Privacy Policy

Version: 2026-10-07.1

Scheduled Effective Date: November 7, 2026. Matters requiring individual customer consent apply from the later of this date and valid consent.

Last Updated: October 7, 2026

Advance notice / scheduled changes

This revision is scheduled to take effect on November 7, 2026. This document was prepared on October 7, 2026. Important changes are announced at least 30 days before they take effect. Matters requiring express customer consent apply from the later of the announced effective date and valid consent.

New Terms acceptance records, DPA and subprocessing consent and evidence management, customer permanent deletion, and automatic deletion three years after initial submission are planned for November 7, 2026. They are not considered implemented or applicable until development, verification, and necessary consent are complete. Changes to the schedule will be announced in advance with the required notice and consent procedures. Acknowledging or closing a notice is not consent to the Terms, DPA, subprocessing, or personal data processing.

Unimplemented or unverified safeguards and access records describe performance standards and planned measures, not confirmation that every measure is already implemented. Provider settings were checked on October 1-2, 2026, as stated in the relevant schedules and annexes; this revision does not constitute a new verification. Existing statutory duties and valid deletion requests remain in effect.

inblog Inc. (the "Company," "we," "us," or "our") operates the Neopress website builder platform (the "Service"). This Privacy Policy describes how we collect, use, and share information about you when you use the Service.

This Policy explains both personal data of Service users processed directly by the Company and form submissions processed on customers' behalf. We process data on lawful grounds under applicable law, explaining and obtaining separate consent where required. Use of the Service alone is not treated as legally required consent.

1. Information We Collect

1.1 Account Information

When you create an account using Google or GitHub Sign-In, we access:

• Display name from your Google or GitHub profile
• Email address from your Google or GitHub account
• Profile picture URL, if available

We use this information only to create and maintain your neopress account. We do not access contacts, calendars, drive files, or other data from your social-login provider. Our use of Google user data complies with the Google API Services User Data Policy, including Limited Use requirements.

Legal basis for collection: Performance of the contract to provide the Service you registered for.

1.2 Payment Information

Polar Software, Inc. ("Polar") processes purchases as our Merchant of Record. Polar and its payment providers collect and process payment information directly. We do not store full payment-card numbers. See Polar's Privacy Policy.

For Fixed-Term B2B Prepaid Plans, we separately record acceptance of the prepaid-plan conditions and refund policy, including each acceptance time, and associate these records with the purchasing account and site offer. The records support purchase administration, verification of accepted conditions, and payment and refund inquiries.

Legal basis for collection: Contract performance and legal obligations, including tax and accounting.

1.3 Usage Data

We automatically collect certain information when you use the Service, including:

• IP address
• Browser type and version
• Pages visited and time spent
• Referring URL
• Device information

This data is collected through our backend provider Supabase for debugging and service improvement.

Legal basis for collection: Legitimate interests in maintaining and improving the Service.

1.4 User Content

When you create websites, we store their content, including pages, text, and settings, in our database. When you use AI features, your prompts and related content are sent to third-party AI providers for processing (Section 4).

Legal basis for collection: Contract performance.

1.5 Uploaded Files

Files such as images and documents are stored on Cloudflare R2 infrastructure. Files may contain metadata, including image EXIF data with location or device information. We do not separately extract or process metadata, but it may be accessible when included in an upload. You are responsible for removing sensitive metadata before uploading.

Files associated with published websites are publicly accessible by URL.

Legal basis for collection: Contract performance.

1.6 Form Submissions on Customer Sites

We process information entered into customer-configured forms on customers' instructions for appointments, consultations, and inquiries. Actual fields and purposes are described in that customer's form and privacy notice.

The customer determines purposes, fields, and retention periods. We follow lawful customer instructions and the Data Processing Addendum (DPA). Where sensitive data such as health information is included, the customer must obtain the necessary separate processing ground. Customer DPA acceptance does not replace submitter consent.

1.7 Online Acceptance Records for Terms, DPA, and Related Documents

The registration and dashboard consent procedures planned for November 7, 2026, will process acceptance records for the Terms, DPA, and subprocessor list under the following standards. We do not describe acceptance-record management as implemented before necessary development and verification are complete.

1.8 Connected AI Assistants

When you connect an AI assistant such as ChatGPT or Claude to Neopress, the assistant can request data and actions through our OAuth-authenticated connector. Depending on your request, this may include your account identifier, site and page content, settings, assets, analytics, and form responses. Form responses may contain personal information submitted by website visitors.

The connector applies the same account membership, site role, permission, and plan restrictions as the Service. It only returns data or performs actions requested through the connected assistant. You can disconnect the assistant from its provider or revoke its authorization from Neopress.

