DocSleuth Privacy Policy

JinsongTech (진송테크, “we”, “us”) publishes this Privacy Policy in accordance with Article 30 of the Personal Information Protection Act of the Republic of Korea (PIPA) to protect personal information and to handle related requests promptly.

1. Scope

This policy applies to the DocSleuth desktop application for macOS and Windows (the “app”), the website at docsleuth.jinsongtech.com (the “website”), and customer support provided by email. Services operated by others, such as the Apple App Store and Microsoft Store, are governed by their own privacy policies.

2. Purposes, data processed and retention

We process personal information only for the following purposes. If a purpose changes, we will take the necessary steps, such as obtaining separate consent, in accordance with Article 18 of the Personal Information Protection Act (PIPA).

Records of the Pro contract, payment and supply are kept by Apple or Microsoft, which process the payment; we neither receive nor keep them. We keep the records listed in the table above that the law requires us to retain separately from other personal information, and delete them under section 10 when the retention period ends.

We use information you send us only as needed to handle your enquiry. Diagnostic files may contain environment details or file paths, so please review them before sending.

3. Data that stays on your device

The app stores the following on your device. It is not transmitted to us and we cannot access it, so we cannot view, correct or delete it for you; you can delete it yourself (see Support).

Crash-report files mask your home-folder path. The error-reporting setting is off by default, and even when it is on, nothing is sent automatically.

4. Network connections made by the app

Searching does not require a network connection. The connections below are the only ones the app makes, and none of them passes through our servers.

4.1 Downloading the built-in semantic-search model

• When: if semantic search is enabled and the model is not yet on your device, it is downloaded automatically when indexing starts. Choosing “disable semantic search” in Settings prevents the download.
• From: the public model hub operated by Hugging Face, Inc. (United States) at huggingface.co.
• What: EmbeddingGemma 2 (q4) or multilingual-e5-small (int8) model files at a fixed, pinned revision; the app verifies each file’s size and SHA-256 hash.
• Information exchanged: the file request and the network information needed to serve it, such as IP address, time and client details. No document content, file names or queries.
• Who processes it: Hugging Face, under its own privacy policy. We do not receive it.

4.2 Hugging Face models you add

If you add a model by entering a Hugging Face repository in Settings, the app contacts huggingface.co to look up and download it. The information exchanged is as in 4.1. Embedding with that model runs on your device.

4.3 External embedding APIs you register (optional)

You may register an OpenAI-compatible embedding server of your choice (for example your organisation’s server or a cloud API). The feature is off by default and works only when all of the following hold:

• You register the server and activate it yourself; the app never switches to a remote server on its own.
• Servers outside your device must use https:// (http:// is allowed only for a server on the same device). Redirects are not followed and system proxy settings are ignored, so data does not go anywhere other than the server you approved.
• For each server address (origin) you must approve the transfer in an operating-system dialog, not just inside the app. The app re-checks consent before every request.

What is sent: text excerpts extracted from documents you index, your search queries, sample text used to check the connection when you register, and the API key you entered (for authentication).
Recipient: the operator of the server you specified. We are not involved in this transfer, do not receive its contents and cannot control how that server stores or uses data; its own terms and privacy policy apply.
Please note: before using this feature on folders containing other people’s personal information or your organisation’s documents, check that the transfer is permitted by your or your organisation’s policies and applicable law.
How to stop: revoke consent for the server in Settings and transfers stop immediately. Deleting the registered model also deletes its API key from the secure store.

4.4 Other connections

• Installation and updates are handled by the Mac App Store or Microsoft Store.
• The Korean morphological dictionary is bundled with the app and is not downloaded.
• OCR runs on-device using the operating system’s built-in engine.

5. Purchases and payment

Paid sales have not started. Once they do, Pro will be offered as an in-app purchase through the Apple App Store or Microsoft Store.

• Payments are processed by Apple Inc. or Microsoft Corporation under their own terms and privacy policies. We do not receive card numbers or other payment details, or buyers’ names and account emails. Purchase details and bank account details that you send us yourself for a withdrawal or refund are handled under section 2.
• The app checks purchase status on your device using the store frameworks provided by the operating system (StoreKit, Windows Store APIs). Receipt and licence information is not sent to us.
• We may receive aggregated sales reports that stores provide to developers; we do not use them to identify individual buyers.

6. Website

• The website consists of static pages only. It has no sign-up, no forms, no cookies, no analytics, no advertising and loads no third-party fonts or scripts.
• It is served from Amazon Web Services storage (S3) via the CloudFront content delivery network. Network information such as IP addresses is processed in transit to deliver pages, but we have not enabled CloudFront access logging (standard logging) and we keep no visit logs.
• If you contact us using an email link on the website, section 2 applies.

7. Disclosure to third parties

We process personal information only within the purposes in section 2 and do not provide it to third parties except with your consent or where permitted by law (PIPA Articles 17 and 18). We do not sell or rent personal information. Transfers to an external embedding API under section 4.3 happen directly from your device to a server you chose; they are not a disclosure of information we hold.

8. Processors

For Amazon Web Services, the matters required by PIPA Article 26 — including processing only for the entrusted purpose, security measures and restrictions on sub-processing — are set out in writing in its standard data processing addendum (DPA), and we supervise that it processes personal information securely. Changes to processors will be announced through this policy.

