Terms & Policies
Contents 12 articles
- Article 1 (Purposes, Data and Legal Basis)
- Article 2 (Retention)
- Article 3 (Provision to Third Parties)
- Article 4 (Processors)
- Article 5 (International Transfers)
- Article 6 (Deletion)
- Article 7 (Cookies, Analytics, Behavioral Data and Marketing)
- Article 8 (Security Measures)
- Article 9 (Your Rights and How to Exercise Them)
- Article 10 (Privacy Officer)
- Article 11 (Remedies)
- Article 12 (Changes to This Policy)
EverySim Inc. (the "Company") explains below, as required by the Korean Personal Information Protection Act (PIPA), how it handles personal data in the engineering simulation service at everysim.io, sign-up and sign-in at auth.everysim.io, and demo and consultation requests on its website.
Article 1 (Purposes, Data and Legal Basis)
The Company processes only the minimum personal data needed for the purposes below, listed separately for processing without consent and processing based on consent.
- Personal data processed without consent
| Purpose | Data | Legal basis |
|---|---|---|
| Sign-up, sign-in and account management | Name, email, organization, password (one-way hashed). With Google sign-in: Google account ID, email and name | Entering into and performing a contract (PIPA Art. 15(1)(4)) |
| Managing paid access and refunds | Email, account ID, product, amount and currency, transaction ID, payment and refund status, billing country and postal code | Performing a contract (Art. 15(1)(4)); record keeping under the E-Commerce Act (Art. 15(1)(2)) |
| Demo and consultation requests, inquiry replies | Name, email, company or institution, meeting time, inquiry and reply history (optional: role, company size, field of interest) | Steps taken at the data subject's request before a contract (Art. 15(1)(4)) |
| Running analyses and technical support | Personal data inside projects (CAD, meshes, setups, results, reports), support requests, attachments and reply history | Performing a contract (Art. 15(1)(4)) or processing on behalf of business customers (see Article 9) |
| Operations, security and incident response | IP address, access time, requested and referring pages, browser information, sign-in success and failure logs | Legitimate interest in preventing abuse and keeping the Service secure (Art. 15(1)(6)) |
| Essential cookies | Cookies for staying signed in, security and language settings (Article 7) | Performing a contract (Art. 15(1)(4)) |
- Personal data processed with consent
| Purpose | Data | Legal basis |
|---|---|---|
| Marketing email | Email, time and source of opt-in | Consent (Art. 15(1)(1)) |
| Usage analytics (analytics cookies) | PostHog, Google Analytics and Microsoft Clarity data listed in Article 7 | Consent |
| Functional cookies | Meeting calendar and support chat usage | Consent |
| Personalized ads and measurement (marketing cookies) | Behavioral data listed in Article 7 | Consent |
You can refuse anything that needs consent, and refusing does not limit sign-up or core Service use. Card numbers and other payment details are entered directly on the Paddle checkout, and the Company never receives them. With Google sign-in, the Company does not store your Google password or authentication tokens. The Company does not process sensitive data or unique identifiers such as resident registration numbers.
Article 2 (Retention)
The Company keeps personal data for the periods below and deletes it without delay once the purpose is fulfilled or consent is withdrawn, even if time remains.
| Category | Data | Retention |
|---|---|---|
| Account information | Name, email, organization, credentials | Until account deletion |
| Project data | Personal data inside projects | Until the project or account is deleted |
| Demo and consultation requests | Request details, inquiry | 1 year after the request is resolved |
| Technical support material | Support requests, reply history, attachments | 1 year after the request is resolved |
| Marketing opt-in | Email, opt-in time | Until consent is withdrawn or the account is deleted |
| Service security logs | IP, access logs, sign-in logs | 1 year from collection |
| Access logs of the personal data processing system | Access logs of staff handling personal data | At least 1 year (at least 2 years where legally required) |
| PostHog | Events / session recordings | Events 1 year / recordings 90 days |
| Google Analytics | Visit statistics | Events 2 months, user data 14 months |
| Microsoft Clarity | Session recordings / heatmaps | 30 days / 13 months |
Under the E-Commerce Act, the following records are kept separately: contracts and withdrawals 5 years, payments and service delivery 5 years, consumer complaints and disputes 3 years, displays and advertising 6 months. Only those records and the minimum data needed to identify the parties are kept.
Article 3 (Provision to Third Parties)
The Company provides personal data to third parties only in the cases allowed by PIPA Articles 17 and 18, such as with the data subject's consent or where a law specifically requires it.
| Recipient | Purpose | Data | Retention | Basis |
|---|---|---|---|---|
| Paddle.com Market Limited and affiliates (UK, US, Canada, Ireland) | As Merchant of Record: payments, refunds, tax, receipts and fraud prevention | Email, account ID, product, amount and currency | For the business relationship and statutory retention periods | Data subject's consent before payment |
| Google LLC, Microsoft Corporation | The part analytics and ad providers process for their own purposes, such as improving their services | Data for each tool listed in Article 7 | Each provider's policy | Consent in cookie settings |
Data goes to Paddle only if you consent when buying. Without consent you cannot make a purchase, but free Service use is not affected. Requests from investigative authorities under the law are met only through the procedures and within the scope the law sets.
