Privacy Policy (English)
Effective: 2026-10-10 · Controller: Ganachain (sole proprietor, Republic of Korea; the "Company") · Service: ahro · Contact: admin@ganachain.xyz
Article 1 (General provisions)
- This policy explains for what purposes, which items, for how long and through whom the Company processes users' personal information in the service "ahro" that it runs at
ahro.aiand its subdomains, and what rights users have. - The Company does not sell or rent personal information and does not use it for purposes not stated in this policy.
- The Service is intended for persons aged 19 or older, and if the Company learns that personal information of a child under 14 has been collected, it destroys it without delay.
Article 2 (Purposes of processing personal information)
The Company processes personal information only for the following purposes, and if a purpose changes it takes the steps the applicable law requires, such as obtaining separate consent.
- Creating accounts, keeping users signed in and verifying identity
- Performing the jobs users request and delivering the results
- Granting and deducting credits
- Securing the Service and preventing fraud and abuse
- Diagnosing and recovering from failures and errors
- Handling enquiries, complaints and disputes
- Complying with legal obligations
The Company does not use personal information for marketing, advertising, profiling or AI model training.
Article 3 (Items of personal information processed and how they are collected)
| Category | Items | How collected |
|---|---|---|
| Account | Google account identifier, email address | Received from Google at Google sign-in |
| Use of the Service | Files the user uploads and the results created, job instructions and conversation history, workspace names, external API keys the user registers, service usage records (request records, credit usage, error records) | Entered by the user or generated automatically while the Service is used |
| Enquiries | Email address, content of the enquiry | When the user sends an enquiry by email |
- Where files or instructions a user uploads contain personal information about the user or other people, that information is processed together as part of the Content.
- The Company does not request unique identification information or sensitive information.
- Information received through Google sign-in is used only to create the account and keep the user signed in; it is not used for advertising or passed to third parties beyond the outsourcing described in Article 6.
- The legal bases for processing are the conclusion and performance of the service agreement, compliance with legal obligations, and the Company's legitimate interest in securing the Service.
Article 4 (Retention period and destruction)
- The Company retains personal information while the account exists. Files a user deletes in the Service are deleted at that time.
- Request records and error records are kept for up to 90 days for security and failure handling and are then deleted.
- When the Company has confirmed a request to close an account, it destroys the personal information without delay. Information whose retention is required by law is kept separately for that period and then destroyed.
- Information in electronic files is deleted by a method that makes it unrecoverable.
Article 5 (Provision of personal information to third parties)
The Company does not provide users' personal information to third parties, except where the Personal Information Protection Act permits it, such as with the user's consent or where a law makes special provision.
Article 6 (Outsourcing and transfer abroad)
The Company outsources the following processing to run the Service, and all recipients are located outside the Republic of Korea. This transfer is outsourcing and storage needed to perform the service agreement, and the Company gives the following notice under Article 28-8 of the Personal Information Protection Act. Recipients process personal information only on the Company's instructions, and this table is updated when a recipient or an outsourced task changes.
| Recipient (contact) | Country | Outsourced task (purpose of transfer) | Items transferred | Timing and method | Retention and use period | How to refuse and effect |
|---|---|---|---|---|---|---|
Cloudflare, Inc. (www.cloudflare.com/privacypolicy/) | United States | Operating the Service and storing data | The account and use-of-the-Service items in Article 3 | Transmitted over an encrypted network when the Service is used | Until the purpose of outsourcing is achieved or the outsourcing contract ends | Stop using the Service or close the account; the Service then cannot be used |
Google LLC (policies.google.com/privacy) | United States | AI model processing | Job instructions and conversation content, files used in the job | Transmitted over an encrypted network when the Service is used | Until the purpose of outsourcing is achieved or the outsourcing contract ends | Stop using the Service or close the account; the Service then cannot be used |
Anthropic, PBC (www.anthropic.com/legal/privacy) | United States | AI model processing | Job instructions and conversation content, files used in the job | Transmitted over an encrypted network when the Service is used | Until the purpose of outsourcing is achieved or the outsourcing contract ends | Stop using the Service or close the account; the Service then cannot be used |
Microsoft Corporation (www.microsoft.com/en-us/privacy/privacystatement) | United States | Character recognition of document images | Files submitted for character recognition | Transmitted over an encrypted network when the Service is used | Until the purpose of outsourcing is achieved or the outsourcing contract ends | Stop using the Service or close the account; the Service then cannot be used |
Functional Software, Inc. (Sentry · sentry.io/privacy/) | United States | Error monitoring | Error information (error type and identifiers) | Transmitted over an encrypted network when the Service is used | Until the purpose of outsourcing is achieved or the outsourcing contract ends | Stop using the Service or close the account; the Service then cannot be used |
Article 7 (Measures to ensure the security of personal information)
The Company takes the following measures under Article 29 of the Personal Information Protection Act.
- Data is encrypted in transit and at rest.
- Access rights to personal information are limited to the minimum necessary and controlled.
- Access records of the personal information processing system are kept and reviewed.
- An internal management plan is established and implemented.
Article 8 (Installation, operation and refusal of automatic collection devices)
- The landing page (
ahro.ai) uses no cookies or browser storage. - The Service uses cookies and browser storage to keep you signed in and secure, and to remember display settings (theme, pane layout) and work screen state (open documents, conversion lists, the last opened workspace). Document content is not kept in browser storage, and no cookies are used for advertising or behavioural tracking.
- How to refuse: you can block or delete cookies and browser storage in your browser settings. If cookies are blocked, you cannot stay signed in and so cannot use the Service; if browser storage is blocked, display settings and work screen state are not remembered.
Article 9 (Rights of data subjects and how to exercise them)
- Users may at any time request access to, correction or deletion of, or suspension of processing of their personal information, or withdraw consent, and may also do so through a legal representative or an authorised agent.
- On a request to admin@ganachain.xyz, the Company confirms that the requester is the account holder, acts within 10 days of receiving the request and communicates the result. Where it refuses or limits a request, it also gives the reason and how to object.
- Deletion may be limited for information whose retention is required by other laws.
- Disconnecting ahro in your Google account does not close your ahro account. Please request account closure by the email above.
- The Company makes no automated decisions that affect users' rights or obligations without human involvement.
Article 10 (Privacy officer and remedies for infringement)
- Privacy officer: Ganachain representative Jaeho Choi · email admin@ganachain.xyz. Enquiries, complaints and requests for remedy concerning personal information are received at this contact.
- Users may apply for dispute resolution or counselling to the following bodies: Personal Information Dispute Mediation Committee (no area code) 1833-6972 ·
www.kopico.go.kr/ Personal Information Infringement Report Center (Korea Internet & Security Agency) (no area code) 118 ·privacy.kisa.or.kr/ Korean National Police Agency Cyber Crime Report (no area code) 182 ·ecrm.police.go.kr.
Article 11 (Changes to this Privacy Policy)
- When the Company changes this policy, it states the effective date and the changes and announces them on the initial screen of the Service from 7 days before the effective date. Changes that matter to users' rights, such as to the items processed, the purposes of processing, provision to third parties or transfer abroad, are announced from 30 days before the effective date and also notified to the account email, and consent is obtained where the law requires it.
- The business information of the controller is as shown in the table in the Supplementary Provisions of the Terms of Service.
- This policy takes effect on 2026-10-10 and replaces the previous policy (effective 2026-10-06).