Privacy Policy
Nalin Co., Ltd.
1. Who we are and what this policy covers
Nalin Co., Ltd. (“Nalin”, “we”, “us”) runs an email API from Seoul for Korean apps. Apps send us product events or template names with their recipients' values; our own models draft and classify the templates and check the advertising ones against the Network Act; once a person at the customer approves a template, we send it and keep the consent records and notices the law asks of an advertiser. This policy explains what personal data we handle when we do that, and why.
Registered at 32 Seongsui-ro 7-gil, Seongdong-gu, Seoul 04781, South Korea.
We handle personal data in two different situations, and different rules apply to each:
| Whose data | Our role | What applies | |
|---|---|---|---|
| Part A | People who visit this website, ask about the service or write to us | Controller: we decide why and how the data is used | This policy |
| Part B | Staff of our customers who hold accounts with us or own and approve templates; and the people our customers email through Nalin, whose addresses, values and consent records the customer sends us | Set out in B.1, because it depends on the data | This policy and the data processing agreement we sign with each customer |
If the data processing agreement (“DPA”) and this policy ever disagree about Part B, the DPA wins.
2. Part A: this website and our contact with you
This part covers the personal data we collect for our own purposes: running this website, answering requests, and staying in touch with people who are or might become customers.
A.1 What we collect
What you give us. When you send the form on this site, we collect what you type into it, such as your name, email address, phone number or company, and the fact that you agreed to be contacted. If you email or talk to us, we keep that correspondence and any contact details in it.
What is collected automatically. Our web server records the IP address a request came from, the browser used, the pages requested, the page you came from and the time. These logs exist to keep the site running and secure.
We don’t ask for sensitive data (the “special categories” in Article 9 GDPR) through this website, so please don’t send any through the form.
A.2 Why we use it, and what allows us to
| Why | What | Legal basis (GDPR Art. 6) |
|---|---|---|
| Answering your request and working out whether the service fits | What you sent in the form, our correspondence | Art. 6(1)(b): steps you asked for before a contract |
| Looking after customers, billing and support | Contact details, correspondence | Art. 6(1)(b): carrying out a contract |
| Keeping the site running, secure and free of abuse | Server logs | Art. 6(1)(f): our legitimate interest in running a secure service |
| Contacting you about the service | Email address, company | Art. 6(1)(f): our legitimate interest in business-to-business marketing. You can object at any time |
| Meeting tax, accounting and legal duties | Billing and contract records | Art. 6(1)(c): a legal obligation |
Where we rely on legitimate interest, we have weighed that interest against your rights, and you can ask to see the assessment.
A.3 How long we keep it
- Requests from people who don’t become customers: 12 months from our last contact, then deleted.
- Customer contact and contract records: for the length of the agreement plus ten years, the period South Korea’s Commercial Act sets for a company’s commercial books.
- Server logs: 30 days.
- A record that you objected or opted out: kept indefinitely, so we can keep respecting it.
A.4 Your rights
If you are in the EEA or the UK, you can ask to see your data, correct it, have it deleted, limit or object to how we use it, get a copy you can take elsewhere, and withdraw consent where we rely on it. Write to [email protected] and we will answer within one month.
You can also complain to a data protection authority. If you are in the EEA, that can be the authority where you live or work.
3. Part B: data inside the service
This part covers the data that passes through the email API: recipients' addresses and the values merged into each email, the consent records customers keep with us, delivery events, and the templates, classes and approvals of our customers' staff.
B.1 What we handle, and in what role
For the email a customer sends through Nalin we process personal data on the customer's behalf, as the processor it entrusts the work to under our data processing agreement; the customer decides whom to email, with what and on what consent. For account details and approval records we decide ourselves and act as a controller. The service handles the following:
- Recipients and their values. Each recipient's email address and the values the customer's app sends for that email, such as a name, an order number, a courier, a points balance or a coupon's end date. They are merged into an approved template to render that one email and are used for nothing else.
- Consent records. For each recipient of advertising email: the date of each consent, refusal or withdrawal, where it was given, the wording the recipient was shown, the end date of a transaction where the customer relies on the six-month transaction exception, and the result notices and two-year confirmations sent about it.
- Delivery events. Accepted, delivered, bounced, complained and unsubscribed, and opened or clicked where the customer turns tracking on, each with its time and the receiving mail server's response.
- Templates and approvals. Template text in Korean and English, the event it belongs to with the name and one sample value of each field, its class and the model's reasons, the check and forecast results, and the name, work email and approval time of the person who approved each version.
Our models draft and read templates, not individual emails. No recipient's address, consent history or values are ever a model's input: every email a recipient receives is an approved template with that recipient's values merged in by rule.
We never read the customer's database, app or source code. Templates reach us as files the customer uploads, as HTML and text our command-line tool renders inside the customer's own build, or through an import the customer starts from its own account with the previous provider.
To forecast placement we send one copy of a new template version, rendered with sample values rather than any recipient's, to mailboxes Nalin owns at Naver Mail, Daum and Gmail.
B.2 What we do with it
Sending. An approved template version is rendered with each recipient's values and sent from our mail servers on cloud infrastructure in Seoul. An advertising email goes only to a recipient whose consent is dated, not withdrawn and confirmed within the last two years, and carries '(광고)' at the start of its subject, the sender's details and an opt-out in Korean and English.
Drafting, classing and forecasting. Open-weight models we fine-tune and serve ourselves on cloud GPU capacity we control in Seoul draft templates from event fields, class each template informational or advertising with its reasons, and read consent wording. A separate, smaller model on our ordinary servers in Seoul forecasts inbox or spam for each mailbox. No third-party model provider receives anything.
