Privacy Policy
주식회사 영올리버 (the “Company”) complies with the Personal Information Protection Act of Korea and related laws, and processes the personal information of those who use the Lawtology service (the “Service”) as follows.
1. The Company's role
The Company processes personal information in two roles.
- Controller: account information and usage records of lawyers and staff who use the Service (“Users”), and information from inquiries.
- Processor: personal information of clients, opposing parties and others contained in material Users upload or enter for case work (“Case Material”). The purpose and scope of processing Case Material are determined by the User's law firm (the “Firm”), and the Company processes it only as needed to provide the Service on the Firm's behalf.
2. Information processed and purposes
| Category | Items | Purpose |
|---|---|---|
| Sign-up and account | Name, email, password (stored encrypted), firm | Identification, account management, inviting firm members |
| Service use | IP address, access times, session data, activity records (confirmations, edits, filings) | Security, abuse prevention, audit records |
| Case Material | Information in documents, recordings, messages, spreadsheets and other material Users upload or enter | Organizing facts, managing issues and evidence, drafting, and other Service features |
| Inquiries | Email address, name and firm (if given), inquiry content | Responding to inquiries and sales consultations |
The Company does not provide Case Material to other firms and does not use it to train AI models.
3. Retention period
- Account information: until the account is closed, then destroyed without delay.
- Case Material: for the term of the Firm's contract. After the contract ends, it is kept for 30 days so the Firm can export it, then destroyed. It is destroyed earlier at the Firm's request.
- Service access logs (IP address, access times): 3 months (Protection of Communications Secrets Act, Article 15-2; Enforcement Decree, Article 41)
- Processing-system access logs (including activity records): 2 years (Standards for Ensuring the Safety of Personal Information, Article 8; applied because Case Material may contain unique identifiers or sensitive information)
- Contract and billing records: 5 years (Framework Act on National Taxes, Article 85-3)
- Inquiries: 1 year after the inquiry is handled
- Where another law sets a retention period, information is kept for that period.
4. Provision to third parties
The Company does not provide personal information to third parties except with the data subject's consent or where required by law.
5. Outsourcing
The Company entrusts the following processing to provide the Service (Personal Information Protection Act, Article 26).
| Processor | Task |
|---|---|
| Oracle Corporation (Oracle Cloud Infrastructure, Korea region) | Operating servers and storage for the Service. Data is stored in Korea |
| Anthropic PBC | Analyzing Case Material (extracting facts, assisting with drafts) |
| Cloudflare, Inc. | Encrypted transport and security (attack mitigation) for access to the Service |
| Google LLC (Google Workspace) | Sending invitation and notification emails |
6. Transfers outside Korea
In entrusting processing to perform the service contract, the Company transfers personal information abroad as follows (Personal Information Protection Act, Article 28-8(1)(iii)(a)).
| Recipient (contact) | Country | Items | Purpose | Retention |
|---|---|---|---|---|
| Anthropic PBC (privacy@anthropic.com) | United States | Text of Case Material that needs analysis | Extracting facts, assisting with drafts | Automatically deleted within 30 days of receipt or generation; up to 2 years if flagged for a usage policy violation. Not used to train models (Anthropic retention policy, Commercial Terms) |
| Cloudflare, Inc. (privacyquestions@cloudflare.com) | United States (via the Cloudflare data center nearest the user) | Information exchanged while using the Service | Encrypted transport, security | While the traffic is processed; logs per the Cloudflare Privacy Policy |
| Google LLC (support.google.com/policies) | United States and other countries with Google data centers | User name, email address, email content | Sending invitation and notification emails | Until deleted by the Company; otherwise per the Google Privacy Policy |
When and how: sent over encrypted connections whenever needed while the Service is used.
How to refuse, procedure and effect: to refuse the transfer, write to contact@lawtology.com. Because these providers are needed to deliver the Service, refusing may limit AI analysis or other features, or use of the Service.
7. Destruction
Personal information is destroyed without delay once its retention period ends or its purpose is achieved. Electronic files are deleted so they cannot be recovered; paper documents are shredded or incinerated.
8. Security measures
- Encryption in transit and one-way encryption of passwords
- Separate storage per firm and access control
- Retention and review of access and activity logs
- Protection of uploaded originals against modification
- Minimizing and training staff who handle personal information
9. Data subjects' rights
Data subjects may request access to, correction or deletion of, or suspension of processing of their personal information at any time by writing to contact@lawtology.com. Requests about personal information in Case Material may be made to the Firm that manages it, or sent to the Company, which will forward them to the Firm.
10. Cookies
The Service uses only essential cookies to keep users signed in. This website (lawtology.com) uses no cookies or analytics tools.
11. Privacy officer
| Name | 정진교 (Jeong Jin-gyo) |
|---|---|
| Title | CEO |
| Contact | contact@lawtology.com |
12. Remedies
- Personal Information Infringement Report Center: 118 (privacy.kisa.or.kr)
- Personal Information Dispute Mediation Committee: 1833-6972 (www.kopico.go.kr)
- Supreme Prosecutors' Office: 1301 (www.spo.go.kr)
- Korean National Police Agency: 182 (ecrm.police.go.kr)
13. Changes
Changes to this policy are announced on this page and in the Service 7 days before they take effect, or 30 days before for changes that materially affect users' rights.