Syidax Privacy Policy
Effective date: 2026-10-08 · Version 2026-10-08
This Privacy Policy explains how parrru ("Syidax", "we", "us") handles personal data when you use the Syidax websites (including syidax.web.app, the Syidax Core documentation site and the Syidax Chart & Grid documentation site), Syidax accounts, the license portal, downloads and subscriptions. It applies to visitors, account holders, buyers and people who are assigned a seat by their organization.
We do not sell personal data, we do not use advertising or analytics trackers, and we do not use personal data for automated decisions that have legal or similarly significant effects on you.
1. Who is responsible
The controller is parrru, a sole proprietorship in the Republic of Korea: 4F, Room 465, Dongseong Building (Sinjeong-dong), 50, Mokdongdong-ro 12-gil, Yangcheon-gu, Seoul, Republic of Korea.
Privacy officer: Sungrae Kim (김성래), parrrudev@gmail.com.
2. What we collect and why
| When | Personal data | Purpose | Legal basis (GDPR) |
|---|---|---|---|
| You visit the websites | IP address, browser and device information, requested page, referring page, date and time, recorded in technical logs by our hosting provider | Deliver pages, keep the Service secure, investigate errors and abuse | Legitimate interests (operating and securing the Service) |
| You sign in | Google account identifier, email address, and the name and profile picture URL that Google provides; sign-in times; IP addresses logged by the sign-in service for security | Authenticate you and link your licenses to you | Contract |
| You buy or manage a license | Email address; organization name and, optionally, its registration number; billing email; the name and department of the person you designate; products, seats, prices, currency, promotions (including a private offer addressed to you or your organization); order and license status; paid-through dates; web domains registered for license certificates; Creem customer, subscription and order identifiers | Take orders, issue and renew licenses and certificates, manage subscriptions, refunds and support | Contract; legal obligation (keeping commercial and tax records) |
| Your organization assigns you a seat | Your email address, name and department, received from your organization's administrator; seat assignment history | Manage the seats your organization bought | Legitimate interests of your organization and us in administering licensed seats |
| You contact us | Your email address and the content of your message | Answer you and keep a record of the request | Contract; legitimate interests |
| You use the Service | Account identifier, per-minute request counters, and an audit trail of license actions (who did what and when; seat changes include the seat holder's email address) | Prevent abuse, secure accounts, keep a verifiable license history | Legitimate interests (security, fraud prevention, proving license history) |
License certificates that you deploy in your applications contain license identifiers, products, paid-through dates and your registered web domains. They contain no names or email addresses. The Syidax libraries do not send usage data to us.
Signing in is needed to buy or manage licenses and to generate with AI. If you do not provide an email address through Google sign-in we cannot sell you a subscription. You can read the documentation without giving us any personal data apart from the technical log data above.
We may send necessary service messages about your account, orders and licenses. We do not send marketing emails without your consent.
AI generation (optional). After Google sign-in and separate overseas-transfer consent, your request passes through our server to Anthropic (Claude) or OpenAI, according to the administrator-selected model, to generate a supported interface. We do not add your account email or account identifier to the provider request. Do not include personal or confidential information in the prompt. We retain account ID, request ID, product, time, outcome, model, token usage, daily counters, credit balance and consent version/time for account limits, cost control and support, on a contract/legitimate-interest basis. We do not store prompt or result text in our database or application logs. For each product, your browser retains the 3 most recently used conversations and up to 10 request/result pairs per conversation (section 4). Every account has 10 successful generations per day across products, resetting at 00:00 Korea time. Credit purchases are paused; existing balances remain. Samples do not invoke either provider.
3. Payments through Creem
Payments are processed by Creem (Armitage Labs OÜ, Estonia), which is the merchant of record and an independent controller for the payment. You enter your email address, payment details and billing address directly on Creem's checkout, and Creem handles them under its own Privacy Policy. To open a checkout we send Creem only the selected product, the number of seats, discount details and an internal order reference. Opening the billing portal also sends your Creem customer identifier. These identifiers can be linked to your order and account and are treated as personal data. We obtain separate consent for disclosure and international transfer before sending them (section 6). After the payment, Creem sends us the customer, subscription, order and transaction identifiers, the amounts, and the status of payments, refunds and subscriptions. We never receive your card number.
