Privacy Policy
Last updated 4 August 2026. This policy explains what EastStartup does with your personal information.
1. Who we are
EastStartup (“we”) operates eaststartup.com, a platform that helps founders outside Korea find Korean government startup support programmes, assess D-8-4 startup visa eligibility, and prepare business plan drafts.
The data controller is legal entity name to be confirmed, registered at registered address to be confirmed.
Our Personal Information Protection Officer is privacy officer name to be confirmed, reachable at privacy contact email to be confirmed. They are responsible for handling your requests and complaints about personal information.
2. What we collect
- Account data. Your email address, and — if you sign in with Google or Kakao — the name, profile image, and account identifier those providers return. We never receive or store your password for those accounts.
- Founder profile data. Facts you choose to enter about your venture, background, capital, sector, and location, used to explain how programmes and ideas fit your situation.
- Content you create. Ventures, canvases, validation runs, business plan drafts, and any documents you upload to your vault.
- Newsletter data. If you subscribe to the Daily Founder Brief: your email, chosen language, when you confirmed, and delivery events from our email provider (delivered, opened, clicked, bounced, marked as spam).
- Technical data. Standard server logs and a first-party cookie that remembers which newsletter link brought you to the site. We do not use third-party advertising or cross-site tracking cookies.
3. Why we use it, and on what basis
- To provide the service — matching programmes, computing visa points, generating drafts, storing your work. Basis: performance of our contract with you.
- To send the Daily Founder Brief — only after you confirm by clicking the link in a confirmation email. Basis: your consent, withdrawable at any time.
- To keep the service working and secure — rate limiting, abuse prevention, debugging. Basis: our legitimate interest in a functioning service.
We do not sell personal information, and we do not use your content to train general-purpose AI models.
4. Automated processing and AI
Visa point scores and programme eligibility are calculated by deterministic rules, not by a language model. Business plan drafting and idea validation send the text you supply to third-party model providers (see below) to generate a draft. Those drafts are a starting point for your own work — they are not legal, immigration, tax, or investment advice, and no immigration or funding outcome is guaranteed by them. Always verify requirements against the responsible Korean government agency before you act.
5. Who we share it with
We use a small number of processors, each for one purpose. We disclose personal information otherwise only where the law requires it, and we never sell it.
6. Transfers outside Korea
EastStartup runs on infrastructure located outside Korea. The table below lists every recipient, what reaches them, and why.
| Recipient | Country | Data transferred | Purpose | Retained |
|---|---|---|---|---|
| Netlify | United States | Request metadata, IP address | Serving the website | Short operational log period |
| Our own Supabase servers | hosting country to be confirmed | All account, profile, and content data | Database, authentication, file storage | While your account is open |
| Resend | Japan (Tokyo region) | Email address, message content, delivery events | Sending account and newsletter email | While subscribed, then a suppression record |
| Google, Kakao | United States, Republic of Korea | Your account identifier — only if you sign in with them | Authentication | Per that provider's own policy |
| Google (Gemini), OpenRouter | United States | Only the text you submit for drafting or translation | Generating that draft or translation | Not retained by us beyond the result |
You can refuse these transfers, but because they are how the service physically runs, refusing means we cannot provide an account. You may withdraw at any time by deleting your account.
7. How long we keep it
Account and content data is kept while your account is open, and deleted within 30 days of you deleting your account. Newsletter records are kept while you are subscribed; after you unsubscribe we retain a suppression record — your email address and the reason — so that we do not email you again. Server logs are kept for a short operational period.
8. Your rights
You can ask us to give you a copy of your data, correct it, delete it, or stop a particular use of it, and you can withdraw newsletter consent at any time using the unsubscribe link in any email or your email preferences. Write to privacy contact email to be confirmed and we will respond within 30 days. If you are in Korea you may also complain to the Personal Information Protection Commission (PIPC); in the EEA or UK, to your local supervisory authority.
9. Security, and its limits
Traffic is encrypted in transit, access to your rows is enforced at the database level so one account cannot read another's, and administrative access is restricted. No system is perfectly secure; please do not upload documents you cannot afford to have exposed.
10. Children
EastStartup is for adults founding companies. We do not knowingly collect data from anyone under 14, and will delete such data if we learn of it.
11. Changes
If we change this policy materially we will update the date above and, for changes that affect how we use data you already gave us, tell subscribers by email before the change takes effect.
See also our Terms of Service.