MUDANZA, Corp. ("Company") establishes and discloses this Privacy Policy to explain how it collects, uses, and protects personal information, and to handle user grievances related to personal information promptly. Where the law of a User's country of establishment grants that User rights beyond those described here, those rights apply in addition to this Policy.
| Category | Items |
|---|---|
| Required | Email address, password (stored as salted one-way hashes), name, company name, mobile phone number |
| Optional | Job title |
| Inquiries and consultations | Inquiry content (description of the website/app the user wants built, etc.), consultation booking time |
| Video consultations | Consultation audio and its transcript (video and screen-share content are not collected) |
| Paid subscriptions | Card number (stored masked), card issuer, payment history, billing key |
| Automatically collected | Service usage records, access IP, cookies, browser/OS information |
| Collection method | Direct entry by the user during signup, inquiry, consultation booking, and Service use, and provision via the payment gateway used for your account (Stripe, Inc.) |
In principle, the Company does not provide personal information to third parties. Exceptions are listed below.
| Recipient | Purpose | Items | Retention |
|---|---|---|---|
| Stripe, Inc. (United States) | Payment processing, settlement, and stored payment-method management | Payment amount, order info, card authentication info | 5 years (applicable record-keeping and tax law) |
| Processor | Entrusted Work |
|---|---|
| Supabase (Infrastructure) | Database hosting during the transition period |
| Neon, LLC | Database hosting, backup, and recovery |
| Cloudflare | CDN, DNS, security |
| Cloudflare, Inc. | Video-consultation audio transcription processing (RealtimeKit, Workers AI) |
| Anthropic, Google, OpenAI and other LLM providers | AI response generation |
| Stripe, Inc. | Subscription and Service payment processing |
| Kucon Inc. (CODEF) | Retrieval of financial and public-institution data on the user's behalf, for integrations requested by the user |
| Hyphen Corporation | Retrieval of National Tax Service data on the user's behalf, for integrations requested by the user |
| Nurigo Co., Ltd. (Solapi) | SMS/text message sending |
| Resend, Inc. | Email sending |
Users may at any time request access, correction, deletion, or suspension of processing of their personal information, and may request deletion of personal information by deleting their account. Requests submitted via the contact below will be processed without delay.
When the retention period expires or the processing purpose is fulfilled, personal information is destroyed without delay. Electronic files are permanently deleted by irrecoverable means, and printouts are shredded or incinerated.
The Company retains backups for the stable operation of the Service and for incident recovery, and backups are stored in a form from which an individual user's data cannot be separately deleted. Accordingly, the information may remain within backups for the backup retention period (up to 30 days) after the destruction described above, and is deleted thereafter as backups rotate.
Backups are held separately from the operating environment with access blocked, and the Company does not restore or use personal information within backups during that period. Where a full backup is restored to recover from an incident, the Company deletes again any personal information already due for destruction before it is used in operation.
The Company is established in the United States and uses the service providers listed below, which process personal information in the countries stated. Users have the right to refuse such transfers; however, refusal may limit the use of related Services.
| Recipient | Country, Items, Purpose, Period |
|---|---|
| Supabase Inc. (U.S. entity) |
Country: Data is stored in the Seoul, Republic of Korea region (AWS ap-northeast-2); the controlling entity is a U.S. corporation Items: Email, encrypted password, member ID, Service usage records, payment history (masked card number, card issuer, billing key, etc.) Purpose: Database hosting and authentication service Timing and method: Transmitted in real time over the network when the Service is used Retention: Until account deletion (payment records: 5 years as required by applicable record-keeping and tax law) |
| Neon, LLC (U.S. entity, [email protected]) |
Country: Singapore (AWS ap-southeast-1; the Service is operated by a U.S. entity) Items: Email, encrypted password, member ID, Service usage records, consultation, inquiry and message records, payment history (masked card number, card issuer, billing key, etc.), and information entered by users of customer websites and applications Purpose: Database hosting, backup, and incident recovery Timing and method: Transmitted over an encrypted network when the Service is used and when the database is migrated Retention: Until account deletion or termination of the processing agreement (records subject to legal retention duties are kept for the applicable period) |
| Cloudflare, Inc. (U.S. entity) |
Country: United States and global CDN edge locations Items: Access IP, cookies, browser/OS information Purpose: CDN, DNS, and security (DDoS protection) services Timing and method: Transmitted in real time over the network upon Service access Retention: Up to 3 months for log records |
| Cloudflare, Inc. (U.S. entity) |
Country: United States and global edge locations Items: Video-consultation audio and its transcript Purpose: Audio transcription and video-consultation requirements organization via RealtimeKit and Workers AI Timing and method: Transmitted in real time over the network during video consultations Retention: Retained for 90 days from collection, then automatically destroyed (the requirements summary derived from the transcript is retained separately as a business record) |
| Anthropic, PBC (U.S. entity) |
Country: United States Items: Prompts and attachments entered by users into AI agents Purpose: AI response generation Timing and method: Transmitted in real time over the network at the time of an AI request Retention: Up to 30 days per Anthropic policy (not used for training) |
| OpenAI, L.L.C. (U.S. entity) |
Country: United States Items: Prompts and attachments entered by users into AI agents Purpose: AI response generation Timing and method: Transmitted in real time over the network at the time of an AI request Retention: Up to 30 days per OpenAI API policy (not used for training) |
| Google LLC (U.S. entity) |
Country: United States Items: Prompts and attachments entered by users into AI agents Purpose: AI response generation via Gemini and other AI models Timing and method: Transmitted in real time over the network at the time of an AI request Retention: Up to 60 days from the date of collection per Google API policy (not used for training) |
| Meta Platforms, Inc. (U.S. entity) |
Country: United States Items: Irreversible cryptographic hashes (SHA-256) of the email address and contact information entered when submitting an inquiry, advertising identifiers (fbp/fbc), access IP, and browser information Purpose: Ad conversion measurement and performance analysis Timing and method: Transmitted in real time over the network at the time of inquiry submission Retention: Per Meta's data policy (the original personal information is not transmitted) |
※ The above is disclosed so that Users know which service providers process their personal information and in which countries. Where the law of a User's country of establishment requires consent to such processing, agreeing to this Policy constitutes that consent.