2. Privacy Policy

Effective date: 2026-06-05

This Privacy Policy explains how Abo Labs ("we") handles personal data across abolabs.io and abo.tools. Abo Labs is the data controller. Privacy inquiries: contact@abolabs.io. Designated privacy officer (개인정보 보호책임자): Ji Cheol-guk (General Manager), contact@abolabs.io.

2.1 Summary

• The tools run in your browser — files and text you process with them are not sent to or stored by us.
• We collect the minimum needed to run the waitlist (and any account), to send emails you ask for, and to keep the Service reliable and secure.
• We do not sell your personal data, and we do not use advertising or cross-site tracking.
• The current tools do not use server-side AI, so no content is sent to AI providers at this stage.

2.2 What we collect

• Tool content — not collected. Files/text you load into the in-browser tools are processed locally and are not transmitted to us.
• Waitlist: your email address, and optionally which tools you're interested in.
• Account (if you create one): email, optional name, and authentication identifiers (via Supabase Auth). (Omit if accounts are not live at launch.)
• Email you send us: if you email contact@abolabs.io, we receive the message and your address in order to reply.
• Product analytics: privacy-friendly, cookieless usage analytics via PostHog (e.g., which pages/tools are used, approximate region, device/browser type). We use this to understand demand and improve the tools.
• Diagnostics: error and performance monitoring via Sentry, with personal-data scrubbing.
• Technical/server data: standard logs and security data (e.g., IP address, request metadata) generated by our hosting/CDN provider to operate and protect the Service.

2.3 Cookies and similar storage

We do not use advertising or cross-site tracking cookies, and we do not show a cookie-consent banner because none is required for the storage we use. abolabs.io is largely static and sets no tracking cookies. On abo.tools, any storage is strictly necessary — for example, to keep you signed in if you have an account, or to remember your tool settings locally in your browser. Our analytics (PostHog) run in a cookieless configuration, and our error monitoring (Sentry) does not set tracking cookies.

2.4 How and why we use data, and legal bases

We use data to: provide and secure the Service; operate the waitlist and any account; send the emails you request (e.g., waitlist notifications) and reply to your messages; understand usage and improve the tools; prevent abuse; and comply with legal obligations. Our legal bases (where PIPA/GDPR apply) include performance of a contract, our legitimate interests (running, securing, and improving the Service), your consent (where required, e.g., waitlist emails), and legal obligation.

2.5 Sharing and sub-processors

We do not sell personal data. We share data only with service providers acting under contract on our behalf:

We may also disclose data where required to comply with law or to protect our rights, our users, or the public.

Note: when paid and AI features launch, additional sub-processors (e.g., the payment Merchant of Record and AI providers) will be added here — see Appendix A.

2.6 International transfers

Your data may be processed in Japan (Tokyo region) and in the United States and other countries where our providers operate. Where required, we rely on appropriate safeguards (such as standard contractual clauses or equivalent mechanisms).

2.7 Retention

We keep personal data only as long as needed for the purposes above:

• Waitlist email: until you unsubscribe or ask us to delete it.
• Account data (if any): while your account is active, and for up to 90 days after closure (then deleted or anonymized), unless a longer period is required by law.
• Email correspondence: kept for as long as needed to handle your inquiry and a reasonable period afterward.
• Analytics: retained in aggregated/limited form per our PostHog configuration.
• Diagnostic/error logs (Sentry): up to 90 days.
• Security/server logs: short retention per our provider's configuration.

We delete or anonymize personal data once it is no longer needed for these purposes.

2.8 Your rights

Depending on where you live, you may have rights to access, correct, delete, restrict, object to, or port your personal data, and to withdraw consent. This includes rights under Korea's PIPA, the EU/UK GDPR, and California's CCPA (including the right to know and delete, and confirmation that we do not sell personal data). To exercise these rights, contact contact@abolabs.io. You may also complain to your local authority — in Korea, the Personal Information Protection Commission (PIPC).

2.9 Security

We protect data with encryption in transit, access controls, least-privilege practices, and personal-data scrubbing in error logs. We do not claim security certifications we do not hold.

2.10 Children

The Service is not directed to children. You must be at least 14 years old (or the minimum age in your country, if higher). We do not knowingly collect personal data from children below that age.

2.11 Changes

We will post updates here with a new effective date and provide notice of material changes.

2.12 Contact

contact@abolabs.io — Abo Labs, Room 1005-A-19, 53 Yangsan-ro, Yeongdeungpo-gu, Seoul, Republic of Korea.