4. Cookies and browser storage
We use only storage that is needed for the Service or that remembers a choice you made. We do not use analytics, advertising or cross-site tracking cookies, so we do not show a cookie banner.
| Name | Type | Purpose | Duration |
|---|---|---|---|
syidax_language | Cookie | Remembers your language across Syidax sites | 1 year |
syidax:language | Local storage | Remembers your language on this site | Until you clear it |
syidax:docs:theme | Local storage | Remembers light or dark theme | Until you clear it |
syidax:promo:dismissed | Local storage | Remembers that you closed a promotion notice | Until you clear it |
syidax-ai-sessions-v2:* | Local storage | Per product: 3 recent conversations, up to 10 request/result pairs each. Older records are replaced when limits are exceeded; existing history is migrated into one conversation. Cloud processing is described in sections 2 and 6. | Until replaced by newer records or cleared in your browser |
| Firebase Authentication session | Browser storage (IndexedDB) | Keeps you signed in | Until you sign out |
You can delete these at any time in your browser settings. Signing out ends the authentication session; it does not clear saved language, theme or example history. Do Not Track and Global Privacy Control: we do not track you across websites and we neither sell nor share personal data for cross-context behavioral advertising, so these signals require no further action from us.
5. Who receives personal data
| Recipient | Role | What they do | Location |
|---|---|---|---|
| Google LLC (Firebase, Google Cloud) | Processor | Website hosting, sign-in, database, server functions, technical logs | Database and server functions in Seoul, Republic of Korea; sign-in in the United States; websites served through Google's global network |
| Anthropic, PBC | Processor | Generate interfaces from your request; API operation and abuse prevention under its data processing terms | United States |
| OpenAI OpCo, LLC | Processor | Generate interfaces from your request; API operation and abuse prevention under its data processing terms | United States |
Creem also receives the identifiers and order details described in section 3, in addition to the payment information you enter directly. It acts as an independent payment controller.
Within a Business license, your organization's administrator can see the seat holders' email addresses, names and departments and the license status. We may also disclose personal data when the law requires it, to protect our rights or the safety of others, to professional advisers under confidentiality, or to a successor if the business is transferred, in which case we will tell you.
6. International transfers
We are located in the Republic of Korea. Google LLC processes some data in the United States, as listed in section 5; for users in Korea, the details that Korean law requires are listed in the Korean version of this Policy. If you are in the EEA or the UK: the European Commission and the United Kingdom recognize Korea as providing an adequate level of data protection, and Google is certified under the EU-U.S. Data Privacy Framework and offers Standard Contractual Clauses in its data processing terms.
Optional AI transfers. Before each page session's first AI generation, we obtain separate consent under Korean PIPA article 28-8(1)(1). This new optional feature applies only to users who read its notice and consent; it does not change processing for users who do not enable it.
| Detail | Description |
|---|---|
| Recipient and contact | OpenAI OpCo, LLC, 1455 3rd Street, San Francisco, CA 94158, USA; privacy@openai.com. Anthropic, PBC; privacy@anthropic.com. The selected model determines which recipient processes a request. |
| Country | United States (the standard Anthropic or OpenAI API; no Korean data-residency option is configured) |
| Timing, method and data | On a generation request after consent, over HTTPS: your prompt, selected product, output language and interface instructions/schema. The selected provider produces the result. We do not add your account email or identifier. |
| Purpose and retention | Generate the requested interface and prevent abuse. With Chat Completions and store=false, we do not request stored completions. OpenAI may keep abuse-monitoring content for up to 30 days, with legal or safety exceptions. Anthropic normally deletes API inputs and outputs within 30 days, with legal, safety or contractual exceptions. API data is not used for model training by default. See OpenAI data controls and Anthropic API retention. |
| Refusal and withdrawal | Leave the AI consent box unchecked or stop generating. AI generation is unavailable without consent; documentation and license services remain available. Email parrrudev@gmail.com for deletion/withdrawal requests. Retention obligations for previously processed records remain. |
Creem transfers. We obtain separate consent for disclosure and overseas transfer under Korean PIPA articles 17(1)(1) and 28-8(1)(1) before opening checkout or the billing portal.
| Detail | Description |
|---|---|
| Recipient and contact | Armitage Labs OÜ (Creem), Rotermanni 14, Tallinn 10111, Estonia; support@creem.io |
| Countries | Estonia. Creem's published sub-processor list also includes Germany, the United States, Ireland, the Netherlands and processing within the European Union. |
| Timing and method | When you request checkout or the billing portal after consent, over HTTPS |
| Data | Checkout: order reference, product, seat count, discount code, amount and duration. Billing portal: Creem customer identifier |
| Purpose | Create and link payment orders; manage subscriptions, cancellations and refunds |
| Retention | Creem's Privacy Policy section 5 provides 3.5 years after contract termination for contractual data and 7 years for accounting data; longer where required by law or ongoing disputes. |
| Refusal or withdrawal | Leave either consent unchecked to decline. Checkout and the billing portal then remain unavailable; public documentation and free features remain available. Email parrrudev@gmail.com to cancel, request a refund or withdraw consent. Existing transaction record obligations remain. |
We retain the policy version, consent time, account and related order or license identifier with transaction records as evidence of consent. Data you enter directly on Creem and its subsequent processing are governed by Creem's own notice.
