Privacy notice
This notice covers this website and the Kotiful early-access waitlist — the signup form and the emails it sends. The Kotiful app is not released yet and will publish its own policy when it is. Effective 2026-08-19.
Who is responsible for this data
Representative
DO HEE CHUNG
Business registration no.
596-02-03685
Registered address
Bldg. B, Unit 1703, The Opera Harrington Tower, 53, Hyoryeong-ro 53-gil, Seocho-gu, Seoul, Republic of Korea
Your email address
So we can send your confirmation link, your place in line, and your referral link. This is the only thing the form requires.
Your name (optional)
Only if you give it. Used to address emails, and shown to other subscribers only as a first name and last initial — never in full, never next to your address.
Country and region
Derived coarsely from your connection so we can sequence the launch by geography. We do not collect your city.
Device type
Mobile or desktop, so we can see where the form is working and where it isn't.
A rotating, salted hash of your network prefix and browser
Used to spot a burst of fake signups from one place on one day. It is a keyed hash of a /24 network prefix, never your address itself, and the key is destroyed after 30 days — after which the value cannot be linked to anything.
How you arrived
A referral code if a friend sent you, plus the UTM campaign parameters in the URL (utm_source, utm_medium, utm_campaign, utm_content, utm_term) and the page you landed on. We keep the FIRST set we see and never overwrite it, so credit goes to whatever actually brought you here. This tells us which of our own posts are working.
Your email verification status
Whether you clicked the confirmation link, and when. Until you do, you are not on the list and we send you nothing else. The link itself carries a random token; we store only a one-way hash of it, never the token.
What you did on the page
Anonymous step events — page viewed, form started, submitted, confirmed — tied to a random session id, so we can find the step where people drop off.
We do not store your IP address
Raw addresses are never written to the database. We keep only the coarse hash described above, and the country it resolved to.
We do not fingerprint your device
No canvas, font, audio or hardware fingerprinting, and no third-party fingerprinting service. Device fingerprinting needs consent under EU rules whether or not it is hashed, and we chose not to build on it at all.
We do not put your email into analytics
No aggregate, export, dashboard or third-party analytics payload contains an email address.
We do not show your email to anyone else
Other subscribers see a first name and last initial, or a masked address. Never the full address.
We do not sell or rent your data
Not to advertisers, not to data brokers, not to anyone.
No advertising or tracking cookies on this site
We store your signup state in your browser's local storage so the page remembers you, and a random session id for the funnel events above. Neither is used for advertising.
Joining the waitlist means we send you what the waitlist is for: a confirmation link, your position, your referral link, and changes to your spot. Promotional email — launch news, announcements, offers — is a separate, optional checkbox on the form. It is off unless you tick it, and ticking it is never a condition of joining.
Under Korean 정보통신망법, advertising email must be identifiable as advertising. Any promotional email we send carries the (광고) prefix in the subject, our business details in the footer, and a free, one-step way to refuse. You can withdraw consent at any time from the link in any email or on the unsubscribe page — no login, no reason required. Withdrawing promotional consent does not remove you from the waitlist.
The key behind the network hash
30 days, then destroyed. After that the hash is permanently unlinkable.
Short-term rate-limit and burst counters
24 to 72 hours.
Funnel step events
Up to 400 days.
Your account activity history
Up to 730 days, for support and dispute resolution.
Your subscriber record
Until you unsubscribe, then up to 24 months — or immediately, if you ask us to delete it.
Proof that you opted in
If you tick the marketing box, we keep the record that you did, and when, even after you unsubscribe. Keeping that proof is itself a legal requirement — it is the record that we had your permission.
You can ask us for a copy of what we hold about you, ask us to correct it, ask us to delete it, withdraw your marketing consent, or object to how we use it. Deletion is a real delete, not a flag — the record and everything attached to it goes.
Write to info@kscanai.app and we will act on it. If you are in Korea and you are not satisfied with how we handle your request, you can raise it with the Personal Information Protection Commission (privacy.go.kr, 국번없이 182). In the EU or UK, you can complain to your national data protection authority.
Two processors, both under contract and both acting only on our instructions:
Our managed PostgreSQL host
Stores the subscriber database. This is the only place your address is kept.
Resend
Sends the confirmation, welcome and status emails. It receives your address and the message content, because it cannot deliver mail otherwise.
That is the complete list. We do not use a third-party referral or waitlist service — the referral system on this site is ours, so your data does not pass through one. There is no advertising network, no analytics vendor, no data broker and no third-party pixel.
Our processors may store or process data outside the Republic of Korea, including in the United States and the European Union. Where that happens we rely on the processor's contractual data-protection commitments — Standard Contractual Clauses or equivalent — and the transfer is limited to what running the waitlist requires: your email address, the message we are sending you, and the record that we sent it. If you would rather your address were not processed abroad, the remedy is the same as any other: ask us to delete it, and we will.
If we change what we collect or why, we will update this page. If the change is material and you are on the list, we will email you about it rather than quietly editing this page.
This notice describes the waitlist as it is actually built. It is not legal advice, and the marketing-consent wording above is pending review by Korean counsel before the first promotional send.
Back to the waitlist