Baroro Privacy Notice
Effective date: 2026-08-31 · Version: 2026-08-31-r1
This Notice explains what information Baroro handles, why it is needed, how long it is kept, which service providers receive it, and how you can exercise your privacy rights.
1. Controller and Privacy Contact
Controller: 임재웅. Privacy Officer: 임재웅. Privacy requests may be submitted to contact@baroroai.com or through the privacy inquiry form.
Baroro does not permit registration by individuals under 19 and does not knowingly collect their personal information. If such information is discovered, it will be verified and deleted without undue delay.
2. Information, Purpose, and Retention
| Category | Information processed | Purpose | Retention |
|---|---|---|---|
| Account and authentication | Email address, display name, OAuth identifier, login and session records | Registration, sign-in, and account security | Access is disabled and data is scheduled for deletion when the account is closed, except for the minimum records required by law or a dispute |
| Works and AI | Works, manuscript excerpts, prompts, AI output, and Wiki content | Writing and storage, AI editing and feedback, and Wiki maintenance | Baroro copies are deleted when the account is closed. When an AI feature runs, manuscript, Wiki, prompt, response, and request data is retained in OpenAI application state for 30 days by default, except for an approved Zero Data Retention project |
| Files | Uploaded files, storage keys, file format, size, and checksum | Upload, display, and security inspection | Until you delete the file or close your account, subject to legal retention |
| Support inquiries | Email address, inquiry type, subject, message, and support reference ID | Responding to support and privacy-rights requests | For the period stated in the consent notice shown when the inquiry is submitted, with exceptions for legal retention and dispute handling |
| Access and security | IP address and access, security, and error logs | Account protection, fraud prevention, and incident response | Until the purpose is fulfilled or for the period required by applicable law |
| Usage analytics | Pages visited, referrer, usage events, approximate location, browser and device information, and a Google Analytics client identifier after consent | Understanding service usage and improving features and performance | According to the Google Analytics configuration. Analytics cookies expire after no more than 395 days and can be withdrawn or deleted at any time |
| Billing | Lemon Squeezy customer, subscription, and transaction identifiers; payment status; currency and amount; and refund records | Paid subscription access, payment and refund handling, and fraud prevention | Five years for contract, withdrawal, payment, and supply records; three years for consumer complaint and dispute records |
Some information is supplied directly by you, while authentication, billing, device, access, and security information may be generated automatically or received from the provider you choose. Required fields are limited to information necessary to provide or secure the relevant function.
3. Processors and External Services
| Processor or service | Processing task | Retention |
|---|---|---|
| Amazon Web Services, Inc. | 서울 리전 서버·데이터베이스·파일 저장, 이메일 전송 및 보안 운영 | 회원 탈퇴 또는 위탁계약 종료 시까지. 법정 보존 대상은 해당 기간 |
| Google LLC 및 Kakao Corp. | OAuth 기반 본인확인과 로그인 | 연동 해제 또는 회원 탈퇴 시까지. 각 제공자의 법정 보존 기록 제외 |
| Google LLC (Google Analytics) | 이용자가 동의한 경우 방문·이용 현황 분석과 서비스 개선 | 분석 쿠키는 최대 395일. Google Analytics 서버의 이벤트 데이터 보존기간은 속성 설정과 Google 정책에 따름 |
| OpenAI OpCo, LLC | 원고 편집·피드백·연속성 확인·Wiki 유지 지원 | 현재 Responses API application state는 기본 30일. 별도 오남용 모니터링 로그는 OpenAI 정책과 프로젝트 설정에 따름 |
| Sold through Link, LLC f/k/a Lemon Squeezy LLC 및 결제 처리 관계사 | 결제, 세금, 구독, 환불, 차지백 및 부정 결제 방지 | Lemon Squeezy의 법적 의무, 거래 처리 및 분쟁 해결에 필요한 기간 |
External services may handle information only to the extent needed to supply, secure, and support their service. Sold through Link, LLC f/k/a Lemon Squeezy LLC ("Lemon Squeezy") acts as the Merchant of Record and handles payment, tax, refunds, chargebacks, and payment security. Full card numbers and other raw payment credentials are collected directly by Lemon Squeezy in Lemon Squeezy Checkout and are not stored on Baroro servers. Lemon Squeezy's own Privacy Policy applies to its processing of transaction data.
4. Data Transfers Outside Korea
When you consent to analytics or use AI or paid billing features, data is transferred outside the Republic of Korea as follows:
- Essential Service AI Processing: To provide AI feedback, correction, continuation, and Wiki analysis, manuscript excerpts and prompts are securely transmitted via encrypted API to OpenAI (US).
