Your documents are inputs, not training material.
Effective 2026-08-30 · Last updated 2026-10-19
This notice explains the production data path for the TAVONEL service. TAVONEL does not sell personal data or use customer document contents to train shared models.
The last-updated date identifies this notice. Your workspace agreement is the versioned self-service terms and processing addendum linked from the Terms page.
Which laws this notice is written under
TAVONEL is operated from the Republic of Korea and this notice is written under the Personal Information Protection Act (PIPA). Where you are in the European Economic Area or the United Kingdom, the GDPR and the UK GDPR also apply to the processing described here, and the table of legal bases below states the basis under each. We are the processor for the personal data inside the documents you upload or connect, and you are the controller of it, under the processing addendum your workspace owner accepts with the self-service terms; we are the controller of your account, billing and inquiry data.
What we collect
Account identifiers from Google OAuth; workspace and entitlement metadata; source files you deliberately upload; derived OCR, citation and knowledge artifacts; security and operational logs; billing identifiers supplied by Paddle; and the name, work email, optional company or organization, inquiry type, selected plan when you arrive from Pricing, optional qualification answers, interface language and message you submit through the contact form.
Why we process it
We process data to authenticate users, compile and return knowledge packages, secure and operate the service, provide support, prevent abuse, maintain transaction records and comply with law. We do not request sensitive source documents through the public inquiry form.
The legal basis for each purpose
| Purpose | GDPR and UK GDPR | Korea (PIPA) |
|---|---|---|
| Authenticate you and bind your workspace | Performance of a contract (Art. 6(1)(b)) | Necessary to perform the service contract (PIPA Art. 15(1)4) |
| Compile the sources you upload or connect, and return the result with its evidence | Performance of a contract (Art. 6(1)(b)) | Necessary to perform the service contract (PIPA Art. 15(1)4) |
| Secure and operate the service, and investigate abuse and incidents | Legitimate interests (Art. 6(1)(f)) — keeping a multi-tenant service safe, weighed against your interests | Necessary for our legitimate interests, which demonstrably outweigh yours (PIPA Art. 15(1)6) |
| Answer an inquiry you send us | Steps at your request before a contract (Art. 6(1)(b)), or legitimate interests (Art. 6(1)(f)) | Consent, given by sending the inquiry (PIPA Art. 15(1)1) |
| Record and reconcile a payment, and keep the transaction record | Legal obligation (Art. 6(1)(c)) | Required by law, including the Korean commercial and tax retention duties (PIPA Art. 15(1)2) |
| Measure visits on public marketing pages | Consent (Art. 6(1)(a)), withdrawable at any time | Consent to an access-analysis tool (PIPA Art. 15(1)1) |
Where a row says consent, you can withdraw it at any time without affecting the service or the lawfulness of what was done before you withdrew it. Where a row says legitimate interests, you can object: write to privacy@tavonel.com and we will tell you what we weighed and whether the objection changes the answer.
Storage and lifecycle
Document bytes are stored in tenant-scoped Cloudflare R2 quarantine and immutable result paths, not in the application database. Supabase stores account, entitlement and proof metadata. A source is written once under a content hash and is never rewritten: editing a file produces a second version rather than replacing the first, so deletion, not overwriting, is the only way source material leaves. Data remains until workspace deletion, a verified deletion request, or a legal retention duty applies. Immutable document artifacts carry a configured recovery protection of 28 days from their creation, during which the storage provider refuses their removal.
What deletion does, step by step
Disconnecting a source connection deletes the stored provider refresh token immediately, before the connection is marked revoked; if that deletion fails, the disconnect returns an error rather than reporting success. Removing a connected source, or losing access to it, suspends it — and a suspended source is refused on the next answer, source-byte read, export and promotion, with no wait for a background reindex. The connection record itself is kept, marked revoked, alongside the append-only audit row for the act.
A workspace owner or administrator can request deletion of an uploaded source through the service. Everything else begins with a verified request to privacy@tavonel.com. A verified deletion request restricts use of the affected material, which becomes eligible for physical purge 30 days after the request; each removal is then independently verified before it is reported. We confirm the scope and outcome in writing. The 28-day recovery protection and the 30-day eligibility are configured periods, not a guaranteed completion deadline. No fixed operational completion period is published. Timing depends on the material covered by the request, any applicable legal hold or retention duty, and the provider-backup lifecycle described below.
Provider backups are the slowest part: a copy of a deleted database row can survive in the database provider’s own backups until those age out on the provider’s schedule, and we publish no day count for it, because that schedule is the provider’s and we have not verified one against our own project. Operational and security logs are kept for security and abuse investigation and have no published retention period either.
A signed deletion certificate is not issued today.
