Privacy Policy

1. Principle: content-free

Bringthehome Inc. (브링더홈 주식회사, the "Company") operates the PurplePrint service on a content-free principle. When you receive coaching in your own AI tool (Claude, Cursor, ChatGPT, etc.), what you build and what you type (your content) is not stored on the Company's servers. Only the minimum information needed for account identification and service operation is processed. When you use the web coach (Section 6F), the server review engines (Section 6), or GitHub and Notion connections (Section 6G), we process the content those features need, within the scope stated in each section.

2. Personal Data We Collect

• Account data: the email address, provider account identifier, and display nickname received from your login provider (Google or GitHub) or used for a pre-provisioned account
• Web coach conversations and design documents (only if you use the web coach): your conversations in the web coach (including web, repository, and page information brought in at your request), the design documents you create together, and project and conversation names
• Web coach usage: usage information for managing usage limits (no content)
• GitHub and Notion connection information (only if you connect): an access token, granted scope, display account name, the list of repositories and pages you choose, and usage records for security (no content). We do not store the email address or other user information that Notion sends along.
• Shared link information (if you create links): sharing scope, expiry date, and whether the link is stopped
• Server review results (if you run a server review engine): review results and processing status
• Threads connection information (only if you connect): Threads account identifier and display name, permissions granted, connection status, and the access token and its expiry
• Threads read, search, and insights results: your own posts, public search/profile/mention/reply/conversation results, location and publishing-limit data, and post/account insights returned by Threads when you call a read tool. These results are not stored; they are delivered in that request's response to your AI client.
• Threads publishing records: status, post identifier, a value from which the original text cannot be restored, and Meta receipt for publishing, reply, or deletion jobs you approve. Original text and media are kept encrypted only while being processed and are deleted when processing ends.
• Threads tester registration request data: the Threads username you give us when you ask to be registered as a tester, and the request status (requested, registered, connected)
• Promotional email consent data (optional): whether you consent to receive promotional emails, and the date, time, and route (login screen, settings, or unsubscribe link) of consent or withdrawal. It exists only if you consent or withdraw.
• Pre-provisioned email authentication data: a verification value, never the plaintext password
• Usage records (metadata): progress and usage metadata such as current Phase, command usage counts, trial/subscription status, and server review request counts
• Environment & acquisition data: access country, browser/OS/device type (a classification, not the raw User-Agent), referral domain and path (query strings excluded), and referral-source category. We do not store personal-identification IP addresses or the raw User-Agent.
• Aggregated landing visits: page views, page paths, referral-source category, country, and performance metrics for the marketing site. We do not store personal-identification cookies, browser storage, query strings, or per-user IP addresses.
• Payment-related: email, account identifier, and payment/subscription status at payment time (card numbers and other payment method details are handled by the payment processor)
• Instagram connection information (only if you connect): Facebook user identifier; Facebook Page and Instagram professional-account identifiers and display names; granted permissions and Page access tasks; connection status, token expiry and the user access token. The Page access token is used only for account verification and is not stored.
• Inquiry and founder-help application emails (only if you send one): the sender's email address and the email content. A founder-help application email includes your name, project information, a shared link to your review report, the scope of consent for case introductions and, if you choose public introduction, your service name and social media account.

3. How We Collect

Personal data is collected when you log in with Google, GitHub, or a pre-provisioned email account, or when you authorize a Threads, Instagram, GitHub, or Notion connection. Metadata is also generated automatically while you use the Service. Marketing-site visits are aggregated without cookies. Consent to promotional emails is collected only when you choose it yourself on the login screen or in settings; the default is "not consented". Web coach conversations and design documents are collected when you use the web coach. Inquiry and founder-help application emails are collected when you send them. Public email sign-up is not offered.

4. Purpose of Use

• Account identification and login persistence
• Managing the free trial and paid subscription, and usage management
• Service delivery, session resumption (restoring your prior progress point), and quality improvement (your content is viewed only as set out in Section 6I)
• Providing the web coach: keeping and continuing conversations and design documents, and managing usage limits
• Using the GitHub repositories and Notion pages you choose for reviews and coaching, and carrying out writes you approve
• Showing documents, conversations, and review results to people who have a shared link you created
• Keeping server review results so you can view them again
• Aggregating acquisition source, device environment, usage stages, and marketing-site page usage and web performance to improve the product and the onboarding/conversion experience
• Preventing abuse, maintaining security, responding to incidents, and complying with legal obligations
• Connecting your Threads account and processing posts, replies, or deletions that you explicitly approve
• Returning the Threads post, profile, mention, reply, search, and insights results you request to your AI client
• Handling Threads tester registration requests for connecting Threads before Meta app review
• Emailing you about actions needed to keep using the Service, such as an expired connection, a required reconnection, or a tester registration result (these are service notices, not advertising, and are sent regardless of promotional email consent)
• Sending promotional information, such as new PurplePrint features and events, by email only to users who consent, and sending the results of consent or unsubscribe requests and the biennial consent check (optional · Section 6E)
• Connecting the Instagram professional account you choose, verifying the connected account and Page, and managing connection status and expiry notices
• Responding to inquiries, supporting and contacting founder-help applicants, and introducing cases within the scope you consent to (Section 6J)

