Privacy Policy

Epic Ventures (에픽벤처스, business registration number 771-24-00812, hereinafter “we” or “the Operator”) operates Seoulstart, a website providing practical guides and tools for foreign residents in Korea. This Privacy Policy explains what personal information we collect, why we collect it, how long we keep it, and who else processes it on our behalf.

We process personal information under the Personal Information Protection Act of the Republic of Korea (개인정보 보호법, “PIPA”). Where there is any inconsistency between this English version and the Korean version, the Korean version controls.

We collect three categories of personal information:

2.1 Service usage data (collected automatically)

• IP address and a hashed/truncated form of it
• Device, operating system, and browser information
• Pages visited, referrer URL, time on page, and event interactions
• Anonymous identifiers stored in cookies or local storage (e.g., PostHog distinct_id) that allow us to recognise returning browsers

2.2 CV Tailor tool (only when you use it)

• The CV file you upload (PDF or DOCX)
• The text and structured contents extracted from your CV (which may include your name, contact details, work history, education, and skills as written in your CV)
• The answers you provide to follow-up questions
• The tailored CV we generate for you
• Your email address, when you provide it at the download step

2.3 Newsletter and email subscriptions (only if you subscribe)

• Your email address
• The date and method of your subscription
• Open and click events on emails we send you (basic delivery analytics)

We do not knowingly collect sensitive information (race, religion, political views, health, sexual orientation, biometric data, etc.). Please do not include such information in CVs you upload to the CV Tailor.

• Operate and improve the service. We use service usage data to understand which pages and tools are useful, fix bugs, and prioritise new content.
• Run the CV Tailor. We use your uploaded CV and answers to generate a tailored CV using an AI processor (Anthropic). We use your email to send you a copy of the result and occasional updates about new tools.
• Send subscription emails. If you subscribe to a newsletter, we use your email solely to send you the content you subscribed to.
• Comply with legal obligations. Where Korean law requires retention or disclosure (e.g., responses to lawful requests by Korean authorities), we comply within the scope of that law.

We do not sell personal information. We do not use personal information for advertising profiling or for automated decisions with legal effects on you.

Where Korean law mandates a specific retention period (for example, once we begin processing payments, the Act on Consumer Protection in Electronic Commerce requires retention of transaction records for up to 5 years), that statutory period overrides the table above and we will update this Policy accordingly.

We do not provide your personal information to third parties for their independent use. We do entrust processing to the service providers listed in Section 6 (Processors), strictly to operate the service.

We may disclose information when required by Korean law (court order, lawful request by a Korean authority) or to protect the rights, property, or safety of users or the public.

We outsource (위탁) parts of the service to the providers below. Each is contractually bound to process your information only for the purpose we instruct.

Under PIPA Article 28-8, we are required to disclose the following for each processor located outside Korea. All processors listed above are located in the United States. Personal information is transferred over encrypted connections in real time at the moment you use the relevant feature.

Retention by recipient: Each recipient retains data for the period required to deliver the contracted service, plus any log-retention period set in their own policies. We delete data we control under Section 4; data that recipients hold under their own agreements (e.g., aggregated analytics, billing logs) is governed by their privacy policies.

How to refuse transfer: You may refuse the transfer of your personal information overseas. If you refuse, we cannot provide the parts of the service that depend on those processors (analytics tracking, CV Tailor, hosting). Email privacy@seoulstart.com with your request. For analytics specifically, you can also opt out by enabling “Do Not Track” in your browser, blocking cookies, or using a private browsing window.

When the retention period for an item ends, or when you request deletion, we destroy that information using the following methods:

• Electronic records: permanently deleted from databases and storage so they cannot be reproduced.
• Files (e.g., uploaded CVs): permanently deleted from object storage.
• Backups:overwritten or expired according to our processors’ backup-rotation policies (typically within 30 days of primary deletion).

You have the following rights under PIPA:

• The right to be informed about what we process
• The right to access your personal information
• The right to correct inaccurate information
• The right to have your information deleted
• The right to suspend processing
• The right to withdraw consent at any time

To exercise any of these rights, email privacy@seoulstart.com. We will respond within 10 days. If we cannot fulfil the request within that period, we will explain why and give you a revised timeline.

If you believe we have mishandled your information, you may file a complaint with:

• Personal Information Protection Commission (개인정보보호위원회) · pipc.go.kr
• Personal Information Infringement Report Centre (개인정보침해 신고센터) · privacy.kisa.or.kr · Phone: 118 (no area code, dial from inside Korea)
• Cyber Investigation Department, Supreme Prosecutors’ Office · 1301
• Cyber Bureau, Korean National Police Agency · 182

We use cookies and local-storage entries to operate the service and understand how it is used. Specifically:

• Strictly necessary: session and security cookies required for pages and forms to work.
• Analytics: a PostHog distinct_id that lets us recognise a returning browser without identifying you personally. No name, email, or other identifying field is attached to this ID unless you provide it elsewhere.

You can refuse all non-essential cookies by adjusting your browser settings (block third-party cookies, clear site data, or use private browsing). Refusing analytics cookies will not affect your ability to read guides or use the CV Tailor.

• All connections to our service use HTTPS/TLS encryption.
• Personal information at rest is stored on managed infrastructure (Supabase, Vercel) with encryption-at-rest enabled by the provider.
• Access to production systems is restricted to administrators authorised by the Operator and protected by strong authentication.
• We follow the principle of minimum collection: we do not ask for information we do not need.
• We log significant administrative actions for incident-response purposes.

Despite these measures, no online service can guarantee absolute security. If you believe an incident has affected your information, email us immediately at privacy@seoulstart.com.

The CV Tailor uses an AI processor (Anthropic) to analyse your CV and generate a tailored version. The output is reference material, not professional career advice. You are responsible for reviewing the result before submitting it to any employer.

We do not allow our processors to use your CV content to train general-purpose AI models. Your CV text is used only to generate your result and is destroyed under the retention rules in Section 4.

Under PIPA Article 30(1)(6), we publish the contact for our Personal Information Protection Officer. PIPA accepts publication of either a personal name or a department/position name; we publish the position and a dedicated contact email.

• Position: Representative (대표)
• Email: privacy@seoulstart.com

We may update this Privacy Policy as our service changes or as Korean law evolves. When we make a change that affects your rights or the way we handle your information, we will post the updated Policy on this page at least 7 days before it takes effect (30 days for changes that are unfavourable to data subjects). The “Effective date” at the top of this page reflects the current version.

• v1.0 (2026-05-05): Initial publication.