle for billing.
Before live sales, the actual receiving entity and contact details, destination countries, items, purposes, transfer timing and methods, retention periods, legal basis, and refusal method and consequences will be specifically confirmed and disclosed, with required consent obtained. Paddle entity locations are not assumed to be the complete actual transfer-country list. Live payments are unavailable before this detailed notice is complete.
Users may refuse or withdraw required consent by not purchasing or by contacting the Chief Privacy Officer. If essential payment processing cannot occur, paid purchases may be unavailable, but unnecessary consent is not required for FREE use on that basis. Withdrawal of consent does not erase an existing statutory retention duty or automatically complete subscription cancellation.
Requests concerning information independently processed by Paddle may be sent through Paddle’s rights portal or privacy@paddle.com. The Company supports inquiries about its own processing.
7. Rights and Obligations of Data Subjects and Legal Representatives
- Users and authorized representatives may request access, correction, deletion, restriction, or withdrawal of consent through the Chief Privacy Officer, following identity and authority verification.
- Refund, dispute, and privacy support remains available after membership withdrawal without restoring an account or subscription. Re-registration with the same email does not automatically connect prior subscriptions or rights. Deleted data cannot be recovered.
- Requests to delete or restrict minimum payment, contract, or dispute records required by law may be limited during the applicable period. The reason will be explained, and records are not used beyond their statutory purposes.
8. Safeguards for Personal Information
The Company implements the following measures to protect personal information:
- One-way encryption of passwords and encrypted data transmission using SSL
- Server-side access restrictions for payment API credentials, payment event signature verification, processing access controls, and minimization of personal information in logs
- Operation of intrusion prevention systems and periodic antivirus updates
9. Use and Refusal of Cookies
The Company uses cookies to provide an optimized Service. Users may allow or refuse all cookies through their web browser settings. Refusing cookies may limit use of some Service features.
Device information and cookies in Paddle checkout are subject to Paddle’s notices. Essential processing is distinguished from optional marketing consent. Reading these Terms or this Policy does not constitute payment consent or consent to optional tracking.
10. Chief Privacy Officer
For questions regarding personal information protection, please contact the Chief Privacy Officer below.
- Title: Chief Privacy Officer
- Email: contact@aliothrs.com
11. Governing Law and Protection of Data Subjects
This Privacy Policy and the Company’s processing of personal information are protected and interpreted under the Personal Information Protection Act, the Act on Consumer Protection in Electronic Commerce, Etc., and other applicable laws of the Republic of Korea.
This English version is provided for convenience. To the extent permitted by applicable law, the Korean version prevails if there is any inconsistency in interpretation.
Governing-law or translation-priority provisions do not restrict privacy rights that cannot be waived under the laws of the user’s country of residence.
[Addendum]
Document version: paddle-legal-20260914 · Drafted: September 14, 2026. The effective date of the Paddle provisions will be announced in advance and is separate from the drafting date.