Consent for Cross-Border Transfer of Personal Information¶
This document is provided for users in the Republic of Korea in accordance with the Personal Information Protection Act (PIPA).
AI Castle Inc. ("Company") transfers your personal information to entities located outside the Republic of Korea as described below. Please review the details carefully.
1. Transfers Subject to Consent (Third-Party Provision)¶
| Recipient | Country | Items Transferred | Purpose | Method | Retention Period |
|---|---|---|---|---|---|
| OpenAI, L.L.C. | United States | Chat messages and attached images, conversation summarization input, AI response text for speech synthesis (TTS), realtime voice sessions (audio, text, images) | GPT-series response generation, TTS, realtime voice conversation | Encrypted transmission via API | Real-time processing; per OpenAI's API data policy (up to 30 days for abuse monitoring) |
| Google LLC | United States | Chat messages and attached images, realtime voice sessions (audio, text) | Gemini-series response generation, realtime voice conversation | Encrypted transmission via API | Real-time processing; per Google's API data policy |
| Anthropic, PBC | United States | Chat messages and attached images | Claude-series response generation | Encrypted transmission via API | Real-time processing; per Anthropic's API data policy |
| Paddle.com Market Limited | United Kingdom / United States | Purchase amount, user ID, client IP address at checkout (payment method details are collected directly by Paddle) | Payment processing as merchant of record, tax handling, invoicing | Encrypted transmission via API at the time of purchase | Per Paddle's policy and applicable e-commerce/tax laws |
Images and text of worlds you publish are also sent to the AI providers above (United States) for automated content review.
2. Transfers for Entrustment and Storage (Disclosed per Article 28-8(1)3 of PIPA)¶
The following transfers occur for processing entrustment and storage necessary to perform our service contract with you. They are disclosed here and in our Privacy Policy in lieu of separate consent, as permitted by PIPA:
| Recipient | Country | Items Transferred | Entrusted Work | Method | Retention Period |
|---|---|---|---|---|---|
| Cloudflare, Inc. | United States | All data processed through the platform (account information, chat data, session data, stored files, published worlds) | Platform hosting, data storage, AI request routing and running of some AI models, bot prevention, security, storage and public delivery of published worlds | Encrypted transmission and storage | Per the retention periods in our Privacy Policy |
| Resend, Inc. | United States | Email address | Transactional email delivery (verification, password reset, notifications) | Encrypted transmission via API | Duration of email delivery |
| Amazon Web Services, Inc. | Republic of Korea, Japan, United States | Simulator workspaces, email address for operational identification, league submissions | Running cloud simulators and league evaluation servers, workspace storage | Encrypted transmission and storage | Until simulator deletion; fully deleted after 30 days without use |
Data Protection Measures¶
The Company implements the following measures to protect your personal information during cross-border transfers:
- Encryption in Transit: All data is transmitted using TLS/HTTPS encryption.
- Encryption at Rest: Stored data is encrypted at rest where supported by the infrastructure provider.
- Access Controls: Access to personal information is restricted to authorized personnel and systems.
- Contractual Safeguards: We maintain data processing agreements with each provider that include obligations regarding data protection.
- Security Standards: Our providers maintain industry-standard security certifications and practices.
Contact Information of Recipients¶
| Recipient | Contact | Website |
|---|---|---|
| OpenAI, L.L.C. | privacy@openai.com | openai.com |
| Google LLC | Privacy inquiry form | policies.google.com/privacy |
| Anthropic, PBC | privacy@anthropic.com | anthropic.com |
| Paddle.com Market Limited | privacy@paddle.com | paddle.com |
| Cloudflare, Inc. | privacyquestions@cloudflare.com | cloudflare.com |
| Resend, Inc. | privacy@resend.com | resend.com |
| Amazon Web Services, Inc. | Privacy inquiry form | aws.amazon.com/privacy |
Right to Refuse and Consequences¶
You have the right to refuse consent for the cross-border transfers in Section 1. However, if you refuse:
- AI model providers (OpenAI, Google, Anthropic): AI features (chat, TTS, realtime voice) will not be available; as these are the core of the Service, you will not be able to use the Service in any meaningful way.
- Paddle: You will not be able to purchase credits. (No transfer occurs unless you make a purchase.)
The transfers in Section 2 are made for contract performance (entrustment and storage) and are subject to disclosure rather than consent; they are essential infrastructure, so the Service cannot be provided without them.
Effective Date: July 29, 2026
For questions about this consent, please contact support@physicar.ai.
