Privacy Policy

1. Purposes of processing personal information

BlackWall, Inc. (the "Company") processes personal information only for the following purposes. If a purpose changes, the Company will tell you in advance and ask for your consent again.

• Signing up, verifying your identity and managing your account
• Providing the service: creating projects and running databases, authentication and file storage
• Measuring usage and billing, processing payments and refunds
• Responding to outages and inquiries
• Carrying out the tasks you ask the console's AI agent to do
• Checking eligibility for the Free plan (one Free organization per GitHub account)
• Running the GPU jobs and GPU servers you ask for and keeping GPU storage
• Preventing abuse and keeping the service secure

Advertising messages are sent only if you have consented to them separately, and not consenting places no restriction at all on your use of the service.

2. Personal information processed

On sign-up (required): email address, password (stored with one-way encryption, so even the Company cannot know the original), organization name

When you sign up with or connect GitHub: your GitHub account's id number and user name, and the email address GitHub has verified. Used to sign you in and to limit the Free plan to one organization per GitHub account. Your GitHub password and repository contents are not received.

When using a paid plan: the customer and subscription identifiers issued by the payment processor (Lemon Squeezy), the subscription status and payment history. The full card number, expiry date, card password and CVC are entered on the payment processor's screen and are neither sent to nor stored on the Company's servers.

Generated automatically while you use the service: date and time of access, IP address, browser information, usage records (number of requests, storage used, data transferred)

When using the AI agent: the conversation you enter, the tasks the agent ran and their results (which may include project data within the scope of what you asked about), and the number of tokens used. Conversation history is stored per project and is deleted when you press "New conversation".

The Company does not collect sensitive information, such as ideology or beliefs, trade union membership, health or sex life, or resident registration numbers.

3. Processing and retention periods

As a rule, personal information is destroyed without delay when you close your account. However, information that the following laws require to be kept is retained for the period stated and then destroyed.

Information kept during these periods is used only for the purpose of keeping it and for no other purpose.

The data users put on the service (including personal information they entrust to the Company for processing) is processed for as long as the service agreement lasts, and in the following cases it is destroyed once the stated period has passed.

• The database of a project that has been stopped for non-payment, unusable on the Free plan, or paused for 90 days: moved to archive storage, kept for 1 year, and then destroyed together with the project's files. Users are told 30, 7 and 1 day before the move and 30 days before the destruction.
• A deleted project: destroyed after 30 days.
• When the service agreement is terminated (the account is closed): kept for 30 days and then destroyed. If destruction at once is requested on termination, it is destroyed without delay.

Destroyed data may remain in the storage's recovery features for up to 21 days; during that time it is used for no purpose, and after it the data is erased beyond recovery.

4. Provision of personal information to third parties

The Company does not provide your personal information to third parties.

The exceptions are where a law specifically provides otherwise, or where an investigative agency requests it following the procedures and methods set by law. Even then, the Company checks the basis and scope of the request and responds only to the minimum extent necessary.

5. Entrustment of processing

To run the service, the Company entrusts the following tasks to others.

The data you upload to the service is stored and processed in the Republic of Korea (Seoul). However, if you use the AI agent or GPUs, what they need is processed abroad as set out in section 6 below.

The entrustment contracts reflect the matters the Personal Information Protection Act requires, and the Company manages and supervises the trustees so that they do not process personal information beyond the purpose of the entrustment.

6. Transfer of personal information overseas

Personal information is transferred abroad only in the following three cases. Outside these three cases, nothing is transferred abroad.

A. If you pay for a paid plan: personal information is transferred as follows to process the payment. If you use only the free plan, nothing is transferred abroad.

You may refuse the overseas transfer. If you refuse, you cannot pay for a paid plan, but you can continue to use the free plan.

B. If you use the console's AI agent: personal information is transferred as follows to generate its answers. If you do not talk to the AI agent, nothing is transferred.

Secret values such as keys, passwords and connection addresses are masked before sending, and are not sent to the recipient. So that your data is not sent in bulk, the number of table rows sent at a time is limited.

You may refuse the overseas transfer. You can do so by not using the AI agent, and even if you refuse, you can continue to use the rest of the service apart from the AI agent.

C. If you use GPUs: personal information is transferred as follows to run GPU jobs and GPU servers and to keep GPU storage. If you do not use GPUs, nothing is transferred.

You may refuse the overseas transfer. You can do so by not using GPUs, and even if you refuse, you can continue to use the rest of the service apart from GPUs.

