Back to Home

Privacy Policy

Last updated: July 14, 2026

TOTARO International Co., Ltd. (the "Company") values user privacy. This policy explains what information the service processes and how it is used.

Article 1 (Information We Process)

Account and company information

  • Required: email address, password, company name, contact name
  • Supplier accounts: business registration number
  • Optional: phone number, company location, company description

When you use AI consultation

  • Consultation messages and searches, conversation history, AI-generated answers, and supplier search results
  • Name, format, size, and contents of files you choose to attach
  • Linked consultation records such as quote requests and supplier selections

Automatically collected and analytics data

  • IP address, cookies, access logs, browser and device data, page URL, and performance data
  • User ID and email for signed-in users, and feature events such as searches, results, and quote activity

Do not enter government identifiers, passport numbers, health data, other sensitive personal data, or confidential information that is not needed for the consultation.

Article 2 (Purposes of Processing)

  • Account administration, identity verification, and security
  • Supplier-buyer matching and processing quote requests and responses
  • Generating AI answers, searching and recommending suppliers, and providing conversation history
  • Preventing errors and misuse, measuring performance, analytics, and service improvement
  • Responding to inquiries and resolving disputes

Article 3 (Retention)

  • Account and company information: while you use the service
  • AI conversations and attachments: until you delete the conversation or close your account
  • Analytics events and session replay: for the retention period configured in the PostHog project. You may ask the Privacy Officer for the current setting or request deletion.
  • Information that must be retained by law is segregated and retained for the required period.
  • Contract and withdrawal records: 5 years (E-Commerce Act)
  • Consumer complaint and dispute records: 3 years (E-Commerce Act)
  • Access logs: 3 months (Communications Secrets Protection Act)

Article 4 (Disclosure to Third Parties)

The Company does not disclose personal information to third parties without prior consent, except where required by law or through a lawful request. The providers below process information on the Company's behalf to deliver the service.

Article 5 (Processors and International Processing)

The cloud services below may process information outside Korea. Data is transmitted over encrypted connections when you use the relevant feature. Processing regions and provider retention can vary by deployment configuration and contract.

Provider / serviceProcessing and dataInternational processing / retention
Supabase Inc.Authentication, database, and storage of AI conversations and attachmentsThe region configured for the Company's Supabase project / subject to service and backup settings
Google LLC (Google Cloud Vertex AI / Gemini API)Generating AI answers and supplier searches from consultation input, attachments included in the request, and conversation contextThe configured Vertex AI region (the application default is global) or Gemini API infrastructure / subject to the applicable product configuration and contract
PostHog Inc.Product analytics and session replay: user ID and email, page and feature events, device and performance data. Input values, rendered text, and element attributes are globally masked in replay.The configured PostHog host (a US endpoint when unset) / subject to the project's retention setting

Article 6 (Your Rights)

You may request access, correction, deletion, or suspension of processing.

You can delete an AI conversation using the service or contact the Privacy Officer below. The Company handles requests in accordance with applicable law.

Article 7 (Privacy Officer)

Name: Taejun Yoon

Title: CEO

Email: totaro@totaro.co.kr

Phone: +82-10-9427-2659

Article 8 (Security Measures)

  • Access controls and minimization of access rights
  • SSL/TLS encryption for data in transit
  • Masking input values, rendered text, and element attributes in PostHog session replay
  • Security systems designed to prevent external intrusion

This Privacy Policy is effective as of July 14, 2026.