Article 4 (Processors)
The Company entrusts the processing below to service providers. Its contracts with them prohibit processing beyond the stated purpose and cover security measures, limits on sub-processing and liability, and the Company supervises them.
| Processor | Service |
|---|---|
| Amazon Web Services, Inc. | Hosting and backup of servers, databases and file storage |
| NAVER Cloud Corp. | Hosting and backup of servers, databases and file storage (until the move to AWS is complete) |
| Plus Five Five, Inc. (Resend) | Service email such as verification codes and job status alerts |
| Microsoft Azure (via OpenRouter) | Processing AI Assistant requests and generating responses (only when you use AI Assistant) |
| Stibee Inc. | Marketing email (opted-in recipients only) |
| PostHog Inc. | Usage analytics, error tracking and session recording (with analytics cookie consent) |
| Google LLC | Google Analytics statistics and ad measurement (with the relevant cookie consent) |
| Microsoft Corporation | Clarity session recordings and heatmaps (with analytics cookie consent) |
The Company runs the meeting calendar and support chat itself. With Google sign-in, you authenticate directly with Google and the Company receives the result, so this is not entrusted processing.
Article 5 (International Transfers)
The Company transfers personal data abroad as follows. All transfers use encrypted connections.
| Recipient (contact) | Country | Data | Purpose | When and how | Retention | Legal basis | How to refuse and effect |
|---|---|---|---|---|---|---|---|
| Amazon Web Services, Inc. (aws-korea-privacy@amazon.com) | US, India, Singapore (data stored in the Seoul region is not transferred abroad) | Account information, personal data in projects, support material, security logs | Hosting and backup of servers, databases and storage | Sent and stored over the network as you use the Service | Periods in Article 2 | Entrusted processing and storage to perform the contract (PIPA Art. 28-8(1)(3)) | You can refuse via support@everysim.io, but Service use will be limited |
| Plus Five Five, Inc. (support@resend.com) | US | Email, name, verification codes, alert content | Sending service email | Sent when an email goes out | Until delivered; sending logs 30 days | Entrusted processing to perform the contract (Art. 28-8(1)(3)) | You can refuse, but without verification and alerts Service use will be limited |
| Microsoft Azure (via OpenRouter) | US and others, depending on routing | Messages you enter into AI Assistant and project information included in the request | Generating AI Assistant responses | Sent over encrypted connections each time you use AI Assistant | Only providers that do not keep prompts are used (ZDR setting) | Entrusted processing to perform the contract (Art. 28-8(1)(3)) | Not sent if you do not use AI Assistant |
| Paddle.com Market Limited and affiliates (privacy@paddle.com) | UK, US, Canada, Ireland | Data listed in Article 3 | Purposes listed in Article 3 | Sent when you make a purchase | Period in Article 3 | Data subject's consent (Art. 28-8(1)(1)) | Without consent you cannot purchase; free use is not affected |
| PostHog Inc. (privacy@posthog.com) | US | PostHog data in Article 7 | Usage analytics, error tracking, session recording | Sent as you use the Service after accepting analytics cookies | Events 1 year, recordings 90 days | Data subject's consent (Art. 28-8(1)(1)) | Refuse in cookie settings; no effect on Service use |
| Google LLC (support.google.com/policies/contact/general_privacy_form) | US | Google Analytics data in Article 7, behavioral data | Visit statistics, ad measurement, interest-based ads | Sent from your browser on page visits after accepting the relevant cookies | Periods in Article 2 | Data subject's consent | Refuse in cookie settings; no effect on Service use |
| Microsoft Corporation (aka.ms/privacyresponse) | US | Screen recordings, click and scroll logs, device and browser information, identifiers | Usability improvement | Sent from your browser on page visits after accepting analytics cookies | Recordings 30 days, heatmaps 13 months | Data subject's consent | Refuse in cookie settings; no effect on Service use |
Questions about international transfers and requests to refuse them go to support@everysim.io.
Article 6 (Deletion)
The Company deletes personal data without delay when the retention period ends or the purpose is fulfilled. Data that must be kept by law is stored separately. Electronic files are deleted so they cannot be recovered, and paper documents are shredded or incinerated. Personal data in backups is removed on the 30-day backup rotation, and deleted data is not reused after a restore.
Article 7 (Cookies, Analytics, Behavioral Data and Marketing)
- The Company uses essential cookies for staying signed in, security and language settings, and uses functional, analytics and marketing cookies only with your consent. You can accept or refuse optional cookies at any time in the cookie banner on your first visit or under "Cookie Settings" at the bottom of the page, and those tools do not run before you consent. The name and lifetime of each cookie are listed in Cookie Settings. You can also block cookies in your browser, but blocking essential cookies will break some features such as sign-in.
