Privacy Policy
This is a translation; if it differs from the Korean version, the Korean version prevails.
Effective date: October 21, 2026
The NLP & AI Lab and HIAI Institute, Korea University (the "Operator") run the Korean retrieval model APIs at kure.kullm.ai (the "KURE API"; currently embeddings, sparse embeddings and reranking) and the website (together, the "Service") and process personal information as follows, under the Personal Information Protection Act of Korea (the "Act").
1. What we process, why, on what basis, and for how long
| Category | Items | Purpose | Legal basis | Retention |
|---|---|---|---|---|
| Member profile | Signed up with GitHub: GitHub account ID, GitHub username, avatar URL, public GitHub email (if any). Signed up with Google: Google account ID, email, name, avatar URL. Both: sign-up date, last sign-in time | Identifying members, sign-in, notices | Performance of contract (Art. 15(1)4) | Until account deletion |
| Terms and consent records | Accepted terms version, input-storage consent (choice, version, time), consent history | Confirming consent | Performance of contract, legal obligations | Until account deletion; afterwards the member identifier is removed and only anonymous statistics remain |
| API keys | Key name, first 8 characters, hash of the key, created / last used / revoked time | API authentication, key management | Performance of contract | Until account deletion |
| Usage records | Request time, key used, model, number of inputs, tokens, output dimensions, response status, latency | Enforcing limits, showing usage, troubleshooting, abuse prevention | Performance of contract | Per-request records 30 days; daily totals until account deletion |
| Access records | IP address, request time and path, browser information (User-Agent) | Security, troubleshooting, abuse prevention, per-IP limits for the anonymous playground | Performance of contract, security measures (Art. 29) | Up to 30 days (per-IP limit records 2 days) |
| Sign-in session | Hash of the session token, expiry | Keeping you signed in | Performance of contract | Up to 30 days (deleted on sign-out or expiry) |
| Inquiries | Email, name and organization (optional), message, expected usage (optional), IP address, and if signed in, your account and usage at that time | Answering inquiries, reviewing limit requests | Consent given in the contact form (Art. 15(1)1) | 1 year after the inquiry is closed (longer only while a dispute is ongoing) |
| Input text (optional, consenting members only) | Text sent via the KURE API or playground after giving consent (such as search queries and documents), input type, model, request time | Research to improve Korean retrieval models, including building training and evaluation data | Consent (Art. 15(1)1) | 180 days from collection |
- Input text is not stored by default. For members who have not consented and for anonymous users, inputs are used only to compute the results and then discarded.
- For members who consented under the October 17, 2026 version or later, text inputs to the whole KURE API (including APIs added later) are stored. Members who consented under an earlier version have inputs stored only within that consent: the October 16 version covers the embedding, sparse embedding and reranking APIs and the playground; the October 15 version covers the embedding API and the playground.
- We will ask for consent again before storing non-text inputs (such as images) or changing the purpose.
- Consent to input storage is optional. Without it you can use the Service with the default limits; consenting members get higher limits.
Personal information inside inputs
The Operator does not run the Service to collect national ID numbers or other unique identifiers or sensitive information. Users must not send text containing third parties' personal information, sensitive information, or unique identifiers without a lawful basis.
For consenting members, national ID numbers, card numbers, phone numbers, and email addresses are detected by pattern and masked before storage (for example [PHONE]). Free-form information such as names and addresses cannot all be caught this way. We check again when building research data and exclude any text found to contain personal information.
2. Disclosure to third parties
We do not provide personal information to third parties, except where required by law or requested by investigative authorities through legal procedures. Stored input text is never published or provided to third parties.
3. Processors
| Processor | Task | Items |
|---|---|---|
| Google LLC (Gmail) | Receiving and storing inquiry notification emails, sending replies | Inquiry message, email, name and organization (optional), and if signed in, GitHub username and usage at that time |
We pass only what the task needs and oversee that the processor handles it securely.