Grounds for processing and transfer: A connection request does not automatically establish grounds needed to process third-party personal data or transfer it internationally. We consider the scope necessary for the requested function and the recipient's actual role, and process only within applicable disclosure, notice, separate-consent, and other requirements in Section 5. Form submissions also remain subject to lawful customer instructions and the DPA's purpose limitations.

2. How We Use Information

We use collected information to:

• Provide, operate, and maintain the Service
• Process transactions and send related information
• Record and verify acceptance of prepaid-plan conditions and refund policies
• Record online acceptance of the Terms, DPA, and subprocessor list and verify applicable conditions
• Send administrative and transactional emails, including account verification, trial reminders, and subscription notices
• Respond to feedback, questions, and support requests
• Monitor and analyze usage patterns to improve the Service
• Detect, prevent, and respond to technical issues and fraud
• Provide AI features for content generation and website building

Entrusted form submissions are processed for reception, storage, viewing, notifications, return, deletion, and necessary support, incident recovery, and security response. General service-improvement or AI descriptions do not authorize separate advertising, model training, or similar use of submissions.

3. Entrusted Processing and Third-Party Provision

The following lists integrated providers and work. Processing on the Company's behalf is distinguished from provision to recipients for their independent purposes.

For entrusted processing, our contracts address purpose limitations, safeguards, restrictions on subprocessing, management, supervision, and responsibility, and we manage providers' performance. Polar is an independent seller. Grounds for our provision of buyer information and international transfers follow Section 5. Information entered directly by a buyer into Polar is distinguished from Company provision to a third party.

We do not sell or share personal data for advertising or cross-context behavioral advertising.

For customer forms, the Company is a processor and the providers in the Schedule are subprocessors. Inputs are stored in Supabase's operational DB and, when notifications are enabled, sent via Resend to customer-designated email addresses. Notification bodies contain submission contents. We obtain necessary subprocessing consent from customers and manage and supervise subprocessors.

4. AI-Powered Features

Third-Party AI Services

The Service uses third-party artificial intelligence services — including Anthropic (Claude), OpenAI, Google AI (Gemini), and Cerebras — to generate website content, provide suggestions, and assist with page creation. When you use AI features, your prompts and related content are sent to these providers for processing. When you connect an external AI assistant to Neopress, data requested through the connector is also processed under that provider's terms and privacy policy.

The processing and transfer requirements in Sections 1.8 and 5 also apply.

AI Data Usage

AI interactions, including prompts, inputs, and outputs, are processed under providers' respective data policies. We do not use your content to train AI models. Refer to each provider's terms for processing details.

5. International Transfers of Personal Data

We transfer personal data to overseas recipients as follows:

The table concerns Service-user information; customer form submissions are covered in the Schedule. Headquarters and actual storage or processing countries can differ. Additional disclosure in preparation: Transfer timing and methods, recipient-specific contacts, and detailed processing of Service-user information are being checked and compiled. A detailed-disclosure page is not yet available. Verified details will be added to this Policy or linked to a real details page before commencement. We do not represent that this table alone contains every statutory disclosure. Disclosure-based transfers apply only where all statutory particulars and the relevant legal criteria are met. This document alone does not justify transfers lacking required disclosure or consent.

Purpose-Specific Legal Grounds

We apply the following criteria according to actual processing purpose and recipient role. International processing or storage necessary for contract formation or performance uses the disclosure approach in PIPA Article 28-8(1)(3)(a) only when all statutory particulars are disclosed and its requirements are satisfied. It is limited to processing and storage necessary for a contract with the data subject, not indiscriminately applied to provision to independent third parties or unnecessary processing.

Disclosure must include required fields, countries, timing and methods, recipients and contacts, purposes and retention, refusal procedures and effects, and other statutory particulars. Where separate consent is required, it must precede transfer. Publishing this Policy or accepting the Terms or DPA is not that consent. Customer forms follow the customer's established grounds and instructions, and the Company also fulfills its processor duties.

Refusal, Restrictions, and Alternatives

Request refusal or suspension of international transfers, or withdrawal of consent-based transfer authorization, at contact@email.neopress.ai. Identify the account or site and work to stop so we can verify authority and scope. For customer form submissions, you may also contact that site's privacy contact.

We do not indiscriminately restrict functions unrelated to the refused work. Previously transferred data follows applicable retention, deletion, and statutory duties. Refusal or withdrawal alone does not immediately or retroactively erase existing backups or recipient-mailbox copies.

