Effective 6 October 2026
Who is responsible
The controller of the personal data described here is Jiwon Pi of [FIELD: registered address]. Privacy questions and requests can be sent to support@kairolock.com. We have not appointed a data protection officer; requests from anywhere, including the EU and the UK, go to that same address, and if a representative or officer later becomes legally required this notice will name them.
Scope
This notice covers the KairoLock website, the KairoLock cloud services (account, billing and entitlement) and the KairoLock Windows application.
What we process, and why
- Waitlist email. If you submit your address to the pre-launch waitlist, we store that address and the time it was submitted so we can tell you when KairoLock is released.
- Account identity. When you sign in with Google we receive your Google account identifier and verified email address, and store them so the account exists across devices. We never receive your Google password.
- Billing references. Paddle customer, transaction and subscription identifiers, so we can tell whether your subscription is active. We do not receive or store your card number or other raw payment credentials; Paddle does.
- Entitlement state. Whether you are on trial, subscribed or expired, when the trial was consumed, and the related timestamps.
- Support messages. Whatever you choose to send us by email, including any technical detail you attach.
- Service logs. Request and error logs generated by our hosting and database providers, used to keep the service working and to prevent abuse.
The lawful bases, where that concept applies to you, are performance of the contract (account, entitlement, billing), legitimate interests (security, abuse prevention, answering support) and consent (the waitlist email, which you can withdraw at any time).
What stays on your device
The list of applications and sites you block, your schedules and your lock state are held on your own Windows device, and enforcement runs on that device rather than on our servers. None of it is transmitted to us. The desktop application has no analytics or usage-tracking integration, sends no diagnostic bundle and no crash report, and the Windows service that does the enforcing has no way to make a network request at all.
The application contacts three of our endpoints, and only when you use the features that need them: signing in (an authorisation code, and the token refresh and sign-out that follow); your subscription (reading whether your entitlement is active, opening a checkout for the plan you chose, opening the billing portal); and the trusted clock, which asks our time service to sign the current time so a lock cannot be ended early by changing your computer's clock.
The checkout request carries the plan, the billing period and the email address on your account. The clock request carries a random number generated on your device and how long the signature should be valid for — nothing else. None of these requests carries anything about the applications or sites on your list.
Website analytics
This website uses Vercel Web Analytics, provided by our host Vercel, to count page views in aggregate. Vercel Web Analytics does not use cookies. For each page view it records the page address, referrer, approximate location (country, region and city), browser, operating system and device type, and distinguishes visits with a hash of the request that is discarded after 24 hours. On the checkout page the transaction identifier is removed from the address before the page view is recorded. These statistics are used only to understand overall website traffic, not for advertising and not to identify individual visitors. It sets no advertising or tracking cookies, and the website does not use any other analytics provider or any advertising tracker.
Processors we use today
- Supabase — account authentication and entitlement data. The production database is hosted in the Asia Pacific (Seoul,
ap-northeast-2) region. - Google — sign-in. Signing in with Google means Google knows you authenticated to KairoLock; Google's own privacy policy governs your Google account.
- Paddle — payments and subscription billing, as merchant of record. Paddle collects and holds your payment details and the billing address and tax information it needs for the sale.
- Vercel — hosting for this website and its API routes, and the aggregate page-view analytics described above.
- Neon — Postgres storage for the pre-launch waitlist email addresses only.
These providers operate in more than one country, so your data may be transferred outside the country where you live. Those transfers rely on the standard contractual clauses published by the European Commission — with the UK addendum where the UK regime applies — as set out in each provider's own data processing agreement, or on an adequacy decision covering the country concerned.
Sharing
We do not sell personal data and we do not share it for advertising. Beyond the processors above, we disclose data only where we are legally required to, or where it is necessary to establish or defend a legal claim.
How long we keep it
- Waitlist addresses: until the launch email has been sent, or until you ask us to remove yours, whichever comes first.
- Account and entitlement records: kept while the account exists, then deleted within 30 days of the account being closed.
- Billing and tax records: kept for as long as tax and accounting law requires, which in the Republic of Korea is generally five years from the end of the relevant period. These cannot be deleted on request before that period expires.
- Service logs: up to 30 days, except where a log is retained for a specific security investigation.
Your rights
Depending on where you live you may have rights of access, correction, deletion, objection, restriction and portability, and the right to withdraw consent. Write to support@kairolock.com and we will verify that the request comes from the account holder before acting on it. We aim to respond within 30 days. You may also complain to your local supervisory authority; in our jurisdiction that is the Personal Information Protection Commission of the Republic of Korea.
Changes
If this notice changes in a way that materially affects you, we will notify the email address on your account before the change takes effect. The effective date at the top of this page always shows the version that applies.