5. Information Not Sent to Our Servers

When you receive coaching in your own AI tool, the following stays only in your local environment and is not transmitted to or stored on the Company's servers. When you use the web coach, Section 6F applies.

• Ideas, conversation content, and design artifacts (context documents, design documents, UX designs, etc.)
• The execution content of research/verification engines (Hyper-Research, Scenario, etc.): these run in your AI client and do not pass through our servers.
• Growth measurement (builder level): recorded from behavioral signals only, without conversation content. It may be recorded automatically when you complete a design document, and you can turn automatic recording off if you want.

6. Exceptional Transmission by Server Review Engines

When you explicitly run the server-based review engines Hyper-Review or DAR (development-design review), the design document and review input you submit for review are transmitted to the AI processing infrastructure below to perform the review.

• ① Cloudflare, Inc.: processed within the server infrastructure the Company uses, and not used to train models. Text extraction from attached files (PDFs and images) is performed only here.
• ② AI models run on Microsoft Azure or OpenAI via Vercel Inc.: requested only under Zero Data Retention terms. Neither Vercel nor Microsoft Azure or OpenAI (with which Vercel has zero-data-retention agreements) retains the input or output; data is deleted once the request completes and is not used to train models.

This transmission occurs only when you invoke those engines. Review results are kept in your account so you can view them again, and anyone who has a report link you created can see that result. Records of the review process (including the review input) are deleted automatically after at most 30 days, and original attached files are deleted when the review ends. When you use GitHub repositories or Notion pages you choose as review input, Section 6G applies. Code Audit runs locally on your machine and is not transmitted to our servers.

6A. Cookieless Landing Analytics

We aggregate visits, referral source, country, and web performance for our marketing site (purpleprint-ai.com) with the analytics service of Cloudflare, Inc. It does not use personal-identification cookies or browser storage, and it does not store query strings or per-user IP addresses. This landing analytics applies only to the marketing site. On product and authentication screens (/app/*), we collect operational logs for service improvement (access country, device classification, acquisition path, usage stage), but we do not store personal-identification IP addresses, cookies, or fingerprints, and we do not collect your ideas or design content. It does not apply to MCP usage content.

6B. Threads Social Publishing

When you connect a Threads account and approve a post, reply, or deletion, we send the text and media you approved (for a deletion, the target post identifier) to Meta together with the connection information. Published content may be public on Threads. Text and media to be published are kept encrypted only while being processed and are deleted when processing ends; status checks and duplicate prevention use only processing records from which the original text cannot be restored.

6C. Threads Reading, Search, and Insights

When you call a Threads read tool, we retrieve, within the permissions of your connected account, your own posts, public search/profile/mention/reply/conversation results, location and publishing-limit data, and post/account insights. Results are not stored; they are delivered in that request's response to your AI client.

6D. Threads Tester Registration Requests

Until Meta app review is complete, only accounts registered with Meta as testers can connect Threads. When you ask to be registered as a tester, the Company asks Meta to register the Threads username you give us as a tester. We delete the username without delay once the connection is complete, you cancel the request, or app review is complete and tester registration is no longer needed. So that you never have to ask again, we keep the request status (requested, registered, connected) without the username.

6E. Consent to Promotional Emails

The Company sends commercial promotional information, such as new PurplePrint features and events, by email only to users who consent to receive it.

• Optional consent: you choose it yourself on the login screen or under Settings → Account → Email preferences. The default is "not consented", and not consenting places no restriction on your use of the Service.
• How we send: the subject line starts with "(광고)" (advertisement), and the body states the sender's name, email, phone number, and address, and how to unsubscribe, in both Korean and English. We do not send between 21:00 and 08:00 KST.
• Unsubscribing and withdrawing consent: at any time, through the unsubscribe link at the bottom of a promotional email (no login needed), under Settings → Account → Email preferences, or through the contact in Section 12. It costs nothing, and we ask for no information other than your contact address.
• Result notice: when we process a consent, unsubscribe, or withdrawal, we email you the fact, its date and time, and the result within 14 days.
• Consent check: every two years from the date you consented, we check by email whether you want to keep receiving promotional emails.
• Service emails, such as review-result notifications or connection expiry notices, are not advertising and are sent regardless of this consent.