4. Transfers abroad
| Recipient | Google LLC (privacy contact: via policies.google.com/privacy) |
| Country | United States and other countries where Google operates data centers |
| Items | The items in Section 3 |
| Purpose | Inquiry notifications and replies |
| When and how | When you send an inquiry, over encrypted connections |
| Retention | 1 year after the inquiry is closed (the Operator then deletes the email) |
| Legal basis | Separate consent to transfer abroad, given in the contact form (Art. 28-8(1)1) |
| How to refuse | You may refuse this consent in the contact form, but then you cannot send an inquiry through the form |
If you email kure.nlpai@gmail.com directly instead of using the form, you are sending it to a Gmail address yourself, and it is stored on Google's servers as described above.
Other external services:
- GitHub and Google sign-in: you approve sign-in and information sharing directly on GitHub (GitHub, Inc., USA) or Google (Google LLC, USA); we receive only the member profile in Section 1 from them and send none of your personal information to them. Accounts created with GitHub and with Google are separate accounts, even if the email is the same.
- Slack: internal notifications to the Operator contain only the inquiry number and topic, no personal information.
5. Deletion
- Personal information is deleted without delay once its retention period ends or its purpose is fulfilled. Expired items in Section 1 (per-request usage records, access records, input text, expired sessions, inquiries closed more than a year ago) are deleted automatically and periodically.
- When you delete your account, your profile, API keys, sessions, daily usage, and stored input text are deleted immediately. Per-request usage records remain, no longer linkable to you, and are deleted after 30 days.
- Databases are backed up for disaster recovery and backups are kept for up to 8 weeks. Backups are used only for recovery, and after a restore we use the account deletion log to delete again the data of members who had already left.
- Electronic files are deleted in a way that cannot be recovered.
6. Your rights
You can ask to access, correct, delete, or stop processing your personal information at any time.
- In the dashboard: give or withdraw consent to input storage, delete stored inputs, revoke API keys, delete your account
- Withdrawing consent and deleting stored text are separate. After you withdraw consent, new inputs are not stored. Text stored before that is kept until its 180-day retention ends unless you delete it, which you can do anytime in Dashboard → Settings.
- Other requests: Contact us or kure.nlpai@gmail.com. We verify your identity and respond within 10 days.
- Profile items from GitHub or Google (username or name, avatar, email) update when you change them there and sign in again.
- Limits for trained models: stored text can be deleted, but removing the influence of specific text from a model already trained with it is not possible with current technology. Research data and models created after your deletion request will not use that text.
7. Cookies
We use cookies to keep you signed in.
| Cookie | Content | Lifetime |
|---|---|---|
| Sign-in session | Session token (the server stores only its hash) | Up to 30 days |
| Sign-in check | Anti-forgery value during GitHub or Google sign-in | 10 minutes |
We use no advertising or analytics cookies or third-party trackers. Your theme preference is stored only in your browser. You can block cookies in your browser, but features that require sign-in will not work.
8. Security measures
- API keys and session tokens are stored only as hashes, never in plain text.
- Traffic between you and the Service is encrypted with HTTPS.
- Databases, stored inputs, and access records sit on internal servers not reachable from outside, with access limited to the operations staff.
- Structured personal information is masked in input text before storage (Section 1).
- Admin functions are limited to designated staff, and admin actions are logged.
- We monitor for outages and anomalies around the clock, back up daily, and verify every backup by restoring it.
9. Children under 14
The Service does not accept sign-ups from children under 14.
10. Privacy officer
| Privacy officer | Taemin Lee |
| Affiliation and title | Researcher, NLP & AI Lab, Korea University |
| Contact | kure.nlpai@gmail.com |
You can also report privacy violations to the Korean authorities: the Personal Information Infringement Report Center (privacy.kisa.or.kr, 118), the Personal Information Dispute Mediation Committee (www.kopico.go.kr, 1833-6972), the Supreme Prosecutors' Office cyber investigation (www.spo.go.kr, 1301), and the Korean National Police Agency cyber bureau (ecrm.police.go.kr, 182).
11. Changes
We announce changes to this policy on the Service at least 7 days before they take effect, or at least 30 days before for important changes such as collecting new items or new purposes, and ask for consent again where required.
This policy takes effect on October 21, 2026. (The October 17, 2026 version with Google sign-in and its member profile items added. The October 17 version was the October 16, 2026 version with the Service widened to the whole KURE API at kure.kullm.ai and input storage aligned with it. The October 16 version added the sparse embedding and reranking APIs and their input storage to the October 15 version.)