Plans · Pricing

Privacy Policy

Effective date: 2026-10-27

Zero to One Flow (021flow), a sole proprietorship represented by Sungtae Ryu (the "Company"), processes personal data to provide the JarvIR service, in compliance with Korea's PIPA and applicable laws (including the GDPR where relevant).

1. Data We Collect

  • Account: name, email, social/SSO identifier, profile image, company & role
  • Workspace accounts use passwordless authentication through Google, Apple, or a company IdP (SSO). Investor portal accounts have a separate password; the server stores only its bcrypt hash, not the original password.
  • Customer Data: company info, IR, financial, and documents you upload or generate
  • Usage: access logs, feature usage, AI usage (metering), device/browser info
  • Billing: subscription/payment status and receipts. Web payments are processed by Paddle and mobile in-app payments by Apple/Google; we do not store card details.
  • Inquiries: the name, email, and message you send through the contact form. These are delivered to our inbox and not stored in a separate database.

2. Purposes

Providing and operating the Service, authentication and security, billing and reconciliation, support, usage metering, product improvement, and legal compliance.

3. Processors & Third Parties

  • Paddle.com Market Ltd — payments, invoicing, tax (Merchant of Record)
  • Anthropic, OpenAI — AI processing (portions of input are sent for model processing)
  • Database and sessions — Company-operated MongoDB and Redis store accounts, company materials, authentication and collaboration state. MongoDB Atlas is not the current operating database.
  • Google LLC, Apple Inc. — social sign-in and mobile in-app payment receipt verification
  • Google LLC — optional web Google Analytics 4 (GA4) runs after explicit consent only on signed-out public information pages. Native Firebase Analytics sends fixed app screen names after a separate opt-in.
  • Files and backups — S3-compatible storage on the Company-operated NAS holds uploads and recovery backups. This does not establish AWS S3 hosting or an independent overseas replica.
  • Amazon Web Services (SES) — delivers addresses and message contents for authentication, invitations and inquiries. Current sending configuration uses Seoul (ap-northeast-2, Republic of Korea); recipient mailbox locations and additional processing locations require separate confirmation.
  • Hosting/infrastructure — Company-operated hosts/NAS and Cloudflare, Inc. (traffic delivery, content delivery and security)

Global HawkEyeOps and GTM tags have been removed from the current app code. Retention and deletion of previously collected data require separate confirmation.

We do not share personal data with third parties beyond these purposes except as required by law.

3-1. No AI Model Training on Your Data

We do not use Customer Data to train our own AI models. AI features send portions of input to commercial APIs. Provider-specific training exclusions, abuse monitoring and retention require confirmation of contracts and settings; we do not promise uniform zero retention.

4. International Transfers

Overseas AI, authentication, payment and analytics providers and Cloudflare’s global network may process personal data internationally. Apart from the configured SES Seoul region, exact processing countries, locations of Company-operated hosts and NAS, transfer grounds, methods and safeguards are pending confirmation. We do not represent unverified DPAs or transfer arrangements as established.

5. Retention

Account deletion removes the account, profile, private conversations, searches and notifications. Organizational audit, billing and pulse records are not automatically deleted and may retain author identifiers or information in the record. Transaction records subject to statutory retention are kept for the applicable period. Contact our privacy team about backup and optional analytics retention periods and additional erasure requests.

Exact retention periods and deletion propagation for mailboxes, provider logs, GA4/Firebase analytics and NAS backups require operational and contractual confirmation. We do not promise complete deletion within an unverified period.

6. Your Rights

You may request access, correction, deletion, restriction, or portability of your personal data.

You can delete your account and personal data yourself from Settings → Delete account in the product (including the mobile app). See Account Deletion for the steps and for what is erased or retained. For other requests, use the contact below.

7. Cookies

We use cookies and browser storage for authentication, preferences (theme), and sessions. See our Cookie Policy.

8. Security

We apply reasonable technical and organizational measures, including encryption in transit (HTTPS), access control, and least-privilege principles.

9. Children's Privacy

The Service is intended for business and professional (B2B) users and is not directed to children under 14. We do not knowingly collect personal data from children under 14, and will delete it without undue delay if discovered.

10. Data Protection Contact

Officer: Sungtae Ryu (Representative) · Zero to One Flow (021flow) · contact@021flow.com · A-2704, 25 Beopjo-ro, Yeongtong-gu, Suwon-si, Gyeonggi-do, Republic of Korea

11. Changes

We may update this Policy in response to legal or service changes and will give advance notice of material changes in-app or by email. The effective date is shown at the top of this page.