Privacy Policy

1. Information We Collect

• GitHub account identifiers — your GitHub user ID and username, provided when you authorize the connection through GitHub login. Used to identify you and map access to your own repository only.
• GitHub App installation information — the installation ID and the owner and name of the repository the Service creates for you. Used to issue repository access tokens.
• Subscription and connection status — your plan, and status such as trial, active, or canceled, needed to operate the Service.
• Email address — provided at sign-up. Used to send onboarding messages and to deliver the skill file. If you separately opt in to marketing communications, we also use it to send product updates and tips; you can withdraw that consent at any time.
• Payment identifiers — if you subscribe to a paid plan, payment method identifiers and transaction records are processed by our payment processor. See Section 3.

We do not collect your GitHub password or personal access token (PAT). The original content of your Notes and files remains entirely in your own GitHub repository. For response speed, a temporary copy of Note content and its search index may be held on our servers (Cloudflare) for up to 10 minutes before automatic deletion. In addition, so that when you search again ("not that one, the other one") we can keep showing the candidates you already saw, we keep the paths (file locations) of the Notes in your recent search results and the times of those searches and views for up to 10 minutes before automatic deletion. This record contains no Note content. Both the temporary copy and this record are isolated per account and are not shared with other users.

We also collect usage-flow analytics (PostHog) to improve the Service. We do not collect the content of your Notes for analytics, but this may include your IP address, browser identifier, device information, and page-navigation history. We use this data only to understand where users drop off in the product flow.

In the course of operating the Service, we automatically generate and collect usage records (save, edit, and delete counts and dates), the timezone your browser reports, and connection logs. We use your timezone to display the correct date on your Notes.

2. How We Use Your Information

• To identify you and provide a secure connection to your own repository
• To authenticate MCP access on claude.ai (delegated login) and relay read/write requests to your repository
• To manage your subscription and respond to support inquiries
• To process payments and refunds through our payment processor

3. Service Providers and Third Parties

We use the following providers to operate the Service:

• GitHub — where your repository is stored (in your own account).
• Cloudflare — hosts the connection-relay server and the subscription metadata database.
• Anthropic (claude.ai) — the platform you connect MCP to directly. The connection is established only with your authorization.
• Resend — sends onboarding and skill-delivery emails.
• Polar Software Inc. ("Polar") — our Merchant of Record for international (USD) payments. Polar is the seller and payee of record for USD transactions, processes your payment method details and transaction data, calculates and remits applicable sales tax or VAT, and may contact you directly regarding your USD transaction, including receipts and support inquiries it forwards to us.
• PortOne and its connected payment gateway (KG Inicis) — for customers billed in Korean Won, PortOne registers your payment method, processes recurring charges, and handles cancellations and refunds for domestic transactions. We do not store your full card number ourselves.

We do not sell or share your information with third parties beyond the purposes listed above.

International transfers of personal information.

Because of how our infrastructure is built, the information below is transferred to and processed by providers outside the Republic of Korea. If you do not want your information transferred internationally, you can remove the Service's GitHub App installation to stop the transfer; doing so will limit your ability to use the Service.

• GitHub, Inc. (United States) — Items transferred: GitHub user ID, username, installation info — Purpose: Repository connection and authentication — Retention: Duration of use — Transfer method: Network transmission during use — Contact: support.github.com
• Cloudflare, Inc. (United States) — Items transferred: Connection session and subscription metadata; temporary copy of Note content and search index; paths and times of recent search results (each auto-deleted within 10 minutes) — Purpose: Relay server and database operation — Retention: Duration of use (temporary copy: up to 10 minutes) — Transfer method: Network transmission — Contact: cloudflare.com/trust-hub
• Vercel, Inc. (United States) — Items transferred: IP address, browser information — Purpose: Hosting the website (landing, onboarding, dashboard) — Retention: Duration of use — Transfer method: Network transmission — Contact: vercel.com/legal/privacy-policy
• PostHog, Inc. (United States) — Items transferred: IP address, browser identifier, device information, page-navigation history — Purpose: Usage analytics to improve the Service — Retention: Duration of use — Transfer method: Network transmission — Contact: posthog.com/privacy
• Resend (United States) — Items transferred: Email address — Purpose: Onboarding and skill-delivery emails — Retention: Duration of use, or until marketing consent is withdrawn — Transfer method: Network transmission — Contact: resend.com
• Polar Software Inc. (United States) — Items transferred: Payment method identifiers, transaction and billing data, email address (for receipts) — Purpose: Payment processing as Merchant of Record for USD transactions — Retention: Duration of use, and as required for tax and financial recordkeeping — Transfer method: Network transmission during checkout and billing — Contact: polar.sh

4. Data Retention and Deletion

• Subscription and connection metadata (tenant record)— retained for the duration of your use, and deleted within 30 days of cancellation or a deletion request. Removing the GitHub App installation immediately stops the Service's access to your repository.
• Email and sign-up information — deleted within 30 days of cancellation or a deletion request.
• Marketing consent information — deleted immediately when you withdraw consent.
• Payment records — retained for 5 years, consistent with Korean e-commerce consumer protection recordkeeping requirements.
• Any other information subject to a legal retention obligation is kept only for the period that law requires.
• Canceling does not remove your repository or your Notes from your own GitHub account. You always own your data.

5. Your Rights

• You may request access to, correction of, or deletion of your information.
• You can revoke the Service's repository access at any time by removing the GitHub App installation in your GitHub settings.
• Disconnecting MCP stops claude.ai's automatic read and write access.

6. Additional Rights for EU/EEA and UK Residents (GDPR)

If you are located in the European Economic Area, the United Kingdom, or another jurisdiction with equivalent data protection law, you additionally have the right to: access your personal data; request correction or erasure; restrict or object to processing; request data portability; and lodge a complaint with your local data protection authority.

EU representative: We have not appointed a representative in the EU under Article 27 GDPR. EU or UK residents may contact us directly at kezilac.works@gmail.com for any data protection request.

7. Security

• Repository access uses only short-lived tokens that expire after 1 hour; we do not retain standing access or long-term secrets belonging to you.
• Connection authentication is protected by PKCE and signed tokens, with access scoped separately per user.

Breach notification.

If we become aware of the loss, theft, or unauthorized disclosure of personal information, we will notify affected users without undue delay, within the timeframe required by applicable law, including the items disclosed, the time and circumstances of the incident, steps you can take, and our response measures. Where required by applicable law, we will also report the incident to the Personal Information Protection Commission or the Korea Internet & Security Agency (KISA) without delay.

8. Children's Privacy

The Service is intended for users aged 14 and older.

9. Changes to This Policy

We may update this policy from time to time. Material changes will be posted on this page with an updated effective date.

10. Data Protection Contact / Company Information

• Business name (brand): kez-works (케즈웍스)
• Data protection contact: JIN HA RIN, representative of kez-works
• Business registration number: 552-45-01234
• E-commerce registration no.: 2026-Suwon Yeongtong-1184 (Yeongtong-gu, Suwon-si)
• Business address: #460, 46, Edu town-ro 106beon-gil, Yeongtong-gu, Suwon-si, Gyeonggi-do 16509, Republic of Korea
• Phone: +82-10-9108-7714
• Email: kezilac.works@gmail.com

11. Contact

Questions about this policy may be sent to kezilac.works@gmail.com.