Privacy Policy

• Sign-up and sign-in: username, password (stored encrypted), email address, display name, affiliation (institution or company), purpose of use, referrer username (if provided), country/region (and identifiers received from your social-login provider)
• Sign-up consent record: time of consent, the version of each consented document (notice date and body hash), request IP address and browser information
• Paid services: payment approval details (sensitive payment data such as card numbers is handled by the payment provider and is never stored by the Company)
• Service usage: access logs (including IP address), usage history (such as credit consumption), browser and device information
• 1:1 inquiries: name, email address, affiliation (if entered), contact number (if entered), inquiry category, subject and message, attached file (if any), and the consent record made at the time of the inquiry (time of consent, the edition of the consent text you were shown (its body hash), request IP address, browser information, display language), plus your member identifier if you were signed in
• Data you upload or enter yourself (for example equipment data or images)

Access logs are combined and accumulated into a per-IP-address visit ledger. Each ledger records the IP address, access country (where determinable), first and most-recent access times, visit count, per-path visit counts (excluding URL query strings), the last visited path, and a referral classification (direct, internal or external). This visit ledger is viewed and searched only in an administrator-only dashboard, for detecting and responding to abnormal access and misuse and for service security, and is destroyed without undue delay once 90 days have elapsed since the last access (see Section 3).

Anyone may send an inquiry without being a member, and we collect nothing beyond the items above. Attachments are opened only in the administrator screen for handling the inquiry; permitted formats are images, PDF, archives and text, and the file name you supply is used only for display.

The Company does not collect personal data of children under 14, and children under 14 may not create an account.

• Providing and operating the Service, identifying and authenticating members, processing and settling paid services
• Responding to inquiries, improving the Service and preventing fraudulent use
• Administrator review of and response to misuse and abnormal access, and service security (the per-IP-address visit ledger is viewed and searched in an administrator-only dashboard). General access statistics such as visit trends, countries and referrals are aggregated separately, without IP addresses.

Personal data is destroyed without delay once the purpose of collection and use is achieved. Where required by law, it is retained for the prescribed period (for example: 5 years for records of contracts, withdrawals and payments under Korean e-commerce law; 3 years for records of consumer complaints and dispute handling; 3 months for access logs under the Protection of Communications Secrets Act).

The retention period of the per-IP-address visit ledger is 90 days from the last access; once that period elapses, it is destroyed without undue delay through a periodic purge. However, if you revisit within 90 days, the visit is accumulated into the existing ledger, and the retention period of the whole ledger is recalculated from the most-recent access date.

When you sign up, a record of your confirmation that you are 14 years of age or older and of your consent to the Terms of Service and to the collection and use of personal data is stored together with your account. The record contains the time of consent, the version of each consented document (notice date and body hash), the request IP address and browser information, and is used to verify after the fact which version of the terms and policy was agreed to at sign-up. Because it is stored on the account, it is destroyed together with the account when you close your membership; no separate retention period applies.

When a paid transaction is initiated, a record of the user's consent to the terms of service, privacy policy and refund policy is retained. The record contains the member identifier, server timestamp, version of each consented document (notice date and body hash), request IP address and browser information, and is used to verify after the fact which version of the terms was agreed to at the time of payment. Where the consent led to an actual payment, the record is retained for the same period as the corresponding transaction record (5 years under Korean e-commerce law). Where the consent did not lead to a payment, it is destroyed through a periodic purge after 30 days. Upon membership withdrawal, consent records not linked to a payment are destroyed together with the account; consent records linked to a payment are retained alongside the transaction record until the statutory retention period expires and are then destroyed.

Information received through 1:1 inquiries is kept for the periods below, after which the message and any attachment are destroyed without delay. An inquiry classified as payment- or refund-related, or marked by an administrator as a dispute record, is a consumer complaint and dispute-handling record under the Electronic Commerce Act and is kept for three years from the day its handling ends; every other inquiry is kept for one year from the day it was received. A dispute-related inquiry whose handling has not ended is kept until it does, and the three years are counted from that day.

When a member deletes their account, the inquiries they sent are destroyed together with the account. Dispute-related inquiries are retained where the law requires it; in that case we erase the contact number, affiliation, request IP address, browser information and member identifier, and keep only what is needed to handle the dispute (name, email address, the message, any attachment, and the handling history). What we keep is stored separately from other personal data and destroyed without delay once the retention period above has passed.

