Privacy Policy

Effective: February 8, 2026 | Last updated: February 10, 2026

Introduction

chulbuji.com is a one-person space for recording, experimenting, and building with AI. I take your personal data seriously and handle it in compliance with the Korean Personal Information Protection Act (PIPA), the EU General Data Protection Regulation (GDPR), the California Consumer Privacy Act as amended by the CPRA (CCPA), and other applicable laws.

This policy applies to all services offered through chulbuji.com, including the website, AI tools, and both free and paid products. If you reside in the EU/EEA or California, please see the region-specific sections below for additional rights.

01. Information I Collect

What I collect depends on how you interact with the site.

02. How and Why I Use Your Information

I use the data I collect only for the purposes listed below, along with the legal basis for each under GDPR Article 6.

I do not sell your personal information. I do not use it for automated decision-making or profiling that produces legal or similarly significant effects.

03. Data Retention and Deletion

Personal data is deleted once its purpose has been fulfilled. Where law requires longer retention, the data is kept only for the legally mandated period.

Deletion method: Electronic files are erased using irreversible technical methods (low-level formatting, overwriting). Paper documents are shredded or incinerated.

04. AI Tool Data Handling

When you use AI tools on chulbuji.com, the following principles govern your prompts and outputs.

Data ownership

Your prompts and the outputs they generate belong to you.

No training use

I do not use your input data to train or fine-tune any AI models.

Third-party AI providers

AI features may be processed through external APIs (e.g., OpenAI, Anthropic). Each service’s privacy policy applies in addition to this one. I clearly indicate which provider powers each tool.

Storage and deletion

Prompts and outputs are retained only as long as needed. You can request deletion at any time, and I will process it without delay.

05. Cookies and Tracking

You can manage cookies through your browser settings. Disabling essential cookies may affect site functionality. EU/EEA visitors: non-essential cookies are only set with your prior consent.

05-A. Payment and Subscription Data Processing

Payment Information Processing

1. Payment information is processed through third-party payment processors (e.g., Toss Payments, Stripe, PayPal).
2. Information stored on this site: Last 4 digits of card number, card issuer name, payment authorization number, transaction timestamp
3. Information NOT stored: Full card number, CVV, passwords
4. Payment processors are PCI DSS (Payment Card Industry Data Security Standard) certified.

Auto-renewal Processing

1. Explicit consent for auto-renewal is obtained when subscribing.
2. Renewal reminder emails are sent 7 days before the renewal date, and email delivery records are retained.
3. Information processed during auto-renewal: Member identification, subscription status, payment method information (in tokenized form)
4. Auto-renewal consent can be withdrawn at any time, and related records are retained for 6 months after subscription ends for dispute resolution.

Payment Failure Handling

1. Payment is retried up to 3 times upon failure, and the reason and time of each attempt are recorded.
2. Payment failure notification email delivery records are retained.
3. After 3 failed attempts, the subscription is automatically terminated, and such information is processed according to the retention periods above.

Personal Information in Refund Processing

1. Information collected for refund requests: Refund reason (optional), request timestamp, processing status
2. Records are retained for 5 years after refund completion in accordance with tax laws and e-commerce regulations.
3. If additional identity verification is required during refund processing, only minimal information is requested.

06. Third-Party Services

I do not share your personal data with third parties except where you have consented or where required by law. The following services are used:

07. International Data Transfers

Your data may be transferred to and processed in countries outside your country of residence, including the United States, where some of the third-party services above are based.

Transfers are carried out in accordance with GDPR Article 46 and Korean PIPA Article 28-8, using appropriate safeguards.

08. Your Rights

You have the following rights regardless of your location. Additional region-specific rights are listed in the sections below.

Access

Request to see what personal data I hold about you.

Correction and deletion

Ask me to correct inaccurate data or delete your personal information.

Restrict processing

Request that I stop processing your data.

Withdraw consent

Withdraw consent to data collection and use at any time.

To exercise any right, email hello@chulbuji.com. I will respond within 10 days (or 30 days where GDPR applies).

09. Additional Rights for EEA Residents (GDPR)

If you are in the European Economic Area, the following additional rights and disclosures apply under the General Data Protection Regulation.