Approval. No new or changed template version sends until the person the customer names as its owner approves it in our console with a passkey. API keys can submit templates and send approved ones; none can approve.
Notices to recipients. Within three days of each consent, refusal or withdrawal the customer records, we send the recipient the result notice the Network Act's decree requires within 14 days, and at least 30 days before the second anniversary of each consent we send its confirmation. A person at the customer approves the first notice of each kind.
No onward sale. We do not sell, rent or share recipients' data, consent records, templates or send logs. The subprocessors that host our servers on cloud infrastructure in Seoul and issue our electronic tax invoices are named on our subprocessor list.
B.3 AI models: where they run and what they learn from
Where models run. Nalin's classifier and drafting model are open-weight models we fine-tune and serve ourselves on cloud GPU capacity we control in Seoul, beside our API and mail servers on cloud infrastructure in Seoul, where the placement forecaster also runs. They read template text, the names and sample values of event fields, consent wording and a sending domain's delivery facts. No recipient's address is ever a model's input, and nothing is sent to a third-party model provider, which is why none appears on our subprocessor list.
Training. We do not train any model on a customer's recipients, merge values or send log. The classifier learns from two sources only: a corpus our own privacy team wrote and labeled from KISA's 2026 guide and the decree's Annex 6, and, from customers who opt in on their order form, pairs built from owners' decisions, each the passage that decided a class beside the class the owner set, with every merge value and personal detail removed. Opt-in pairs are pooled across those customers and train our own models in Seoul; a customer that withdraws its opt-in has its pairs left out of the next training run. The placement forecaster learns from copies with sample values sent to Nalin's own seed mailboxes. Every template our model drafts is marked as model-drafted in the console and in the inventory, so the people who approve it know.
Where a person decides. Every class and every draft the models produce is a proposal. No new or changed template version sends until the person the customer names as its owner approves it with a passkey; API keys, including any an AI agent holds, can submit templates but never approve one. Where the classifier falls below its 90 percent confidence line, or a template mixes informational and advertising content, it proposes no class and the owner decides, and a template carrying a coupon, points or recommendation line the recipient did not ask for is never classed informational. Consents given through wording the consent reader flags wait for the customer's privacy officer. An advertising send forecast to land in the spam folder at a mailbox is held for that mailbox until a person releases it. The service makes no automated decision with legal or similarly significant effect on any recipient: whom to email, and on what consent, is the customer's decision.
B.4 Where the data is kept
Recipients' addresses and values, consent records, delivery events, templates, approvals, the send log and the models that read templates are stored and processed on cloud infrastructure in Seoul, South Korea, and nowhere else.
Delivering an email hands it to the recipient's own mailbox provider, which the recipient chose; that is the delivery the customer asked for, not storage by us. Invoices are paid by bank transfer, so no card details reach us.
The suppliers that handle data in the service are named on our subprocessor list, which comes with the data processing agreement and which we send to anyone who asks: write to [email protected].
B.5 How long we keep it, and what deleting can’t remove
The text of each email as it was rendered is kept for 90 days, so a customer can show exactly what a recipient received, and is then deleted.
The send log (recipient address, template version, class, the consent record it relied on, times and delivery events) is kept for three years by default; a customer can set any period from one to five years.
Consent records, result notices, two-year confirmations, template versions and approvals are kept for as long as the customer keeps its account, because a consent question can turn on a record years old, and are deleted 60 days after the account closes, once the customer has had the chance to export them.
Labeled pairs from customers who opted in (the passage that decided a class beside the class an owner set, with merge values and personal details removed) are kept while the models they train are in use. Account and approver details are kept for the life of the account and three years after it closes.
B.6 Requests from people whose data is in the service
If you received an email sent through Nalin, the company that sent it decides what it sends you and holds your consent; write to that company, or use the opt-out link in the email, which asks for nothing but your address. If you write to us instead and are refusing advertising email, we stop that sender's advertising email to your address at once, and we pass your request to the sender within five business days. If you own or approve templates or hold an account with us, write to us directly about your account and approval records.
For everyone
4. Moving data between countries
Nalin Co., Ltd. is a company in South Korea, outside the EEA, and handles personal data under South Korea’s Personal Information Protection Act (PIPA) and, where it applies, the GDPR. Section B.4 says where the data in the service is kept. When personal data from the EEA or the UK reaches us, for example because someone there writes to us or a customer there uses the service, it is protected by the European Commission’s adequacy decision for the Republic of Korea, or by its Standard Contractual Clauses, and the technical measures described in our security documentation. You can ask us for a copy. In South Korea you can complain to the Personal Information Protection Commission (PIPC).
EU representative (Article 27 GDPR). Write to [email protected] with “EU representative” in the subject line and we will send you our representative’s details.
5. Security
We protect data in line with the risk. That includes encryption in transit and at rest, access limited to the people and systems that need it, each customer’s data kept separate from every other’s, and a log of every access to production systems.
If a personal data breach affects you, we tell you without undue delay, and at the latest within 36 hours of finding out, with the information you need to meet your own reporting duties.
6. Children
The service is sold to businesses and is not meant for children. We don’t knowingly collect personal data from anyone under 16.
7. Changes to this policy
We may update this policy. If a change matters, we email customers at least 30 days before it takes effect. The version number and date at the top of this page change every time.
8. Contact
Privacy questions and anything else: [email protected]
By post: Nalin Co., Ltd., 32 Seongsui-ro 7-gil, Seongdong-gu, Seoul 04781, South Korea