Electronic files are deleted irrecoverably; printed materials are shredded or incinerated.

The Company entrusts the following processing to provide the Service; each processor handles data only within the scope of the entrusted purpose.

• Email delivery: Resend
• Hosting and infrastructure: Fly.io, Cloudflare
• AI answer and image generation: overseas AI cloud providers — when you use AI features, the conversations, prompts and attachments you enter are transmitted only within the scope of processing, and are not used to train AI models. Account identifiers such as your name, email address and affiliation are not included in the transmission; only the content you entered is sent, it is used solely to generate the response, and it is not stored beyond the provider’s short-term abuse-monitoring retention.

For payment processing, the Company provides order identifiers and product codes to Dodo Payments Inc. (contact: [email protected]). As Merchant of Record and an independent data controller, that provider processes checkout, billing and tax data under its own privacy policy. Card and billing details entered by users on that provider’s checkout form are collected and processed directly by the provider; the Company neither collects nor stores them. Except for the provision to that payment provider, the Company does not provide personal data to third parties except where required by law or with your consent.

The Service runs on overseas cloud infrastructure, so personal data is transferred and stored abroad as follows in order to perform the service contract. The transferred items are the minimum necessary for each task among the items in Section 1, and retention follows Section 3.

• Fly.io (server hosting · Japan and other regions): storage and processing of account data, service-usage data, 1:1 inquiry messages and attachments, and the per-IP-address visit ledger — account and usage data for the duration of service provision; inquiry material per the retention period in Section 3; the visit ledger per the retention period in Section 3 (90 days from the last access)
• Cloudflare (security and delivery network · United States and global): transmission during connection handling — at the time of transmission
• Resend (email delivery · United States): email address and message content — until the delivery purpose is achieved
• Dodo Payments Inc. (payment processing · a Delaware, United States corporation · including the countries where the provider’s data centres are located · contact: [email protected]): order identifiers and product codes sent by the Company — for checkout, billing and tax processing, transmitted over the network at the time of each payment request — retained per that provider’s policy (the applicable limitation period plus two months, and for as long as needed to handle any claim brought). Payment and billing details entered by users on the provider’s checkout form are collected and processed directly by that provider as an independent data controller under its own policy.
• AI cloud providers (United States): content you enter when using AI features (excluding account identifiers) — until processing is complete

You may object to cross-border transfers via the contact below; however, because these transfers are essential to providing the Service, use of the Service may be restricted if you object.

The Service uses only the minimum cookies and browser storage needed for operation, such as keeping you signed in and remembering your language setting. No advertising or tracking cookies are used. You can refuse cookies in your browser settings, but some features such as sign-in may then be limited.

In addition, the Service automatically collects a per-IP-address visit ledger (Section 1) via a visit-logging script when you load a page. This is not for advertising or tracking but for preventing misuse and for security, and it cannot be individually turned off while you use the Service. To access or delete the collected visit ledger, or for related inquiries, you may contact us via Sections 7 and 10.

You may at any time request access to, correction or deletion of, or suspension of processing of your personal data. Requests are received at the contact below and handled without delay. You may refuse consent where consent is required, but sign-up or use of the Service may then be limited.

In Korea, you may report or seek advice on privacy infringements at the Personal Information Infringement Report Center (privacy.kisa.or.kr · 118) and apply for dispute mediation to the Personal Information Dispute Mediation Committee (www.kopico.go.kr · 1833-6972).

If you use the Service from the European Economic Area, the United Kingdom or other regions, the rights granted by the applicable data-protection law (such as GDPR/UK GDPR — access, rectification, erasure, portability, restriction of processing and objection) may apply. Please direct related inquiries to the contact below.

• Access-permission management and access control; encryption in transit and at rest
• Minimization of personal-data processing and management of access records

For privacy inquiries or to exercise your rights, please contact:

• Data Protection Officer: Hwanyeol Park (CEO, Quantum Materials Inc.)
• Email: [email protected] · Phone: +82-70-7609-1376

This Policy may be revised to reflect changes in law or the Service; revisions are announced within the Service.