7. How long we keep data
| Data | Retention |
|---|---|
| Account (identifier, email) | While your account exists. Deleted within 30 days after you ask, except the records below. The sign-in service removes deleted accounts from its backups within 180 days. |
| Orders, payments, refunds, licenses, certificates and subscriptions | 5 years after the contract ends (Korea's Act on Consumer Protection in Electronic Commerce and tax laws require keeping contract, payment and supply records for 5 years) |
| Complaints and disputes, support emails | 3 years after the matter is closed |
| Audit trail of license actions | As long as the related license records |
| General request counters | Overwritten continuously and deleted with your account |
| AI request/day records, consent evidence and credit balances | While the account exists; deleted within 30 days of an account deletion request. AI purchase/payment/refund records follow the 5-year commercial retention rule above. Raw prompts and results are not retained in our database. |
| Firebase Hosting access/IP logs | A few months, according to Firebase’s privacy information. |
| Firebase Authentication IP logs | A few weeks, according to the same Firebase information. These are separate from Hosting logs. |
| Other server logs | Retained for the period configured for the relevant logging service. |
| Browser storage | For the periods in section 4. Signing out ends authentication; preferences remain until cleared. |
When the retention period ends, we delete the data so that it cannot be restored.
8. Your rights
Wherever you live, you can ask us to access, correct or delete your personal data, or to stop using it. Email parrrudev@gmail.com from the address linked to your account, or tell us how we can verify that the request is yours. We do not charge for requests and we do not treat you differently for making them.
- Korea. You may request access, correction, deletion or suspension of processing, and withdraw consent, under the Personal Information Protection Act. A legal representative or a person you authorize may make a request for you.
- United States. Depending on your state, you may have the right to know, access, correct, delete and obtain a copy of your personal data, and to opt out of sale, sharing, targeted advertising and profiling (we do none of these). You may use an authorized agent. If we decline your request, you may appeal by replying to our answer; if the appeal is denied, you may contact your state attorney general.
- EEA and UK. You also have the rights to restriction of processing, data portability, to object to processing based on legitimate interests, and to complain to your data protection authority.
We answer within 10 days for requests under Korean law and otherwise within 30 days, or within the shorter period your law requires. Where the law allows a longer period, we will tell you why we need it. We may keep data that the law requires us to keep (section 7). Deleting your account ends access to the license portal; please cancel active subscriptions first.
9. Security
- All connections use HTTPS (TLS).
- We do not store passwords; you sign in with Google.
- Browsers cannot read or write our database directly. Every request goes through our server, which checks who you are and what you may access.
- Payment card details never reach our systems.
- Access keys are stored in a secrets manager, payment-provider keys are limited to the permissions we need, and administrative actions are recorded in an audit trail.
- Our hosting provider protects its data centers physically and technically.
10. Children
The Service is meant for professional developers and organizations. You must be at least 18 to create an account or buy a subscription. We do not knowingly collect personal data from children (under 14 in Korea, under 13 in the US). If we learn that we have, we delete it.
11. Notice for US residents
In the past 12 months we collected these categories of personal information: identifiers (email address, account identifier, IP address), commercial information (orders and subscriptions), professional information (organization, department), and internet activity (technical logs). We collected them from you, from your organization's administrator, from Google sign-in and from Creem, for the purposes in section 2, and disclosed them for business purposes to the processor in section 5. We do not sell or share personal information and we do not use or disclose sensitive personal information. California residents may also ask how we disclose personal information for direct marketing; we do not disclose it for that purpose.
12. Changes to this Policy
We publish changes on this page with a new effective date. We announce changes at least 7 days before they take effect, and important changes such as new purposes or recipients at least 30 days before, on the website and by email to account holders. Earlier versions are available on request.
13. Contact and complaints
Privacy officer: Sungrae Kim (김성래) · parrrudev@gmail.com · 4F, #465, 50, Mokdongdong-ro 12-gil, Yangcheon-gu, Seoul, Republic of Korea (Dongseong Building, Sinjeong-dong).
You may also contact an authority: in Korea, see the Korean version of this Policy; in the US, your state attorney general; in the EEA or UK, your data protection authority.