Unless you use the AI agent or GPUs, the data you upload to the service is itself never transferred abroad. Only the information listed in the three tables above is transferred; the data in table B is limited to what you asked the AI agent for, and the data in table C to what you put in GPU jobs, servers and storage.

7. Procedure and method of destruction

When the retention period ends or the purpose of processing has been achieved, the information is destroyed without delay.

Procedure: when you close your account or the purpose is achieved, the information is immediately set apart, and destroyed unless it is a record that section 3 above requires by law to be kept.

Method: electronic files are deleted in a way that cannot be recovered, and any printouts are shredded or incinerated.

8. Possibility of sensitive information being disclosed

Because the Company does not collect sensitive information, there is no possibility of sensitive information being disclosed. Accordingly, there is also no procedure for choosing whether to disclose it.

9. Processing of pseudonymized information

The Company currently does not process pseudonymized information. If it begins pseudonymizing information for statistics or research, it will first amend and publish this policy and only then process it.

10. Rights of users and legal representatives, and how to exercise them

You may exercise the following rights at any time.

• Request access to your personal information
• Request correction where it contains errors
• Request deletion (except where a law requires it to be kept)
• Request suspension of processing
• Withdraw consent you have given

You can do this yourself on the account screen of the console, or tell us at [email protected], and the Company will handle it within 10 days and tell you the result.

Children under the age of 14 cannot sign up without the consent of a legal representative. If the Company confirms that a user is under 14, it destroys that account's information without delay.

You may also exercise these rights through an agent, in which case a document confirming the delegation is required.

11. Privacy officer

The officer who oversees the processing of personal information and handles users' complaints and remedies for damage is as follows.

Send any inquiries, complaints or requests for remedy about personal information to the contact above. The Company does not put off its answers.

12. Devices that automatically collect access information

The Company uses a cookie to keep you signed in, and a cookie that remembers the display language you chose (bw-lang, one year). The language cookie holds only the chosen language code and nothing that identifies you. It uses no cookies for advertising or for tracking users, and has added no third-party analytics tools.

You can refuse this cookie in your browser settings. However, if you refuse it, you will not stay signed in and cannot use the console.

Your display theme setting is stored only in your browser and is not sent to the Company's servers.

13. Measures to keep personal information secure

• Passwords are stored with one-way encryption, so even the Company cannot know the original.
• TLS encryption is applied to the entire transmission path.
• Cards and other payment methods are not stored by the Company; the payment processor (Lemon Squeezy) stores them.
• Each project's database uses its own schema and permissions, and row-level access rules apply to every table.
• Administrative access is open only through paths that verify identity, and all other ports are closed.
• Access records are kept and cannot be altered or deleted at will.

14. Remedies for infringement of rights

If you are not satisfied with how the Company has handled a matter, you can ask the following bodies for help.

• Personal Information Dispute Mediation Committee: 1833-6972 (www.kopico.go.kr)
• Personal Information Infringement Report Center: 118 (privacy.kisa.or.kr)
• Supreme Prosecutors' Office, Cyber Investigation Division: 1301 (www.spo.go.kr)
• Korean National Police Agency, Cyber Investigation Bureau: 182 (ecrm.police.go.kr)

15. Connecting AI tools

You can connect AI tools such as Claude and ChatGPT to your One Server account and let them work on your projects. A connection is made only when you sign in and allow it yourself, and on the consent screen you choose whether it may only read or may also make changes.

What the Company processes when you connect: the connected app's name and address, the permissions you allowed, when it was connected and refreshed, and the IP address the connection was allowed from. The keys issued to the app (access and refresh tokens) are stored only as one-way hashes.

What is passed to the AI tool: when the AI tool calls a function (tool) at your request, the result (for example the project list, a table's contents, or the data queried) is passed to the company that runs that AI tool (for example Anthropic or OpenAI). This happens only within what you connected and asked for, and the information is then handled under that operator's privacy policy. The Company neither receives nor stores your conversation with the AI tool.

Retention: access tokens stop working after 1 hour and refresh tokens 30 days after their last use; connection records are destroyed when you disconnect or leave. Access records under section 3 are kept for the period stated there.

Disconnecting: you can disconnect at any time under Account → API · MCP tokens → Connected apps in the console; the app's next request is then refused.

16. Changes to this policy

When this policy is amended, the Company announces it in the console and on this page from 7 days before the effective date. Changes that are unfavorable to users or that require new consent are announced from 30 days before, and consent is asked for again.

Previous versions of this policy are sent on request.