6F. Web Coach

When you use the web coach in a browser, we process data as follows.

• Keeping your work: we keep your conversations and design documents on our servers so you can close and reopen the window or continue on another device.
• AI processing: to produce coaching replies, your conversations and design documents are sent via Vercel Inc. to AI models on Microsoft Azure or OpenAI. Requests are made only under Zero Data Retention terms, so inputs and outputs are not retained and are not used to train models.
• Checking web information: to handle your requests, the coach may find and read public web information, or open a web page to look at it with you. Search terms and page content may be processed through the path above, and opened pages are not kept. Inputs only you should make, such as passwords and payments, you enter yourself.
• Shared links: if you create a shared link, anyone with the link can see that project's documents (and its conversations, if you choose) without logging in. You choose the expiry date and can stop the link at any time, and links are kept out of search engines.
• Deletion: when you delete a project, we delete its conversations and design documents immediately and stop its shared links. Progress and usage information without content remains.

6G. GitHub and Notion Connections

• We read only the repositories and pages you choose, and process what we read through the paths in Sections 6 and 6F.
• We write to repositories and pages (creating a repository, exporting documents, writing a page, and so on) only when you approve the action with that content.
• For security and dispute handling, we keep usage records of connections, reads, and writes, without content.
• When you disconnect in settings, we delete the stored token. You can also revoke access in each service's own settings.

6H. Instagram Account Connection

When you choose to connect an Instagram professional account, we use the connection information stated in Section 2 to verify the account and connected Facebook Page. The Page access token is used during account verification and is not stored. Display information and connection status of the connected account and Page are returned to the AI tool you use to check the connection; access tokens are not. Retention by your chosen AI tool follows its settings and policy.

Disconnecting deletes the stored connection information and user access token. If Meta authorization may remain, we explain how to revoke it in Facebook settings.

6I. When the Company Views Your Content

As a rule, the Company does not view web coach conversations and design documents, or review inputs and results submitted to server review engines ("your content"). Designated staff, kept to the minimum, view your content only as far as needed in the following cases.

• Your request: when you ask us to resolve an inquiry or reported error, limited to the project or review you asked about.
• Outages, security and legal obligations: when needed to find the cause of a service outage, investigate a security incident, prevent misuse, or meet a legal obligation.
• Quality checks: when needed to improve coaching and review quality. You can opt out of viewing for this purpose in Settings, and if you do, your content is not viewed for this purpose.

Each viewing is logged with who viewed it, when, what, and why. You can ask for the viewing log of your content through the contact in Section 12. Viewed content is never disclosed outside the Company or used to train AI models, and internal quality notes do not carry anything that identifies you.

6J. Founder Help Applications and Case Introductions

• Applications to the founder help program are sent by email. The Company looks only at the application email and the review result opened through the shared link you send. We do not separately view your account content because of an application.
• Case introductions are made only within the scope you choose in your application email: no introduction, anonymous (industry and situation only), with your service name, or with your service name and social media account. The help is the same if you do not consent.
• You can withdraw consent at any time from the address you applied from. After withdrawal we make no further introductions and remove, without delay, anything that identifies you from case posts the Company has published.

7. Sub-processors and Third Parties

The Company entrusts processing to, or uses the infrastructure of, the following providers to deliver the Service.

• Cloudflare, Inc.: server hosting, storage of account and service data (including web coach conversations and design documents, and server review results), cookieless landing-visit/performance aggregation, AI processing and attachment text extraction for server review engines, opening web pages for the web coach, and forwarding inquiry and application emails
• Google LLC: login (OAuth), and keeping and replying to inquiry and application emails (Gmail)
• GitHub, Inc.: login (OAuth), reading repositories you connect, and writes you approve
• Vercel Inc.: relaying AI requests for server review engines and the web coach (zero data retention). Sub-processors: Microsoft Corporation (Azure) and OpenAI OpCo, LLC for AI model processing (zero data retention)
• Polar Software, Inc.: payment processing (Merchant of Record)
• Plus Five Five, Inc. (Resend): email delivery (review-result notifications, notices about actions needed to keep using the Service, promotional information sent to consenting users, and consent result and consent check notices)
• Notion Labs, Inc.: reading pages you connect, and writes you approve
• Meta Platforms, Inc.: Threads account connection, Threads posts, replies, and deletions you approve, Threads read, search, and insights requests you call, Threads tester registration you request, and Instagram account connection and verification

8. Cross-border Transfer

The servers of the above sub-processors may be located outside your country, and your personal data may be transferred and processed abroad when you use the Service. Transferred items are limited to what is necessary to provide the Service.

