Privacy Policy

Todea ("we", "us") respects the privacy of visitors to todea.co.kr (the "Site"). This Privacy Policy explains what limited personal information we process when you visit the Site, submit our contact form, or write to us by email, and the choices you have. It is written to comply with the Republic of Korea's Personal Information Protection Act (PIPA).

1. Personal information we process

The Site does not offer newsletter sign-up or account registration. We process personal information only in the following narrow cases.

a. Information you send us by email. When you write to hello@todea.co.kr, we receive your email address, your name (if disclosed), and the contents of your message. We use this only to respond to your enquiry.

b. Information you submit through the contact form. The contact form on the Site collects your name, email address, optional company name, area of interest, and message. We use this to respond to your enquiry and to follow up on it. The form is protected by Cloudflare Turnstile, which receives your IP address, browser metadata, and limited interaction signals to determine whether the submission is from a human. Once a submission is accepted, the same details also go to Apollo.io, which saves you as a contact in our Apollo.io account and adds business information it holds about you and your company, such as your job title, LinkedIn profile, and your company's size and industry. Nothing goes to Apollo.io while you type, or when a submission is rejected.

c. Information collected automatically when you visit the Site.

• Standard server access information: IP address, user-agent string, referrer, requested URL, and timestamp. Collected by our hosting provider for security and reliability.
• Cookie consent state: a record of your choice (granted or denied) together with the timestamp of that choice, stored in your browser's localStorage under the key cookie-consent. This stays on your device and is not transmitted to us. We treat the stored value as expired after 12 months and re-request your consent.
• Google Analytics (only if you accept analytics cookies): client identifier, page views, approximate location derived from IP, device and browser metadata. Analytics is disabled by default and only activates after you click "Accept" in the cookie banner.
• Apollo.io website visitor identification (only if you accept analytics cookies): IP address, the pages you view, the referring page and campaign (UTM) parameters, and a random visitor identifier stored in your browser's localStorage under the key apolloAnonId. Apollo.io matches the IP address to the company that operates the network you visit from, so we learn which companies visit the Site, not who you are. Like analytics, it is disabled by default and only activates after you click "Accept" in the cookie banner.

We do not collect special-category data (health, beliefs, biometric, etc.) and we do not knowingly collect information from children under 14.

2. Purposes of processing

We use the information above only to:

• respond to email and contact-form enquiries and follow up on them;
• operate, secure, and debug the Site;
• measure aggregate usage of the Site (only with your consent);
• learn which companies visit the Site so we can follow up on business interest (only with your consent).

3. Third parties

We do not sell or rent personal information. The following third parties process Site data on our behalf:

Personal information may be transferred outside the Republic of Korea to these providers' infrastructure. We rely on the providers' standard contractual safeguards.

4. Retention

• Email correspondence and contact-form submissions (including their copy in Apollo.io): kept for as long as needed to handle the enquiry and any follow-up business relationship, then deleted.
• Server access logs: retained by the hosting provider for a short rolling window (typically up to 90 days).
• Cookie consent value: stored in your browser until you clear it, change your selection, or 12 months pass (after which we re-request your consent).
• Google Analytics data: retained according to the property's configured retention window (currently 14 months) and then automatically deleted.
• Apollo.io visitor data: the apolloAnonId identifier stays in your browser until you clear it or choose "Decline" under "Cookie settings", which removes it. Company-level visit records are kept in our Apollo.io account while we use the service.

5. Your rights

Under PIPA you may, at any time:

• ask what personal information we hold about you;
• ask us to correct or delete it;
• ask us to stop processing it;
• withdraw consent for analytics cookies at any time via the "Cookie settings" link in the Site footer (or by blocking cookies in your browser); withdrawing stops both Google Analytics and Apollo.io.

To exercise any of these rights, email hello@todea.co.kr. We respond within 10 days. You may also lodge a complaint with the Korea Internet & Security Agency (KISA) at https://privacy.kisa.or.kr (call 118 within Korea).

6. Security measures

We protect personal information through:

• HTTPS for all Site traffic;
• a strict Content Security Policy and standard browser-security headers;
• access controls and least-privilege on email and analytics consoles;
• prompt patching of dependencies.

No system is perfectly secure; please do not send sensitive information by unencrypted email.

7. Links to external sites

The Site links to external resources (LinkedIn, GitHub, etc.). This Privacy Policy does not apply to those sites. Please review their own policies.

8. Changes to this policy

We will publish any revision on this page at least 7 days before it takes effect. Material changes affecting your rights will be notified at least 30 days in advance.

9. Contact

Todea 396 Seocho-daero, 16F, Seocho-gu, Seoul 06619, Republic of Korea Email: hello@todea.co.kr

Effective date: 16 October 2026 Version: 1.4