Privacy Policy

Last Updated: July 26, 2026

Koreflow Inc. ("Koreflow," "we," "us," or "our") respects your privacy and is committed to protecting the personal data we collect. This Privacy Policy explains how we collect, use, disclose, and safeguard personal information when you visit our website at koreflow.com (the "Site"), interact with our marketing channels, apply to our Design Partner Program, or register for an account to evaluate or use our platform (the "Service").

1. Scope of This Policy

1.1 Website Visitors and Account Data

This Policy applies to personal data we collect as a business in our own right — from Site visitors, prospective customers, Design Partner Program applicants, and authorized administrators setting up or managing a Koreflow account.

1.2 Private Cloud, VPC, and Product Data

Data processed by or transmitted through the Koreflow platform inside a customer's own environment — including an on-premise or self-hosted Virtual Private Cloud (VPC) deployment on AWS, GCP, or Azure — is governed exclusively by the Master Services Agreement (MSA), Proof-of-Concept (POC) Agreement, or Data Processing Agreement (DPA) executed between Koreflow and that customer. This Policy does not apply to live prompt payloads, API keys, operational tokens, or other customer data processed within a customer's environment or under a DPA. If you are an end user of a Koreflow customer, please refer to that customer's own privacy policy; with respect to that data, Koreflow acts as a data processor or service provider on the customer's behalf, not as the party responsible for this Policy.

2. Information We Collect

We collect information directly from you, automatically through the Site, and from trusted third parties.

A. Information You Provide Directly

Contact & lead information: name, work email, phone number, company name, job title, and details submitted via contact forms, demo requests, or Design Partner Program applications.
Account administration data: usernames, role titles, and billing or contact metadata provided when configuring account access.
Communications: content of feedback, support tickets, or messages sent to our team.

B. Information Collected Automatically

When you browse the Site, we automatically collect limited technical information, including:

device type, operating system, and browser type;
IP address, approximate location, and internet service provider;
referring/exit pages and access timestamps, collected through our standard web hosting infrastructure.

C. Information from Third Parties

We may receive information about you from commercial partners, analytics providers, or public professional databases (such as LinkedIn) to help us qualify leads and evaluate enterprise fit.

3. How We Use Your Information

We use the information described above to:

operate, maintain, and improve the Site;
respond to inquiries, evaluate Design Partner applications, schedule demos, and send administrative notices;
detect, prevent, and investigate fraud, unauthorized access, or malicious activity; and
analyze marketing effectiveness and improve lead acquisition.

AI model training. Koreflow does not use, sell, or license personal data, user communications, Site interactions, or customer platform telemetry to train, fine-tune, prompt, or otherwise improve any internal or third-party artificial intelligence or machine learning model.

4. Cookies and Tracking Technologies

As of the Effective Date of this Policy, the Site uses only strictly necessary cookies required for basic functionality (for example, to maintain a login session); we do not currently use analytics, marketing, or advertising cookies. We anticipate introducing analytics tooling (such as Google Analytics or PostHog) in the near future. Before any non-essential cookie is set, we will update this Policy and, where required by law, present a cookie consent banner allowing you to accept or decline non-essential cookies, along with instructions for managing cookie preferences through your browser.

5. How We Share Information

We do not sell, rent, or trade your personal information. We disclose it only in the following circumstances:

Service providers: trusted vendors who perform services on our behalf (e.g., website hosting, email delivery, CRM, and, once introduced, analytics platforms), bound by confidentiality and data protection obligations.
Legal and regulatory compliance: where required by law, court order, or governmental request, or to protect the rights, safety, or property of Koreflow, our users, or the public.
Business transfers: in connection with a merger, acquisition, reorganization, or sale of assets, subject to standard confidentiality protections.

6. Data Security and Retention

6.1 Security Measures

We maintain administrative, technical, and physical safeguards designed to protect personal data against unauthorized access, loss, alteration, or disclosure. Data transmitted to and from the Site is encrypted in transit using TLS.

6.2 Data Retention

We retain personal information only as long as reasonably necessary to fulfill the purposes for which it was collected, comply with legal obligations, resolve disputes, and enforce our agreements.

7. Your Privacy Rights

Depending on your state of residence, you may have the right to:

Access: request a copy of the personal information we hold about you;
Correction: request correction of inaccurate or incomplete personal data;
Deletion: request deletion of your personal data, subject to certain legal exceptions;
Opt-out: opt out of marketing communications or, once introduced, non-essential tracking cookies; and
Non-discrimination: you will not receive discriminatory treatment for exercising any of these rights.

We do not sell or share personal information as those terms are defined under applicable state privacy laws, including the California Consumer Privacy Act / California Privacy Rights Act. To exercise any privacy right, contact us using the information in Section 11.

8. Children's Privacy

The Site and Service are intended for business use by individuals over the age of 18 and are not directed to children. We do not knowingly collect personal information from children under 13, and we will delete any such information if we become aware it was collected.

9. International Data Transfers

Koreflow is based in the United States, and information collected through the Site is processed in the United States. If you are visiting from outside the U.S., your information may be transferred to, stored, and processed in a jurisdiction where privacy laws may differ from those in your home country.

10. Changes to This Policy

We may update this Policy from time to time to reflect changes in our operational practices or legal obligations. We will notify you of material changes by posting the updated Policy on this page with a revised "Last Updated" date.

11. Contact Us

If you have questions, concerns, or requests regarding this Policy or our data practices, please contact us at:

Koreflow Inc.
Attn: Legal & Privacy
Email: service@koreflow.com
Location: Sunnyvale CA, United States