6. Data Retention

Service Accounts and General Content

We retain personal data and User Content for the period necessary to provide the account and Service. Even for active accounts, data is destroyed without delay when its purpose is achieved or it becomes unnecessary. Account deletion is handled as follows:

• Account data such as name and email: deleted within a reasonable time, typically 30 days
• Website content such as pages, media, and files: deleted within a reasonable time, typically 30 days
• Payment records: retained as required by tax and accounting law, typically five years
• AI interaction logs: deleted within a reasonable time, typically 30 days
• Online Terms, DPA, and other acceptance records: separately retained and destroyed under Section 1.7, distinct from three-year automatic deletion of form submissions
• Backup copies: may remain in encrypted backups for up to 90 days before automatic deletion

These periods are not a grace period to keep using data without a separate ground after its purpose ends or uniformly delay destruction. Statutory-retention data is segregated and managed only for that purpose.

Published websites become private immediately upon account deletion or termination.

Form Submissions on Customer Sites

Submissions follow the customer's lawful purposes and necessary retention periods. If the customer specifies a shorter period or the purpose is achieved earlier, it must delete or request Company deletion at that point. The three-year threshold below does not provide a legal basis to retain all personal data for three years.

Customer permanent deletion (planned for November 7, 2026): After development and verification, and from the date announced in advance through service notices and dashboard-entry popups, authorized customers can select submissions for permanent deletion in the dashboard. After confirmation of targets, count, and irreversibility, deletion work starts immediately. Completion is shown only when the operational DB records and Company-managed service replicas have been removed. Partial processing or failure is shown as processing or failed. Completion does not mean final destruction of backups or email-provider copies.

Three-year automatic deletion (planned for November 7, 2026): After development, verification, advance notice through those channels, and necessary consent, all form submissions are deleted from the operational DB and Company-managed service replicas within 24 hours of reaching three years after initial submission. Jobs run daily; edits or views do not extend the period. Initial submission time also governs pre-rollout data. Submissions already older than three years at commencement are deleted within 24 hours of lawful application to the relevant customer. Customer-specific retention settings are not provided.

Before commencement: Current dashboard deletion marks records deleted; it does not immediately permanently erase them from the operational DB. Before the permanent-deletion feature begins, requests can be sent to contact@email.neopress.ai. We verify authority and targets and act without delay; if delayed, we explain the reason and expected completion time.

Deletion failures: Failed, interrupted, and missed work is detected and reprocessed, and staff check outstanding items. Automatic retries begin with each deletion feature. Staff check incomplete work each business day, and automatic deletion exceeding 24 hours is managed as delayed. Records contain requester or job identifier, target identifiers and count, request and processing times, success, failure, and retry results, excluding submission contents. Deletion-result records are retained for two years after operation closure for verification, error response, and re-deletion after restoration, then destroyed.

Rollout notices: Before commencement, notices and dashboard-entry popups explain the actual calendar date, scope, methods, irreversibility, and backups. We do not announce completion before verifying required functions, records, and failure detection. Valid pre-rollout requests continue to be processed through the request procedure.

Backups and replicas: Operational deletion does not immediately delete individual records in existing backups. Residual copies have restricted access and use and follow provider retention and deletion procedures. Verified provider periods and backup handling appear in the Schedule. Previously deleted submissions are deleted again before exposure after a restore. Required deletion identifiers are retained separately from the backup being restored. Operational deletion completion and destruction of all copies are distinct. Supabase's latest-seven-days daily backup retention does not mean all residual copies disappear within seven days of customer deletion.

Scope: Company-managed form operational data and backups and email-provider copies are within our management scope. Customers separately manage notification emails already in their mailboxes and downloaded submissions.

End of processing: We return or delete data upon customer request or termination of entrusted processing. If law requires separate retention, we identify the ground, data, and period to the customer and segregate only necessary information. Customers needing longer statutory retention must move records to a separate lawful system before deletion. The form service does not replace a statutory medical-record system.

Destruction Procedures and Methods

We identify destruction targets upon expiry, fulfillment of purpose, deletion requests, or termination. Information subject to separate statutory retention is segregated as necessary; staff destroy the rest under established procedures or approved automatic criteria. Results and failures are checked; submissions and backups follow the above standards.

When personal data is no longer necessary, it is destroyed without delay by:

• Electronic files: permanent technical deletion preventing recovery
• Paper: shredding or incineration

7. Your Rights

Depending on jurisdiction, your rights may include:

Korea's Personal Information Protection Act (PIPA)

• Access to personal data
• Correction of inaccurate information
• Deletion
• Suspension of processing
• Notification of use and provision and data transmission where statutory conditions apply
• Withdrawal of consent
• Refusal of international transfers

EU and UK GDPR

• Access, rectification, and erasure
• Restriction of processing or objection
• Data portability
• Withdrawal of consent

California CCPA and CPRA

• Know what personal data is collected
• Correct inaccurate personal data
• Delete personal data
• Opt out of sale or sharing
• Limit use of sensitive personal information
• Non-discrimination

Requests may be sent to contact@email.neopress.ai, +82-503-7150-2997, or the address in Section 13. The privacy officer in Section 12 handles requests. We verify only minimum information needed to establish identity or lawful representation and communicate results within statutory deadlines.