Recipient contacts

• Cloudflare, Inc.: privacyquestions@cloudflare.com
• Google LLC: https://support.google.com/policies/answer/9581826
• GitHub, Inc.: https://support.github.com/contact/privacy
• Vercel Inc.: privacy@vercel.com
• Microsoft Corporation: https://aka.ms/privacyresponse
• OpenAI OpCo, LLC: dsar@openai.com
• Polar Software, Inc.: privacy@polar.sh
• Plus Five Five, Inc.: support@resend.com
• Notion Labs, Inc.: privacy@makenotion.com
• Meta Platforms, Inc.: https://help.meta.com/support/privacy/

When and how: transmitted over encrypted connections when you log in and use the Service or use the relevant feature, and for inquiry and application emails, when you send them. How to refuse: transfers tied to a feature, such as the web coach, server review engines, payment, or account connections, do not happen if you do not use that feature; only that feature is then unavailable, and coaching in your own AI tool and other features are unaffected. If you do not want the transfers needed to keep your account and host the Service, you cannot use the Service.

9. Retention Period

Personal data is retained while the account is active and destroyed without delay upon a withdrawal request. Retention by item is as follows.

• Web coach conversations and design documents: until you delete the project or withdraw (deleted immediately when you delete the project)
• Server review results: while the account exists · records of the review process: at most 30 days
• Threads, Instagram, GitHub, and Notion connection information and access tokens: while connected (deleted when you disconnect or withdraw). Instagram Page access tokens are not stored.
• Threads username given for tester registration: until the earliest of connection completion, request cancellation, or completion of app review
• Text and media to be published: until processing ends
• Records of consent to and withdrawal from promotional emails: while the account exists, so that consent and withdrawal can be evidenced
• Landing visit aggregates: up to six months · web coach usage (no content): while the account exists
• Usage and processing records without content: as long as needed for security and dispute handling
• Records of Company staff access to and viewing in personal data systems: one year
• Inquiry emails: as long as needed to handle the inquiry and any dispute (up to three years) · founder-help application emails: until the program ends or you ask us to delete them · consent to case introductions: until you withdraw it

Data needed for payment, settlement, dispute handling, security logs, or legally required retention may be separately retained for the applicable period. Personal data whose retention period has ended or whose purpose has been fulfilled is destroyed without delay, and electronic files are deleted in a way that cannot be recovered.

10. Your Rights

You may request access to, correction of, deletion of, and suspension of processing of your personal data, as well as account withdrawal. For Threads and Instagram connection data, see our data deletion instructions. You can view and delete web coach conversations and design documents in the web coach at any time, and stop shared links in settings. Contact us through Section 12 to delete server review results or for other requests.

11. Security Measures

The Company protects personal data through login-token expiry management, access control, HTTPS transmission, secret management, and the minimum-collection principle. Threads, GitHub, and Notion connection tokens are stored encrypted and are never passed to your browser or AI agent. Passwords for pre-provisioned email accounts are never stored in plaintext; they are checked only against a verification value that cannot be reversed.

Instagram user access tokens are stored encrypted, and Page access tokens are not stored.

Only the minimum staff needed for their work can access systems that process personal data, and access and viewing are logged and reviewed regularly.

12. Privacy Officer and Contact

The Company has designated a privacy officer who oversees the processing of personal data and handles your inquiries, complaints, and requests for remedies. Contact us below about how your personal data is processed.

• Company: Bringthehome Inc. (브링더홈 주식회사)
• Privacy officer: 김기원
• Contact: contact@purpleprint-ai.com
• Phone: +82-70-4769-0272
• Address: 202, Hannam Medical Bldg., 43 Chojidong-ro, Danwon-gu, Ansan-si, Gyeonggi-do, Republic of Korea (경기도 안산시 단원구 초지동로 43 한남메디컬 202호)

12A. Remedies for Infringement

If you need to report or get advice on an infringement of your personal data, you can contact the following Korean agencies.

• Personal Information Dispute Mediation Committee: 1833-6972 · www.kopico.go.kr
• Personal Information Infringement Report Center (KISA): 118 · privacy.kisa.or.kr
• Supreme Prosecutors' Office: 1301 · www.spo.go.kr
• Korean National Police Agency: 182 · ecrm.police.go.kr

13. Notice of Changes

If this policy changes, we will provide prior notice of the effective date and reason within the Service.