Consent for Cross-Border Transfer of Personal Information¶
This document is provided for users in the Republic of Korea in accordance with the Personal Information Protection Act (PIPA).
AI Castle Inc. ("Company") transfers your personal information to entities located outside the Republic of Korea as described below. Please review the details carefully.
1. Transfers Subject to Consent (Third-Party Provision)¶
| Recipient | Country | Items Transferred | Purpose | Method | Retention Period |
|---|---|---|---|---|---|
| OpenAI, L.L.C. | United States | Chat messages and attached images, conversation summarization input, AI response text for speech synthesis (TTS), realtime voice sessions (audio, text, images) | GPT-series response generation, TTS, realtime voice conversation | Encrypted transmission via API | Real-time processing; per OpenAI's API data policy (up to 30 days for abuse monitoring) |
| Google LLC | United States | Chat messages and attached images, realtime voice sessions (audio, text) | Gemini-series response generation, realtime voice conversation | Encrypted transmission via API | Real-time processing; per Google's API data policy |
| Anthropic, PBC | United States | Chat messages and attached images | Claude-series response generation | Encrypted transmission via API | Real-time processing; per Anthropic's API data policy |
| Paddle.com Market Limited | United Kingdom / United States | Purchase amount, user ID, client IP address at checkout (payment method details are collected directly by Paddle) | Payment processing as merchant of record, tax handling, invoicing | Encrypted transmission via API at the time of purchase | Per Paddle's policy and applicable e-commerce/tax laws |
2. Transfers for Entrustment and Storage (Disclosed per Article 28-8(1)3 of PIPA)¶
The following transfers occur for processing entrustment and storage necessary to perform our service contract with you. They are disclosed here and in our Privacy Policy in lieu of separate consent, as permitted by PIPA:
| Recipient | Country | Items Transferred | Entrusted Work | Method | Retention Period |
|---|---|---|---|---|---|
| Cloudflare, Inc. | United States (primary); global edge network | All data processed through the platform (account information, chat data, session data, stored files) | Platform hosting, CDN, data storage (D1, KV, R2), AI request routing (AI Gateway), on-platform AI inference (Workers AI), bot prevention (Turnstile), security | Encrypted transmission and storage across global infrastructure | Per the retention periods in our Privacy Policy |
| Resend, Inc. | United States | Email address | Transactional email delivery (verification, password reset, notifications) | Encrypted transmission via API | Duration of email delivery |
| Amazon Web Services, Inc. | Republic of Korea (Seoul region, prioritized for users in Korea); Japan (Tokyo); United States | Simulator workspace data (volumes, images, snapshots), email address included in resource tags | Cloud simulator hosting (EC2) and workspace storage | Encrypted transmission and storage in the assigned region | Until simulator deletion; fully deleted after 30 days without use |
Data Protection Measures¶
The Company implements the following measures to protect your personal information during cross-border transfers:
- Encryption in Transit: All data is transmitted using TLS/HTTPS encryption.
- Encryption at Rest: Stored data is encrypted at rest where supported by the infrastructure provider.
- Access Controls: Access to personal information is restricted to authorized personnel and systems.
- Contractual Safeguards: We maintain data processing agreements with each provider that include obligations regarding data protection.
- Security Standards: Our providers maintain industry-standard security certifications and practices.
Contact Information of Recipients¶
| Recipient | Contact | Website |
|---|---|---|
| OpenAI, L.L.C. | privacy@openai.com | openai.com |
| Google LLC | Privacy inquiry form | policies.google.com/privacy |
| Anthropic, PBC | privacy@anthropic.com | anthropic.com |
| Paddle.com Market Limited | privacy@paddle.com | paddle.com |
| Cloudflare, Inc. | privacyquestions@cloudflare.com | cloudflare.com |
| Resend, Inc. | privacy@resend.com | resend.com |
| Amazon Web Services, Inc. | Privacy inquiry form | aws.amazon.com/privacy |
Right to Refuse and Consequences¶
You have the right to refuse consent for the cross-border transfers in Section 1. However, if you refuse:
- AI model providers (OpenAI, Google, Anthropic): AI features (chat, TTS, realtime voice) will not be available; as these are the core of the Service, you will not be able to use the Service in any meaningful way.
- Paddle: You will not be able to purchase credits. (No transfer occurs unless you make a purchase.)
The transfers in Section 2 are made for contract performance (entrustment and storage) and are subject to disclosure rather than consent; they are essential infrastructure, so the Service cannot be provided without them.
Effective Date: July 29, 2026
For questions about this consent, please contact support@physicar.ai.
