Privacy Policy

1. Controller

Kurnell Inc. operates the official kurnell.io website and processes personal data only as needed to respond to inquiries and operate the site securely.

2. Personal Data We Process

• Required contact form fields: inquiry type, name, email address, and message
• Optional contact form field: company or team name
• Technical data for abuse prevention and rate limiting: IP-based request count data, user agent, and data generated during site access

3. Purposes of Processing

• Reviewing and responding to inquiries
• Classifying project, partnership, career, and other inquiries
• Preventing spam, automated submissions, and excessive repeated submissions
• Maintaining stable and secure website operations

4. Retention

• Inquiry data is retained for one year after the inquiry is completed, then deleted.
• IP-based rate limit data is processed only for the period needed to enforce submission limits.
• If applicable law requires retention, data is retained for the period required by that law.

5. Third-party Disclosure

Kurnell Inc. does not disclose personal data to third parties unless the data subject has consented or disclosure is required by law.

6. External Services

• Vercel: website hosting, deployment, and access log processing
• Resend: contact email delivery
• Upstash Redis: contact form rate limiting
• These services may use infrastructure outside Korea. Actual processing locations and security standards are governed by each service provider's policies.

7. Deletion

When the retention period ends or the processing purpose is fulfilled, personal data is deleted without undue delay in a manner designed to prevent recovery. Electronic files are deleted, and paper records, if any, are shredded or destroyed.

8. Data Subject Rights

Data subjects may request access, correction, deletion, suspension of processing, or withdrawal of consent regarding their personal data. Requests may be submitted through the Contact page, and Kurnell Inc. will process them under applicable law after verifying the requester.

9. Security Measures

• Contact form input validation and honeypot spam protection
• IP-based rate limiting
• Access control for deployment and delivery infrastructure
• HTTPS communication

10. Privacy Inquiries

Privacy inquiries, data subject rights requests, and complaints may be submitted through the Contact page. When the company-domain mailbox is available through Google Workspace, the email contact will be added to this policy.

11. Changes to This Policy

If this policy changes, the effective date and changed content will be published on this page.