Privacy Policy

Our position, in one paragraph

We collect what we need to answer you, and we do not use what you tell us to train anything or to answer anybody else. A conversation you start without an account is kept against your browser session for a limited period and then deleted. Files you attach are scanned, read for text, kept for a short window if you send them before an NDA, and deleted whenever you ask.

iTrix Co., Ltd (주식회사 아이트릭스), incorporated in the Republic of Korea, is the controller. Privacy contact: itrix@gpslab.org.

What we collect

• Conversation content — the text of your messages, the prompts you select, your conversation titles.
• Attachments — files you attach, and the text we extract from them.
• Workspace data — name, email, organisation, role, credentials, and whether the Workspace was opened by registration or invitation.
• Authentication data — sign-in identifier, password hash, password-reset and email-confirmation requests and hashed single-use tokens, confirmation state, password-change time, request IP addresses and sign-in timestamps.
• Assent records — which version of these instruments you accepted, and when.
• Support and relationship data — support requests, meeting notes, feedback, agreed outcomes.
• Technical and usage data — IP address, browser and device information, timestamps, which sections you opened, error and performance logs.
• Session identifiers — a signed session cookie, and capability tokens in links we send you.

We do not knowingly collect special-category data, and we ask you not to send it.

Why, and on what basis

To respond to you and prepare your output (contract, and our legitimate interest in answering an enquiry). To create and operate a workspace (contract). To scan attachments for malware and abuse (legitimate interest in security; legal obligation). To keep audit logs of access and disclosure (legal obligation; accountability). To improve the platform using aggregate, non-identifying signals (legitimate interest). To send you material you asked for (contract; consent where marketing). To comply with law and to establish or defend claims (legal obligation).

Where we rely on legitimate interests we have considered your interests and rights, and you may object.

Authentication includes confirming that an address is yours and protecting the Workspace from unauthorised access. Registration, reset, sign-in, invitation-code and confirmation-resend responses are deliberately enumeration-safe and do not reveal whether an account exists.

Three things we do not do: we do not use your conversation content or attachments to train, fine-tune or evaluate any model; we do not use your content to answer anyone else’s question; and we do not sell personal data or share it for cross-context behavioural advertising.

Automated processing

The platform classifies what you describe in order to route it internally and to decide what material may be shown to you. It also generates text automatically.

This does not produce a legal or similarly significant effect on you: it decides what we show you and who follows up, not whether you receive a right, a credit, employment, or a service you are entitled to. No decision about you is taken by a model — the decisions that matter are taken by fixed rules, and a person is accountable for every commercial step. You can ask for a human at any point, and you can ask what happened by writing to itrix@gpslab.org.

Anonymous conversations

If you use the platform without an account, your conversation is held against a signed session identifier in a cookie and is visible only to that session. An unclaimed anonymous conversation is retained for 90 days and then deleted, unless you create a workspace, in which case it is transferred to that workspace. Attachments have their own shorter pre-NDA retention period described below.

We do not link separate anonymous sessions to each other, and we do not attempt to identify you from them.

Attachments, and the pre-NDA window

Files you attach are stored outside any publicly reachable path and served only through a short-lived, authorisation-checked link. They are scanned for malware and archive abuse before any attempt to read them, and read for text in an isolated environment with no outbound network access.

They are available only within the conversation you attached them to, never added to the knowledge base, and never used for training or evaluation. Deleting one removes the file, the extracted text and any derived excerpt.

A file attached before an NDA is flagged for restricted handling and deleted after 30 days unless a signed agreement requires otherwise.

How long we keep things

• Anonymous conversations — 90 days from creation while unclaimed. Anonymous attachments follow the shorter pre-NDA attachment period below.
• Pre-NDA attachments — 30 days, then purged with a verifiable record unless a signed agreement requires otherwise.
• Workspace conversations and attachments — while the workspace remains active, subject to any shorter attachment-specific period and any deletion request or applicable signed agreement. When a workspace is closed, we delete or de-identify this material through our operational deletion process except where law, security or a live dispute requires limited retention.
• Workspace account data — while the workspace or relationship is active, and afterwards only for as long as reasonably necessary for account closure, security, legal compliance or the establishment or defence of claims.
• Password-reset and email-confirmation tokens — until used, superseded or expired, then purged on a scheduled sweep.
• A Workspace that is never used — deleted after 180 days where there has been no Conversation, no confirmed address and no sign-in.
• How the account was opened — for the life of the Workspace.
• Assent records — retained for as long as reasonably necessary to evidence what you agreed to and to meet legal or claims requirements. The narrow acceptance record may survive Workspace deletion and contains no conversation content or attachments.
• Audit and security logs — retained for as long as reasonably necessary for security, incident investigation, accountability and legal obligations, with access restricted to authorised roles.
• Accounting and tax records — as required by Korean law.
• Aggregate, non-identifying analytics — indefinitely, in a form that does not identify you.

Your rights

Depending on where you are, you may have the right to know what we hold and get a copy, to correct it, to delete it, to restrict or object to processing, to withdraw consent, to receive it in a portable form, and not to be discriminated against for exercising a right. Under Korea’s Personal Information Protection Act you may also request suspension of processing.

Write to itrix@gpslab.org. We respond without undue delay and within the period required by applicable law, and we may need to verify your identity first. You can delete a conversation or an attachment through the platform where that control is available; for workspace closure or another data-right request, contact us at that address.

If you are unhappy with our response you may complain to your supervisory authority — in Korea, the Personal Information Protection Commission.

Sharing, transfers and cookies

We share with service providers who host, secure, scan, email or monitor the platform on our behalf, under written terms restricting them to our instructions; with our partner IWL Partners, which operates the sales and customer-success process, under written terms; with professional advisers and authorities where legally required; and with an acquirer in a merger or sale of assets, under equivalent protection.

We never share your conversation content with another customer.

We are in the Republic of Korea and our providers may be elsewhere. Where we transfer personal data out of the EEA, the UK or Korea we rely on an adequacy decision where one applies — including the European Commission’s adequacy decision for Korea — and otherwise on Standard Contractual Clauses, the UK Addendum, or the route Korean law requires, with a transfer risk assessment.

We use a strictly necessary signed session cookie and a small number of first-party preference and analytics cookies. Where consent is required we ask before setting anything non-essential. We use no advertising cookies.