Nubint Inc. (the "Company") has established and operates the following Privacy Policy in accordance with Article 30 of the Personal Information Protection Act to protect the personal information and rights of users and to promptly handle related grievances.

1. Collection and Use of Personal Information

The collection of personal information is necessary for the use of the Nubint AI service. The following personal information is collected with user consent.

Purpose of Collection	Items Collected	Retention Period
Membership registration and user identification	Name, email, password	Until account deletion
Social (SNS) sign-up	Account information provided by SNS (name, email, profile picture, etc.)	Until account deletion
AI service provision	Paper search queries, AI editor input text, AI-generated results, uploaded files (PDF, etc.)	Up to 30 days after account deletion
Payment processing	Payment information, billing address and country transmitted to a contracted payment gateway (PG) or merchant of record	Until account deletion or up to 5 years per applicable laws
Customer support	Name, email, phone number	Until account deletion or up to 3 years per applicable laws
Statistical analysis for service improvement	IP information, device and browser information, visited web pages, usage records	Until account deletion
Prevention of unauthorized use	Hashed email (irreversible)	As long as necessary to prevent fraudulent re-registration and duplicate benefit claims

The Company collects personal information through the following methods:

Direct input by users during service use
Transfer from linked services such as SNS sign-up
Automatic generation and collection of cookies, access logs, etc. during service use
Collection through usage statistics tools for service improvement and user response analysis

For children under the age of 14, information such as the legal guardian's name and contact information may be collected from the legal guardian.

Collected personal information is processed within the retention period consented to by the user or required by applicable laws, and is destroyed without delay using methods that prevent recovery or restoration once the purpose has been achieved and the retention period has elapsed.

2. No Use of Your Content for AI Training

The Company does not use your content to train AI models.

The Company does not train its own AI models on your manuscripts, uploaded files, search queries, or AI-generated outputs, and does not collect data for that purpose.
Data sent to the external AI processors used to provide the Service (see Section 6, Cross-Border Transfer of Personal Information) is transmitted only under terms that prohibit its use for training those providers' AI models.
The AI models the Company uses are not further trained on your content.
This applies equally regardless of your plan, whether free or paid.

3. Installation and Operation of Automatic Personal Information Collection Devices

The following information may be automatically generated/collected from users during service use:

Legal compliance: User access records (login) are retained for compliance with applicable laws.
Web usability analysis and improvement: Visit dates, service usage records, and Cookie IDs are collected and retained for up to 5 years from the date of collection, then immediately deleted.

The following analytics tools are used to collect and analyze user behavior:

Microsoft Clarity
Google Analytics
Paddle.js (payment processing and failed-payment recovery)

How to Reject Cookies

Users can reject or delete cookies through their web browser settings:

Chrome

Click ⋮ in the top-right corner → Settings → Privacy and Security → Cookies and other site data → Configure cookie blocking settings

Microsoft Edge

Click ⋯ in the top-right corner → Settings → Cookies and site permissions → Manage and delete cookies and site data → Configure cookie blocking settings

Safari

Preferences → Privacy → Manage Website Data → Configure cookie blocking settings

Firefox

Settings → Privacy & Security → Cookies and Site Data → Configure cookie blocking settings

Please note that rejecting cookies may limit access to some services.

4. Provision of Personal Information to Third Parties

The Company processes personal information only within the scope specified in Section 1, and provides personal information to third parties only with the user's separate prior consent or when required by applicable laws.

5. Outsourcing of Personal Information Processing

The Company outsources some personal information processing tasks for smooth operations, and supervises processors to ensure safe handling of personal information in accordance with applicable laws.

Processor	Outsourced Tasks
Google LLC	Membership registration/authentication (Firebase Auth), web usability analysis (Google Analytics)
Microsoft Clarity	User behavior analysis
Toss Payments	Payment processing
PortOne	Payment integration
PayPal	International payment processing

Any additions or changes to outsourced tasks or processors will be promptly disclosed through this Privacy Policy.

6. Cross-Border Transfer of Personal Information

The Company transfers personal information processing tasks overseas for service provision as follows:

Purpose	Items	Timing and Method	Retention Period	Company and Country
AI service processing	AI editor input text, paper search queries, generated results	Transmitted via encrypted network during service use	Up to 30 days after account deletion	OpenAI, Anthropic, Google / United States
Membership/authentication, web usability analysis	Email, visit dates, service usage records, Cookie ID	Transmitted via encrypted network during service use	Until account deletion or up to 5 years from collection	Google / United States
User behavior analysis	Visit dates, service usage records, screen recordings	Transmitted via encrypted network during service use	Up to 30 days from collection	Microsoft Clarity / United States
International payment processing	Payment information	Transmitted via encrypted network during payment	Until account deletion or up to 5 years per applicable laws	PayPal / United States
Payment processing (Merchant of Record)	Name, email, payment information, billing address and country, IP address	Transmitted via encrypted network during payment	Up to 5 years per applicable laws	Paddle.com Market Limited / United Kingdom (Paddle.com Inc. / United States for purchases made in the US; Paddle.com (Canada) Ltd. / Canada for purchases made in Canada)

Contact details of the recipients are as follows.

