Privacy policy

1. What we collect and why

We collect personal data only in the situations below, and use it for nothing beyond the stated purpose.

• Companies inquiry form (innovlab.me): name, company, title (optional), email, area of interest, team size (optional), message (optional), browser information. Purpose: to reply and to run training or development consultations.
• Survey and profile (app.innovlab.me): survey answers, entry path (office worker, solopreneur, student), and an organization code if you arrived through a company invite. Purpose: to recommend a track and generate your report.
• Registration (app.innovlab.me): email, Kakao or Google login identifier, consent time and version, newsletter opt-in. Purpose: account management, course and report notices.
• Waitlists (student and solopreneur courses): email, short answers, newsletter opt-in. Purpose: to tell you when the course opens.
• Collected automatically: server access logs (IP address, time). Purpose: security and error handling. We run no analytics or advertising cookies today; this policy is updated before any are added.

2. How long we keep it

Data is deleted without delay once its purpose is met. By item:

• Company inquiries: up to one year after the reply is complete, or immediately on request.
• Account, survey answers, reports: until you close the account or ask for deletion.
• Waitlists: until the course notice goes out or you ask for deletion.
• Server logs: three months.
• Where another law requires longer retention, only for that period and only that data.

3. Sharing with third parties

We do not provide or sell personal data to third parties. The only exception is a lawful request from an authority under Korean law.

4. Processors and overseas transfer

We rely on the providers below to run the service, and your data is stored or processed on their servers outside Korea. Transfer happens over the network when you use the service; retention equals the engagement period.

• Supabase, Inc.: database and login hosting. Items: everything in section 1. Location: the provider's data centers (United States and others).
• DigitalOcean, LLC: web server hosting. Items: access logs, company inquiries. Location: the provider's data centers.
• Anthropic, PBC: processing survey answers to generate your report. Items: survey answers only, never your name or email. Location: United States.
• Kakao, Google: social login. Items: account identifier. Their own privacy policies apply.

5. Your rights

You may at any time request access, correction, deletion, or suspension of processing, and withdraw consent you have given. Contact us below; we act within ten days and tell you the result. Data of children under 14 is collected only with a legal guardian's consent, and the guardian may exercise the same rights.

6. Deletion

Electronic files are deleted in a way that cannot be recovered. We keep no paper records.

7. Security measures

• Access rights are kept to a minimum, with row-level access control on the database.
• All traffic is encrypted over HTTPS.
• Company clients see only aggregates of five or more people, never an individual's answers.

8. Privacy officer

Eric, co-founder of InnovLabs. For questions, access or deletion requests, and complaints, reach us below.

Ask through the companies inquiry form

9. Where else to turn

If you need independent advice or want to report our handling, these Korean bodies take cases.

• Personal Information Infringement Report Center: privacy.kisa.or.kr, 118
• Personal Information Dispute Mediation Committee: kopico.go.kr, 1833-6972
• Supreme Prosecutors' Office cybercrime unit: spo.go.kr, 1301
• National Police Agency cyber bureau: ecrm.police.go.kr, 182

10. Changes to this policy

We announce changes on this page seven days before they take effect and show the effective date. A material change to what we collect or why means asking for consent again.