Privacy Policy

Effective: 2026-04-30 · Bilingual (EN / KO) · Multi-jurisdiction notices

Smilestory Co., Ltd. operates assess.smilestory.ai, a self-serve AI compliance assessment SaaS. This policy explains what data we collect, why, and how we comply with GDPR (EU), CCPA/CPRA (California), and APPI (Japan).

1. Data we collect (EN)

Diagnosis answers you submit via the 12 assessment forms
Email address & company name when you request a paid report
Order and payment status from Paddle.com, our Merchant of Record (Paddle handles card data — we never see it)
Server logs: IP address, user agent, timestamps (30-day retention)

1. 수집 정보 (KO)

12개 진단 폼에 입력하신 답변
유료 보고서 요청 시 이메일 · 회사명
판매 대행사(Merchant of Record) Paddle.com의 주문·결제 상태 (카드 정보는 Paddle이 직접 처리)
서버 로그: IP, 브라우저 정보, 시각 (30일 보존)

2. How we use it

To generate your compliance report, deliver the PDF, send admin alerts (Telegram), and improve the diagnostic models in aggregate, anonymized form. We never sell your data.

Controller: Smilestory Co., Ltd. (주식회사 스마일스토리) · wiasoom@smilestory.ai
Legal basis: Article 6(1)(b) (contract performance — generating your report) and 6(1)(f) (legitimate interest — service security).
Your rights: access, rectification, erasure, restriction, data portability, objection, and withdrawal of consent. Contact the DPO above.
Cross-border transfers: data may be processed in the Republic of Korea. We use the EU-approved Standard Contractual Clauses (SCC) for transfers outside the EEA.
Retention: diagnosis answers 30 days; aggregate, anonymized statistics indefinitely.
Lodge a complaint: your local supervisory authority (e.g., CNIL, BfDI).

USCCPA / CPRA Notice (California)

"Do Not Sell or Share My Personal Information": we do not sell or share personal information for cross-context behavioral advertising. No action is required, but you may still confirm by emailing wiasoom@smilestory.ai.
Categories collected: identifiers (email), commercial information (purchase), internet activity (logs).
Your rights: right to know, delete, correct, limit use of sensitive PI, and non-discrimination.

JPAPPI Notice (Japan)

事業者: Smilestory Co., Ltd.（株式会社スマイルストーリー）
利用目的: AI コンプライアンス診断レポートの生成・配信、サービス改善。
第三者提供・国外移転: 大韓民国(韓国)で処理されます。同意の撤回・開示・訂正・削除請求は wiasoom@smilestory.ai までお問い合わせください。

3. Cookies

We use only strictly necessary cookies (session, language preference, cart). No advertising trackers.

4. Contact