Privacy policy
2026-10-13
1. What we collect
(a) When you buy: your email address, the currency, amount and order number, and the payment reference the payment provider returns. Card and bank account numbers are handled by the payment provider (PortOne, PayPal) and are never stored on our servers in any form. (b) Only if you request a VAT invoice: business registration number and company name. (c) If you create an account: email, a password hash (Argon2id — we cannot read your password), and, if you sign in with Google, the identifier Google gives us. (d) From the program: a random install identifier, the app version, the operating system version, the definition-pack version, and counts of findings (how many danger, warning and note items, and totals per module). Only if you turn on anonymous statistics: the fingerprint (SHA-256) and signer name of files the program could not decide on (never the file path or name), plus an irreversible hash of your network range computed on receipt (the raw IP address is not stored). (e) When you visit this site: date, language, referrer, and a coarse regional key (we do not store raw IP addresses). (6) If you connect a “My sites” sensor (as the site operator): only error responses, write requests, admin-area requests and AI crawler requests to that site, with path, method, status code, browser information (User-Agent) and whether a cookie was present. Visitor IPs are replaced by a network range (e.g. 203.0.113.0/24) and an irreversible per-site source tag — the raw IP is not stored. We keep the latest 1,000 events per site and delete them when the site is removed. (7) If you turn on fleet monitoring for business: each PC’s random device ID, site name, security score, summaries of active incidents (which may include program names), self-protection status and in-network addresses that touched decoy ports; devices that stop reporting for 90 days are deleted.
2. What we do not collect
We do not send file contents, documents, photos, messages, contacts, screen images, the web addresses you visit, or the path or name of any individual file found during a scan. Scanning and verdicts happen entirely on your PC; the server only delivers definition packs and receives anonymous counts. We never collect national identity numbers, passport numbers or similar unique identifiers, for any purpose. The Android app (Ultari NEO for Android) has no internet permission and sends nothing to our servers. It reads the list of installed apps, their permissions and install sources (QUERY_ALL_PACKAGES) on the device only, for the security check; a message you share or paste is judged on the device only and is not stored. Your SMS inbox is never read. For the same check it also reads, on the device only, the settings of the network you are connected to right now (Wi‑Fi security type, proxy, DNS, whether a VPN or private DNS is in use; ACCESS_NETWORK_STATE) and the list of certificates you have installed yourself. Only if you grant “Usage access” yourself does it read each app’s background data use and usage time for the last 7 days (PACKAGE_USAGE_STATS), again on the device only. None of this leaves the device, and only the result of the last check is stored, on the device. A check report goes only where you send it by tapping “Share”.
3. Why we use it
Email and order data are used to issue and deliver your licence, produce receipts, process refunds and answer your questions. Anonymous statistics are used only to reduce false positives (a file reported as safe from many places is promoted to the allow list), to see which version has a problem, and to decide when to publish a definition update. We do not use them for advertising and we do not sell them.
4. How long we keep it
Korean e-commerce law requires us to keep contract and payment records for 5 years and consumer complaint and dispute records for 3 years. Account data is destroyed as soon as you close your account. Anonymous statistics are deleted automatically after 180 days, as are site visit statistics. Password reset links expire 60 minutes after they are issued and the record is then deleted.
5. Destruction procedure and method
Personal data whose retention period has ended, or whose purpose has been fulfilled, is destroyed without delay. (a) Account deletion: when you delete your account on the account page, your account data (email, name, password hash, Google identifier, company name and business registration number), sign-in sessions, password reset records, order links, and any sites registered under “My sites” together with their event records are erased in a single operation. (b) Records the law requires us to keep: order, payment and VAT invoice records required by Korean e-commerce and tax law are not erased; instead the email address is replaced with an irreversible hash so the record is no longer linked to you, and only the order number, seats, amount, currency, dates, payment status, payment provider reference, licence key and (if you asked for a VAT invoice) business registration number and company name remain. The server deletes these records automatically, once a day, once they are 5 years old. (c) Method: electronic records are deleted from the database so that they cannot be recovered; anything printed on paper is shredded or incinerated. If a copy remains in the hosting provider's backups, it disappears when that backup's retention period ends.
6. Sharing, processors and international transfer
We do not sell or hand your personal data to third parties. We use these processors to run the service — payments: PortOne (Republic of Korea) and PayPal (United States, for international payments); hosting: Railway (United States); email delivery: Resend (United States); network protection: Cloudflare (United States). Your email address and order data may therefore be transferred to the United States, limited to what running the service requires. If you would rather not have that happen, use the domestic payment route and note that the program works fully without an account. Only when you ask for a breach check in My sites do we send the email addresses you entered for that domain, for the lookup only, to LeakCheck (United Kingdom; it does not store queries) — or to Have I Been Pwned (United States) when the server has a key; we do not store them.
7. Your rights
You may at any time ask to see, correct, delete or restrict the processing of your personal data. Do it yourself on the account page, or write to projectteamforyou@gmail.com and we will act without delay (payment records we are legally required to keep are destroyed once that period ends). The program's anonymous statistics can be switched off in settings, and scanning keeps working when they are off. To delete your account, sign in, open the account page and use “Delete account” at the bottom: re-enter your password (or, if you signed up only with Google, sign in with Google again just before) and tick the confirmation box. If you still have a commercial licence with time left or an order awaiting payment confirmation, the page tells you so and does not delete the account; in that case write to us by email and we will handle it.
8. Security and cookies
All traffic is encrypted with HTTPS. Passwords are stored as Argon2id hashes and never in the clear. Administrative access is protected by separate authentication and rate limits. Cookies are used only to keep you signed in (HttpOnly, Secure, SameSite=Lax); we use no advertising or tracking cookies and embed no third-party analytics.
9. Contact and changes
Data protection officer: Yusang Lee (ProjectTeamForYou) · projectteamforyou@gmail.com · +82-70-7620-7256. If this policy changes we will post the change on this page 7 days before it takes effect, and 30 days before if the change is to your disadvantage. If you need to report or seek advice about an infringement of your personal information in Korea, you can contact the Personal Information Infringement Report Centre (privacy.kisa.or.kr, 118), the Personal Information Dispute Mediation Committee (kopico.go.kr, 1833-6972), the Cyber Investigation Division of the Supreme Prosecutors' Office (spo.go.kr, 1301) or the Cyber Investigation Bureau of the Korean National Police Agency (ecrm.police.go.kr, 182).
10. Android app and Google Play payments
All checks and verdicts in the Android app (Ultari NEO: Scam App Check, com.ultarineo.mobile) happen on the device. The app has no internet permission (INTERNET) and sends nothing to our servers. Personal protection remains free. The optional Business annual subscription is sold only through Google Play in-app billing and the payment is processed by Google — we never receive card numbers, bank details or other payment instrument data. Google Play tells the app, on the device only, whether a purchase or subscription is active; the app does not pass this on to us. For sales, accounting, tax and refund handling, Google Play may give us, as the seller, order records (such as order number, product, amount and date); we use them only for those purposes and keep them only for the legal retention period (section 4). Business audit reports are created on the device and go only where you send them with “Share”. Information Google processes for the payment is covered by Google's privacy policy.