Privacy Policy

1.Scope, and the two roles we play

This policy explains how 에스에이치랩솔루션즈 (“we”) handles personal information in the SC4SAP console, its backend and its skills (the Service). It is written to the requirements of the Personal Information Protection Act of the Republic of Korea (the Act) and its enforcement decree, and it forms part of the Terms of Use.

Where we are the controller

For the information you give us to have an account — name, email address, password, billing details, and the record of what your account did — we decide the purposes and means, and we are the controller. Sections 3 to 6 describe that half.

Where we are a processor

For what a Session reads out of your SAP system — ABAP source, dictionary metadata, configuration values, table contents you approved an extraction of, and anything you typed into a prompt — we act only on your instruction. Your organisation is the controller of that material, including any personal information inside it. We process it to run the Session you asked for and for nothing else. Section 8 describes that half.

2.How we approach this

• We collect the minimum the Service needs, and we do not make optional data a condition of using it.
• We do not use your content, your prompts or your SAP material to train models — ours or anyone else’s.
• We do not sell personal information, and we never have.
• We do not use personal information for a purpose beyond the one it was collected for without a fresh legal basis.
• Secrets — passwords, SAP credentials — are stored encrypted and are never rendered back to the browser once saved.

3.What we collect

You give us

• Account — surname, given name, email address, and a password stored only as a salted one-way hash.
• If you sign up with Google — your Google account identifier, and the name and email address Google provides.
• Invitation code — the invitation code you signed up with, stored with your account.
• SAP connection details — SAP logon URL (host), client number, system tier, SAP user ID and SAP password. The SAP password is encrypted at rest.
• Billing — where a paid plan applies, payment records (plan, amounts, dates and transaction references). Card numbers and other payment-method details are held by the payment processor (Toss Payments Co., Ltd.) and never by us.
• Consent records — which versions of the terms and this policy you accepted and when, whether you agreed to the overseas transfer, and whether you agreed to receive marketing messages.
• Reference notes — the Markdown (.md) notes from your Obsidian vault that you upload in Settings. We accept up to 1,000 notes and 50 MB per account, store them on our server in that account’s own folder, and do not share them with other accounts.
• Support and feedback — whatever you write to us, including anything you paste into a message.

“Send to Obsidian” only copies content to the clipboard or Obsidian on your own device; it sends nothing to our server.

Generated or collected while you use the Service

• Session records — prompts, transcripts, the tools a Session called, and the approvals you granted or refused, with timestamps. Approvals are attributed to the account that granted them; that attribution is the audit record, and it is deliberate.
• Usage and cost — turn counts, token counts and the cost each Session reported.
• Access records — IP address, browser information (user agent), request paths, access times and error records, kept for security and for fixing faults.

What we ask you not to send

Do not put personal information into a prompt where the question does not need it, and do not point a Skill at production data you are not permitted to send outside your network. The guardrails in the Service block bulk extraction from tables on a standing blocklist, but they cannot classify your own custom tables and they are not a substitute for your review.

4.Why we process it, and on what basis

Under the Act we process personal information on one of these bases: performance of the contract with you, your consent, our legitimate interest where it does not override your rights, or a legal obligation. Specifically:

• Running the Service — authenticating you, reaching your SAP systems, running Sessions, searching your reference notes when a Session answers, storing transcripts so you can reopen them. Basis: performance of the contract.
• Billing and tax — invoicing, collection, and the records commercial and tax law requires us to keep. Basis: contract and legal obligation.
• Security and abuse prevention — detecting unauthorised access, investigating incidents, enforcing the Terms of Use, and keeping the audit record of approvals. Basis: legitimate interest and legal obligation.
• Support — answering what you write to us. Basis: contract.
• Improving the Service — aggregate and de-identified statistics about how features are used. Basis: legitimate interest. This never includes reading your SAP content or your transcripts.
• Marketing — emails about new features, events and plans. The items processed are 【marketing items】, kept until you withdraw consent or close the account. We send them only where you opted in, and every message says how to unsubscribe. Not agreeing does not limit your use of the Service in any way. Under Article 50(8) of the Act on Promotion of Information and Communications Network Utilization and Information Protection and Article 62-3 of its Enforcement Decree 【article number to be confirmed】, we tell you by email every two years, counted from your consent, that you are subscribed. Basis: consent (Article 15(1)(1) of the Act).