OpenAI, L.L.C. — privacy@openai.com (1455 Third Street, San Francisco, CA 94158, USA)
Anthropic PBC — privacy@anthropic.com (548 Market St, PMB 90375, San Francisco, CA 94104, USA) / Korean representative: Anthropic Korea (anthropicprivacy@bkl.co.kr)
Google LLC — data-access-requests@google.com (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA)
Microsoft Corporation — https://aka.ms/privacyresponse (One Microsoft Way, Redmond, WA 98052, USA)
PayPal, Inc. — https://www.paypal.com/us/legalhub/privacy-full (2211 North First Street, San Jose, CA 95131, USA)
Paddle.com Market Limited — privacy@paddle.com (30 Old Bailey, London EC4M 7AU, United Kingdom)
Paddle.com Inc. — privacy@paddle.com (3811 Ditmars Blvd #1071, Astoria, NY 11105-1803, USA)
Paddle.com (Canada) Ltd. — privacy@paddle.com (22 Adelaide Street West, Suite 3400, Toronto, ON M5H 4E3, Canada)

Users may refuse the cross-border transfer of their personal information. To do so, please contact contact@nubint.ai. However, because each transfer listed above is essential to providing the Service — including AI feature processing, account authentication, and payment processing — refusing the transfer may make some or all of those features unavailable and may require termination of the service agreement.

7. Rights of Data Subjects and How to Exercise Them

Users may request access, correction, or deletion of personal information at any time, and the Company will take prompt action.

When a legal guardian or authorized representative exercises a user's rights (access, correction, suspension of processing, deletion), a power of attorney in accordance with Annexed Form No. 11 of the Enforcement Rules of the Personal Information Protection Act must be submitted.

The Company verifies whether the person making the request is a legitimate representative.

8. Privacy Officer

The Company has designated a Privacy Officer to oversee personal information processing and handle user complaints and remedies related to personal information processing.

Officer: Seunghyun Ha
Affiliation: Nubint Inc.
Email: contact@nubint.ai

9. Destruction Procedures and Methods

Collected personal information is securely deleted using methods that prevent recovery, following retention periods based on internal policies and applicable laws.

Upon account deletion, account information (name, email, profile) is deleted immediately. Documents written by the user, chat history, library materials, and uploaded files are destroyed within 30 days of account deletion using methods that prevent recovery.

10. Measures to Protect Personal Information

The Company takes the following measures to protect personal information, including the content of your manuscripts and data received through Google Workspace APIs.

Encryption in transit: All data sent over the internet between your device, the Company's servers and its processors is encrypted (HTTPS/TLS).
Encryption at rest: Data stored in the Company's databases and file storage is encrypted at rest.
Access control: Access to systems that hold personal information is limited to the personnel who need it to operate the Service, through individually authenticated accounts.
Credentials: Passwords are handled by the Company's authentication provider and are never stored by the Company in readable form. Access tokens issued to plugins and connected apps are stored only as irreversible hashes.
Minimal retention: Personal information is kept only for the periods stated in Sections 1 and 9, and is then destroyed using methods that prevent recovery.
No sale: The Company does not sell your personal information or your content, and does not use your content for advertising.

11. Document Data from Plugins

This section applies when you use a Nubint plugin — the add-in for Microsoft Word, the add-on for Google Docs, or the browser extension.

Data accessed: With your authorization, the plugin reads the text of the manuscript you have open — the document in Word or Google Docs, the project files in Overleaf, or the page you run the browser extension on — and only while you use the plugin there. It does not read your other documents, files or services.
How it is used: The text is sent to the Company's servers only to provide the features you use in the plugin — checking whether your references exist, which passages read as AI-written, and how sound your sources are — and to show you the cost and the results. When you choose to locate a finding, the plugin marks that passage in your document.
AI training: As stated in Section 2, this text is not used to train AI models.
Sharing: Document data received from plugins is not sold and is not shared with third parties, except with the infrastructure providers that host the Service on the Company's behalf, or where required by law.
Storage and retention: The document text is processed to produce the result and is not retained by the Company after the result has been returned.
Protection: This data is protected by the measures described in Section 10.
Revoking access: You can disconnect a plugin from your Nubint account in Settings, or remove it from the editor, at any time. For Google Docs, you can also revoke access from your Google Account.
Google Workspace data: The following applies in addition to data received through Google Workspace APIs. The Company does not use Google Workspace user data — raw, aggregated or derived — to create, train or improve foundational or generalized AI or machine-learning models, and does not transfer or sell it for that purpose. The use of raw or derived user data received from Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements. The Company's personnel do not read this data, unless you have given explicit consent, it is necessary for security purposes, or it is required to comply with applicable law; any internal use is limited to data that has been aggregated and anonymized.

12. Policy Changes

This policy may be modified in accordance with changes in laws or service policies. Any changes will be announced through means determined by the Company.