Privacy
Effective 25 October 2026 · 국문 개인정보처리방침 (the Korean text governs)
This policy explains how HYOR AI Tech Ltd. (효르에이아이테크 유한회사, business registration 641-87-03809, Yongsan-gu, Seoul, Republic of Korea; "we") handles personal information. It covers the sparkpipe.ai website, SparkPipe Chat at sparkpipe.ai:8443, fleet-hour customer accounts and the requests sent during their hours, and email sent to us. It is published under Article 30 of Korea's Personal Information Protection Act.
1. The short version
- The models run on computers we own and operate in Seoul. We do not send your conversations to any other AI company, and we do not train models on them.
- We do not sell personal information, show ads, or use analytics or tracking.
- We keep each kind of data only as long as the table below says, then delete it.
- You can ask us at any time to see, correct, delete or stop processing your data: write to hyor@sparkpipe.ai.
2. Where your data is processed
The models run on sixteen NVIDIA DGX Spark computers and a server that hosts the chat application. We operate all of them in Seoul on SK Telecom's network. Public traffic reaches them through a server we rent from KCInfra in Seoul, which ends the encrypted HTTPS connection, forwards traffic to our hardware through an encrypted tunnel, and runs our email. Code you run with the chat's code interpreter runs in your own browser. Speech-to-text, document reading and search over your files run on our own hardware.
3. What we process, why, and for how long
Each item shows the paragraph of Article 15(1) of the Personal Information Protection Act ("PIPA") that it relies on.
| Personal information | When we collect it | Purpose and legal basis | How long we keep it |
|---|---|---|---|
| Access logs: IP address, time, requested address, response code and size, referring page, browser identifier; for email, the sending server and addresses | Every visit to sparkpipe.ai or the chat, and every email to or from sparkpipe.ai | Running and securing the service; keeping access records that telecommunications operators must keep (legal duty, Art. 15(1)(2), and our legitimate interest, Art. 15(1)(6)) | 3 months, as the Protection of Communications Secrets Act (Art. 15-2; Enforcement Decree Art. 41(2)) requires |
| Chat account: name, email address, password stored only as a hash, profile picture if added | When you sign up for SparkPipe Chat; accounts wait for our approval | Signing you in (contract, Art. 15(1)(4)) | Until you ask us to delete the account |
| Chat content: your messages, the model's replies, files you upload and the text extracted from them, chat settings | When you use SparkPipe Chat | Showing your chats and answering them (contract, Art. 15(1)(4)) | Until you delete the chat or the account |
| Chat memory: a summary of earlier turns of each chat, and the exchanges it was built from | When chat memory is on (the default; the Full context control turns it off for a chat) | Keeping long chats within the model's working context (contract, Art. 15(1)(4)) | Until you delete the chat or the account; a deleted chat's memory is deleted within two hours |
| Model cache: the model's computed internal state for recent prompts, derived from your messages and not stored as text | Every chat request and every fleet-hour request | Answering follow-up messages quickly (contract, Art. 15(1)(4)) | Deleted within 24 hours of its last use, or sooner when newer requests overwrite it |
| Operational records for each request: model used, token counts, timings, chat and message identifiers, a one-way hash of the prompt; no message text | Every chat request and every fleet-hour request | Operating the service and measuring its performance (legitimate interest, Art. 15(1)(6)) | 1 year |
| Requests and replies during fleet-hours | When a fleet-hour customer, or someone it lets use its hours, sends a request | Serving the request for the customer (contract, Art. 15(1)(4)); the customer decides what is sent and answers for it | Not stored beyond processing, apart from the model cache and operational records above |
| Email you send us: your address, name and message | When you write to us | Answering you (legitimate interest, Art. 15(1)(6)) | 3 years after the last message, unless a longer period below applies |
| Fleet-hour business account: company name, registration number and country; contact name, email and phone if given; the Ethereum address that identifies the account | When a business signs up | Entering into and performing the contract with the business, and sending notices (the business's staff: legitimate interest, Art. 15(1)(6)) | While the account is open, then as long as the payment records below |
| Acceptance records: version and hash of the terms accepted, the signature, time, IP address and browser | When a business accepts our terms | Proving what was agreed (legitimate interest, Art. 15(1)(6)) | Signature and terms as long as the payment records; IP address and browser 1 year |
| Payments, orders and reservations: amounts, VAT, payment references, hours bought, reserved and credited; for won transfers, the paying bank and account holder, and the details an electronic tax invoice must carry | Each order, payment and reservation | Performing the contract and keeping tax records (legal duty, Art. 15(1)(2)) | 5 years, as the Framework Act on National Taxes (Art. 85-3) requires |
| Business verification for two-year customers: company documents; names, nationality, country of residence and date of birth of directors and of owners of 25% or more. We collect no ID or passport numbers. | When a business applies for a two-year agreement | Deciding whether to contract and screening against sanctions lists (legitimate interest, Art. 15(1)(6)) | For the life of the agreement and 5 years after it ends |
We do not process sensitive information (Art. 23) or unique identification numbers (Art. 24), and we do not create pseudonymised information (Art. 28-2). Our record of payments and reservations holds account addresses, amounts and hashes, not names or emails, which we keep separately and encrypted. We publish performance figures for the service, such as tokens per second; they never include your content.