Consent, where it is the basis, is optional: refusing it costs you the feature it was asked for and nothing else. You can withdraw it at any time, and withdrawal does not affect processing already carried out.

5.How long we keep it

We keep personal information only for as long as the purpose requires, then destroy it. In practice:

• Account records — for the life of the account, then destroyed without delay on closure, save for what is listed below. An account not used for a year since its last use of the Service (signing in included) is deleted under section 10.
• Connection profiles — until you delete the profile or close the account, whichever comes first.
• Sessions and transcripts — until you delete them or close the account. You can delete any single Session at any time.
• Reference notes — each upload replaces the notes uploaded before. They are destroyed without delay when you use “Clear all” in Settings, when you close the account, or on the one-year inactivity deletion in section 10.
• Approval audit records — retained with the Session they belong to, and destroyed with it.
• Access records — up to three months, longer only where an open security investigation needs them.
• Support correspondence — up to three years from the last message.

Where a statute sets a period, that period wins. Under the Act on Consumer Protection in Electronic Commerce and the tax statutes we retain contract and payment records for five years, records of consumer complaints or dispute handling for three years, advertising records for six months, and, under the Protection of Communications Secrets Act, access logs for three months.

Backups age out on their own cycle, so a deletion propagates to them within that cycle rather than instantly.

6.Provision to third parties

We do not provide your personal information to third parties for their own purposes. We will do so only where you have separately consented, or where a statute requires it — a warrant, a court order, or a lawful demand from an investigating authority following the procedure the law sets out.

Where we receive such a demand we check that it is valid and narrow in scope, disclose only what it covers, and tell you unless the law forbids us from doing so.

If we are ever part of a merger, acquisition or transfer of business, we will notify you of the transferee and of your right to withdraw before the transfer takes effect, as the Act requires.

7.Delegated processing and our subprocessors

We delegate the processing of personal information as follows to provide the Service.

Our processing contracts prohibit processing beyond the delegated purpose and set technical and managerial safeguards, limits on further delegation, our supervision of the processor, and liability for damages. We supervise each processor’s handling of personal information.

Section 9 applies to processors that handle personal information outside Korea. We announce a change of processor or of the work delegated in this policy before it takes effect.

8.Personal information inside your SAP content

When a Session reads from your SAP system, whatever it read is sent to the Model Provider so the model can answer. If personal information is present in that material — in a table you approved an extraction of, in test data, or hard-coded in a program — it is transmitted with the rest.

For that material your organisation is the controller and we are its processor. We use it to run the Session, we do not use it for any purpose of our own, we do not use it to train models, and we delete it with the Session it belongs to. Deciding whether a Session may lawfully touch that data in the first place is the controller’s call.

The same applies to reference notes. Do not upload other people’s personal information that you have no right to share. Where a reference note does contain another person’s personal information, you are the controller of it and we are your processor, as with SAP material.

Where your organisation needs one, we will enter a data processing agreement setting out instructions, subprocessors, security measures, assistance with data-subject requests, breach notification and deletion on termination. Ask at sc4sap.dev@gmail.com.

9.Transfer of personal information overseas

To perform the service contract with you, we transfer personal information outside Korea as set out below. Under Article 28-8(1)(1) of the Act, we ask for your separate consent to this transfer on the sign-up screen.

Processors in section 7 that handle personal information outside Korea are listed in that table with their country. 【If the hosting, database or email processor handles data outside Korea, add a row to this section’s table for each, with the items, timing and method, and retention.】 Our contracts with overseas processors set the level of protection the Act requires, and we transfer over encrypted connections.

You may refuse the overseas transfer: do not give the consent on the sign-up screen. If you have already given it, do not run Sessions, and close your account in Settings or tell us at sc4sap.dev@gmail.com. Once we receive your refusal we stop transferring your information overseas.

AI answers are produced only by Anthropic’s processing, so if you refuse the overseas transfer you cannot use the Service. Fees already paid are refunded as separately determined.

10.How we destroy it

When a retention period ends or the purpose is met, we destroy the information without delay — in practice within thirty days of the triggering event.