- Data and purpose by analytics tool
| Tool (provider) | Data | Purpose | Cookie lifetime |
|---|---|---|---|
| PostHog (PostHog Inc.) | Pages visited and clicks, screen recordings (inputs masked), errors and performance, signed-in user ID, email, organization, plan and IP, analysis run, payment and inquiry events | Usage analytics, fixing errors | Visitor ID 1 year |
| Google Analytics (Google LLC) | Pages visited, scrolling, clicks, device and browser, approximate location, referral source | Visit statistics | Up to 13 months |
| Microsoft Clarity (Microsoft Corporation) | Screen recordings, click and scroll heatmaps, device and browser | Usability improvement | Visitor ID 1 year, session 1 day |
| Functional cookies (Company) | Showing the meeting calendar, continuing support chats | Providing features | Up to 6 months |
- Collection and use of behavioral data (only with marketing cookie consent)
- Collected by: Google LLC
- Data: Pages visited, ad clicks and conversions, cookie identifiers, device and browser information
- How: Ad tags on the web pages send data from your browser to Google's servers
- Purpose: Interest-based ads and ad measurement
- Retention: Cookies up to 2 years
- How to refuse: Turn off marketing cookies in Cookie Settings, or use Google Ad Settings (adssettings.google.com)
- The Company does not collect sensitive behavioral data and does not show personalized ads to users known to be under 14.
- Marketing email is sent only to people who opted in separately on the sign-up screen or the Paddle checkout. Not opting in has no effect on sign-up or payment, and you can opt out at any time using the unsubscribe link in any email or via support@everysim.io.
- The Company does not use customers' non-public design data, analysis setups, results or personal data in projects to train general-purpose AI models or build datasets for other customers. If it ever introduces such use, it will first explain the scope and purpose and obtain any required consent.
Article 8 (Security Measures)
The Company takes the following measures under the PIPA security standards.
- Administrative: An internal management plan, a minimal number of staff handling personal data, and regular training
- Technical: Least-privilege access with records, access control systems, one-way password hashing, encryption in transit (TLS), retention and review of access logs under the internal plan, security updates and malware protection
- Physical: Servers run in access-controlled data centers, and documents and storage media are kept locked
If a breach occurs, the Company contains the damage, notifies affected data subjects and reports to the authorities as the law requires. If an incident affects data processed on behalf of a business customer, the Company informs that customer without delay and cooperates in the response.
Article 9 (Your Rights and How to Exercise Them)
- You can request access to, correction or deletion of your personal data, suspension of processing and withdrawal of consent, either yourself or through a legal representative or authorized agent. Send requests to support@everysim.io. The Company verifies the requester's identity or authority with the minimum information needed and reports the outcome within 10 days. If the law restricts a request, the Company explains why and how to object.
- The Company does not accept sign-ups from children under 14 and deletes a child's personal data without delay if it learns it has been collected.
- When a business customer includes personal data in projects as part of its work, the Company processes it as that customer's processor, following the customer's instructions and the Data Processing Agreement (DPA), and helps with rights requests, incident notices, return and deletion. Rights requests about that data are handled together with the customer. Admins of an organization account can view and manage members' account information and projects within the scope the Service provides.
- Users living outside Korea can exercise, through the same channel, the rights their local laws grant, such as the EU GDPR and U.S. state privacy laws, including access, deletion, restriction of processing, data portability and opting out of sale or sharing. The Company does not discriminate against anyone for exercising these rights.
Article 10 (Privacy Officer)
- Privacy officer: Lee Seok-geun (CEO)
- Email: support@everysim.io
- Address: Rooms 310-312, Research Bldg 3, 70 Yuseong-daero 1689beon-gil, Yuseong-gu, Daejeon, Korea
Send requests for access, correction, deletion or suspension of processing, and any privacy complaints, to the email above.
Article 11 (Remedies)
For advice, reports or dispute mediation about privacy violations, you can contact the following bodies.
- Personal Information Dispute Mediation Committee: www.kopico.go.kr / +82 1833-6972
- Personal Information Infringement Report Center: privacy.kisa.or.kr / 118 (in Korea)
- Supreme Prosecutors' Office Cyber Investigation Division: www.spo.go.kr / 1301 (in Korea)
- Korean National Police Agency Cyber Bureau: ecrm.police.go.kr / 182 (in Korea)
Users outside Korea can also contact the data protection authority in their country.
Article 12 (Changes to This Policy)
The Company publishes this Policy on its website, readable without signing in. Changes are announced with their effective date at least 7 days in advance, and changes that require consent are made only with separate consent. Earlier versions are available on the Privacy Policy page.
This Policy takes effect on November 2, 2026.