🇪🇺 EEA-Specific Rights

Data portability

You have the right to receive your personal data in a structured, commonly used, machine-readable format (e.g., JSON or CSV) and to transmit it to another controller.

Right to object

You may object to processing based on legitimate interest at any time. I will cease processing unless I can demonstrate compelling legitimate grounds.

Automated decision-making

I do not make decisions based solely on automated processing that produce legal or similarly significant effects on you. If this changes in the future, I will update this policy and obtain explicit consent.

Supervisory authority

You have the right to lodge a complaint with your local data protection supervisory authority.

Cookie consent: Non-essential cookies (analytics and advertising) are only activated after you give explicit consent, in compliance with the ePrivacy Directive.

Data controller: chulbuji (hello@chulbuji.com), based in South Korea. As a small-scale controller without an EU establishment, I am not required to appoint an EU representative under GDPR Article 27(2), but I am fully responsive to all EEA inquiries via email.

10. Additional Rights for California Residents (CCPA/CPRA)

If you are a California resident, the following additional disclosures and rights apply under the California Consumer Privacy Act as amended by the California Privacy Rights Act.

🇺🇸 California-Specific Disclosures

Sale and sharing of personal information: I do not sell your personal information. I do not share your personal information for cross-context behavioral advertising purposes. You have the right to opt out of any future sale or sharing by contacting me at hello@chulbuji.com.

Right to know

You can request the categories and specific pieces of personal information I have collected about you, the sources, the business purposes, and any third parties with whom I shared it.

Right to delete

You can request deletion of personal information I have collected from you, subject to legal exceptions.

Right to correct

You can request correction of inaccurate personal information.

Right to limit use of sensitive data

If I collect sensitive personal information, you can direct me to limit its use to what is necessary for the service.

Non-discrimination

I will not discriminate against you for exercising any of these rights.

To exercise these rights, email hello@chulbuji.com. I will verify your identity before processing your request and respond within 45 days.

Categories collected in the past 12 months: Identifiers (email, IP address), commercial information (purchase history), internet activity (browsing, usage data), and inferences (AI-generated content). None of these categories have been sold.

11. Additional Rights for South Korean Residents (PIPA)

🇰🇷 Korean-Specific Disclosures

Under the Korean Personal Information Protection Act, you have the right to access, correct, delete, and suspend processing of your personal data. Requests are processed within 10 days. If acting through a representative, a power of attorney is required.

For privacy-related complaints, you may also contact the following Korean government agencies:

• Personal Information Infringement Report Center: privacy.kisa.or.kr / 118
• Personal Information Dispute Mediation Committee: kopico.go.kr / 1833-6972
• Supreme Prosecutors’ Office Cyber Investigation: spo.go.kr / 1301
• National Police Agency Cyber Bureau: ecrm.police.go.kr / 182

12. Security Measures

• Encryption: Passwords and sensitive data are encrypted at rest and in transit.
• Access control: Access to systems handling personal data is restricted and audited.
• Secure transmission: All data travels over SSL/TLS.
• Regular audits: I review security vulnerabilities on a regular basis.

13. Children’s Privacy

This service does not accept registrations from children under the age of 14 in South Korea, 16 in the EU/EEA (or the lower age set by individual member states), or 13 in the United States. I do not knowingly collect personal data from children. If I learn that a child’s data has been collected, I will delete it without delay.

14. Changes to This Policy

This policy may be updated to reflect changes in law, services, or practices. I will post a site notice at least 7 days before changes take effect. For significant changes — such as new data categories or revised purposes — I will provide 30 days’ notice and, where required, obtain fresh consent.

15. Governing Law and Language

This policy is governed by the laws of the Republic of Korea. However, mandatory local laws applicable to your region of residence (including GDPR and CCPA) prevail to the extent they conflict with this policy. In case of discrepancy between the Korean and English versions of this policy, the Korean version shall prevail.

16. Privacy Officer and Contact

Privacy Officer / Data Controller: chulbuji
Email: hello@chulbuji.com

Based in South Korea. Responsive to all privacy inquiries worldwide.