• Electronic records are deleted by a method that leaves them irrecoverable, and encrypted records are destroyed by discarding the key as well as the ciphertext.
• Anything on paper is shredded or incinerated.
• Records held under a statutory period are separated from live data and stored apart until that period ends.
• If an account has not been used for a year since the last day it used the Service (signing in included), we tell you by email thirty days before the year is up, and when the year is up we delete the account, its transcripts, its SAP connection details and its reference notes. Records the law requires us to keep (contract and payment records for five years, and so on) are kept apart for that period only.

11.Your rights, and how to use them

As a data subject under the Act you may at any time:

• ask what we hold about you, and get a copy of it;
• have it corrected if it is wrong, or completed if it is partial;
• have it deleted, unless a statute requires us to keep it;
• tell us to stop processing it;
• withdraw a consent you gave, without penalty;
• receive a machine-readable export of what you supplied and what your Sessions produced.

How

Most of this is in the console: settings holds your account details and connection profiles, and any Session can be exported or deleted from where it is listed. You can delete your account at any time under “Delete account” in Settings, confirming with your password (or, for an account made through Google, your e-mail address); your personal information is then destroyed at once, except records the law requires us to keep, for that period only. For anything else, write to sc4sap.dev@gmail.com. We answer within ten days of receiving a request, as the Act requires, and we tell you the reason in writing if we cannot act on it — along with how to object.

We verify identity before acting, to stop someone else exercising your rights for you. A legal representative or an agent may act for you on production of the authority the Act’s enforcement rules prescribe. A child under fourteen must have a legal representative’s consent, and we do not knowingly open accounts for children.

Requests about material inside your SAP content go to the controller of that system — your organisation. If one reaches us directly, we pass it on rather than acting alone.

12.Automated decisions

The Service does not make automated decisions that produce legal effects for you or significantly affect you. The model generates answers and drafts; it does not decide anything about a person.

Where that ever changes we will say so here first, explain the logic and the criteria in plain terms, and give you the Act’s rights to refuse the decision and to ask for an explanation and a review by a human.

13.How we protect it

We take the administrative, technical and physical measures the Act requires, including:

• an internal management plan, access rules, and periodic staff training;
• access limited to the minimum number of people, granted by role, reviewed regularly, and revoked immediately when someone leaves;
• encryption in transit for everything, and encryption at rest for passwords and SAP credentials — passwords as a one-way salted hash that we cannot reverse;
• access logs retained and reviewed so unauthorised use can be traced;
• intrusion prevention, vulnerability management and patching on the systems that run the Service;
• physical controls at the data centres our hosting provider operates.

No safeguard is absolute. If a breach affects your personal information we will notify you and the Protection Commission without delay, in the form and within the time the Act sets, and tell you what happened, what was affected and what to do about it.

14.Cookies and similar technologies

We use cookies and browser storage only for what the Service needs to work: keeping you signed in, remembering which session or skill you had open, and holding your language and rail preference. There is no advertising cookie and no third-party tracker on the console.

You can refuse or delete cookies in your browser settings. Refusing the session cookie means you cannot stay signed in.

15.Privacy officer and where to write

We have designated a privacy officer responsible for handling personal information, for your requests, and for complaints and remedies arising from our processing.

• Privacy officer — 【privacy officer’s name】 (【title】)
• Phone — 【privacy officer’s phone】
• Email — sc4sap.dev@gmail.com
• Security reports — sc4sap.dev@gmail.com

Write to us first about anything in this policy. We answer without delay, and within the periods the Act sets.

16.If you are not satisfied

You can take a complaint to any of these bodies, independently of us:

• Personal Information Dispute Mediation Committee — 1833-6972, kopico.go.kr
• Personal Information Infringement Report Centre (Korea Internet & Security Agency) — 118, privacy.kisa.or.kr
• Supreme Prosecutors’ Office — 1301, spo.go.kr
• National Police Agency cybercrime bureau — 182, ecrm.police.go.kr

Under the Act you may also seek an administrative appeal against a disposition or omission by a public authority in respect of your rights.

17.Changes to this policy

We update this policy when the Service or the law changes. We post the new version here with its effective date and keep the previous versions available.

For a change that matters to you — a new purpose, a new subprocessor, a new recipient overseas, or a longer retention period — we give notice in the console or by email at least seven days before it takes effect, and thirty days where the Act requires it. Where a change needs your consent, we ask for it rather than assuming it.

This policy is written in Korean. Where the English or Japanese translation differs from it, the Korean text governs.