- Optional OpenAI Data Sharing: If you explicitly consent during registration or in Settings, inputs and AI outputs may additionally be processed by OpenAI for model quality evaluation, usage pattern analysis, and future model evaluation, training, and improvement. Declining data sharing does not affect your ability to use any AI feature in Baroro.
| Recipient and country | Timing and method | Information and purpose | Retention |
|---|---|---|---|
| Google LLC (Google Analytics) (미국 등 Google Analytics 처리 인프라가 위치한 국가) | 이용자가 분석 쿠키에 동의한 뒤 페이지를 방문하거나 이용 이벤트가 발생할 때 암호화 통신으로 전송 | 방문 페이지, 유입 경로, 이용 이벤트, 대략적 위치, 브라우저·기기 정보, IP 기반 처리 정보 및 Google Analytics 클라이언트 식별자 / 서비스 이용 현황 분석과 기능·성능 개선 | 분석 쿠키는 최대 395일. 이벤트 데이터는 Google Analytics 속성의 보존 설정과 Google 정책에 따름 |
| OpenAI OpCo, LLC (미국) | 이용자가 AI 기능을 실행할 때 암호화된 API 통신으로 전송 | 선택한 원고와 주변 문맥, Wiki, 프롬프트, AI 응답 및 요청 처리 정보 / AI 편집·피드백·연속성 확인·Wiki 유지 지원 및 OpenAI 모델 평가·학습·개선 | 현재 Responses API application state는 기본 30일. 오남용 모니터링 로그는 별도 정책에 따름. 모델 개선용 Data Sharing에 따른 처리 기간은 OpenAI의 적용 가능한 정책에 따르며 application state 보존기간과 다를 수 있음 |
| Sold through Link, LLC f/k/a Lemon Squeezy LLC 및 결제 처리 관계사 (미국 및 결제수단 처리에 필요한 국가) | 이용자가 Lemon Squeezy 호스팅 결제 화면에서 결제를 요청할 때 암호화 통신으로 전송 | 이름, 이메일, 청구지 정보, 결제수단 정보, 거래·구독·환불 기록, IP 및 부정결제 방지 정보 / 결제, 세금, 구독, 환불, 차지백 및 부정 결제 방지 | Lemon Squeezy의 법적 의무, 거래 처리 및 분쟁 해결에 필요한 기간 |
The transfer basis is processing and storage necessary to enter into or perform the service contract and to comply with applicable law. Lemon Squeezy may use affiliates or payment processors based on buyer location and payment method. See the Lemon Squeezy Privacy Notice for its current details.
5. Cookies and Browser Storage
Baroro uses storage required for authentication, security, and interface settings. Google Analytics cookies are used only after separate consent:
- 필수 인증 쿠키: 로그인 세션 유지와 보안; retention: 세션 또는 인증 토큰 만료 시까지.
- 환경설정 로컬 저장소: 언어, 편집기, AI On/Off 및 온보딩 상태 유지; retention: 이용자가 브라우저 데이터를 삭제하거나 설정을 초기화할 때까지.
- 로그인 흐름 세션 저장소: OAuth·매직링크 복귀 경로와 정책 확인 상태 유지; retention: 로그인 흐름 완료 또는 브라우저 탭 종료 시까지.
- 분석 동의 로컬 저장소: Google Analytics 동의 또는 거부 선택 유지; retention: 이용자가 브라우저 데이터를 삭제하거나 분석 쿠키 설정을 변경할 때까지.
- 선택적 Google Analytics 쿠키 (_ga, _ga_*): 동의한 이용자의 방문·세션 구분과 서비스 이용 현황 분석; retention: 최대 395일. 동의 철회 시 바로로 도메인의 해당 쿠키 삭제.
Before consent, the Google Analytics tag is not loaded and no analytics data is sent to Google. After consent, page visits and usage events are measured with advertising personalization and Google Signals disabled. Declining does not affect the service, and consent can be withdrawn at any time below.
6. Account Closure, Legal Retention, and Deletion
When account closure is completed, authentication sessions are revoked and access is blocked. Account information is de-identified, and works, manuscripts, Wiki content, AI feedback, and file metadata are deleted. Electronic files are deleted using methods designed to make recovery impracticable. Any paper record, if one exists, is shredded or destroyed.
Records of advertising are separated and kept for six months; contract, withdrawal, payment, and supply records for five years; and consumer complaint or dispute records for three years where required by Korean electronic-commerce law. Only the minimum information needed for law or an active dispute is retained. Data sent to OpenAI or Lemon Squeezy before account closure may remain for the recipient's applicable legal or contractual retention period.
7. Your Rights and Security Measures
You may request access, correction, deletion, suspension of processing, or withdrawal of consent, directly or through a duly authorized representative. Baroro may verify the minimum information needed to confirm identity or authority and will respond within the period and manner required by law. Submit a request through the privacy inquiry form or email contact@baroroai.com.
Baroro applies reasonable organizational and technical safeguards, including access controls, authorization management, encrypted transmission, and security monitoring.
8. Complaints and Changes to This Notice
In South Korea, privacy infringement counseling is available from the Personal Information Infringement Report Center at 118, and privacy disputes may be submitted to the Personal Information Dispute Mediation Committee at 1833-6972. Changes to this Notice or its version will be announced on this page or in the Service before they take effect. Fresh consent will be obtained when required by law.
9. Revision History
2026-08-31: Clarified Lemon Squeezy payment processing and international transfers, statutory retention, deletion methods, children's data, privacy rights, and complaint procedures; added a complete English version.