International processing
Supabase is configured in Seoul, and so are the Vercel serverless functions that serve this site. The content-disarm service that rasterizes and scans every source — the first thing to touch your document bytes — runs on Google Cloud Run in Seoul, orchestrated by a Cloudflare worker on Cloudflare's edge. The GPU OCR that reads the sanitized result runs on a RunPod endpoint with no pinned region, so we do not state one. Cloudflare, RunPod, Resend, Google and Paddle may process limited data through global infrastructure or support systems outside Korea. The exact processor, purpose, data category and region are listed on the subprocessors page. Cloudflare R2 location hints are best-effort and are not a promise of Korean data residency, and no data residency is guaranteed.
The processing addendum does not execute the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum or a transfer impact assessment for you. Where a transfer of personal data in a customer's documents requires one of those or another transfer instrument, we agree it with that customer before processing the affected documents, and the self-service terms exclude that data until it is agreed. Ask privacy@tavonel.com to arrange it and for details of the providers relevant to your use.
Optional website analytics
With your permission, Google Analytics uses first-party cookies to measure visits and selected interactions on public marketing pages. It receives a pseudonymous browser identifier, device information, a public page address without query parameters, and the referring website origin. We do not send document contents, filenames, questions, account identifiers or workspace events to Google Analytics. Advertising personalization and Google signals are disabled. Your choice and analytics cookies expire after 180 days. You can decline without affecting the service, or withdraw permission using Analytics preferences on a public page. Google may process analytics data outside Korea. With the same permission, Vercel Web Analytics, run by our hosting provider, counts page views and the same selected interactions on public marketing pages without cookies or storage on your device. It receives the page address without query parameters, the referring address, your browser, operating system and device type, and an approximate location derived from the request; Vercel tells visits apart with a hash of the request that it discards after 24 hours. We do not send document contents, filenames, questions, account identifiers or workspace events to Vercel Web Analytics.
Cookies and similar storage
| What | Set by | What it does | Kept for |
|---|---|---|---|
| Analytics preference | Ours, first-party | Remembers whether you allowed or declined website analytics, so you are not asked twice | 180 days |
| Google Analytics | Google, first-party | Counts visits and selected interactions on public marketing pages. Set only after you allow analytics, and never on the sign-in or workspace pages | 180 days |
| Vercel website analytics | Vercel, same-origin | Counts page views and selected clicks on public marketing pages, only after you allow analytics. Sets no cookie and stores nothing on your device | No cookie |
| tavonel.funnel-log | Ours, session storage | A record of the interactions in this tab. Not sent | Until you close the tab |
| tavonel.first-touch.v1 | Ours, session storage | The campaign parameters of the sign-in address you arrived on, if it had any. Not sent | Until you close the tab |
| Sign-in session | Supabase, first-party | Keeps you signed in to your workspace. Strictly necessary, and set only when you sign in | The session |
Nothing in the analytics rows is set before you choose. Decline and no analytics cookie is written and no analytics request is sent; you can change your mind from Analytics preferences on any public page. There is no advertising cookie, no cross-site tracking pixel and no third-party cookie on this site.
Your choices
You may request access, correction, export, restriction or deletion by writing to privacy@tavonel.com. We verify the requester before acting. Security reports should go to security@tavonel.com.
If you want to complain
Write to privacy@tavonel.com first — it is read by the person who can act on it. If that does not resolve it, you can complain to a supervisory authority. In Korea that is the Personal Information Protection Commission, including through the Korea Internet & Security Agency's privacy call centre (118). In the European Economic Area it is the supervisory authority of the country you live or work in, or where the issue happened; in the United Kingdom it is the Information Commissioner's Office. You do not have to come to us first, and doing so does not affect that right.
Representatives
No representative under Art. 27 of the GDPR or of the UK GDPR is appointed, and no data protection officer is appointed: neither is required of us at this scale, and we state that rather than leave it for you to find out. The privacy contact below is the person who answers a request, and the personal information protection officer under PIPA is the operator named there.
Children
This service is for organizations and the people who work in them. It is not directed at children, we do not knowingly collect personal data from anyone under 14 (or under 16 in the EEA and the United Kingdom, where a member state has not set a lower age), and we do not offer a child-facing account. If you believe a child's personal data has reached us, write to privacy@tavonel.com and it will be deleted.
Contact
Privacy inquiries: privacy@tavonel.com.
- Business
- 타보넬(TAVONEL)
- Representative
- 김영솔
- Business registration
- 691-19-02562
- Business address
- 서울특별시 금천구 시흥대로 8, 402호(시흥동, 아르스파크)
- Contact
- +82 10 2464 7664 · contact@tavonel.com