The people who operate SparkPipe can access stored accounts, chats, chat memory and logs. They do so only to run the service, give support, keep it secure or meet a legal obligation.
4. Deletion
When a retention period ends or its purpose is met, we delete the data from our systems so it cannot be recovered, and destroy any printed copy by shredding. Where a law requires us to keep data longer (the 3-month access logs and the 5-year tax records above), we keep only those items, separately, and only for that period.
5. Giving data to third parties
We do not give personal information to third parties, except where a law requires it, such as a court order or a warrant (PIPA Art. 17 and 18).
6. Processors we use
| Processor | Task |
|---|---|
| KCInfra Inc. (Seoul) | Hosting the public web and email server for sparkpipe.ai |
| Payment processor | Processing fleet-hour payments. We will name it here before we take any payment. |
SK Telecom carries traffic to our hardware, and Let's Encrypt issues our HTTPS certificate; neither receives the content of your data. We bind processors by contract to use data only for the task (PIPA Art. 26).
7. Data that leaves Korea
| What, to whom and where | When and how | Why, and for how long | How to refuse |
|---|---|---|---|
| Your IP address and browser identifier, to Google LLC (United States) | When your browser loads the fonts on our home and checkout pages, over HTTPS | Displaying the fonts; Google keeps them under its own privacy policy | Block fonts.googleapis.com in your browser; the pages still work. The chat, the API and this page do not load them |
| The search terms of a chat, without your account details, to public web search engines | Only when you turn on web search in a chat; sent from our server | Answering with search results; not kept by us beyond the chat | Leave web search off |
| A tool request, to the tool's service, such as GitHub, Inc. (United States) | Only when the model uses a tool you have enabled | Carrying out the request | Leave the tool off |
| Fleet-hour payment data, to our payment processor | When a business pays | Processing the payment | We will describe this here before we take any payment |
We disclose these transfers as PIPA Article 28-8 requires. Web search and tools run only when you turn them on. If you are in the European Union, the European Commission has recognised Korea as providing an adequate level of data protection.
8. Your rights
You can view, export and delete your chats in the chat application. You may also ask us to show you your personal information, correct or delete it, or stop processing it, and you may withdraw any consent (PIPA Art. 35 to 37). A legal representative or someone you authorise may ask for you. Write to hyor@sparkpipe.ai; we answer within 10 days. We may decline only where a law allows it, for example when a law requires us to keep the data, and we will tell you why. No decision about you is made solely by automated processing (Art. 37-2): our sanctions screening only flags accounts for a person to review. Depending on where you live, for example in the EU or the UK, you may also have the right to object to or restrict processing, and to complain to a data protection authority.
9. How we protect data
- All traffic to sparkpipe.ai is encrypted with HTTPS; traffic between our servers runs through encrypted tunnels.
- Passwords are stored only as hashes, and fleet-hour account data is stored encrypted.
- Only the people who operate SparkPipe can reach the systems, by personal key. Servers sit behind firewalls that block addresses after repeated failed logins.
- We keep access records for our systems and review them after any incident.
- Our computers are in premises we control in Seoul, and our public server is in KCInfra's data centre.
No system is perfectly secure, so do not send information you could not afford to have exposed.
10. Cookies and browser storage
The chat keeps you signed in with a session token stored in your browser; without it the chat cannot work. The checkout preview keeps its demo in local storage only. Neither leaves your browser except to sign you in to the chat.
Language. On your first visit, the site shows Korean pages if your IP address is in the Korean address ranges that APNIC, the regional internet registry, publishes, and English pages otherwise. The check runs on our own server against a copy of that list; your address goes to no one else, and we keep no record of the result. When you choose a language with the EN / 한국어 switch, a cookie named lang, holding only ko or en, remembers your choice for one year and is sent to our server with each page request.
Chat controls and local mode. The chat keeps your language choice, the memory switch of each chat and the compaction setting in the browser's local storage. In local mode (sparkpipe.ai:8443/local/) your chats are stored only in the browser's IndexedDB: each message is sent to the model and the reply comes back, and our servers keep no chat history or memory of them.
We use no advertising, analytics or tracking cookies. You can delete or block any of these in your browser settings.
11. Children
SparkPipe is not meant for children under 16; please do not create an account if you are under 16. We do not knowingly collect personal information of children under 14, which PIPA Article 22-2 allows only with a legal guardian's consent. If we learn that we have, we delete it.
12. Privacy officer
Our privacy officer is TURAN CEM, Representative Director, who also handles complaints about personal information: hyor@sparkpipe.ai. We give our full postal address on request.
13. Where else to turn
- Personal Information Dispute Mediation Committee: 1833-6972, www.kopico.go.kr
- Personal Information Infringement Report Center (KISA): 118, privacy.kisa.or.kr
- Supreme Prosecutors' Office: 1301, www.spo.go.kr
- Korean National Police Agency, cyber investigation: 182, ecrm.police.go.kr
14. Changes
We publish any change here at least 7 days before it takes effect, or 30 days before for a change that reduces your rights, and note the date at the top. Earlier versions are available on request.