In addition, we use Google LLC’s email service (Gmail, United States) to receive and answer support enquiries, and in the process personal information contained in support emails is stored on Google’s servers. The resulting international transfer is described in section 9.

9. International transfers

We use Google LLC’s email service (Gmail, United States) to receive and answer support enquiries, and in the process personal information contained in support emails is stored on Google’s servers. This is a transfer abroad under PIPA Article 28-8(1)(3) (entrustment and storage necessary to conclude and perform a contract with you), and the matters required by Article 28-8(2) are as follows.

In addition, AWS CloudFront may deliver the website through edge locations near you, including outside Korea, and network information such as IP addresses is processed there transiently (we do not store it).

The following are not transfers by us but direct connections between your device and providers abroad, listed for transparency:

10. Deletion

• When personal information is no longer needed — for example when the retention period ends — we delete it without delay (within five days absent a legitimate reason).
• Information we must keep under other laws is stored in a separate storage location kept apart from other data (encrypted storage) and, when the retention period ends, permanently deleted in a way that cannot be restored.
• Electronic files are permanently deleted in a way that prevents recovery (including emptying mail trash); paper records are shredded or incinerated.
• Data on your device (section 3) is not held by us; you can delete it by removing the app data folder (how to).

11. Your rights and how to exercise them

• You may at any time request access to, correction or deletion of, or suspension of processing of your personal information, and withdraw consent (PIPA Articles 35–37).
• Send requests by email to wjstkddyd420@gmail.com or in writing. We will act within 10 days of receipt and tell you the outcome.
• A legal representative or an authorised agent may act on your behalf; in that case a power of attorney in the form required by the Notice on Methods of Processing Personal Information (개인정보 처리 방법에 관한 고시) must be submitted.
• We may verify the identity of the requester and may limit or refuse a request on grounds set out in law, in which case we will tell you why.
• Personal information that other laws designate for collection cannot be deleted on request.

12. Children

The app and website require no registration, so we do not collect age information. We do not knowingly collect personal information from children under 14. A child under 14 who wishes to contact us should do so through a legal guardian. If we learn that we have received such information without guardian consent, we will delete it without delay.

13. Security measures

In accordance with Article 29 of PIPA, we take the following measures.

• Administrative: only the representative handles personal information; information is deleted as described in section 10.
• Technical: access to the support mailbox is restricted and protected by authentication; the website is served over HTTPS only.
• By design: the app is built not to send documents off the device and allows external transfers only to servers you explicitly approve; API keys are kept only in the operating system’s secure store; crash reports mask user paths.
• Physical: devices and papers containing personal information are kept locked.

14. Cookies and similar technologies

The website does not set cookies or use web beacons, analytics or other automatic collection tools. The app uses no advertising identifiers or tracking technologies; settings are kept in storage on your device and are not transmitted. You can control cookies in your browser settings in any case. Because neither the website nor the app tracks you, we treat every user as if a Do Not Track signal had been sent, whatever your browser’s Do Not Track setting.

15. Automated decisions

We do not make fully automated decisions that have legal or similarly significant effects on you. Search ranking is computed on your device from the relevance of documents to your query and is not used by us to evaluate anyone.

16. Privacy officer

17. Remedies

You may seek dispute resolution or advice regarding privacy infringements from the following Korean bodies:

18. Additional information for users in the EEA and the UK

If you are in the European Economic Area or the United Kingdom, the following applies in addition under the General Data Protection Regulation (GDPR) and the UK GDPR. The controller is JinsongTech, contactable as in section 16.

• Legal bases (GDPR Article 6(1)): answering enquiries and handling withdrawal and refund requests is necessary to perform a contract with you or to take steps at your request (point (b)); keeping withdrawal, refund, complaint and dispute records is necessary to comply with a legal obligation (point (c)); keeping a record of support handling serves our legitimate interests in resolving recurring issues and in establishing or defending legal claims (point (f)).
• Your rights: you may request access, rectification, erasure, restriction of processing and data portability, and object to processing based on legitimate interests, as described in section 11. You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the country where you live or work or where the alleged infringement took place (in the UK, the Information Commissioner’s Office).
• International transfers: we are established in the Republic of Korea, for which the European Commission adopted an adequacy decision in December 2021 (the UK adopted adequacy regulations for Korea in 2022). Transfers to our processor in the United States, Amazon Web Services, Inc., rely on the European Commission’s Standard Contractual Clauses included in its data processing terms (with the UK Addendum) or on its certification under the EU-U.S. Data Privacy Framework (and its UK Extension); transfers resulting from storing support email with Google LLC (Gmail) rely on Google LLC’s certification under the EU-U.S. Data Privacy Framework (and its UK Extension).

19. Changes to this policy

• This policy takes effect on 1 November 2026 and replaces the draft dated 16 May 2026 (version 1.0).
• We will announce changes on the website at least 7 days before they take effect, or at least 30 days before for material changes to your rights such as new data items, purposes or disclosures.

This document may be revised following legal review; changes will be announced as described above. · 한국어 원문 — If the Korean and English versions differ, the Korean version prevails for users resident in the Republic of Korea and the English version prevails for all other users.