PRIVACY NOTICE · SEPTEMBER 15, 2026

Privacy notice

Inferaft is operated by VROF Inc. (주식회사 브이로프), a company registered in South Korea, which is the controller for the personal data described here. We follow the Personal Information Protection Act (개인정보 보호법) and the e-commerce rules that apply to a Korean mail-order seller.

Operator

주식회사 브이로프 (VROF Inc.)

Business registration

433-88-02526

Mail-order registration

제2024-서울은평-0124호

Address

서울특별시 은평구 은평로13길 11-6, 303호

개인정보책임자

황의범

Privacy contact

admin@inferaft.com

What we store

Account data (name, email address, password hash and sessions), API key hashes with their visible prefix, workspace and plan state, and request metadata: model, timestamps, token counts, cache hits, queue and latency figures, status and cost. Billing records hold the Paddle customer, transaction and invoice identifiers. All of it lives on our own server in South Korea.

What we never store

Prompt and response bodies are not written to our database: they pass through Inferaft only while the request runs and are gone. A full API key exists only in the response that creates it — we keep a hash. Card numbers never reach us; Paddle processes payment.

Keep regulated or confidential material out of prompts.

Processors and transfers abroad

We do not sell personal data and we do not share it with advertisers. Service delivery requires these processors, and using the service transfers the listed data to them over the network:

Verification, password-reset and support email is sent from our own mail server in South Korea, so no third-party sending service handles it. Your own email provider processes the message it receives under its policy.

Cookies and analytics

Sign-in uses an essential session cookie. Page views are counted with PostHog on its European infrastructure and proxied through this site, so no third-party host sees your IP address directly.

Analytics sets no cookie and writes no identifier to your browser: the session is held in page memory and is gone when you close the tab, so a return visit is not linked to a previous one. Automatic capture of clicks and form contents is switched off, element attributes are masked, and a Do Not Track signal disables collection entirely. Because nothing persistent is stored, there is no consent banner to dismiss.

Retention

Account data and request metadata are kept while the account exists and are deleted when you ask us to close it. Korean commerce law then requires us to keep certain records regardless: contract and withdrawal records for five years, payment and supply records for five years, and consumer complaint or dispute records for three years. Backups roll over on their own schedule, so a copy can persist briefly after deletion.

Your rights

You can ask to access, correct, delete or suspend the processing of your personal data. Self-service deletion is not built yet, so write to support@inferaft.com and we will act without undue delay. If you are unsatisfied, you can contact the Korea Internet & Security Agency privacy centre (118), the Supreme Prosecutors' Office cybercrime division (1301) or the National Police Agency cyber bureau (182).

Changes

This notice applies from September 15, 2026. If it changes materially we will publish the new version on this page at least seven days before it takes effect.