Legal or authorized representatives may also request, and we may request evidence of authority where necessary. If law permits restricting, refusing, or deferring all or part of a request, we explain the reasons and objection procedure. Objections may be sent to the same contact. Information subject to correction or deletion is not used or provided until handling is complete unless permitted by law.

For privacy-violation counseling or reports, contact the Personal Information Infringement Report Center at 118; for mediation, the Personal Information Dispute Mediation Committee at 1833-6972.

Requests concerning customer form submissions may be directed to the site operator. If we receive one directly, we take necessary steps such as identity and authority verification and secure referral and assist the customer in meeting statutory deadlines.

8. Security

We implement technical, organizational, and physical safeguards required by applicable law.

• Form submissions are transmitted using HTTPS. Supabase provides AES-256 encryption at rest for the operational DB and scheduled backups under its official policy.
• Authorized operational personnel can technically access submissions. Access is limited to necessary support, incident recovery, security response, and similar work, with minimum personnel and permissions for necessary sites, submissions, and fields.
• The privacy officer approves work-related access and manages authorized personnel, scope, and periods in an authorization register. Individual accounts are used; operators are identified for special operations accounts, direct DB access, and manual service-account work. Role changes, departures, and expiry trigger prompt permission changes or revocation. Authorization grants, changes, and revocations are retained for three years from occurrence.
• Form-access record standards cover viewing, downloading, changing, and deleting submissions through administrator and customer dashboards, APIs, and direct DB access, with two-year retention from creation. Records include personnel identifier, time, source location, target identifiers, action, and result, without duplicating submission contents in audit records.
• Record access and modification are restricted, with protection against unauthorized viewing, alteration, and deletion. Access, downloads, permission changes, missing records, and reasons for downloads are reviewed at least monthly. Anomalies are promptly investigated and addressed; review results are retained for two years from preparation.
• Verification of per-submission recording and retention across all paths is ongoing. We do not claim that these standards are implemented everywhere. Confirmed gaps are managed with owners and improvement deadlines. This does not defer statutory safeguard duties.

Customers can create individual staff accounts and invite them to sites with permissions. Built-in Neopress dashboard two-factor authentication or organization-wide enforcement is not currently provided.

At-rest encryption does not make access by authorized operators impossible. Absolute security of internet transmission or electronic storage cannot be guaranteed.

9. Personal Data Incident Notices

Upon detecting a personal data incident, we promptly take protective and containment measures and notify data subjects and report to relevant authorities according to statutory criteria and deadlines.

For entrusted form submissions, we promptly tell the customer confirmed facts and provide later findings as available. We assist with incident response, notices, and reports and fulfill our directly applicable statutory obligations.

10. Children's Privacy

The Service is not directed at children. In the United States, we do not knowingly collect data from children under 13 under COPPA. In Korea, we do not knowingly collect data from children under 14 without verifiable consent of their legal representative under PIPA. EU and UK children's data follows applicable country-specific consent ages and parental or representative-consent requirements.

If we learn that children's data was collected without necessary grounds, we promptly take necessary steps, including deletion. Contact us if you believe a child has provided data to us.

These age criteria concern Company service accounts. For children's form submissions on customer sites, the customer must meet applicable legal requirements, including representative consent, and we assist within the entrusted scope.

11. Changes to This Policy

We publish changes and their effective date in the Service and update the revision date. Important changes are announced through service notices and dashboard-entry popups from at least 30 days before the effective date through that date. Where separate statutory consent is needed, we distinguish those matters and apply them after consent. Reading the Policy, closing a popup, or continued use is not required consent. Any legally mandated notice method or procedure is followed.

Previous policies and change history are available with the Service's Privacy Policy screen. If inaccessible, copies may be requested using the contact below.

12. Privacy Officer

The following person is designated to oversee privacy matters under Korea's PIPA:

• Name: Sangwon Im
• Title: CEO
• Email: contact@email.neopress.ai
• Phone: +82-503-7150-2997

13. Contact

For questions about this Policy:

• Email: contact@email.neopress.ai
• Phone: +82-503-7150-2997
• Company: inblog Inc.
• Address: 302, 460, Bongcheon-ro, Gwanak-gu, Seoul 08758, South Korea

Schedule. Form Subprocessors and International Transfers

Schedule Version: 2026-10-07.1

The following reflects operational settings and official provider materials checked on October 1-2, 2026. Deleting operational DB submissions is distinct from final destruction of existing backups or email copies. Unless stated otherwise, the retention periods below are not deadlines measured from a Customer's deletion request.

Supabase

Resend

Vercel